From 8748d67aacde4401fc446ebea9e541ff76a3910c Mon Sep 17 00:00:00 2001
From: Wroclaw <wroclaw223@outlook.com>
Date: Mon, 24 Feb 2025 14:25:04 +0100
Subject: [PATCH 0001/1209] makeScriptWrapper: warn if target file does not
 exist

---
 pkgs/build-support/setup-hooks/make-wrapper.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index cba158bd31ea..1ba5a2a9c0c7 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -3,6 +3,8 @@
 # assertExecutable FILE
 assertExecutable() {
     local file="$1"
+    [[ -e "$file" ]] || \
+        die "Cannot wrap '$file' because it does not exist"
     [[ -f "$file" && -x "$file" ]] || \
         die "Cannot wrap '$file' because it is not an executable file"
 }

From bd17e51cdeb7fcf0143b773ab0c4010ea4a011fc Mon Sep 17 00:00:00 2001
From: Wroclaw <wroclaw223@outlook.com>
Date: Mon, 24 Feb 2025 14:25:17 +0100
Subject: [PATCH 0002/1209] makeBinaryWrapper: warn if target file does not
 exist

---
 pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh b/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
index 3948342a36fc..f846a9fa0885 100644
--- a/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
+++ b/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
@@ -6,6 +6,8 @@ set -euo pipefail
 # assertExecutable FILE
 assertExecutable() {
     local file="$1"
+    [[ -e "$file" ]] || \
+        die "Cannot wrap '$file' because it does not exist"
     [[ -f "$file" && -x "$file" ]] || \
         die "Cannot wrap '$file' because it is not an executable file"
 }

From 93309d7b76f9969c0bd3d96166d8fbaaa821bfe5 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sat, 8 Nov 2025 17:57:04 +0100
Subject: [PATCH 0003/1209] gst_all_1.gst-plugins-bad: don't build with gtk3 by
 default

---
 pkgs/development/libraries/gstreamer/bad/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 5bee93cb5124..5e5ed2f8eb43 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -108,7 +108,8 @@
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
-  guiSupport ? true,
+  # causes gtk4 to depend on gtk3 and makes little sense
+  guiSupport ? false,
   gst-plugins-bad,
   apple-sdk_gstreamer,
 }:
@@ -356,8 +357,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (!gst-plugins-base.glEnabled) [
     "-Dgl=disabled"
   ]
-  ++ lib.optionals (!gst-plugins-base.waylandEnabled || !guiSupport) [
+  ++ lib.optionals (!guiSupport) [
     "-Dgtk3=disabled" # Wayland-based GTK sink
+  ]
+  ++ lib.optionals (!gst-plugins-base.waylandEnabled) [
     "-Dwayland=disabled"
   ]
   ++ lib.optionals (!gst-plugins-base.glEnabled) [

From 40092a228d3a850f924a0f3cc723fb39bac15752 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Nov 2025 12:28:17 +0000
Subject: [PATCH 0004/1209] libnice: 0.1.22 -> 0.1.23

---
 pkgs/by-name/li/libnice/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 6d2361b25d2e..99b58d0dc778 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libnice";
-  version = "0.1.22";
+  version = "0.1.23";
 
   outputs = [
     "bin"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz";
-    hash = "sha256-pfckzwnq5QxBp1FxQdidpKYeyerKMtpKAHP67VQXrX4=";
+    hash = "sha256-YY/E6N45O3GbFkHB2O7AGCbU050VrekmedIhx/Xk5w0=";
   };
 
   patches = [

From 3d38015f9045a45b81bdcd32b17dee20de4bcc5a Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Thu, 8 Jan 2026 22:46:44 +0100
Subject: [PATCH 0005/1209] libajantv2: correctly generate pc module for the
 dev output

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/li/libajantv2/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libajantv2/package.nix b/pkgs/by-name/li/libajantv2/package.nix
index 2044db178b6a..383cce7df67c 100644
--- a/pkgs/by-name/li/libajantv2/package.nix
+++ b/pkgs/by-name/li/libajantv2/package.nix
@@ -47,11 +47,11 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    mkdir -p "$out/lib/pkgconfig"
-    cat >"$out/lib/pkgconfig/libajantv2.pc" <<EOF
+    mkdir -p "$dev/lib/pkgconfig"
+    cat >"$dev/lib/pkgconfig/libajantv2.pc" <<EOF
     prefix=$out
     libdir=\''${prefix}/lib
-    includedir=\''${prefix}/include/libajantv2
+    includedir=$dev/include/libajantv2
 
     Name: libajantv2
     Description: Library for controlling AJA NTV2 video devices

From 470cbe3d39b8b46ec2d49c2cfc7aced1e7e7e542 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 25 Jan 2026 00:28:38 +0000
Subject: [PATCH 0006/1209] byacc: 20241231 -> 20260126

---
 pkgs/by-name/by/byacc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/by/byacc/package.nix b/pkgs/by-name/by/byacc/package.nix
index 8da6559f602b..12b19dd74a14 100644
--- a/pkgs/by-name/by/byacc/package.nix
+++ b/pkgs/by-name/by/byacc/package.nix
@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "byacc";
-  version = "20241231";
+  version = "20260126";
 
   src = fetchurl {
     urls = [
       "https://invisible-mirror.net/archives/byacc/byacc-${finalAttrs.version}.tgz"
       "https://invisible-island.net/archives/byacc/byacc-${finalAttrs.version}.tgz"
     ];
-    hash = "sha256-GSwvrgSNTn9RS6RRYn+cTmEnZQmfgZwZGR+f3j5glnM=";
+    hash = "sha256-thjF+0TC9fBIhD25D30bJPePR7B5E8jHuoyULT6ySwA=";
   };
 
   configureFlags = [

From 2ae3d0ab89adf70a97711ac661e6ec9d0c9c2512 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 11 Feb 2026 12:40:01 +0000
Subject: [PATCH 0007/1209] sord: 0.16.20 -> 0.16.22

---
 pkgs/by-name/so/sord/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/so/sord/package.nix b/pkgs/by-name/so/sord/package.nix
index 75f9e48de010..3c00f7edc721 100644
--- a/pkgs/by-name/so/sord/package.nix
+++ b/pkgs/by-name/so/sord/package.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sord";
-  version = "0.16.20";
+  version = "0.16.22";
 
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "drobilla";
     repo = "sord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+f3dxhcxVoub+KeI5c5/J87SVvAawrm5cZgo2qogdRM=";
+    hash = "sha256-XrtYKc/7oD/4XrWduokILeWgNIY0QrRDj36s50LOK80=";
   };
 
   outputs = [

From 222a2527d2dd16a0a24053cd99bfd96e7dc042c8 Mon Sep 17 00:00:00 2001
From: Rohit Singh <Rohit1.Singh@deshaw.com>
Date: Fri, 13 Feb 2026 08:38:23 -0500
Subject: [PATCH 0008/1209] awscli2: replace vendored certs

---
 pkgs/by-name/aw/awscli2/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/aw/awscli2/package.nix b/pkgs/by-name/aw/awscli2/package.nix
index 7557d14a22b6..2a08fc333968 100644
--- a/pkgs/by-name/aw/awscli2/package.nix
+++ b/pkgs/by-name/aw/awscli2/package.nix
@@ -12,6 +12,7 @@
   awscli2,
   addBinToPathHook,
   writableTmpDirAsHomeHook,
+  cacert,
 }:
 
 let
@@ -81,6 +82,8 @@ py.pkgs.buildPythonApplication rec {
     # with a configure script, but we don't as we provide all of the packages
     # through PYTHONPATH
     sed -i '/pip>=/d' requirements/bootstrap.txt
+
+    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt awscli/botocore/cacert.pem
   '';
 
   nativeBuildInputs = [

From c110df0ccebea65a1e2715ec8974fa0511f25684 Mon Sep 17 00:00:00 2001
From: Rohit Singh <Rohit1.Singh@deshaw.com>
Date: Fri, 13 Feb 2026 08:38:35 -0500
Subject: [PATCH 0009/1209] python3Packages.botocore: replace vendored certs

---
 pkgs/development/python-modules/botocore/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 9164bcd76bb9..810b95dfb660 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   awscrt,
+  cacert,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -29,6 +30,10 @@ buildPythonPackage rec {
     hash = "sha256-avuv1uXKMeSr3SL+BI9XW8tDCQM/dlXFn590di3S03k=";
   };
 
+  postPatch = ''
+    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt botocore/cacert.pem
+  '';
+
   build-system = [
     setuptools
   ];

From b3ebd1069ea3132b7de8f42e148e58af17448c9e Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Tue, 17 Feb 2026 16:53:19 +0000
Subject: [PATCH 0010/1209] pkgsMusl.nix: fix build

---
 .../package-management/nix/modular/src/libexpr/package.nix    | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
index 79cb2c93e259..5e5edd94871d 100644
--- a/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
@@ -37,6 +37,10 @@ mkMesonLibrary (finalAttrs: {
 
   workDir = ./.;
 
+  hardeningDisable = lib.optionals stdenv.hostPlatform.isMusl [
+    "fortify"
+  ];
+
   nativeBuildInputs = [
     bison
     flex

From c4831d5909c65bbd71b42951dc6d3d15066950aa Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 29 Jan 2026 22:21:13 +0100
Subject: [PATCH 0011/1209] abseil-cpp: add pkg-config validation

---
 pkgs/by-name/ab/abseil-cpp_202505/package.nix | 216 +++++++++++++++++-
 pkgs/by-name/ab/abseil-cpp_202508/package.nix | 107 ++++++++-
 2 files changed, 321 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ab/abseil-cpp_202505/package.nix b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
index c1884d4a953d..f85b5b2f95ab 100644
--- a/pkgs/by-name/ab/abseil-cpp_202505/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
@@ -6,6 +6,8 @@
   gtest,
   static ? stdenv.hostPlatform.isStatic,
   cxxStandard ? null,
+  testers,
+  validatePkgConfig,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -30,10 +32,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    validatePkgConfig
+  ];
 
   buildInputs = [ gtest ];
 
+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
@@ -41,5 +52,208 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.GaetanLepage ];
+    pkgConfigModules = [
+      "absl_log_internal_check_op"
+      "absl_absl_check"
+      "absl_strerror"
+      "absl_common_policy_traits"
+      "absl_graphcycles_internal"
+      "absl_raw_hash_set"
+      "absl_random_internal_entropy_pool"
+      "absl_time_zone"
+      "absl_prefetch"
+      "absl_compressed_tuple"
+      "absl_nullability"
+      "absl_vlog_is_on"
+      "absl_utf8_for_code_point"
+      "absl_base_internal"
+      "absl_bad_variant_access"
+      "absl_flags_parse"
+      "absl_exponential_biased"
+      "absl_log_internal_nullstream"
+      "absl_log_internal_structured_proto"
+      "absl_log_internal_check_impl"
+      "absl_tracing_internal"
+      "absl_random_bit_gen_ref"
+      "absl_meta"
+      "absl_random_distributions"
+      "absl_numeric"
+      "absl_flat_hash_set"
+      "absl_random_internal_randen_hwaes_impl"
+      "absl_malloc_internal"
+      "absl_layout"
+      "absl_type_traits"
+      "absl_random_internal_mock_helpers"
+      "absl_log_streamer"
+      "absl_function_ref"
+      "absl_log"
+      "absl_dynamic_annotations"
+      "absl_non_temporal_memcpy"
+      "absl_random_internal_randen"
+      "absl_stacktrace"
+      "absl_log_internal_globals"
+      "absl_log_internal_strip"
+      "absl_atomic_hook"
+      "absl_flags_usage_internal"
+      "absl_log_internal_voidify"
+      "absl_synchronization"
+      "absl_debugging_internal"
+      "absl_bind_front"
+      "absl_crc_internal"
+      "absl_random_internal_platform"
+      "absl_flags_path_util"
+      "absl_hash_testing"
+      "absl_flags_commandlineflag_internal"
+      "absl_hashtable_debug"
+      "absl_hashtablez_sampler"
+      "absl_random_internal_randen_engine"
+      "absl_log_globals"
+      "absl_optional"
+      "absl_crc_cpu_detect"
+      "absl_demangle_internal"
+      "absl_node_hash_map"
+      "absl_core_headers"
+      "absl_statusor"
+      "absl_str_format_internal"
+      "absl_crc32c"
+      "absl_cordz_update_scope"
+      "absl_cordz_handle"
+      "absl_log_internal_nullguard"
+      "absl_numeric_representation"
+      "absl_log_internal_log_impl"
+      "absl_raw_hash_set_resize_impl"
+      "absl_random_internal_distribution_test_util"
+      "absl_kernel_timeout_internal"
+      "absl_random_internal_uniform_helper"
+      "absl_random_seed_sequences"
+      "absl_cordz_info"
+      "absl_spy_hash_state"
+      "absl_vlog_config_internal"
+      "absl_flags_program_name"
+      "absl_hashtable_debug_hooks"
+      "absl_crc_cord_state"
+      "absl_decode_rust_punycode"
+      "absl_debugging"
+      "absl_overload"
+      "absl_config"
+      "absl_random_internal_fast_uniform_bits"
+      "absl_raw_hash_map"
+      "absl_random_internal_randen_hwaes"
+      "absl_bad_any_cast"
+      "absl_variant"
+      "absl_has_ostream_operator"
+      "absl_span"
+      "absl_btree"
+      "absl_random_internal_distribution_caller"
+      "absl_failure_signal_handler"
+      "absl_any"
+      "absl_poison"
+      "absl_str_format"
+      "absl_cord"
+      "absl_random_internal_wide_multiply"
+      "absl_random_internal_pcg_engine"
+      "absl_flags_internal"
+      "absl_check"
+      "absl_random_internal_seed_material"
+      "absl_log_flags"
+      "absl_no_destructor"
+      "absl_low_level_hash"
+      "absl_hashtable_control_bytes"
+      "absl_periodic_sampler"
+      "absl_log_internal_format"
+      "absl_log_initialize"
+      "absl_random_internal_generate_real"
+      "absl_raw_logging_internal"
+      "absl_inlined_vector"
+      "absl_log_internal_log_sink_set"
+      "absl_log_internal_flags"
+      "absl_flat_hash_map"
+      "absl_scoped_mock_log"
+      "absl_cordz_functions"
+      "absl_random_mocking_bit_gen"
+      "absl_fast_type_id"
+      "absl_sample_recorder"
+      "absl_log_internal_message"
+      "absl_bits"
+      "absl_random_seed_gen_exception"
+      "absl_log_sink_registry"
+      "absl_flags_marshalling"
+      "absl_leak_check"
+      "absl_examine_stack"
+      "absl_status_matchers"
+      "absl_flags_commandlineflag"
+      "absl_absl_vlog_is_on"
+      "absl_any_invocable"
+      "absl_cleanup_internal"
+      "absl_log_severity"
+      "absl_random_internal_salted_seed_seq"
+      "absl_flags_config"
+      "absl_log_structured"
+      "absl_die_if_null"
+      "absl_fixed_array"
+      "absl_cord_internal"
+      "absl_endian"
+      "absl_strings_internal"
+      "absl_symbolize"
+      "absl_log_internal_config"
+      "absl_absl_log"
+      "absl_memory"
+      "absl_container_common"
+      "absl_compare"
+      "absl_civil_time"
+      "absl_int128"
+      "absl_log_internal_append_truncated"
+      "absl_cordz_statistics"
+      "absl_log_internal_fnmatch"
+      "absl_flags"
+      "absl_non_temporal_arm_intrinsics"
+      "absl_random_internal_traits"
+      "absl_base"
+      "absl_algorithm_container"
+      "absl_hash"
+      "absl_log_internal_conditions"
+      "absl_time"
+      "absl_node_slot_policy"
+      "absl_errno_saver"
+      "absl_random_internal_randen_slow"
+      "absl_charset"
+      "absl_bounded_utf8_length_sequence"
+      "absl_city"
+      "absl_bad_optional_access"
+      "absl_random_internal_nonsecure_base"
+      "absl_flags_usage"
+      "absl_utility"
+      "absl_iterator_traits_internal"
+      "absl_spinlock_wait"
+      "absl_pretty_function"
+      "absl_algorithm"
+      "absl_log_sink"
+      "absl_status"
+      "absl_demangle_rust"
+      "absl_node_hash_set"
+      "absl_hash_policy_traits"
+      "absl_flags_private_handle_accessor"
+      "absl_cord_test_helpers"
+      "absl_strings"
+      "absl_log_internal_proto"
+      "absl_inlined_vector_internal"
+      "absl_iterator_traits_test_helper_internal"
+      "absl_random_random"
+      "absl_flags_reflection"
+      "absl_scoped_set_env"
+      "absl_throw_delegate"
+      "absl_hash_function_defaults"
+      "absl_weakly_mixed_integer"
+      "absl_cleanup"
+      "absl_random_internal_iostream_state_saver"
+      "absl_cordz_sample_token"
+      "absl_cordz_update_tracker"
+      "absl_string_view"
+      "absl_hash_container_defaults"
+      "absl_random_internal_fastmath"
+      "absl_log_internal_structured"
+      "absl_container_memory"
+      "absl_log_entry"
+    ];
   };
 })
diff --git a/pkgs/by-name/ab/abseil-cpp_202508/package.nix b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
index 5419ae381c67..7a808df2670a 100644
--- a/pkgs/by-name/ab/abseil-cpp_202508/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
@@ -6,6 +6,8 @@
   gtest,
   static ? stdenv.hostPlatform.isStatic,
   cxxStandard ? null,
+  testers,
+  validatePkgConfig,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,10 +37,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    validatePkgConfig
+  ];
 
   buildInputs = [ gtest ];
 
+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage.dev;
+    };
+  };
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
@@ -46,5 +57,99 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.GaetanLepage ];
+    pkgConfigModules = [
+      "absl_base"
+      "absl_city"
+      "absl_civil_time"
+      "absl_cord_internal"
+      "absl_cord"
+      "absl_cordz_functions"
+      "absl_cordz_handle"
+      "absl_cordz_info"
+      "absl_cordz_sample_token"
+      "absl_crc_cord_state"
+      "absl_crc_cpu_detect"
+      "absl_crc_internal"
+      "absl_crc32c"
+      "absl_debugging_internal"
+      "absl_decode_rust_punycode"
+      "absl_demangle_internal"
+      "absl_demangle_rust"
+      "absl_die_if_null"
+      "absl_examine_stack"
+      "absl_exponential_biased"
+      "absl_failure_signal_handler"
+      "absl_flags_commandlineflag_internal"
+      "absl_flags_commandlineflag"
+      "absl_flags_config"
+      "absl_flags_internal"
+      "absl_flags_marshalling"
+      "absl_flags_parse"
+      "absl_flags_private_handle_accessor"
+      "absl_flags_program_name"
+      "absl_flags_reflection"
+      "absl_flags_usage_internal"
+      "absl_flags_usage"
+      "absl_graphcycles_internal"
+      "absl_hash"
+      "absl_hashtable_profiler"
+      "absl_hashtablez_sampler"
+      "absl_int128"
+      "absl_kernel_timeout_internal"
+      "absl_leak_check"
+      "absl_log_entry"
+      "absl_log_flags"
+      "absl_log_globals"
+      "absl_log_initialize"
+      "absl_log_internal_check_op"
+      "absl_log_internal_conditions"
+      "absl_log_internal_fnmatch"
+      "absl_log_internal_format"
+      "absl_log_internal_globals"
+      "absl_log_internal_log_sink_set"
+      "absl_log_internal_message"
+      "absl_log_internal_nullguard"
+      "absl_log_internal_proto"
+      "absl_log_internal_structured_proto"
+      "absl_log_severity"
+      "absl_log_sink"
+      "absl_malloc_internal"
+      "absl_periodic_sampler"
+      "absl_poison"
+      "absl_profile_builder"
+      "absl_random_distributions"
+      "absl_random_internal_distribution_test_util"
+      "absl_random_internal_entropy_pool"
+      "absl_random_internal_platform"
+      "absl_random_internal_randen_hwaes_impl"
+      "absl_random_internal_randen_hwaes"
+      "absl_random_internal_randen_slow"
+      "absl_random_internal_randen"
+      "absl_random_internal_seed_material"
+      "absl_random_seed_gen_exception"
+      "absl_random_seed_sequences"
+      "absl_raw_hash_set"
+      "absl_raw_logging_internal"
+      "absl_scoped_mock_log"
+      "absl_scoped_set_env"
+      "absl_spinlock_wait"
+      "absl_stacktrace"
+      "absl_status_matchers"
+      "absl_status"
+      "absl_statusor"
+      "absl_str_format_internal"
+      "absl_strerror"
+      "absl_string_view"
+      "absl_strings_internal"
+      "absl_strings"
+      "absl_symbolize"
+      "absl_synchronization"
+      "absl_throw_delegate"
+      "absl_time_zone"
+      "absl_time"
+      "absl_tracing_internal"
+      "absl_utf8_for_code_point"
+      "absl_vlog_config_internal"
+    ];
   };
 })

From 2c5281616010ee627abf04761500335941b4cc55 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Tue, 27 Jan 2026 16:11:01 +0000
Subject: [PATCH 0012/1209] prefetch-npm-deps: support file: scheme for
 dependencies

Fixes #484067
---
 .../node/prefetch-npm-deps/default.nix        | 22 +++++++++++++++++++
 .../node/prefetch-npm-deps/src/main.rs        | 10 +++++++++
 .../node/prefetch-npm-deps/src/parse/mod.rs   | 14 +++++++-----
 3 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/node/prefetch-npm-deps/default.nix b/pkgs/build-support/node/prefetch-npm-deps/default.nix
index bfa8fb863e4b..8bbbe4e10312 100644
--- a/pkgs/build-support/node/prefetch-npm-deps/default.nix
+++ b/pkgs/build-support/node/prefetch-npm-deps/default.nix
@@ -195,6 +195,28 @@
 
           hash = "sha256-QGObVDd9qVtf/U78+ayP6RHVWsU+HXhg70BFblQ1PZs=";
         };
+
+        # Test lockfiles with file: dependencies
+        fileDependenciesV1 = makeTest {
+          name = "file-dependencies-lockfile-v1";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/elbywan/wretch/970b19e0fcc3dd219b9f3fc247d8f34cc01979c6/package-lock.json";
+            hash = "sha256-3vTMxc9M2TeiclUFYbG5eTzavSAXjAzz6N5v/1VM4Bc=";
+          };
+
+          hash = "sha256-4wTohTVWF49iQvdaUxNhwplfTVb53yFnAaUVA2xIXrc=";
+        };
+        fileDependenciesV3 = makeTest {
+          name = "file-dependencies-lockfile-v3";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/alam00000/bentopdf/146e3f07d4111e309d0b29bb949e78e44454be3b/package-lock.json";
+            hash = "sha256-9Ea5ctJYbClxStYNhSfSpsO/P99/4CQK58PLK5e6PoQ=";
+          };
+
+          hash = "sha256-1xWkzAzZXd9f4sY9xFHLfj482ZCs2oKFJ79C+Iy7RFY=";
+        };
       };
 
     meta = {
diff --git a/pkgs/build-support/node/prefetch-npm-deps/src/main.rs b/pkgs/build-support/node/prefetch-npm-deps/src/main.rs
index 2882aee9ec20..b65db0492c3e 100644
--- a/pkgs/build-support/node/prefetch-npm-deps/src/main.rs
+++ b/pkgs/build-support/node/prefetch-npm-deps/src/main.rs
@@ -238,6 +238,7 @@ fn fixup_lockfile(
                 .values_mut()
             {
                 if let Some(Value::String(resolved)) = package.get("resolved")
+                    && !resolved.starts_with("file:")
                     && let Some(Value::String(integrity)) = package.get("integrity")
                 {
                     if resolved.starts_with("git+") {
@@ -286,6 +287,7 @@ fn fixup_v1_deps(
             .as_object()
             .expect("v1 dep must be object")
             .get("resolved")
+            && !resolved.starts_with("file:")
             && let Some(Value::String(integrity)) = dep
                 .as_object()
                 .expect("v1 dep must be object")
@@ -509,6 +511,10 @@ mod tests {
                     "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
                     "integrity": "sha512-aaa"
                 },
+                "baz": {
+                    "resolved": "file:baz.tar.gz",
+                    "integrity": "sha512-bbb"
+                },
                 "foo-bad": {
                     "resolved": "foo",
                     "integrity": "sha1-foo"
@@ -534,6 +540,10 @@ mod tests {
                 "bar": {
                     "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
                 },
+                "baz": {
+                    "resolved": "file:baz.tar.gz",
+                    "integrity": "sha512-bbb"
+                },
                 "foo-bad": {
                     "resolved": "foo",
                     "integrity": "sha512-foo"
diff --git a/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs b/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs
index 3e6f5019ea33..6f76dd7f59df 100644
--- a/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs
+++ b/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs
@@ -25,10 +25,10 @@ pub fn lockfile(
     let mut packages = lock::packages(content)
         .context("failed to extract packages from lockfile")?
         .into_par_iter()
-        .map(|p| {
+        .filter_map(|p| {
             let n = p.name.clone().unwrap();
 
-            Package::from_lock(p).with_context(|| format!("failed to parse data for {n}"))
+            Package::from_lock(p).with_context(|| format!("failed to parse data for {n}")).transpose()
         })
         .collect::<anyhow::Result<Vec<_>>>()?;
 
@@ -124,7 +124,7 @@ enum Specifics {
 }
 
 impl Package {
-    fn from_lock(pkg: lock::Package) -> anyhow::Result<Package> {
+    fn from_lock(pkg: lock::Package) -> anyhow::Result<Option<Package>> {
         let mut resolved = match pkg
             .resolved
             .expect("at this point, packages should have URLs")
@@ -133,6 +133,10 @@ impl Package {
             UrlOrString::String(_) => panic!("at this point, all packages should have URLs"),
         };
 
+        if resolved.scheme() == "file" {
+            return Ok(None);
+        }
+
         let specifics = match get_hosted_git_url(&resolved)? {
             Some(hosted) => {
                 let body = util::get_url_body_with_retry(&hosted)?;
@@ -174,12 +178,12 @@ impl Package {
             },
         };
 
-        Ok(Package {
+        Ok(Some(Package {
             name: pkg.name.unwrap(),
             version: pkg.version,
             url: resolved,
             specifics,
-        })
+        }))
     }
 
     pub fn tarball(&self) -> anyhow::Result<Vec<u8>> {

From f33cf3c09ed6c4345ca13f46df17012fda9d46c4 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 19 Mar 2026 09:10:11 +0100
Subject: [PATCH 0013/1209] meson.setupHook: fix enableParallelChecking

Previously, this controlled the parallelism of building the tests.
The tests were then always run in parallel.  Fix so
enableParallelBuilding controls building, and enableParallelChecking
controls the test run.

Fixes: bb73d9a0ceb2 ("meson: support enableParallelChecking")
---
 pkgs/by-name/me/meson/setup-hook.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/me/meson/setup-hook.sh b/pkgs/by-name/me/meson/setup-hook.sh
index a9feb15eedd3..4eac58193142 100644
--- a/pkgs/by-name/me/meson/setup-hook.sh
+++ b/pkgs/by-name/me/meson/setup-hook.sh
@@ -63,16 +63,22 @@ mesonCheckPhase() {
         flagsArray+=("--timeout-multiplier=0")
     fi
 
-    # Parallel checking is enabled by default.
+    # Parallel building is enabled by default.
     local buildCores=1
-    if [ "${enableParallelChecking-1}" ]; then
+    if [ "${enableParallelBuilding-1}" ]; then
         buildCores="$NIX_BUILD_CORES"
     fi
 
     TERM=dumb ninja -j"$buildCores" $ninjaFlags "${ninjaFlagsArray[@]}" meson-test-prereq
 
+    # Parallel checking is enabled by default.
+    local testCores=1
+    if [ "${enableParallelChecking-1}" ]; then
+        testCores="$NIX_BUILD_CORES"
+    fi
+
     echoCmd 'mesonCheckPhase flags' "${flagsArray[@]}"
-    meson test --no-rebuild --print-errorlogs --max-lines=1000000 "${flagsArray[@]}"
+    meson test -j"$testCores" --no-rebuild --print-errorlogs --max-lines=1000000 "${flagsArray[@]}"
 
     runHook postCheck
 }

From 9088b3d1674994911e0d24c851fb46cca48871a0 Mon Sep 17 00:00:00 2001
From: znaniye <zn4niye@proton.me>
Date: Thu, 16 Oct 2025 14:28:11 -0300
Subject: [PATCH 0014/1209] python3Packages.paramiko: invoke is a required
 dependency

---
 pkgs/development/python-modules/paramiko/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index 156fae9d96d0..6350ba2e5a8a 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -30,6 +30,7 @@ buildPythonPackage rec {
   dependencies = [
     bcrypt
     cryptography
+    invoke
     pynacl
   ];
 
@@ -39,7 +40,6 @@ buildPythonPackage rec {
       gssapi
     ];
     ed25519 = [ ];
-    invoke = [ invoke ];
   };
 
   nativeCheckInputs = [

From b6254c48df9b757515242f80d7f78a598333b941 Mon Sep 17 00:00:00 2001
From: znaniye <zn4niye@proton.me>
Date: Thu, 16 Oct 2025 15:43:36 -0300
Subject: [PATCH 0015/1209] duplicity: remove invoke from dependencies

invoke is not a required dependency of duplicity.
It does not appear in upstream's requirements.txt nor pyproject.toml:
- https://gitlab.com/duplicity/duplicity/-/blob/dev/requirements.txt
- https://gitlab.com/duplicity/duplicity/-/blob/dev/pyproject.toml
---
 pkgs/by-name/du/duplicity/package.nix | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/du/duplicity/package.nix b/pkgs/by-name/du/duplicity/package.nix
index 7cdb8eff47f2..8e7b8698a1a4 100644
--- a/pkgs/by-name/du/duplicity/package.nix
+++ b/pkgs/by-name/du/duplicity/package.nix
@@ -75,20 +75,17 @@ let
       glib
     ];
 
-    pythonPath =
-      with python3.pkgs;
-      [
-        b2sdk
-        boto3
-        idna
-        pygobject3
-        fasteners
-        paramiko
-        pexpect
-        # Currently marked as broken.
-        # pydrive2
-      ]
-      ++ paramiko.optional-dependencies.invoke;
+    pythonPath = with python3.pkgs; [
+      b2sdk
+      boto3
+      idna
+      pygobject3
+      fasteners
+      paramiko
+      pexpect
+      # Currently marked as broken.
+      # pydrive2
+    ];
 
     nativeCheckInputs = [
       gnupg # Add 'gpg' to PATH.

From 23c46c60c0dca1e971425b43903dd87ea206e674 Mon Sep 17 00:00:00 2001
From: Null Terminator <nullterminator0@protonmail.com>
Date: Sat, 28 Feb 2026 16:30:18 +0300
Subject: [PATCH 0016/1209] bintools-wrapper: use `tr` for uppercase

Since bash's parameter expansion for uppercase creates invalid
identifiers in certain locales (like Turkish), it is more ideal
to use `tr` for locale-agnostic string substitution.
---
 pkgs/build-support/bintools-wrapper/setup-hook.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh
index 93aa7825f9a9..1d67e65baf20 100644
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@@ -60,7 +60,8 @@ do
     if
         PATH=$_PATH type -p "@targetPrefix@${cmd}" > /dev/null
     then
-        export "${cmd^^}${role_post}=@targetPrefix@${cmd}";
+        upper_case="$(echo "$cmd" | tr "a-z" "A-Z")"
+        export "${upper_case}${role_post}=@targetPrefix@${cmd}";
     fi
 done
 

From f6da9198396a515d12e2f9d41bc7d6b45aa28209 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 4 Apr 2026 02:07:15 +0700
Subject: [PATCH 0017/1209] gbenchmark: 1.9.4 -> 1.9.5

---
 pkgs/by-name/gb/gbenchmark/package.nix | 35 +++++++++++++++++---------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index 6cc1617193ee..6c9097d041d7 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -5,18 +5,19 @@
   cmake,
   ninja,
   gtest,
+  glibcLocales,
   prometheus-cpp,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gbenchmark";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "benchmark";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-P7wJcKkIBoWtN9FCRticpBzYbEZPq71a0iW/2oDTZRU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Mm4pG7zMB00iof32CxreoNBFnduPZTMp3reHMCIAFPQ=";
   };
 
   nativeBuildInputs = [
@@ -26,20 +27,30 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gtest ];
 
+  nativeCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ glibcLocales ];
+
   cmakeFlags = [
     (lib.cmakeBool "BENCHMARK_USE_BUNDLED_GTEST" false)
     (lib.cmakeBool "BENCHMARK_ENABLE_WERROR" false)
   ];
 
-  # We ran into issues with gtest 1.8.5 conditioning on
-  # `#if __has_cpp_attribute(maybe_unused)`, which was, for some
-  # reason, going through even when C++14 was being used and
-  # breaking the build on Darwin by triggering errors about using
-  # C++17 features.
-  #
-  # This might be a problem with our Clang, as it does not reproduce
-  # with Xcode, but we just work around it by silencing the warning.
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++17-attribute-extensions";
+  env = {
+    # We ran into issues with gtest 1.8.5 conditioning on
+    # `#if __has_cpp_attribute(maybe_unused)`, which was, for some
+    # reason, going through even when C++14 was being used and
+    # breaking the build on Darwin by triggering errors about using
+    # C++17 features.
+    #
+    # This might be a problem with our Clang, as it does not reproduce
+    # with Xcode, but we just work around it by silencing the warning.
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++17-attribute-extensions";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    # For test:locale_impermeability_test
+    LANG = "en_US.UTF-8";
+    LC_ALL = "en_US.UTF-8";
+    LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive";
+  };
 
   # Tests fail on 32-bit due to not enough precision
   doCheck = stdenv.hostPlatform.is64bit;

From 63ac700b307cfca805d642d85a459e8c3371526b Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 4 Apr 2026 02:08:06 +0700
Subject: [PATCH 0018/1209] gbenchmark: add miniharinn as a maintainer

---
 pkgs/by-name/gb/gbenchmark/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index 6c9097d041d7..9d21e2c8a84b 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -64,6 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/google/benchmark";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux ++ lib.platforms.darwin ++ lib.platforms.freebsd;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ miniharinn ];
   };
 })

From 8eba8a5341f8feef7909fe1414ac4f6152e1fc58 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 5 Apr 2026 17:53:57 +0200
Subject: [PATCH 0019/1209] pcre2: modernize

---
 pkgs/development/libraries/pcre2/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 88d6cedb39f5..89fdc25b7982 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   version = "10.46";
 
   src = fetchurl {
-    url = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
+    url = "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
     hash = "sha256-FfvFq6a+7gsXrssEYCrjlDI5OroevY45t8q/fbiDKZ8=";
   };
 
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://www.pcre.org/";
+    changelog = "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-${version}";
     description = "Perl Compatible Regular Expressions";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ ttuegel ];

From 4564ed7a7618d93e986d0d11393b260c67d9af2e Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 5 Apr 2026 17:56:00 +0200
Subject: [PATCH 0020/1209] pcre2: 10.46 -> 10.47

changelog: https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.47

diff: https://github.com/PCRE2Project/pcre2/compare/pcre2-10.46...pcre2-10.47
---
 pkgs/development/libraries/pcre2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 89fdc25b7982..362f78bad0e3 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.46";
+  version = "10.47";
 
   src = fetchurl {
     url = "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
-    hash = "sha256-FfvFq6a+7gsXrssEYCrjlDI5OroevY45t8q/fbiDKZ8=";
+    hash = "sha256-R/6MmUYSUNQviebo/a66naBXhV0G63/AjZygP9CNe8c=";
   };
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];

From 68ee0a8e0e154d5a31018fe69053e5f17012fbe5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Apr 2026 12:51:19 +0000
Subject: [PATCH 0021/1209] libcbor: 0.13.0 -> 0.14.0

---
 pkgs/by-name/li/libcbor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libcbor/package.nix b/pkgs/by-name/li/libcbor/package.nix
index c2445e7d8965..f4a3790f9bbe 100644
--- a/pkgs/by-name/li/libcbor/package.nix
+++ b/pkgs/by-name/li/libcbor/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "PJK";
     repo = "libcbor";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ePgVR7VHXWKqOShuAEQG3BJ08W2aZS/vfcPUCqTw7X4=";
+    hash = "sha256-zjajNtj4jKbt3pLjfLrgtYljyMDYJtnzAC5JPdt+Wys=";
   };
 
   outputs = [

From 216e73bd0ffce505b23e5396c8ae6304d9149a04 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Apr 2026 06:16:54 +0000
Subject: [PATCH 0022/1209] cmocka: 2.0.1 -> 2.0.2

---
 pkgs/by-name/cm/cmocka/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cm/cmocka/package.nix b/pkgs/by-name/cm/cmocka/package.nix
index 34cb30c206b1..cae6effbbfbd 100644
--- a/pkgs/by-name/cm/cmocka/package.nix
+++ b/pkgs/by-name/cm/cmocka/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cmocka";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchurl {
     url = "https://cmocka.org/files/${lib.versions.majorMinor finalAttrs.version}/cmocka-${finalAttrs.version}.tar.xz";
-    hash = "sha256-PzUzOCuimrOr9cT0snt50WXw31HqWH3nSbEbaLQBkYA=";
+    hash = "sha256-OfkvNmvfPxoCr02nW0pcUt9sn35zbH1l3hMoP58O9BY=";
   };
 
   patches = [

From e749b0a6c79dd13e42d84ad26f6761518d8bf1bd Mon Sep 17 00:00:00 2001
From: Lily Ballard <lily@ballards.net>
Date: Tue, 14 Apr 2026 21:40:50 -0700
Subject: [PATCH 0023/1209] cargo: remove runtime references to cargo-bootstrap

The shell completions were being generated by cargo-bootstrap instead of
by the just-built cargo, which meant they were embedding the
cargo-bootstrap path and causing it to be part of the runtime closure.
---
 pkgs/development/compilers/rust/cargo.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index a86e4a3d186d..87903ed443d5 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -80,9 +80,9 @@ rustPlatform.buildRustPackage.override
       if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
         ''
           installShellCompletion --cmd cargo \
-            --bash <(CARGO_COMPLETE=bash cargo) \
-            --fish <(CARGO_COMPLETE=fish cargo) \
-            --zsh <(CARGO_COMPLETE=zsh cargo)
+            --bash <(CARGO_COMPLETE=bash $out/bin/cargo) \
+            --fish <(CARGO_COMPLETE=fish $out/bin/cargo) \
+            --zsh <(CARGO_COMPLETE=zsh $out/bin/cargo)
         ''
       else
         ''

From 8b7658bfa57bcc361bdb7d79c80f9cf0bde62db0 Mon Sep 17 00:00:00 2001
From: beviu <contact@beviu.com>
Date: Wed, 15 Apr 2026 15:45:27 +0200
Subject: [PATCH 0024/1209] installer/nixos-generate-config: use lib.getExe

---
 nixos/modules/installer/tools/tools.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index 086d8971d466..f3f60dfbdd49 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -30,15 +30,15 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     replacements = {
-      perl = "${
+      perl = lib.getExe (
         pkgs.perl.withPackages (p: [
           p.FileSlurp
           p.ConfigIniFiles
         ])
-      }/bin/perl";
+      );
       hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
-      detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
-      btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
+      detectvirt = lib.getExe' config.systemd.package "systemd-detect-virt";
+      btrfs = lib.getExe pkgs.btrfs-progs;
       inherit (config.system.nixos-generate-config) configuration desktopConfiguration flake;
       xserverEnabled = config.services.xserver.enable;
     };

From 623ec633ba806be11031a0cd1760649edd9d5c3a Mon Sep 17 00:00:00 2001
From: beviu <contact@beviu.com>
Date: Wed, 15 Apr 2026 16:07:29 +0200
Subject: [PATCH 0025/1209] nixos-generate-config: substitute bcachefs

For systems where the package is marked as broken, use `false` instead.
The Perl script checks for a non-zero exit status, so it will handle it
as if the command failed.
---
 nixos/modules/installer/tools/nixos-generate-config.pl | 2 +-
 nixos/modules/installer/tools/tools.nix                | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 3d0f4a9f7d86..96d0d68e5c93 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -505,7 +505,7 @@ EOF
     # This should work for single and multi-device systems.
     # still needs subvolume support
     if ($fsType eq "bcachefs") {
-        my ($status, @info) = runCommand("bcachefs fs usage $rootDir$mountPoint");
+        my ($status, @info) = runCommand("@bcachefs@ fs usage $rootDir$mountPoint");
         my $UUID = $info[0];
 
         if ($status == 0 && $UUID =~ /^Filesystem:[ \t\n]*([0-9a-z-]+)/) {
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index f3f60dfbdd49..6ce3e2839371 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -38,6 +38,11 @@ let
       );
       hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
       detectvirt = lib.getExe' config.systemd.package "systemd-detect-virt";
+      bcachefs =
+        if pkgs.bcachefs-tools.meta.broken then
+          lib.getExe' pkgs.coreutils "false"
+        else
+          lib.getExe pkgs.bcachefs-tools;
       btrfs = lib.getExe pkgs.btrfs-progs;
       inherit (config.system.nixos-generate-config) configuration desktopConfiguration flake;
       xserverEnabled = config.services.xserver.enable;

From 8eb3c82575d6ea29bb031db9ac450847d73069f9 Mon Sep 17 00:00:00 2001
From: Lily Ballard <lily@ballards.net>
Date: Wed, 15 Apr 2026 21:28:26 -0700
Subject: [PATCH 0026/1209] rustPlatform.rust: undeprecate

These attributes were deprecated in #230951 because they confused things
with splicing, e.g. passing `rustPlatform.rust.rustc` to
`nativeBuildInputs` would get the wrong derivation when cross-compiling.
This was a consequence of the fact that they come from the buildPackages
set. But we still want to expose these packages as otherwise Rust
packages have no way to reference the rustc and cargo that build them,
which means they can't e.g. use `disallowedReferences` to ensure they
don't end up in the runtime closure.

Just as `stdenv.cc` itself isn't spliced, we can solve this problem by
unsplicing the packages.
---
 .../compilers/rust/make-rust-platform.nix            | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/rust/make-rust-platform.nix b/pkgs/development/compilers/rust/make-rust-platform.nix
index 1f69bb92e213..254ae918bbf6 100644
--- a/pkgs/development/compilers/rust/make-rust-platform.nix
+++ b/pkgs/development/compilers/rust/make-rust-platform.nix
@@ -72,14 +72,16 @@
         maturinBuildHook
         bindgenHook
         ;
+
+      # Let packages reference the build derivations, e.g. for disallowedReferences.
+      # Get rid of the splicing though, so `nativeBuildInputs = [ rustPlatform.rust.rustc ]` works.
+      rust = {
+        rustc = rustc.__spliced.hostTarget or rustc;
+        cargo = cargo.__spliced.hostTarget or cargo;
+      };
     };
 })
 // lib.optionalAttrs config.allowAliases {
-  rust = {
-    rustc = lib.warn "rustPlatform.rust.rustc is deprecated. Use rustc instead." rustc;
-    cargo = lib.warn "rustPlatform.rust.cargo is deprecated. Use cargo instead." cargo;
-  };
-
   # Added in 25.05.
   fetchCargoTarball = throw "`rustPlatform.fetchCargoTarball` has been removed in 25.05, use `rustPlatform.fetchCargoVendor` instead";
 }

From 126bd3b578fdeedd9af7887e028dfdfbf4a223dd Mon Sep 17 00:00:00 2001
From: Lily Ballard <lily@ballards.net>
Date: Tue, 14 Apr 2026 21:39:14 -0700
Subject: [PATCH 0027/1209] cargo: disallow references to bootstrap cargo,
 rustc

cargo recently accidentally gained a runtime dependency on
cargo-bootstrap, we don't want to let that happen again.
---
 pkgs/development/compilers/rust/cargo.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 87903ed443d5..3fb4f948a223 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -109,6 +109,13 @@ rustPlatform.buildRustPackage.override
       runHook postInstallCheck
     '';
 
+    # Make sure our build rustc/cargo never make it into our runtime closure
+    disallowedReferences = [
+      rustPlatform.rust.cargo
+      rustPlatform.rust.rustc
+      rustPlatform.rust.rustc.unwrapped
+    ];
+
     meta = {
       homepage = "https://crates.io";
       description = "Downloads your Rust project's dependencies and builds your project";

From 19d080de23ecc22a508509f0f6734c972a785e62 Mon Sep 17 00:00:00 2001
From: Lily Ballard <lily@ballards.net>
Date: Wed, 15 Apr 2026 22:44:18 -0700
Subject: [PATCH 0028/1209] rustc-unwrapped: disallow references to build
 rustc/cargo

---
 pkgs/development/compilers/rust/rustc.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 8b816b08f9b2..2419ab02c761 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -443,6 +443,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   requiredSystemFeatures = [ "big-parallel" ];
 
+  # Make sure our bootstrap packages don't end up in our runtime closure
+  disallowedReferences = [
+    cargo
+    rustc
+  ];
+
   passthru = {
     llvm = llvmShared;
     inherit llvmPackages;

From e7d1fca56e9878d4f7e70ad1b8678e913a4b2316 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 18 Apr 2026 21:57:26 +0100
Subject: [PATCH 0029/1209] netpbm: 11.13.3 -> 11.14.0

---
 pkgs/by-name/ne/netpbm/c23.patch   | 63 ------------------------------
 pkgs/by-name/ne/netpbm/package.nix | 11 ++----
 2 files changed, 3 insertions(+), 71 deletions(-)
 delete mode 100644 pkgs/by-name/ne/netpbm/c23.patch

diff --git a/pkgs/by-name/ne/netpbm/c23.patch b/pkgs/by-name/ne/netpbm/c23.patch
deleted file mode 100644
index c7712f0ba230..000000000000
--- a/pkgs/by-name/ne/netpbm/c23.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From cde10364f1b59098fa2fbcacbdba88c7bbab4848 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Sun, 22 Feb 2026 12:06:15 +0100
-Subject: [PATCH] Remove function declarators without prototypes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-These are no longer valid in C23 — they prototype the function as
-taking no arguments, and now cause compilation errors when building
-for non-Glibc systems.
-
-getenv is part of the C standard, so should be universally present,
-and getopt is part of POSIX, so conflicting prototypes should be a
-thing of the past.  Similar changes have been made in upstream gnulib.
----
- converter/other/fiasco/getopt.c | 3 +--
- converter/other/fiasco/getopt.h | 7 -------
- 2 files changed, 1 insertion(+), 9 deletions(-)
-
-diff --git a/converter/other/fiasco/getopt.c b/converter/other/fiasco/getopt.c
-index 65c206c3..565fac28 100644
---- a/converter/other/fiasco/getopt.c
-+++ b/converter/other/fiasco/getopt.c
-@@ -44,6 +44,7 @@
- 
- #include <string.h>
- #include <stdio.h>
-+#include <stdlib.h>
- 
- /* Comment out all this code if we are using the GNU C Library, and are not
-    actually compiling the library itself.  This code is part of the GNU C
-@@ -203,8 +204,6 @@ static char *posixly_correct;
- /* Avoid depending on library functions or files
-    whose names are inconsistent.  */
- 
--char *getenv ();
--
- static char *
- my_index (str, chr)
-      const char *str;
-diff --git a/converter/other/fiasco/getopt.h b/converter/other/fiasco/getopt.h
-index 3c735e3d..08138da4 100644
---- a/converter/other/fiasco/getopt.h
-+++ b/converter/other/fiasco/getopt.h
-@@ -95,14 +95,7 @@ struct option
- #define optional_argument       2
- 
- #if defined (__STDC__) && __STDC__
--#ifdef __GNU_LIBRARY__
--/* Many other libraries have conflicting prototypes for getopt, with
--   differences in the consts, in stdlib.h.  To avoid compilation
--   errors, only prototype getopt for the GNU C library.  */
- extern int getopt (int argc, char *const *argv, const char *shortopts);
--#else /* not __GNU_LIBRARY__ */
--extern int getopt ();
--#endif /* __GNU_LIBRARY__ */
- extern int getopt_long (int argc, char *const *argv, const char *shortopts,
-                         const struct option *longopts, int *longind);
- extern int getopt_long_only (int argc, char *const *argv,
--- 
-2.52.0
-
diff --git a/pkgs/by-name/ne/netpbm/package.nix b/pkgs/by-name/ne/netpbm/package.nix
index f7841cfe54bf..0b6ea0555c86 100644
--- a/pkgs/by-name/ne/netpbm/package.nix
+++ b/pkgs/by-name/ne/netpbm/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.13.3";
+  version = "11.14.0";
 
   outputs = [
     "bin"
@@ -31,15 +31,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "5164";
-    sha256 = "sha256-3teRW9oucwv0+V+eyLVvh8Y2NtrFoyIt1JWoC2gyVgM=";
+    rev = "5182";
+    sha256 = "sha256-VbVN08WVXQYXlEBK1yIKj5aIWWaBhim4rQc68ViA/vA=";
   };
 
-  patches = [
-    # Sent to maintainer 2026-02-22.
-    ./c23.patch
-  ];
-
   nativeBuildInputs = [
     pkg-config
     flex

From 2b8ae0a0f1e2a1c302cab306ee8926f0214f71ba Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Sun, 19 Apr 2026 11:08:58 +0800
Subject: [PATCH 0030/1209] openssl*: enable strictDeps and __structuredAttrs

---
 pkgs/development/libraries/openssl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 2401b143436e..029085b841a6 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -378,8 +378,8 @@ let
 
       passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
-      strictDeps = lib.versionAtLeast version "4.0";
-      __structuredAttrs = lib.versionAtLeast version "4.0";
+      strictDeps = true;
+      __structuredAttrs = true;
 
       meta = {
         homepage = "https://www.openssl.org/";

From 40041739c7dc0885be77d3dc259b10354ed9d189 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 19 Apr 2026 09:05:18 +0100
Subject: [PATCH 0031/1209] elfutils: 0.194 -> 0.195

Changes: https://www.mail-archive.com/elfutils-devel@sourceware.org/msg09139.html
---
 pkgs/by-name/el/elfutils/package.nix          | 11 +----
 .../test-run-sysroot-reliability.patch        | 44 -------------------
 2 files changed, 2 insertions(+), 53 deletions(-)
 delete mode 100644 pkgs/by-name/el/elfutils/test-run-sysroot-reliability.patch

diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix
index 10d00afecf70..4a73d364c75c 100644
--- a/pkgs/by-name/el/elfutils/package.nix
+++ b/pkgs/by-name/el/elfutils/package.nix
@@ -28,11 +28,11 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation (finalAttrs: {
   pname = "elfutils";
-  version = "0.194";
+  version = "0.195";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${finalAttrs.version}/elfutils-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-CeL/Az05uqiziKLX+8U5C/3pmuO3xnx9qvdDP7zw8B4=";
+    hash = "sha256-N2Kf338fPcKBjhOPyiuAlBd9bC0PcB07tlClYSGNwCY=";
   };
 
   patches = [
@@ -57,13 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-strndupa.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "sha256-7daehJj1t0wPtQzTv+/Rpuqqs5Ng/EYnZzrcf2o/Lb0=";
     })
-    (fetchpatch {
-      name = "fix-aarch64_attributes.patch";
-      url = "https://sourceware.org/git/?p=elfutils.git;a=patch;h=b27adc5262e807f341ca0a4910ce04294144f79a";
-      hash = "sha256-hksO5HXL9Jv5E4o2rI4NAgQp+4z+Lg7Wn/AdW7fpr0c=";
-    })
-    # https://patchwork.sourceware.org/project/elfutils/patch/20251205145241.1165646-1-arnout@bzzt.net/
-    ./test-run-sysroot-reliability.patch
   ]
   ++ lib.optionals stdenv.hostPlatform.isMusl [ ./musl-error_h.patch ];
 
diff --git a/pkgs/by-name/el/elfutils/test-run-sysroot-reliability.patch b/pkgs/by-name/el/elfutils/test-run-sysroot-reliability.patch
deleted file mode 100644
index 6e5b5890a758..000000000000
--- a/pkgs/by-name/el/elfutils/test-run-sysroot-reliability.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-commit 898804bed022d1ef26e5c0b12550f87fc86f29ed
-Author: Arnout Engelen <arnout@bzzt.net>
-Date:   Thu Dec 4 21:42:40 2025 +0100
-
-    tests: improve reliability of run-sysroot.sh
-    
-    Previously, the 'second' test would test the `RESOLVE_IN_ROOT` feature
-    when the current libc supports it, even when the currently running
-    kernel did not yet support it.
-    
-    Signed-off-by: Arnout Engelen <arnout@bzzt.net>
-
-diff --git a/tests/run-sysroot.sh b/tests/run-sysroot.sh
-index fe302446..d2041e8a 100755
---- a/tests/run-sysroot.sh
-+++ b/tests/run-sysroot.sh
-@@ -46,10 +46,14 @@ TID 431185:
- #8  0x0000aaaae56127f0 _start
- EOF
- 
--HAVE_OPENAT2=$(grep '^#define HAVE_OPENAT2_RESOLVE_IN_ROOT' \
--                    ${abs_builddir}/../config.h | awk '{print $3}')
-+libc_has_openat2_resolve_in_root() {
-+  grep '^#define HAVE_OPENAT2_RESOLVE_IN_ROOT' ${abs_builddir}/../config.h | awk '{print $3}'
-+}
-+kernel_has_openat2_resolve_in_root() {
-+  printf "%s\n%s" "5.6.0" "$(uname -r)" | sort -V -C
-+}
- 
--if [[ "$HAVE_OPENAT2" = 1 ]]; then
-+if libc_has_openat2_resolve_in_root && kernel_has_openat2_resolve_in_root; then
-     # Change the layout of files in sysroot to test symlink escape scenario
-     rm -f "${tmpdir}/sysroot/bin"
-     mkdir "${tmpdir}/sysroot/bin"
-@@ -57,7 +61,8 @@ if [[ "$HAVE_OPENAT2" = 1 ]]; then
-     ln -s /bin/bash "${tmpdir}/sysroot/usr/bin/bash"
- 
-     # Check that stack with --sysroot generates correct backtrace even if target
--    # binary is actually absolute symlink pointing outside of sysroot directory
-+    # binary is actually absolute symlink to be interpreted relative to the sysroot
-+    # directory
-     testrun "${abs_top_builddir}"/src/stack --core "${tmpdir}/core.bash" \
- 	    --sysroot "${tmpdir}/sysroot" >"${tmpdir}/stack.out"
- 

From 95f82fa6e711b63f1b94ba2b30ba9bfd0f2e46ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 16:03:41 +0000
Subject: [PATCH 0032/1209] fluidsynth: 2.5.3 -> 2.5.4

---
 pkgs/by-name/fl/fluidsynth/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fl/fluidsynth/package.nix b/pkgs/by-name/fl/fluidsynth/package.nix
index 78b37719df78..3bb34d87c60d 100644
--- a/pkgs/by-name/fl/fluidsynth/package.nix
+++ b/pkgs/by-name/fl/fluidsynth/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k8IHS6Mh1b1iMSuBg3svlf7A2dsg6VHEKqlDhvyJnbo=";
+    hash = "sha256-uL9K2Bc5PA6qm/QVFvEUDyGBst9L/sNP0+HculCWCZk=";
     fetchSubmodules = true;
   };
 

From c1fde5e8adc88ec9a133913b2b67c61b1a4d666e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 20 Apr 2026 20:06:21 +0000
Subject: [PATCH 0033/1209] game-music-emu: 0.6.4 -> 0.6.5

---
 pkgs/by-name/ga/game-music-emu/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ga/game-music-emu/package.nix b/pkgs/by-name/ga/game-music-emu/package.nix
index 54eee2b237f9..f660fde43654 100644
--- a/pkgs/by-name/ga/game-music-emu/package.nix
+++ b/pkgs/by-name/ga/game-music-emu/package.nix
@@ -8,14 +8,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "0.6.4";
+  version = "0.6.5";
   pname = "game-music-emu";
 
   src = fetchFromGitHub {
     owner = "libgme";
     repo = "game-music-emu";
     tag = finalAttrs.version;
-    hash = "sha256-qGNWFFUUjv2R5e/nQrriAyDJCARISqNB8e5/1zEJ3fk=";
+    hash = "sha256-zn1t0oDj8hz/sfbG7lrstkv2Kf6cL7zAEMpIu9X4dyQ=";
   };
   nativeBuildInputs = [
     cmake

From 4ec33b014efb87a9a6997bdf8bdd4e9f62790272 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 20 Apr 2026 21:40:13 +0100
Subject: [PATCH 0034/1209] md4c: 0.5.2 -> 0.5.3

Changes: https://github.com/mity/md4c/compare/release-0.5.2...release-0.5.3
---
 pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch | 44 -------------------
 pkgs/by-name/md/md4c/package.nix              | 11 +----
 2 files changed, 2 insertions(+), 53 deletions(-)
 delete mode 100644 pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch

diff --git a/pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch b/pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch
deleted file mode 100644
index e0e9f3d96b2b..000000000000
--- a/pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 0ab8f5a6ee305cf4edcebfdc7b9eb5f98302de75 Mon Sep 17 00:00:00 2001
-From: Leif Middelschulte <Leif.Middelschulte@klsmartin.com>
-Date: Fri, 17 Sep 2021 16:16:17 +0200
-Subject: [PATCH] pc.in: use _FULL_ variable variants
-
-Nix' cmake packaging handler replaces the CMAKE_INSTALL_INCLUDEDIR
-with the absolute path. Which break package
-portability (i.e. `prefix`-usage).
----
- src/md4c-html.pc.in | 6 ++----
- src/md4c.pc.in      | 6 ++----
- 2 files changed, 4 insertions(+), 8 deletions(-)
-
-diff --git a/src/md4c-html.pc.in b/src/md4c-html.pc.in
-index 504bb52..fec7df4 100644
---- a/src/md4c-html.pc.in
-+++ b/src/md4c-html.pc.in
-@@ -1,7 +1,5 @@
--prefix=@CMAKE_INSTALL_PREFIX@
--exec_prefix=@CMAKE_INSTALL_PREFIX@
--libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
--includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
-+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
- 
- Name: @PROJECT_NAME@ HTML renderer
- Description: Markdown to HTML converter library.
-diff --git a/src/md4c.pc.in b/src/md4c.pc.in
-index cd8842d..b5d81f8 100644
---- a/src/md4c.pc.in
-+++ b/src/md4c.pc.in
-@@ -1,7 +1,5 @@
--prefix=@CMAKE_INSTALL_PREFIX@
--exec_prefix=@CMAKE_INSTALL_PREFIX@
--libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
--includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
-+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
- 
- Name: @PROJECT_NAME@
- Description: Markdown parser library with a SAX-like callback-based interface.
--- 
-2.31.0
-
diff --git a/pkgs/by-name/md/md4c/package.nix b/pkgs/by-name/md/md4c/package.nix
index 10fe4712b78d..32fad6ff5a2a 100644
--- a/pkgs/by-name/md/md4c/package.nix
+++ b/pkgs/by-name/md/md4c/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "md4c";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "mity";
     repo = "md4c";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-2/wi7nJugR8X2J9FjXJF1UDnbsozGoO7iR295/KSJng=";
+    hash = "sha256-rsNJlNLsmTEiAARqQ5TovNWmHNikMiRi8eEyn8o43ao=";
   };
 
   outputs = [
@@ -24,13 +24,6 @@ stdenv.mkDerivation (finalAttrs: {
     "man"
   ];
 
-  patches = [
-    # We set CMAKE_INSTALL_LIBDIR to the absolute path in $out, so prefix and
-    # exec_prefix cannot be $out, too
-    # Use CMake's _FULL_ variables instead of `prefix` concatenation.
-    ./0001-fix-pkgconfig.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config

From 4f72341536ca5fdb7520328e835802476a897f1b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 21 Apr 2026 22:07:04 +0100
Subject: [PATCH 0035/1209] valgrind: 3.26.0 -> 3.27.0

Changes: https://valgrind.org/docs/manual/dist.news.html
---
 pkgs/by-name/va/valgrind/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index 8c3a2ca3db1e..caf76027d8ee 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
-  version = "3.26.0";
+  version = "3.27.0";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-jVTHFwKRBvFkSq2vgCq5aS5T2T3QFcvRnnQZDrpha9c=";
+    hash = "sha256-W1k33oJX7o9RaY6nG5cRrc6YBhqgfapKaF78OvkhW+8=";
   };
 
   patches = [

From f20fda6d42187f1c54896b1356941472cc844972 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Apr 2026 12:28:28 +0000
Subject: [PATCH 0036/1209] gnused: 4.9 -> 4.10

---
 pkgs/tools/text/gnused/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 6effd6d9f41d..7f1cfe514425 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnused";
-  version = "4.9";
+  version = "4.10";
 
   src = fetchurl {
     url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    sha256 = "sha256-biJrcy4c1zlGStaGK9Ghq6QteYKSLaelNRljHSSXUYE=";
+    sha256 = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
   };
 
   outputs = [

From 75eb347675416d3bdb8d0b9b2324b18b540a3607 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 22 Apr 2026 21:28:31 +0100
Subject: [PATCH 0037/1209] libmpc: 1.4.0 -> 1.4.1

Changes: https://www.multiprecision.org/
---
 pkgs/by-name/li/libmpc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libmpc/package.nix b/pkgs/by-name/li/libmpc/package.nix
index 35328cc0023c..908ff90ff44a 100644
--- a/pkgs/by-name/li/libmpc/package.nix
+++ b/pkgs/by-name/li/libmpc/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmpc";
-  version = "1.4.0"; # to avoid clash with the MPD client
+  version = "1.4.1"; # to avoid clash with the MPD client
 
   src = fetchurl {
     url = "mirror://gnu/mpc/mpc-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MhCzpUaxywDClso2CJHXdA7m/wbesCono1sgzTwLsaU=";
+    hash = "sha256-kSBM0y8WS9O3yZLUpqjOZRlRGq2rMPeLaYLQv41z6TE=";
   };
 
   strictDeps = true;

From 9dbaf2b09f8e512f13c68ff4c583103f14c84fa7 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 24 Apr 2026 21:47:15 +0100
Subject: [PATCH 0038/1209] libhwy: 1.3.0 -> 1.4.0

Changes: https://github.com/google/highway/releases/tag/1.4.0
---
 pkgs/by-name/li/libhwy/package.nix | 21 ++-------------------
 1 file changed, 2 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/li/libhwy/package.nix b/pkgs/by-name/li/libhwy/package.nix
index d78d12faf698..fc60dbff5d0a 100644
--- a/pkgs/by-name/li/libhwy/package.nix
+++ b/pkgs/by-name/li/libhwy/package.nix
@@ -5,36 +5,19 @@
   ninja,
   gtest,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libhwy";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "highway";
     rev = version;
-    hash = "sha256-8QOk96Y3GIIvBUGIDikMgTylx8y5aCyr68/TP5w5ha4=";
+    hash = "sha256-YUYZO9KLffczjwIz3mBBceD6oM1giLCFLDHgDCevdRA=";
   };
 
-  patches = [
-    # Apply upstream workaround for gcc-15 bug:
-    #   https://github.com/google/highway/issues/2813
-    #   https://github.com/google/highway/pull/2824
-    (fetchpatch {
-      name = "gcc-15-clone-hack-prerequisite.patch";
-      url = "https://github.com/google/highway/commit/3b680cde3a556bead9cc23c8f595d07a44d5a0d5.patch";
-      hash = "sha256-8xBPuhsifalhzKgeEOQq6yZw2NWas+SFQrNIaMicRnY=";
-    })
-    (fetchpatch {
-      name = "gcc-15-clone-hack.patch";
-      url = "https://github.com/google/highway/commit/5af21b8a9078330a3d7456d855e69245bb87bc7a.patch";
-      hash = "sha256-hC/oEdxHsdZKlLFIw929ZHjffPURGzk9jiKz6iGSLkY=";
-    })
-  ];
-
   hardeningDisable = lib.optionals stdenv.hostPlatform.isAarch64 [
     # aarch64-specific code gets:
     # __builtin_clear_padding not supported for variable length aggregates

From 02ddf0a084f082c1f9bdd8b8f16fae66d0f8ae14 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Sat, 25 Apr 2026 17:57:58 +0900
Subject: [PATCH 0039/1209] libxslt: fixup cmake so it can properly find lib
 outputs

---
 pkgs/by-name/li/libxslt/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/li/libxslt/package.nix b/pkgs/by-name/li/libxslt/package.nix
index 6de4895cf7bc..da39812157a4 100644
--- a/pkgs/by-name/li/libxslt/package.nix
+++ b/pkgs/by-name/li/libxslt/package.nix
@@ -78,6 +78,9 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
     moveToOutput lib/xsltConf.sh "$dev"
+
+    substituteInPlace "$dev/lib/cmake/libxslt/libxslt-config.cmake" \
+      --replace-fail '"''${PACKAGE_PREFIX_DIR}/lib"' "\"$out/lib\""
   ''
   + lib.optionalString pythonSupport ''
     mkdir -p $py/nix-support

From a0329b88aed371b01b272c79b63f7097e66f8315 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 25 Apr 2026 10:15:21 +0100
Subject: [PATCH 0040/1209] libmicrohttpd: 1.0.2 -> 1.0.5

---
 pkgs/development/libraries/libmicrohttpd/1.0.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libmicrohttpd/1.0.nix b/pkgs/development/libraries/libmicrohttpd/1.0.nix
index 8070e78356c7..138f80ca444c 100644
--- a/pkgs/development/libraries/libmicrohttpd/1.0.nix
+++ b/pkgs/development/libraries/libmicrohttpd/1.0.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix rec {
-  version = "1.0.2";
+  version = "1.0.5";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/libmicrohttpd-${version}.tar.gz";
-    hash = "sha256-3zJPzQg0F12rB0gxM5Atl3SmBb+imAJfaYgyiP0gqMc=";
+    hash = "sha256-tG0A9Y76b0l7l9LngsTuZjAdQS3dhV3TBoUYs6LNPqI=";
   };
 }

From 2ba029a78e1fc8804152a62e4202215264554b6c Mon Sep 17 00:00:00 2001
From: Liam Murphy <liampm32@gmail.com>
Date: Sun, 26 Apr 2026 12:09:41 +1000
Subject: [PATCH 0041/1209] openblas: 0.3.32 -> 0.3.33

This release fixes build failures for linbox on aarch64
(https://hydra.nixos.org/build/327030681,
https://hydra.nixos.org/build/327030680); see
https://github.com/OpenMathLib/OpenBLAS/issues/5763.
---
 .../libraries/science/math/openblas/default.nix      | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 6274578cfcdf..716d330c28e3 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -170,7 +170,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openblas";
-  version = "0.3.32";
+  version = "0.3.33";
 
   outputs = [
     "out"
@@ -181,7 +181,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OpenMathLib";
     repo = "OpenBLAS";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-D0Wu5Ew72aTqSjj970yOfAwPg1T4Qm6zmpaGlQ/5Q1k=";
+    hash = "sha256-EArf0K2Gs+w8IRD5wkMOQv79e8yMoTgQfa9kzjXKn3Y=";
   };
 
   patches = [
@@ -190,13 +190,13 @@ stdenv.mkDerivation (finalAttrs: {
     # INCLUDEDIR already fixed in upstream HEAD & significant refactor
     # to config gen so not PRing changes
     ./cmake-include-fixes.patch
-    # Fix build on LoongArch (error: '_Float16' is not supported on this target)
+    # This was an attempted fix for the below commit but still leaves some scipy tests failing.
     (fetchpatch {
-      url = "https://github.com/OpenMathLib/OpenBLAS/commit/7086a1b075ca317e12cfe79d40a32ad342a30496.patch";
-      hash = "sha256-pA3HK2f2MJr/+h/uale7edIYk/KH194EscYFcsujPXY=";
+      url = "https://github.com/OpenMathLib/OpenBLAS/commit/e3ce4623c299068bbd47c35ee87aab334bac73b1.patch";
+      revert = true;
+      hash = "sha256-WrP3RCDk/EbpqVOw9XGLnFI+6/bBGJTIrt2TRYGLVQ4=";
     })
     # This commit led to miscompilation of certain ASIMD extensions code paths.
-    # There was an attempted fix in upstream but this still leaves some scipy tests failing.
     (fetchpatch {
       url = "https://github.com/OpenMathLib/OpenBLAS/commit/3f6e928d34aca977bd5d4191e6d2c2338a342.patch";
       revert = true;

From 57cd8cc8a3a34e5d97b64885973eef72dbfd24ef Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 26 Apr 2026 10:32:26 +0100
Subject: [PATCH 0042/1209] mpg123: 1.33.4 -> 1.33.5

Changes: https://mpg123.org/#2026-04-25
---
 pkgs/applications/audio/mpg123/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index df13df07a978..e46a14127710 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.4";
+  version = "1.33.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-OujJ/4Cpe/wOIuifvNdGh+yk/B2zFbEmB/J/ActaR9k=";
+    hash = "sha256-DX68jaCv88o4PIxrWmrb5ALuW7JWaFuMVJnzpzn51t0=";
   };
 
   outputs = [

From 7bd3d8daf2081be2a6a0aa44b54f0df58f95c7d4 Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Wed, 29 Apr 2026 14:51:08 +0200
Subject: [PATCH 0043/1209] doctest: 2.5.0 -> 2.5.2

Diff: https://github.com/doctest/doctest/compare/v2.5.0...v2.5.2

Changelog: https://github.com/doctest/doctest/releases/tag/v2.5.2
---
 pkgs/by-name/do/doctest/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/do/doctest/package.nix b/pkgs/by-name/do/doctest/package.nix
index f6ffd1b9e559..cbea1dcba749 100644
--- a/pkgs/by-name/do/doctest/package.nix
+++ b/pkgs/by-name/do/doctest/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doctest";
-  version = "2.5.0";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "doctest";
     repo = "doctest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7t/eknv7VtHoBgcuJmI07x//HIyqzE9HUuH5u2y7X8A=";
+    hash = "sha256-4jW6xPFCFxk1l47EkSUVojhycrtluPhOc5Adf/25R7M=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -27,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   meta = {
+    changelog = "https://github.com/doctest/doctest/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/doctest/doctest";
     description = "Fastest feature-rich C++11/14/17/20 single-header testing framework";
     platforms = lib.platforms.all;

From b0af552236ff2e10d2fd7c3de4819079062c8055 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 1 May 2026 13:58:01 +0200
Subject: [PATCH 0044/1209] assimp: 6.0.4 -> 6.0.5

changelog: https://github.com/assimp/assimp/blob/master/CHANGES.md

diff: https://github.com/assimp/assimp/compare/v6.0.4...v6.0.5
---
 pkgs/by-name/as/assimp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/as/assimp/package.nix b/pkgs/by-name/as/assimp/package.nix
index 717fd1a0746f..24769c4a231c 100644
--- a/pkgs/by-name/as/assimp/package.nix
+++ b/pkgs/by-name/as/assimp/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "assimp";
-  version = "6.0.4";
+  version = "6.0.5";
   outputs = [
     "out"
     "lib"
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "assimp";
     repo = "assimp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ryTgsN0z9BZBz7i9aUMKuneN5oqfxpduwJlb+Q0q3Mk=";
+    hash = "sha256-QWBi1pl5C76UtPhB6SmFipm9oEdnfhELMT3MqfV6oxg=";
   };
 
   postPatch = ''

From fc513d020b35545da312241125fa5cb60b3d4a0f Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 30 Jan 2026 17:32:55 +0100
Subject: [PATCH 0045/1209] nixos/systemd-lib: use structuredAttrs instead of
 passAsFile for makeUnit

---
 nixos/lib/systemd-lib.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/nixos/lib/systemd-lib.nix b/nixos/lib/systemd-lib.nix
index 8397eca39c51..9f5ec37e5270 100644
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@@ -76,16 +76,13 @@ rec {
         {
           preferLocalBuild = true;
           allowSubstitutes = false;
-          # unit.text can be null. But variables that are null listed in
-          # passAsFile are ignored by nix, resulting in no file being created,
-          # making the mv operation fail.
-          text = optionalString (unit.text != null) unit.text;
-          passAsFile = [ "text" ];
+          text = unit.text or "";
+          __structuredAttrs = true;
         }
         ''
           name=${shellEscape name}
           mkdir -p "$out/$(dirname -- "$name")"
-          mv "$textPath" "$out/$name"
+          printf "%s" "$text" > "$out/$name"
         ''
     else
       pkgs.runCommand "unit-${mkPathSafeName name}-disabled"

From 06b17cff7d67f07779cc4b2adae419012c90f677 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 May 2026 15:40:47 +0000
Subject: [PATCH 0046/1209] libapparmor: 4.1.7 -> 5.0.0

---
 pkgs/by-name/li/libapparmor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libapparmor/package.nix b/pkgs/by-name/li/libapparmor/package.nix
index 9290ebfa7044..7cfb71447ceb 100644
--- a/pkgs/by-name/li/libapparmor/package.nix
+++ b/pkgs/by-name/li/libapparmor/package.nix
@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "4.1.7";
+  version = "5.0.0";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yjqdUwHkQ1uiPKPZQVf/o8tGixQeIKNMOIYo4aVK7N0=";
+    hash = "sha256-seEREIc83alEPyZGD/GY48hjpqiw3QENnqYsdjHOGgs=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
 

From f0847890f4303c4c69c3c252eb183bf60fc46a45 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 1 May 2026 21:34:04 +0100
Subject: [PATCH 0047/1209] srt: 1.5.4 -> 1.5.5

Changes: https://github.com/Haivision/srt/releases/tag/v1.5.5
---
 pkgs/by-name/sr/srt/package.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/sr/srt/package.nix b/pkgs/by-name/sr/srt/package.nix
index a5190b8b6d36..d02efdc3d4e6 100644
--- a/pkgs/by-name/sr/srt/package.nix
+++ b/pkgs/by-name/sr/srt/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   openssl,
   windows,
@@ -10,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "srt";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-NLy9GuP4OT/kKAIIDXSHtsmaBzXRuFohFM/aM+46cao=";
+    sha256 = "sha256-hOkLlmtF9dKqXZTjAeBntkkg5WsmsZN6DKhyakoIF1k=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -29,12 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   patches = [
-    # Fix the build with CMake 4.
-    (fetchpatch {
-      name = "srt-fix-cmake-4.patch";
-      url = "https://github.com/Haivision/srt/commit/0def1b1a1094fc57752f241250e9a1aed71bbffd.patch";
-      hash = "sha256-dnBGNut+I9trkQzr81Wo36O2Pt7d2gsjA1buJBegPMM=";
-    })
   ]
   ++ lib.optionals stdenv.hostPlatform.isMinGW [
     ./no-msvc-compat-headers.patch

From feb7c9ff7812521077ce8ac75c0cdc8f5de31152 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Fri, 1 May 2026 21:53:30 +0200
Subject: [PATCH 0048/1209] libressl_4_3: init at 4.3.1

I also added expiration date comments on all of them, because I always
spend some time chasing what the support dates are, and it would save
maintainer time to be able to see what to do with these branches.
---
 pkgs/by-name/li/libressl/default.nix | 13 +++++++++++++
 pkgs/top-level/all-packages.nix      |  1 +
 2 files changed, 14 insertions(+)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 7a266936f6c4..7a7408243433 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -111,13 +111,17 @@ let
         identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "openbsd" version;
       };
     };
+
   # https://github.com/libressl/portable/pull/1206
+  # This got merged in February 2026 and is included as of LibreSSL 4.3.0.
   common-cmake-install-full-dirs-patch = fetchpatch {
     url = "https://github.com/libressl/portable/commit/a15ea0710398eaeed3be53cf643e80a1e80c981d.patch";
     hash = "sha256-Mlf4SrGCCqALQicbGtmVGdkdfcE8DEGYkOuVyG2CozM=";
   };
 in
 {
+  # 4.1 was released April 2025 and became unsupported on April 28, 2026,
+  # one year after the release of OpenBSD 7.7.
   libressl_4_1 = generic {
     version = "4.1.2";
     hash = "sha256-+6Ti+ip/UjBt96OJlwoQ6YuX6w7bKZqf252/SZmcYeE=";
@@ -137,6 +141,8 @@ in
     ];
   };
 
+  # 4.2 was released October 2025 and will become unsupported on October 22,
+  # 2026, one year after the release of OpenBSD 7.8.
   libressl_4_2 = generic {
     version = "4.2.1";
     hash = "sha256-bVwvWFg1iOp5H0yGRQBAcdAN+lVKW/eIoAbKHrWr1ws=";
@@ -144,4 +150,11 @@ in
       common-cmake-install-full-dirs-patch
     ];
   };
+
+  # 4.3 was released April 2026 and will become unsupported one year after the
+  # release of OpenBSD 7.9.
+  libressl_4_3 = generic {
+    version = "4.3.1";
+    hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
+  };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 52f3e94da50a..4fc3a62e8955 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7003,6 +7003,7 @@ with pkgs;
   inherit (callPackages ../by-name/li/libressl { })
     libressl_4_1
     libressl_4_2
+    libressl_4_3
     ;
 
   openssl = openssl_3_6;

From 0bfe3de9edd95a12bd7049dcd03055d796124a31 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Fri, 1 May 2026 22:07:13 +0200
Subject: [PATCH 0049/1209] libressl_4_1: delete unsupported package

LibreSSL branches are supported for one year after the OpenBSD release
in which they are included. LibreSSL 4.1 was part of OpenBSD 7.7, which
was released on April 28, 2025, so it's end of life now.
---
 pkgs/by-name/li/libressl/default.nix | 21 ---------------------
 pkgs/top-level/all-packages.nix      |  1 -
 2 files changed, 22 deletions(-)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 7a7408243433..8d6f40f61c01 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -120,27 +120,6 @@ let
   };
 in
 {
-  # 4.1 was released April 2025 and became unsupported on April 28, 2026,
-  # one year after the release of OpenBSD 7.7.
-  libressl_4_1 = generic {
-    version = "4.1.2";
-    hash = "sha256-+6Ti+ip/UjBt96OJlwoQ6YuX6w7bKZqf252/SZmcYeE=";
-    # Fixes build on loongarch64
-    # https://github.com/libressl/portable/pull/1184
-    postPatch = ''
-      mkdir -p include/arch/loongarch64
-      cp ${
-        fetchurl {
-          url = "https://github.com/libressl/portable/raw/refs/tags/v4.1.0/include/arch/loongarch64/opensslconf.h";
-          hash = "sha256-68dw5syUy1z6GadCMR4TR9+0UQX6Lw/CbPWvjHGAhgo=";
-        }
-      } include/arch/loongarch64/opensslconf.h
-    '';
-    patches = [
-      common-cmake-install-full-dirs-patch
-    ];
-  };
-
   # 4.2 was released October 2025 and will become unsupported on October 22,
   # 2026, one year after the release of OpenBSD 7.8.
   libressl_4_2 = generic {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4fc3a62e8955..06c6e70e5817 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7001,7 +7001,6 @@ with pkgs;
   zunclient = with python313Packages; toPythonApplication python-zunclient;
 
   inherit (callPackages ../by-name/li/libressl { })
-    libressl_4_1
     libressl_4_2
     libressl_4_3
     ;

From 16656233905ab0ff2fa329c86593cb925094b1e7 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Fri, 1 May 2026 22:08:40 +0200
Subject: [PATCH 0050/1209] libressl: add ruuda as maintainer

I've been keeping this package up to date over the past few years, since
I run a webserver that depends on it. I'd be happy to be co-maintainer
for it, and hopefully reduce the load on others.
---
 pkgs/by-name/li/libressl/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 8d6f40f61c01..fba1c17d5180 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -96,6 +96,7 @@ let
         maintainers = with lib.maintainers; [
           thoughtpolice
           fpletz
+          ruuda
         ];
         inherit knownVulnerabilities;
 

From c74cade494dc95a74dd75099bf700e9bab5deb35 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Fri, 1 May 2026 22:51:35 +0200
Subject: [PATCH 0051/1209] libressl: enable strictDeps and __structuredAttrs

---
 pkgs/by-name/li/libressl/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index fba1c17d5180..a4ac4000d452 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -23,6 +23,9 @@ let
       pname = "libressl";
       inherit version;
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       src = fetchurl {
         url = "mirror://openbsd/LibreSSL/libressl-${version}.tar.gz";
         inherit hash;

From 63147b12a5831e23ce5e88f5f9a35fe8997e9978 Mon Sep 17 00:00:00 2001
From: ElXreno <elxreno@gmail.com>
Date: Sat, 25 Apr 2026 16:00:45 +0300
Subject: [PATCH 0052/1209] openldap: skip flaky syncreplication tests

---
 pkgs/by-name/op/openldap/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/op/openldap/package.nix b/pkgs/by-name/op/openldap/package.nix
index e40648724340..9e1457ef6572 100644
--- a/pkgs/by-name/op/openldap/package.nix
+++ b/pkgs/by-name/op/openldap/package.nix
@@ -122,6 +122,8 @@ stdenv.mkDerivation (finalAttrs: {
     # https://bugs.openldap.org/show_bug.cgi?id=8623
     rm -f tests/scripts/test022-ppolicy
 
+    rm -f tests/scripts/test*-sync*
+
     rm -f tests/scripts/test063-delta-multiprovider
 
     # https://bugs.openldap.org/show_bug.cgi?id=10009

From 21622bac70c240e85777be65c5b65bac6c3f3553 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 3 May 2026 06:56:18 +0000
Subject: [PATCH 0053/1209] freetype: 2.14.2 -> 2.14.3

---
 pkgs/by-name/fr/freetype/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/freetype/package.nix b/pkgs/by-name/fr/freetype/package.nix
index 6146ce0d8cc1..fcace2938756 100644
--- a/pkgs/by-name/fr/freetype/package.nix
+++ b/pkgs/by-name/fr/freetype/package.nix
@@ -39,7 +39,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freetype";
-  version = "2.14.2";
+  version = "2.14.3";
 
   src =
     let
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "mirror://savannah/freetype/freetype-${version}.tar.xz";
-      sha256 = "sha256-S2Lcq0ySChqGA2mTMiGBQ2LmmeJvVXklFtZx5v9VteE=";
+      sha256 = "sha256-NrxPHMQTM1No7mVsQq/KZcWjmH6HaMwozxG6d154Wl8=";
     };
 
   propagatedBuildInputs = [

From efdf5458bd1bbff0bb38dba4b05ac1766ecd9590 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 3 May 2026 11:17:29 -0700
Subject: [PATCH 0054/1209] python3Packages.mistune: 3.2.0 -> 3.2.1

Diff: https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1

Changelog: https://github.com/lepture/mistune/blob/v3.2.1/docs/changes.rst
---
 pkgs/development/python-modules/mistune/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mistune/default.nix b/pkgs/development/python-modules/mistune/default.nix
index a130857e1a71..8cdfa4023ded 100644
--- a/pkgs/development/python-modules/mistune/default.nix
+++ b/pkgs/development/python-modules/mistune/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mistune";
-  version = "3.2.0";
+  version = "3.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "mistune";
     tag = "v${version}";
-    hash = "sha256-rUEZNVuMT5+GsMakrkK6rshKSKtTTN72kK92AmQ8bl8=";
+    hash = "sha256-8AEEh/SWAk/Esq0jAoZGLw1FIQUw6C5Xq8CgnI2fjv0=";
   };
 
   build-system = [ setuptools ];

From b926d50aaf166585c1395092adbdaaa7b572632b Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Sat, 2 May 2026 01:28:38 -0700
Subject: [PATCH 0055/1209] minimal-bootstrap: reduce bootstrap time

---
 pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix        | 5 ++++-
 pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix   | 5 ++++-
 pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix       | 1 +
 pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix     | 4 ++++
 pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix    | 5 ++++-
 pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix | 1 +
 6 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
index 090b939acd7f..3146c350dddb 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
@@ -127,7 +127,10 @@ bash.runCommand "${pname}-${version}"
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
     export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
-    export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CFLAGS="-O1"
+    export CXXFLAGS="-O1"
+    export CFLAGS_FOR_TARGET="-O0 -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CXXFLAGS_FOR_TARGET="$CFLAGS_FOR_TARGET"
     export C_INCLUDE_PATH="${musl}/include"
     export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
     export LIBRARY_PATH="${musl}/lib"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
index 0f442367f72f..9eb873ea0da5 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
@@ -130,7 +130,10 @@ bash.runCommand "${pname}-${version}"
 
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
-    export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CFLAGS="-O1"
+    export CXXFLAGS="-O1"
+    export CFLAGS_FOR_TARGET="-O0 -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CXXFLAGS_FOR_TARGET="$CFLAGS_FOR_TARGET"
     export C_INCLUDE_PATH="${musl}/include"
     export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
     export LIBRARY_PATH="${musl}/lib"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
index d9c37f5a0562..7c533e2d0d5b 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
@@ -110,6 +110,7 @@ bash.runCommand "${pname}-${version}"
 
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
+    export CFLAGS="-O2"
     export C_INCLUDE_PATH="${tinycc.libs}/include:$(pwd)/mpfr/src"
     export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
index 890098aa66b9..eb8da7723f98 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
@@ -126,6 +126,10 @@ bash.runCommand "${pname}-${version}"
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
     export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CFLAGS="-O1 -pipe"
+    export CXXFLAGS="-O1 -pipe"
+    export CFLAGS_FOR_TARGET="-O0"
+    export CXXFLAGS_FOR_TARGET="-O0"
 
     bash ./configure \
       --prefix=$out \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
index e55acf5caecd..287f894626e0 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
@@ -124,7 +124,10 @@ bash.runCommand "${pname}-${version}"
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
     export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
-    export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CFLAGS="-O1"
+    export CXXFLAGS="-O1"
+    export CFLAGS_FOR_TARGET="-O0 -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CXXFLAGS_FOR_TARGET="$CFLAGS_FOR_TARGET"
     export LIBRARY_PATH="${musl}/lib"
 
     bash ./configure \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
index a9694d349f5e..b1df854db276 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
@@ -98,6 +98,7 @@ bash.runCommand "${pname}-${version}"
     cd build
     # libstdc++.so is built against musl and fails to link
     export CXX=false
+    export CFLAGS="-O1"
     bash ../configure \
       --prefix=$out \
       --build=${buildPlatform.config} \

From 6014579a95320d82b7d483ac2392d4a134541685 Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Mon, 30 Mar 2026 17:03:04 +0800
Subject: [PATCH 0056/1209] clang, cc-wrapper: make wrapper flang-aware

Build on the initial LLVM Flang wrapper work by exposing the needed clang passthru and teaching cc-wrapper about flang-specific flag handling.

Co-authored-by: stove <stove@rivosinc.com>
Co-authored-by: acture <acture@gmail.com>
Co-authored-by: Emily <hello@emily.moe>
Co-authored-by: Philip Taron <philip.taron@gmail.com>
---
 .../cc-wrapper/add-clang-cc-cflags-before.sh  |  2 +-
 pkgs/build-support/cc-wrapper/add-flags.sh    |  2 +
 pkgs/build-support/cc-wrapper/cc-wrapper.sh   | 18 +++++++--
 pkgs/build-support/cc-wrapper/default.nix     | 40 ++++++++++++-------
 .../compilers/llvm/common/clang/default.nix   |  6 ++-
 5 files changed, 48 insertions(+), 20 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
index 865e0d054820..d5515604c0bc 100644
--- a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
+++ b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
@@ -36,6 +36,6 @@ elif [[ $0 != *cpp ]]; then
     fi
 fi
 
-if [[ "@darwinMinVersion@" ]]; then
+if [[ "@darwinMinVersion@" ]] && [ "@isFlang@" != 1 ]; then
     extraBefore+=(-Werror=unguarded-availability)
 fi
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index a86f65d03f97..4b9f71af4eab 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -11,6 +11,8 @@ var_templates_list=(
     NIX_CXXSTDLIB_COMPILE
     NIX_CXXSTDLIB_LINK
     NIX_GNATFLAGS_COMPILE
+    NIX_FFLAGS_COMPILE
+    NIX_FFLAGS_COMPILE_BEFORE
 )
 var_templates_bool=(
     NIX_ENFORCE_NO_NATIVE
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 246c1b1f65f6..2d36278b59fa 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -44,7 +44,7 @@ while (( "$n" < "$nParams" )); do
 
     case "$p" in
         -[cSEM] | -MM) dontLink=1 ;;
-        -cc1) cc1=1 ;;
+        -cc1 | -fc1 ) cc1=1 ;;
         -nostdinc) cInclude=0 cxxInclude=0 ;;
         -nostdinc++) cxxInclude=0 ;;
         -nostdlib) cxxLibrary=0 ;;
@@ -185,9 +185,19 @@ fi
 
 source @out@/nix-support/add-hardening.sh
 
-# Add the flags for the C compiler proper.
-extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_CFLAGS_COMPILE_@suffixSalt@)
-extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
+# Add the flags for the compiler proper. Flang reads its user-supplied
+# flags from the Fortran-specific NIX_FFLAGS_COMPILE channel so that
+# C-only flags injected by setup hooks (e.g. -frandom-seed= from
+# reproducible-builds.sh, which Flang does not accept) never reach the
+# Fortran driver. This mirrors the NIX_GNATFLAGS_COMPILE channel that
+# the Ada/GNAT wrapper uses for the same reason.
+if [ "@isFlang@" = 1 ]; then
+    extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_FFLAGS_COMPILE_@suffixSalt@)
+    extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_FFLAGS_COMPILE_BEFORE_@suffixSalt@)
+else
+    extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_CFLAGS_COMPILE_@suffixSalt@)
+    extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
+fi
 
 if [ "$dontLink" != 1 ]; then
     linkType=$(checkLinkType $NIX_LDFLAGS_BEFORE_@suffixSalt@ "${params[@]}" ${NIX_CFLAGS_LINK_@suffixSalt@:-} $NIX_LDFLAGS_@suffixSalt@)
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 10175e91a070..237476818bec 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -26,6 +26,7 @@
   nixSupport ? { },
   isGNU ? false,
   isClang ? cc.isClang or false,
+  isFlang ? cc.isFlang or false,
   isZig ? cc.isZig or false,
   isArocc ? cc.isArocc or false,
   isCcache ? cc.isCcache or false,
@@ -385,7 +386,9 @@ let
   #
   # TODO: Drop `mangle-NIX_STORE-in-__FILE__.patch` from GCC and make
   # this unconditional once the upstream bug is fixed.
-  useMacroPrefixMap = !isGNU;
+  useMacroPrefixMap = !isGNU && !isFlang;
+  systemIncludeFlag = if isFlang || isArocc then "-I" else "-idirafter";
+  fortifyIncludeFlag = if isFlang then "-I" else "-isystem";
 in
 
 assert includeFortifyHeaders' -> fortify-headers != null;
@@ -573,10 +576,18 @@ stdenvNoCC.mkDerivation {
   ''
 
   + optionalString cc.langFortran or false ''
-    wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
-    ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
-    ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
-    export named_fc=${targetPrefix}gfortran
+    if [ -e $ccPath/${targetPrefix}gfortran ]; then
+      wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
+      ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
+      ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
+      export named_fc=${targetPrefix}gfortran
+    elif [ -e $ccPath/${targetPrefix}flang ]; then
+      wrap ${targetPrefix}flang $wrapper $ccPath/${targetPrefix}flang
+      export named_fc=${targetPrefix}flang
+    elif [ -e $ccPath/flang ]; then
+      wrap ${targetPrefix}flang $wrapper $ccPath/flang
+      export named_fc=${targetPrefix}flang
+    fi
   ''
 
   + optionalString cc.langGo or false ''
@@ -712,9 +723,7 @@ stdenvNoCC.mkDerivation {
         echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
       ''
       + ''
-        include "-${
-          if isArocc then "I" else "idirafter"
-        }" "${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
+        include "${systemIncludeFlag}" "${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
       ''
       + optionalString isGNU ''
         for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
@@ -722,9 +731,9 @@ stdenvNoCC.mkDerivation {
         done
       ''
       + optionalString (libc.w32api or null != null) ''
-        echo '-idirafter ${lib.getDev libc.w32api}${
+        include "${systemIncludeFlag}" "${lib.getDev libc.w32api}${
           libc.incdir or "/include/w32api"
-        }' >> $out/nix-support/libc-cflags
+        }" >> $out/nix-support/libc-cflags
       ''
       + ''
 
@@ -739,7 +748,7 @@ stdenvNoCC.mkDerivation {
       # like option that forces the libc headers before all -idirafter,
       # hence -isystem here.
       + optionalString includeFortifyHeaders' ''
-        include -isystem "${fortify-headers}/include" >> $out/nix-support/libc-cflags
+        include "${fortifyIncludeFlag}" "${fortify-headers}/include" >> $out/nix-support/libc-cflags
       ''
     )
 
@@ -760,7 +769,7 @@ stdenvNoCC.mkDerivation {
     # already knows how to find its own libstdc++, and adding
     # additional -isystem flags will confuse gfortran (see
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
-    + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
+    + optionalString (libcxx == null && isClang && useGccForLibs && (cc.langCC or false)) ''
       for dir in ${gccForLibs}/include/c++/*; do
         include -cxx-isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
@@ -827,6 +836,7 @@ stdenvNoCC.mkDerivation {
       optionalString
         (
           (cc.isClang or false)
+          && !isFlang
           && !(cc.isROCm or false)
           && !targetPlatform.isDarwin
           && !targetPlatform.isAndroid
@@ -861,7 +871,8 @@ stdenvNoCC.mkDerivation {
       let
         enable_fp = !targetPlatform.isx86_32 && !targetPlatform.isS390;
         enable_leaf_fp =
-          enable_fp
+          !isFlang
+          && enable_fp
           && (
             targetPlatform.isx86_64
             || targetPlatform.isAarch64
@@ -927,7 +938,7 @@ stdenvNoCC.mkDerivation {
     # well with multi line flags, so make the flags single line again
     + ''
       for flags in "$out/nix-support"/*flags*; do
-        substituteInPlace "$flags" --replace $'\n' ' '
+        substituteInPlace "$flags" --replace-quiet $'\n' ' '
       done
 
       substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
@@ -973,6 +984,7 @@ stdenvNoCC.mkDerivation {
 
   env = {
     inherit isClang;
+    inherit isFlang;
 
     # for substitution in utils.bash
     # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index e3ef79039539..f3b8f52bcfa3 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -16,6 +16,7 @@
   fixDarwinDylibNames,
   enableManpages ? false,
   enableClangToolsExtra ? true,
+  extraPatches ? [ ],
   devExtraCmakeFlags ? [ ],
   replaceVars,
   getVersionFile,
@@ -73,7 +74,8 @@ stdenv.mkDerivation (
       ];
       stripLen = 1;
       hash = "sha256-1NKej08R9SPlbDY/5b0OKUsHjX07i9brR84yXiPwi7E=";
-    });
+    })
+    ++ extraPatches;
 
     nativeBuildInputs = [
       cmake
@@ -189,6 +191,8 @@ stdenv.mkDerivation (
     passthru = {
       inherit libllvm;
       isClang = true;
+      langC = true;
+      langCC = true;
       hardeningUnsupportedFlagsByTargetPlatform =
         targetPlatform:
         [ "fortify3" ]

From 324f837bf1a8cd5f1378501cedeb9b80f037081b Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Mon, 30 Mar 2026 17:03:25 +0800
Subject: [PATCH 0057/1209] flang-rt: add runtime package

Add a standalone derivation for LLVM's flang-rt runtime libraries
(libFortranRuntime, libFortranDecimal). flang-rt is a runtimes-style
package: building it requires running a working flang binary at *build*
time, but the produced libraries are linked into derivations targeting
the *host*.

The runtime is therefore wired up using `buildFlang`, sourced from
`buildLlvmPackages.flang-unwrapped` so that the build-platform flang
(spliced via the LLVM package set) compiles the runtime, while the
resulting libraries are still produced for the host platform. This
mirrors the existing `buildLlvmTools.tblgen` / `buildLlvmPackages.tblgen`
pattern used elsewhere in the LLVM package set.

`unwrapped` rather than the wrapped flang is used because flang-rt's
CMake glue invokes the compiler directly and does not need (or want)
Nix's cc-wrapper resource-dir and rpath plumbing during the runtime
build.

flang-rt only consumes LLVM's CMake helpers and the build-time flang;
it does not link against MLIR or libclang, so neither MLIR_DIR nor
CLANG_DIR is passed and the unused empty `dev` output is omitted.

Co-authored-by: stove <stove@rivosinc.com>
Co-authored-by: acture <acture@gmail.com>
---
 .../llvm/common/flang-rt/default.nix          | 81 +++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 pkgs/development/compilers/llvm/common/flang-rt/default.nix

diff --git a/pkgs/development/compilers/llvm/common/flang-rt/default.nix b/pkgs/development/compilers/llvm/common/flang-rt/default.nix
new file mode 100644
index 000000000000..01a1d6ca8584
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/flang-rt/default.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  llvm_meta,
+  monorepoSrc,
+  runCommand,
+  cmake,
+  libllvm,
+  ninja,
+  python3,
+  buildFlang,
+  version,
+}:
+let
+
+  minDarwinVersion = "10.12";
+  effectiveDarwinVersion =
+    if stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion minDarwinVersion then
+      minDarwinVersion
+    else
+      stdenv.hostPlatform.darwinMinVersion;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "flang-rt";
+  inherit version;
+
+  src =
+    runCommand "${finalAttrs.pname}-src-${version}"
+      {
+        inherit (monorepoSrc) passthru;
+      }
+      ''
+        mkdir -p "$out"
+        cp -r ${monorepoSrc}/cmake "$out"
+
+        mkdir -p "$out/llvm"
+        cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
+        cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
+        cp -r ${monorepoSrc}/third-party "$out"
+
+        cp -r ${monorepoSrc}/${finalAttrs.pname} "$out"
+        cp -r ${monorepoSrc}/flang "$out"
+        cp -r ${monorepoSrc}/runtimes "$out"
+      '';
+
+  sourceRoot = "${finalAttrs.src.name}/runtimes";
+
+  outputs = [ "out" ];
+
+  nativeBuildInputs = [
+    buildFlang
+    cmake
+    ninja
+    python3
+  ];
+  buildInputs = [
+    libllvm
+  ];
+
+  env = lib.optionalAttrs stdenv.isDarwin {
+    MACOSX_DEPLOYMENT_TARGET = effectiveDarwinVersion;
+    NIX_CFLAGS_COMPILE = "-mmacosx-version-min=${effectiveDarwinVersion}";
+  };
+
+  cmakeFlags = [
+    (lib.cmakeFeature "LLVM_DEFAULT_TARGET_TRIPLE" stdenv.hostPlatform.config)
+    (lib.cmakeFeature "CMAKE_Fortran_COMPILER" "${buildFlang}/bin/flang")
+    (lib.cmakeBool "CMAKE_Fortran_COMPILER_WORKS" true)
+    (lib.cmakeBool "CMAKE_Fortran_COMPILER_SUPPORTS_F90" true)
+    (lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm")
+    (lib.cmakeFeature "LLVM_ENABLE_RUNTIMES" "flang-rt")
+  ]
+  ++ lib.optionals stdenv.isDarwin [
+    (lib.cmakeFeature "CMAKE_OSX_DEPLOYMENT_TARGET" effectiveDarwinVersion)
+  ];
+
+  meta = llvm_meta // {
+    homepage = "https://flang.llvm.org";
+    description = "LLVM Fortran Runtime";
+  };
+})

From 1ba36147a8db08211ee1e08ef61af09aad489deb Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Mon, 30 Mar 2026 17:07:37 +0800
Subject: [PATCH 0058/1209] flang: package standalone flang with LLVM 20+
 driver fixes

Wire flang into llvmPackages as a first-class Fortran compiler. flang
is built standalone on top of the LLVM/clang package set rather than
bundled into the llvm derivation, with passthru metadata
(`langFortran`, `isFlang`, `isClang`, `hardeningUnsupportedFlags`) so
cc-wrapper and downstream tooling can detect and adapt to it.

Driver compatibility patches backported from upstream are applied
selectively per LLVM version:

  * `use-xflang-in-diagnostics` is applied to LLVM 20 and newer; it
    teaches the driver to suggest `-Xflang` instead of `-Xclang` in
    error messages for options only available to `flang -fc1`.
  * `warn-on-fbuiltin-and-fno-builtin` and
    `accept-and-ignore-some-gfortran-optimization-flags` are applied
    to LLVM 20 and 21 only. LLVM 22 has equivalent behaviour merged
    upstream (`warn_drv_invalid_argument_for_flang` and
    `clang_ignored_gcc_optimization_f_Group` handling in
    clang/lib/Driver/ToolChains/Flang.cpp), so the patches are skipped
    there.

Patches live under pkgs/development/compilers/llvm/21/flang/ and are
shared across versions via patches.nix. They are applied to a private
libclang variant rather than the flang source tree because standalone
flang resolves driver/option definitions through the installed libclang
package.

Two focused passthru tests are added:

  * `compile-smoke` exercises basic compilation and `@response-file`
    handling.
  * `driver-flags` covers wrapper flag isolation
    (`NIX_CFLAGS_COMPILE` must not leak into flang;
    `NIX_FFLAGS_COMPILE` must reach it), the backported driver
    diagnostics, and regression coverage for previously hard-erroring
    flags.

Build on the earlier standalone flang work by @picostove.

Co-authored-by: stove <stove@rivosinc.com>
Co-authored-by: acture <acture@gmail.com>
Co-authored-by: Alyssa Ross <hi@alyssa.is>
---
 ...ore-some-gfortran-optimization-flags.patch |  49 ++++++++
 .../21/flang/use-xflang-in-diagnostics.patch  |  40 +++++++
 .../warn-on-fbuiltin-and-fno-builtin.patch    |  74 ++++++++++++
 .../compilers/llvm/common/default.nix         | 107 ++++++++++++++----
 .../compilers/llvm/common/flang/default.nix   |  50 +++++---
 .../llvm/common/flang/dummy_target_19+.patch  |   6 +-
 .../compilers/llvm/common/flang/tests.nix     |  92 +++++++++++++++
 .../compilers/llvm/common/patches.nix         |  20 ++++
 8 files changed, 398 insertions(+), 40 deletions(-)
 create mode 100644 pkgs/development/compilers/llvm/21/flang/accept-and-ignore-some-gfortran-optimization-flags.patch
 create mode 100644 pkgs/development/compilers/llvm/21/flang/use-xflang-in-diagnostics.patch
 create mode 100644 pkgs/development/compilers/llvm/21/flang/warn-on-fbuiltin-and-fno-builtin.patch
 create mode 100644 pkgs/development/compilers/llvm/common/flang/tests.nix

diff --git a/pkgs/development/compilers/llvm/21/flang/accept-and-ignore-some-gfortran-optimization-flags.patch b/pkgs/development/compilers/llvm/21/flang/accept-and-ignore-some-gfortran-optimization-flags.patch
new file mode 100644
index 000000000000..912be7169621
--- /dev/null
+++ b/pkgs/development/compilers/llvm/21/flang/accept-and-ignore-some-gfortran-optimization-flags.patch
@@ -0,0 +1,49 @@
+From da7174958be43d69b2ed6b581c8ac8a382b59180 Mon Sep 17 00:00:00 2001
+From: Tarun Prabhu <tarun.prabhu@gmail.com>
+Date: Tue, 28 Oct 2025 19:35:27 -0600
+Subject: [PATCH] [flang][Driver] Accept (and ignore) some gfortran-specific
+ options
+
+Enable the clang_ignored_gcc_optimization_f_group in flang. These options are
+accepted by clang, but ignored after emitting a warning message. flang's
+behavior now mirrors clang.
+
+Fixes #158436
+---
+ clang/include/clang/Driver/Options.td | 3 ++-
+ clang/lib/Driver/ToolChains/Flang.cpp | 8 ++++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/include/clang/Driver/Options.td b/include/clang/Driver/Options.td
+index ef1c8758705f4..cac122d296624 100644
+--- a/include/clang/Driver/Options.td
++++ b/include/clang/Driver/Options.td
+@@ -316,7 +316,8 @@ def mno_mpx : Flag<["-"], "mno-mpx">, Group<clang_ignored_legacy_options_Group>;
+ 
+ // Group that ignores all gcc optimizations that won't be implemented
+ def clang_ignored_gcc_optimization_f_Group : OptionGroup<
+-  "<clang_ignored_gcc_optimization_f_Group>">, Group<f_Group>, Flags<[Ignored]>;
++  "<clang_ignored_gcc_optimization_f_Group>">,
++  Group<f_Group>, Flags<[Ignored]>, Visibility<[ClangOption, FlangOption]>;
+ 
+ class DiagnosticOpts<string base>
+   : KeyPathAndMacro<"DiagnosticOpts->", base, "DIAG_"> {}
+diff --git a/lib/Driver/ToolChains/Flang.cpp b/lib/Driver/ToolChains/Flang.cpp
+index 88bce181d40d2..2f5e93d139858 100644
+--- a/lib/Driver/ToolChains/Flang.cpp
++++ b/lib/Driver/ToolChains/Flang.cpp
+@@ -858,6 +858,14 @@ void Flang::ConstructJob(Compilation &C, const JobAction &JA,
+     if (const Arg *A = Args.getLastArg(Opt))
+       D.Diag(diag::warn_drv_invalid_argument_for_flang) << A->getSpelling();
+ 
++  // Warn about options that are ignored by flang. These are options that are
++  // accepted by gfortran, but have no equivalent in flang.
++  for (const Arg *A :
++       Args.filtered(options::OPT_clang_ignored_gcc_optimization_f_Group)) {
++    D.Diag(diag::warn_ignored_gcc_optimization) << A->getAsString(Args);
++    A->claim();
++  }
++
+   const InputInfo &Input = Inputs[0];
+   types::ID InputType = Input.getType();
+ 
diff --git a/pkgs/development/compilers/llvm/21/flang/use-xflang-in-diagnostics.patch b/pkgs/development/compilers/llvm/21/flang/use-xflang-in-diagnostics.patch
new file mode 100644
index 000000000000..29af46eba798
--- /dev/null
+++ b/pkgs/development/compilers/llvm/21/flang/use-xflang-in-diagnostics.patch
@@ -0,0 +1,40 @@
+From 9ab9d33171ee35c948967a2a2d714b8059887607 Mon Sep 17 00:00:00 2001
+From: Tarun Prabhu <tarun@lanl.gov>
+Date: Wed, 29 Oct 2025 09:13:17 -0600
+Subject: [PATCH] [flang][driver] Use -Xflang in diagnostics
+
+When an option that is only available in `flang -fc1` is provided to
+`flang`, emit a diagnostic with a suggestion containing "did you mean
+-Xflang '-foo'".
+
+Partially addresses #163550.
+---
+ clang/lib/Driver/Driver.cpp | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/lib/Driver/Driver.cpp b/lib/Driver/Driver.cpp
+index 40ea513e85427..71c52807091ba 100644
+--- a/lib/Driver/Driver.cpp
++++ b/lib/Driver/Driver.cpp
+@@ -365,9 +365,18 @@
+     auto ArgString = A->getAsString(Args);
+     std::string Nearest;
+     if (getOpts().findNearest(ArgString, Nearest, VisibilityMask) > 1) {
+-      if (!IsCLMode() &&
+-          getOpts().findExact(ArgString, Nearest,
+-                              llvm::opt::Visibility(options::CC1Option))) {
++      if (IsFlangMode()) {
++        if (getOpts().findExact(ArgString, Nearest,
++                                llvm::opt::Visibility(options::FC1Option))) {
++          DiagID = diag::err_drv_unknown_argument_with_suggestion;
++          Diags.Report(DiagID) << ArgString << "-Xflang " + Nearest;
++        } else {
++          DiagID = diag::err_drv_unknown_argument;
++          Diags.Report(DiagID) << ArgString;
++        }
++      } else if (!IsCLMode() && getOpts().findExact(ArgString, Nearest,
++                                                    llvm::opt::Visibility(
++                                                        options::CC1Option))) {
+         DiagID = diag::err_drv_unknown_argument_with_suggestion;
+         Diags.Report(DiagID) << ArgString << "-Xclang " + Nearest;
+       } else {
diff --git a/pkgs/development/compilers/llvm/21/flang/warn-on-fbuiltin-and-fno-builtin.patch b/pkgs/development/compilers/llvm/21/flang/warn-on-fbuiltin-and-fno-builtin.patch
new file mode 100644
index 000000000000..ee2cb99b57a5
--- /dev/null
+++ b/pkgs/development/compilers/llvm/21/flang/warn-on-fbuiltin-and-fno-builtin.patch
@@ -0,0 +1,74 @@
+From 263377a175709c2d11f3ff63c2d2d2843afb91ea Mon Sep 17 00:00:00 2001
+From: Tarun Prabhu <tarun@lanl.gov>
+Date: Thu, 23 Oct 2025 13:24:20 -0600
+Subject: [PATCH] [flang][Driver] Warn on -fbuiltin and -fno-builtin
+
+The options -fbuiltin and -fno-builtin are not valid for Fortran. However,
+they are accepted by gfortran which emits a warning message but continues to
+compile the code. Both -fbuiltin and -fno-builtin have been enabled for flang.
+Specifying either will result in a warning message being shown but no other
+effects. Compilation will proceed normally after these warnings are shown. This
+brings flang's behavior in line with gfortran for these options.
+
+Fixes #164766
+---
+ clang/include/clang/Basic/DiagnosticDriverKinds.td |  3 +++
+ clang/include/clang/Driver/Options.td              |  4 ++--
+ clang/lib/Driver/ToolChains/Flang.cpp              |  7 +++++++
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/include/clang/Basic/DiagnosticDriverKinds.td b/include/clang/Basic/DiagnosticDriverKinds.td
+index 0581bf353d936..83980e3ac35b7 100644
+--- a/include/clang/Basic/DiagnosticDriverKinds.td
++++ b/include/clang/Basic/DiagnosticDriverKinds.td
+@@ -131,6 +131,9 @@ def warn_drv_unsupported_option_for_offload_arch_req_feature : Warning<
+ def warn_drv_unsupported_option_for_target : Warning<
+   "ignoring '%0' option as it is not currently supported for target '%1'">,
+   InGroup<OptionIgnored>;
++def warn_drv_invalid_argument_for_flang : Warning<
++  "'%0' is not valid for Fortran">,
++  InGroup<OptionIgnored>;
+ def warn_drv_unsupported_option_for_flang : Warning<
+   "the argument '%0' is not supported for option '%1'. Mapping to '%1%2'">,
+   InGroup<OptionIgnored>;
+diff --git a/include/clang/Driver/Options.td b/include/clang/Driver/Options.td
+index ef1c8758705f4..bca8b26bc3d30 100644
+--- a/include/clang/Driver/Options.td
++++ b/include/clang/Driver/Options.td
+@@ -1940,7 +1940,7 @@ defm borland_extensions : BoolFOption<"borland-extensions",
+           "Accept non-standard constructs supported by the Borland compiler">,
+   NegFlag<SetFalse>>;
+ def fbuiltin : Flag<["-"], "fbuiltin">, Group<f_Group>,
+-  Visibility<[ClangOption, CLOption, DXCOption]>;
++  Visibility<[ClangOption, CLOption, DXCOption, FlangOption, FC1Option]>;
+ def fbuiltin_module_map : Flag <["-"], "fbuiltin-module-map">, Group<f_Group>,
+   Flags<[]>, HelpText<"Load the clang builtins module map file.">;
+ defm caret_diagnostics : BoolFOption<"caret-diagnostics",
+@@ -3493,7 +3493,7 @@ def fno_assume_sane_operator_new : Flag<["-"], "fno-assume-sane-operator-new">,
+   HelpText<"Don't assume that C++'s global operator new can't alias any pointer">,
+   Visibility<[ClangOption, CC1Option]>,
+   MarshallingInfoNegativeFlag<CodeGenOpts<"AssumeSaneOperatorNew">>;
+ def fno_builtin : Flag<["-"], "fno-builtin">, Group<f_Group>,
+-  Visibility<[ClangOption, CC1Option, CLOption, DXCOption]>,
++  Visibility<[ClangOption, CC1Option, CLOption, DXCOption, FlangOption, FC1Option]>,
+   HelpText<"Disable implicit builtin knowledge of functions">;
+ def fno_builtin_ : Joined<["-"], "fno-builtin-">, Group<f_Group>,
+   Visibility<[ClangOption, CC1Option, CLOption, DXCOption]>,
+diff --git a/lib/Driver/ToolChains/Flang.cpp b/lib/Driver/ToolChains/Flang.cpp
+index a56fa41c49d34..88bce181d40d2 100644
+--- a/lib/Driver/ToolChains/Flang.cpp
++++ b/lib/Driver/ToolChains/Flang.cpp
+@@ -851,6 +851,13 @@ void Flang::ConstructJob(Compilation &C, const JobAction &JA,
+     assert(false && "Unexpected action class for Flang tool.");
+   }
+ 
++  // We support some options that are invalid for Fortran and have no effect.
++  // These are solely for compatibility with other compilers. Emit a warning if
++  // any such options are provided, then proceed normally.
++  for (options::ID Opt : {options::OPT_fbuiltin, options::OPT_fno_builtin})
++    if (const Arg *A = Args.getLastArg(Opt))
++      D.Diag(diag::warn_drv_invalid_argument_for_flang) << A->getSpelling();
++
+   const InputInfo &Input = Inputs[0];
+   types::ID InputType = Input.getType();
+ 
diff --git a/pkgs/development/compilers/llvm/common/default.nix b/pkgs/development/compilers/llvm/common/default.nix
index 2a88fecc0b6e..54f579695a12 100644
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@@ -476,28 +476,93 @@ makeScopeWithSplicing' {
     // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "19") {
       bolt = callPackage ./bolt { };
     }
-    // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "20") {
-      flang = callPackage ./flang { };
+    // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "20") (
+      let
+        # Standalone flang still resolves driver/option definitions via the
+        # installed libclang package, so keep flang-specific driver backports
+        # in a private libclang variant instead of patching the flang source
+        # tree. The `-Xflang` diagnostic improvement applies to every
+        # supported standalone-flang version (20+); the other two backports
+        # are only needed up to LLVM 21 because upstream merged equivalent
+        # behaviour into LLVM 22.
+        flangDriverPatches =
+          lib.optionals (lib.versionAtLeast metadata.release_version "20") [
+            (metadata.getVersionFile "flang/use-xflang-in-diagnostics.patch")
+          ]
+          ++
+            lib.optionals
+              (lib.versionAtLeast metadata.release_version "20" && lib.versionOlder metadata.release_version "22")
+              [
+                (metadata.getVersionFile "flang/warn-on-fbuiltin-and-fno-builtin.patch")
+                (metadata.getVersionFile "flang/accept-and-ignore-some-gfortran-optimization-flags.patch")
+              ];
+        flangLibclang =
+          if flangDriverPatches == [ ] then
+            self.libclang
+          else
+            self.libclang.override {
+              extraPatches = flangDriverPatches;
+            };
+        flangUnwrapped = callPackage ./flang {
+          libclang = flangLibclang;
+        };
+        flangRt = callPackage ./flang-rt {
+          buildFlang = buildLlvmPackages.flang-unwrapped;
+        };
+      in
+      {
+        flang-unwrapped = flangUnwrapped;
+        flang-rt = flangRt;
+        flang =
+          let
+            wrapped = wrapCCWith rec {
+              cc = flangUnwrapped;
+              bintools = bintools';
+              extraPackages = [ targetLlvmPackages.flang-rt ];
+              extraBuildCommands = mkExtraBuildCommands0 cc + ''
+                # triplet however is not used in darwin
+                PLATFORM_DIR="${if stdenv.targetPlatform.isDarwin then "darwin" else stdenv.targetPlatform.config}"
+                RT_LIB_PATH="${targetLlvmPackages.flang-rt}/lib/clang/${clangVersion}/lib/$PLATFORM_DIR"
+                if [ -d "$RT_LIB_PATH" ]; then
+                  ln -s "$RT_LIB_PATH" "$rsrc"/lib
+                  echo "-L$rsrc/lib" >> $out/nix-support/cc-ldflags
+                else
+                  ln -s "${targetLlvmPackages.flang-rt}/lib" "$rsrc"/lib
+                  echo "-L$rsrc/lib" >> $out/nix-support/cc-ldflags
+                fi
+              '';
+            };
+            tests = callPackage ./flang/tests.nix {
+              flang = wrapped;
+            };
+          in
+          wrapped
+          // {
+            passthru = (wrapped.passthru or { }) // {
+              inherit tests;
+            };
+          };
 
-      libc-overlay = callPackage ./libc {
-        isFullBuild = false;
-        # Use clang due to "gnu::naked" not working on aarch64.
-        # Issue: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77882
-        stdenv = overrideCC stdenv buildLlvmPackages.clang;
-      };
+        libc-overlay = callPackage ./libc {
+          isFullBuild = false;
+          # Use clang due to "gnu::naked" not working on aarch64.
+          # Issue: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77882
+          stdenv = overrideCC stdenv buildLlvmPackages.clang;
+        };
 
-      libc-full = callPackage ./libc {
-        isFullBuild = true;
-        # Use clang due to "gnu::naked" not working on aarch64.
-        # Issue: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77882
-        stdenv = overrideCC stdenv buildLlvmPackages.clangNoLibcNoRt;
-        # FIXME: This should almost certainly be `stdenv.hostPlatform`.
-        cmake = if stdenv.targetPlatform.libc == "llvm" then cmakeMinimal else cmake;
-        python3 = if stdenv.targetPlatform.libc == "llvm" then python3Minimal else python3;
-      };
+        libc-full = callPackage ./libc {
+          isFullBuild = true;
+          # Use clang due to "gnu::naked" not working on aarch64.
+          # Issue: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77882
+          stdenv = overrideCC stdenv buildLlvmPackages.clangNoLibcNoRt;
+          # FIXME: This should almost certainly be `stdenv.hostPlatform`.
+          cmake = if stdenv.targetPlatform.libc == "llvm" then cmakeMinimal else cmake;
+          python3 = if stdenv.targetPlatform.libc == "llvm" then python3Minimal else python3;
+        };
 
-      libc =
-        # FIXME: This should almost certainly be `stdenv.hostPlatform`.
-        if stdenv.targetPlatform.libc == "llvm" then self.libc-full else self.libc-overlay;
-    };
+        libc =
+          # FIXME: This should almost certainly be `stdenv.hostPlatform`.
+          if stdenv.targetPlatform.libc == "llvm" then self.libc-full else self.libc-overlay;
+      }
+    );
 }
diff --git a/pkgs/development/compilers/llvm/common/flang/default.nix b/pkgs/development/compilers/llvm/common/flang/default.nix
index 335633d7d19c..0cd94ab4b4b9 100644
--- a/pkgs/development/compilers/llvm/common/flang/default.nix
+++ b/pkgs/development/compilers/llvm/common/flang/default.nix
@@ -23,21 +23,27 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "flang";
   inherit version;
 
-  src = runCommand "flang-src-${version}" { inherit (monorepoSrc) passthru; } ''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/${finalAttrs.pname} "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/llvm "$out"
-    cp -r ${monorepoSrc}/clang "$out"
-    cp -r ${monorepoSrc}/mlir "$out"
-    cp -r ${monorepoSrc}/third-party "$out"
-    chmod -R +w $out/llvm
-  '';
+  src =
+    runCommand "${finalAttrs.pname}-src-${finalAttrs.version}"
+      {
+        inherit (monorepoSrc) passthru;
+      }
+      ''
+        mkdir -p "$out"
+        cp -r ${monorepoSrc}/${finalAttrs.pname} "$out"
+        cp -r ${monorepoSrc}/cmake "$out"
+        cp -r ${monorepoSrc}/llvm "$out"
+        cp -r ${monorepoSrc}/clang "$out"
+        cp -r ${monorepoSrc}/mlir "$out"
+        cp -r ${monorepoSrc}/third-party "$out"
+        cp -r ${monorepoSrc}/flang-rt "$out"
+        chmod -R +w $out/llvm
+      '';
 
   patches = [
     ./dummy_target_19+.patch
   ];
-  patchFlags = [ "-p2" ];
+  patchFlags = [ "-p1" ];
 
   sourceRoot = "${finalAttrs.src.name}/flang";
 
@@ -62,24 +68,36 @@ stdenv.mkDerivation (finalAttrs: {
     ls -l ${mlir.dev}/lib/cmake/mlir/MLIRConfig.cmake
   '';
   cmakeFlags = [
-    (lib.cmakeBool "CMAKE_VERBOSE_MAKEFILE" true)
     (lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm")
-    # TODO: Needs patches and the `lit` package like other LLVM builds?
     (lib.cmakeFeature "LLVM_TOOLS_BINARY_DIR" "${buildLlvmPackages.tblgen}/bin/")
-    (lib.cmakeFeature "LLVM_EXTERNAL_LIT" "${buildLlvmPackages.tblgen}/bin/llvm-lit")
     (lib.cmakeFeature "CLANG_DIR" "${libclang.dev}/lib/cmake/clang")
     (lib.cmakeFeature "MLIR_DIR" "${mlir.dev}/lib/cmake/mlir")
     (lib.cmakeFeature "MLIR_TABLEGEN_EXE" "${buildLlvmPackages.tblgen}/bin/mlir-tblgen")
     (lib.cmakeFeature "MLIR_TABLEGEN_TARGET" "MLIR-TBLGen")
-    (lib.cmakeBool "LLVM_BUILD_EXAMPLES" false)
+    (lib.cmakeBool "MLIR_LINK_MLIR_DYLIB" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeFeature "LLVM_LIT_ARGS" "-v")
     (lib.cmakeBool "LLVM_ENABLE_PLUGINS" false)
     (lib.cmakeBool "FLANG_STANDALONE_BUILD" true)
     (lib.cmakeBool "LLVM_INCLUDE_EXAMPLES" false)
     (lib.cmakeBool "FLANG_INCLUDE_TESTS" false)
-
   ]
   ++ devExtraCmakeFlags;
 
+  passthru = {
+    # Used by cc-wrapper to determine whether or not the default setup hook is enabled.
+    langC = false;
+    langCC = false;
+    langFortran = true;
+    isClang = true;
+    isFlang = true;
+
+    hardeningUnsupportedFlags = [
+      "zerocallusedregs"
+      "stackprotector"
+      "stackclashprotection"
+    ];
+  };
+
   postUnpack = ''
     chmod -R u+w -- $sourceRoot/..
   '';
diff --git a/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch b/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
index ab09ef650416..a6f295ef50b3 100644
--- a/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
+++ b/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
@@ -1,7 +1,7 @@
-diff --git a/flang/CMakeLists.txt b/flang/CMakeLists.txt
+diff --git a/CMakeLists.txt b/CMakeLists.txt
 index 070c39eb6e9a..168c97524943 100644
---- a/flang/CMakeLists.txt
-+++ b/flang/CMakeLists.txt
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
 @@ -1,6 +1,22 @@
  cmake_minimum_required(VERSION 3.20.0)
  set(LLVM_SUBPROJECT_TITLE "Flang")
diff --git a/pkgs/development/compilers/llvm/common/flang/tests.nix b/pkgs/development/compilers/llvm/common/flang/tests.nix
new file mode 100644
index 000000000000..4c195b9b27ff
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/flang/tests.nix
@@ -0,0 +1,92 @@
+{
+  runCommand,
+  flang,
+}:
+let
+  flangExe = "${flang}/bin/flang";
+  writeHello = ''
+    cat > hello.f90 <<'EOF'
+    program hello
+    end program hello
+    EOF
+  '';
+in
+{
+  compile-smoke = runCommand "flang-compile-smoke" { } ''
+    set -euo pipefail
+
+    ${writeHello}
+
+    ${flangExe} -c hello.f90 -o compile.o
+    [ -f compile.o ]
+
+    cat > args.rsp <<'EOF'
+    -c
+    hello.f90
+    -o
+    response.o
+    EOF
+
+    ${flangExe} @args.rsp
+    [ -f response.o ]
+
+    touch $out
+  '';
+
+  driver-flags = runCommand "flang-driver-flags" { } ''
+    set -euo pipefail
+
+    ${writeHello}
+
+    ${flangExe} -### -c hello.f90 > no-seed.log 2>&1
+    if grep -F -- "-frandom-seed=" no-seed.log; then
+      echo "wrapper unexpectedly injected -frandom-seed" >&2
+      exit 1
+    fi
+
+    # Confirm that user-supplied NIX_CFLAGS_COMPILE does not leak into the
+    # Fortran wrapper invocation: the wrapper must source flags from
+    # NIX_FFLAGS_COMPILE only, so a marker placed in NIX_CFLAGS_COMPILE
+    # must not appear in the resulting flang command line.
+    NIX_CFLAGS_COMPILE="-Icflags-leak-marker-include" \
+      ${flangExe} -### -c hello.f90 > cflags-isolation.log 2>&1
+    if grep -F -- "cflags-leak-marker-include" cflags-isolation.log; then
+      echo "NIX_CFLAGS_COMPILE leaked into the flang wrapper" >&2
+      exit 1
+    fi
+
+    # Confirm that NIX_FFLAGS_COMPILE is the user-facing channel for
+    # Fortran flags and flows through to the driver.
+    NIX_FFLAGS_COMPILE="-Iffflags-marker-include" \
+      ${flangExe} -### -c hello.f90 > fflags-passthrough.log 2>&1
+    grep -F -- "ffflags-marker-include" fflags-passthrough.log
+
+    ${flangExe} -### -fbuiltin -fno-builtin hello.f90 > builtin.log 2>&1
+    grep -F -- "warning: '-fbuiltin' is not valid for Fortran" builtin.log
+    grep -F -- "warning: '-fno-builtin' is not valid for Fortran" builtin.log
+    if grep -F -- "error: unknown argument" builtin.log; then
+      echo "builtin compatibility flags unexpectedly failed" >&2
+      exit 1
+    fi
+
+    ${flangExe} -### -fexpensive-optimizations hello.f90 > ignored-flag.log 2>&1
+    grep -F -- "optimization flag '-fexpensive-optimizations' is not supported" ignored-flag.log
+    if grep -F -- "error: unknown argument" ignored-flag.log; then
+      echo "ignored gfortran-style flag unexpectedly failed" >&2
+      exit 1
+    fi
+
+    if ${flangExe} -### -complex-range=full hello.f90 > suggestion.log 2>&1; then
+      echo "expected -complex-range=full to fail at the driver layer" >&2
+      exit 1
+    fi
+    grep -F -- "error: unknown argument '-complex-range=full'" suggestion.log
+    grep -F -- "did you mean '-Xflang -complex-range=full'" suggestion.log
+    if grep -F -- "-Xclang -complex-range=full" suggestion.log; then
+      echo "driver suggested -Xclang instead of -Xflang" >&2
+      exit 1
+    fi
+
+    touch $out
+  '';
+}
diff --git a/pkgs/development/compilers/llvm/common/patches.nix b/pkgs/development/compilers/llvm/common/patches.nix
index 30fa0411956a..7a780175c8cc 100644
--- a/pkgs/development/compilers/llvm/common/patches.nix
+++ b/pkgs/development/compilers/llvm/common/patches.nix
@@ -138,4 +138,24 @@
       path = ../19;
     }
   ];
+  "flang/warn-on-fbuiltin-and-fno-builtin.patch" = [
+    {
+      after = "20";
+      before = "22";
+      path = ../21;
+    }
+  ];
+  "flang/accept-and-ignore-some-gfortran-optimization-flags.patch" = [
+    {
+      after = "20";
+      before = "22";
+      path = ../21;
+    }
+  ];
+  "flang/use-xflang-in-diagnostics.patch" = [
+    {
+      after = "20";
+      path = ../21;
+    }
+  ];
 }

From 7e8258d3af32103093ec90a6f9b4ae191f4fd5b0 Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Wed, 1 Apr 2026 16:51:38 +0800
Subject: [PATCH 0059/1209] llvm/mlir: fix MLIRConfig.cmake to support external
 tablegen overrides

MLIRConfig.cmake unconditionally overwrites MLIR_TABLEGEN_EXE and does
not create an imported target, breaking standalone builds that provide
their own mlir-tblgen binary (e.g. Nix sandboxed builds).

The patch adds guards to respect caller-set MLIR_TABLEGEN_EXE,
MLIR_PDLL_TABLEGEN_EXE, and MLIR_SRC_SHARDER_TABLEGEN_EXE values, and
auto-creates an imported mlir-tblgen target for downstream consumers.
This replaces the previous dummy-target workaround in flang's
CMakeLists.txt.

Upstream issue: https://github.com/llvm/llvm-project/issues/150986

Co-authored-by: Alexander Bantyev <balsoft@balsoft.ru>
---
 .../compilers/llvm/common/flang/default.nix   |  5 +-
 .../llvm/common/flang/dummy_target_19+.patch  | 27 ----------
 .../compilers/llvm/common/mlir/default.nix    |  8 +++
 .../mlir/mlir-tablegen-imported-target.patch  | 54 +++++++++++++++++++
 4 files changed, 63 insertions(+), 31 deletions(-)
 delete mode 100644 pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
 create mode 100644 pkgs/development/compilers/llvm/common/mlir/mlir-tablegen-imported-target.patch

diff --git a/pkgs/development/compilers/llvm/common/flang/default.nix b/pkgs/development/compilers/llvm/common/flang/default.nix
index 0cd94ab4b4b9..5ddb77d74b2e 100644
--- a/pkgs/development/compilers/llvm/common/flang/default.nix
+++ b/pkgs/development/compilers/llvm/common/flang/default.nix
@@ -40,9 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
         chmod -R +w $out/llvm
       '';
 
-  patches = [
-    ./dummy_target_19+.patch
-  ];
+  patches = [ ];
   patchFlags = [ "-p1" ];
 
   sourceRoot = "${finalAttrs.src.name}/flang";
@@ -73,7 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CLANG_DIR" "${libclang.dev}/lib/cmake/clang")
     (lib.cmakeFeature "MLIR_DIR" "${mlir.dev}/lib/cmake/mlir")
     (lib.cmakeFeature "MLIR_TABLEGEN_EXE" "${buildLlvmPackages.tblgen}/bin/mlir-tblgen")
-    (lib.cmakeFeature "MLIR_TABLEGEN_TARGET" "MLIR-TBLGen")
     (lib.cmakeBool "MLIR_LINK_MLIR_DYLIB" (!stdenv.hostPlatform.isStatic))
     (lib.cmakeFeature "LLVM_LIT_ARGS" "-v")
     (lib.cmakeBool "LLVM_ENABLE_PLUGINS" false)
diff --git a/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch b/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
deleted file mode 100644
index a6f295ef50b3..000000000000
--- a/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 070c39eb6e9a..168c97524943 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1,6 +1,22 @@
- cmake_minimum_required(VERSION 3.20.0)
- set(LLVM_SUBPROJECT_TITLE "Flang")
- 
-+# Patch: define dummy mlir-tblgen target for TableGen.cmake
-+if(DEFINED MLIR_TABLEGEN_EXE AND NOT TARGET mlir-tblgen)
-+  add_executable(mlir-tblgen IMPORTED GLOBAL)
-+  set_target_properties(mlir-tblgen PROPERTIES
-+    IMPORTED_LOCATION "${MLIR_TABLEGEN_EXE}"
-+  )
-+endif()
-+
-+if(DEFINED MLIR_TABLEGEN_EXE AND NOT TARGET MLIR-TBLGen)
-+  add_executable(MLIR-TBLGen IMPORTED GLOBAL)
-+  set_target_properties(MLIR-TBLGen PROPERTIES
-+    IMPORTED_LOCATION "${MLIR_TABLEGEN_EXE}"
-+  )
-+endif()
-+
-+
- if(NOT DEFINED LLVM_COMMON_CMAKE_UTILS)
-   set(LLVM_COMMON_CMAKE_UTILS ${CMAKE_CURRENT_SOURCE_DIR}/../cmake)
- endif()
diff --git a/pkgs/development/compilers/llvm/common/mlir/default.nix b/pkgs/development/compilers/llvm/common/mlir/default.nix
index c68f6a9b0b68..40bfddc38ee2 100644
--- a/pkgs/development/compilers/llvm/common/mlir/default.nix
+++ b/pkgs/development/compilers/llvm/common/mlir/default.nix
@@ -39,6 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./gnu-install-dirs.patch
+    # MLIRConfig.cmake unconditionally overwrites MLIR_TABLEGEN_EXE, breaking standalone
+    # builds that provide their own pre-built mlir-tblgen (e.g. in Nix sandboxed builds).
+    # The patch adds guards to respect caller-set values and auto-creates an imported
+    # mlir-tblgen target for downstream consumers. This replaces the previous dummy target
+    # workaround in flang's CMakeLists.txt.
+
+    # Upstream issue: https://github.com/llvm/llvm-project/issues/150986
+    ./mlir-tablegen-imported-target.patch
   ]
   ++ lib.optional (lib.versionOlder release_version "20") [
     # Fix build with gcc15
diff --git a/pkgs/development/compilers/llvm/common/mlir/mlir-tablegen-imported-target.patch b/pkgs/development/compilers/llvm/common/mlir/mlir-tablegen-imported-target.patch
new file mode 100644
index 000000000000..a173341168d2
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/mlir/mlir-tablegen-imported-target.patch
@@ -0,0 +1,54 @@
+diff --git a/cmake/modules/MLIRConfig.cmake.in b/cmake/modules/MLIRConfig.cmake.in
+index 71f3e028b1e8..b30b6cdc0de1 100644
+--- a/cmake/modules/MLIRConfig.cmake.in
++++ b/cmake/modules/MLIRConfig.cmake.in
+@@ -9,9 +9,16 @@ find_package(LLVM ${LLVM_VERSION} EXACT REQUIRED CONFIG
+ set(MLIR_EXPORTED_TARGETS "@MLIR_EXPORTS@")
+ set(MLIR_CMAKE_DIR "@MLIR_CONFIG_CMAKE_DIR@")
+ set(MLIR_INCLUDE_DIRS "@MLIR_CONFIG_INCLUDE_DIRS@")
+-set(MLIR_TABLEGEN_EXE "@MLIR_CONFIG_TABLEGEN_EXE@")
+-set(MLIR_PDLL_TABLEGEN_EXE "@MLIR_CONFIG_PDLL_TABLEGEN_EXE@")
+-set(MLIR_SRC_SHARDER_TABLEGEN_EXE "@MLIR_CONFIG_SRC_SHARDER_TABLEGEN_EXE@")
++# Allow users to override tablegen executables (e.g. for sandboxed builds).
++if(NOT MLIR_TABLEGEN_EXE)
++  set(MLIR_TABLEGEN_EXE "@MLIR_CONFIG_TABLEGEN_EXE@")
++endif()
++if(NOT MLIR_PDLL_TABLEGEN_EXE)
++  set(MLIR_PDLL_TABLEGEN_EXE "@MLIR_CONFIG_PDLL_TABLEGEN_EXE@")
++endif()
++if(NOT MLIR_SRC_SHARDER_TABLEGEN_EXE)
++  set(MLIR_SRC_SHARDER_TABLEGEN_EXE "@MLIR_CONFIG_SRC_SHARDER_TABLEGEN_EXE@")
++endif()
+ set(MLIR_IRDL_TO_CPP_EXE "@MLIR_CONFIG_IRDL_TO_CPP_EXE@")
+ set(MLIR_INSTALL_AGGREGATE_OBJECTS "@MLIR_INSTALL_AGGREGATE_OBJECTS@")
+ set(MLIR_ENABLE_BINDINGS_PYTHON "@MLIR_ENABLE_BINDINGS_PYTHON@")
+@@ -32,6 +39,29 @@ if(NOT TARGET MLIRSupport)
+   @MLIR_CONFIG_INCLUDE_EXPORTS@
+ endif()
+
++# Ensure MLIR_TABLEGEN_EXE is a full path and has a corresponding imported
++# target. In install trees, MLIR_TABLEGEN_EXE may be a bare name
++# ("mlir-tblgen") rather than an absolute path. Resolve it so that
++# TableGen.cmake can use it as both a COMMAND and a DEPENDS entry.
++if(MLIR_TABLEGEN_EXE AND NOT IS_ABSOLUTE "${MLIR_TABLEGEN_EXE}"
++    AND NOT TARGET "${MLIR_TABLEGEN_EXE}")
++  find_program(_mlir_tblgen_exe "${MLIR_TABLEGEN_EXE}"
++    HINTS "${LLVM_TOOLS_BINARY_DIR}")
++  if(_mlir_tblgen_exe)
++    set(MLIR_TABLEGEN_EXE "${_mlir_tblgen_exe}")
++  endif()
++  unset(_mlir_tblgen_exe)
++endif()
++
++if(NOT TARGET mlir-tblgen AND MLIR_TABLEGEN_EXE)
++  add_executable(mlir-tblgen IMPORTED GLOBAL)
++  set_target_properties(mlir-tblgen PROPERTIES
++    IMPORTED_LOCATION "${MLIR_TABLEGEN_EXE}")
++endif()
++if(NOT DEFINED MLIR_TABLEGEN_TARGET)
++  set(MLIR_TABLEGEN_TARGET mlir-tblgen)
++endif()
++
+ # By creating these targets here, subprojects that depend on MLIR's
+ # tablegen-generated headers can always depend on these targets whether building
+ # in-tree with MLIR or not.

From 09bb0b6ec4d020e2e1ca78b03af7ebd67385e309 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 5 May 2026 12:31:09 +0000
Subject: [PATCH 0060/1209] yara: 4.5.5 -> 4.5.6

---
 pkgs/by-name/ya/yara/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ya/yara/package.nix b/pkgs/by-name/ya/yara/package.nix
index 317575a66bfc..905561b69435 100644
--- a/pkgs/by-name/ya/yara/package.nix
+++ b/pkgs/by-name/ya/yara/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yara";
-  version = "4.5.5";
+  version = "4.5.6";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a+oLxVJgdDrnOra85PPo8ZlFhinawWHuRtVE39S8yJk=";
+    hash = "sha256-G1f0o7wsds4Mz4Whz35JdSKIkPIqea5Fe5rB8vMdkZU=";
   };
 
   nativeBuildInputs = [

From 6bfe46da49c97390f2a81d3fd2bdc2281fae2af7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 5 May 2026 14:24:03 +0000
Subject: [PATCH 0061/1209] hwdata: 0.406 -> 0.407

---
 pkgs/by-name/hw/hwdata/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index 0678443277a9..9624dc7a05c6 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.406";
+  version = "0.407";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6GXXkDzunbtea+MmmWV2gpHgCgdGi75U+TV9H/6Emtk=";
+    hash = "sha256-JrEUmXH1/fua6EJjHHwny19QS0HvYGRPelKF0UroDhc=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)

From 99cda4d5c7e6f7b427dea344b91f3207e5e6e11d Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Thu, 24 Jul 2025 19:58:56 +0200
Subject: [PATCH 0062/1209] hotdoc: use callPackage, refactor clang usage

---
 pkgs/development/tools/hotdoc/clang.patch | 96 ++++++++++++++---------
 pkgs/development/tools/hotdoc/default.nix | 58 +++-----------
 pkgs/top-level/all-packages.nix           |  2 +-
 3 files changed, 74 insertions(+), 82 deletions(-)

diff --git a/pkgs/development/tools/hotdoc/clang.patch b/pkgs/development/tools/hotdoc/clang.patch
index 53334206b7d5..cf5c10fca3d4 100644
--- a/pkgs/development/tools/hotdoc/clang.patch
+++ b/pkgs/development/tools/hotdoc/clang.patch
@@ -1,8 +1,32 @@
 diff --git a/hotdoc/extensions/c/c_extension.py b/hotdoc/extensions/c/c_extension.py
-index 1cfd5b3..cff20c8 100644
+index 1cfd5b3..1e1926f 100644
 --- a/hotdoc/extensions/c/c_extension.py
 +++ b/hotdoc/extensions/c/c_extension.py
-@@ -89,7 +89,7 @@ def get_clang_headers():
+@@ -44,14 +44,6 @@ from hotdoc.utils.loggable import (info as core_info, warn, Logger,
+                                    debug as core_debug)
+ 
+ 
+-LLVM_CONFIG = os.environ.get("LLVM_CONFIG")
+-if LLVM_CONFIG is None:
+-    LLVM_CONFIG = shutil.which('llvm-config')
+-
+-if LLVM_CONFIG is None:
+-    raise ImportError()
+-
+-
+ def ast_node_is_function_pointer(ast_node):
+     if ast_node.kind == cindex.TypeKind.POINTER and \
+             ast_node.get_pointee().get_result().kind != \
+@@ -80,42 +72,26 @@ Logger.register_warning_code('clang-headers-not-found', HotdocException,
+                              'c-extension')
+ 
+ 
+-CLANG_HEADERS_WARNING = (
+-    'Did not find clang headers. Please report a bug with the output of the'
+-    '\'llvm-config --version\' and \'llvm-config --prefix\' commands')
+-
+-
+ def get_clang_headers():
      try:
          # Clang 5.0+ can tell us directly
          resource_dir = subprocess.check_output(
@@ -11,42 +35,44 @@ index 1cfd5b3..cff20c8 100644
          if len(resource_dir) > 0:
              include_dir = os.path.join(resource_dir, 'include')
              if os.path.exists(include_dir):
+                 return include_dir
+     except subprocess.CalledProcessError:
+         pass
+-    version = subprocess.check_output(
+-        [LLVM_CONFIG, '--version']).strip().decode()
+-    prefix = subprocess.check_output(
+-        [LLVM_CONFIG, '--prefix']).strip().decode()
+-    versions = (version, version.split('.').pop(0))
+-    for (ver, lib) in itertools.product(
+-            versions,
+-            ['lib', 'lib64']):
+-        p = os.path.join(prefix, lib, 'clang', ver, 'include')
+-        if os.path.exists(p):
+-            return p
+ 
+-    warn('clang-headers-not-found', CLANG_HEADERS_WARNING)
++    warn('clang-headers-not-found', 'Did not find clang headers. Make sure you\'re using Clang 5.0+')
+ 
+ 
+ CLANG_HEADERS = get_clang_headers()
+ 
+ 
+ def get_clang_libdir():
+-    return subprocess.check_output([LLVM_CONFIG, '--libdir']).strip().decode()
++    return '@libclang_lib_dir@'
+ 
+ 
+ class ClangScanner(object):
 diff --git a/hotdoc/extensions/c/clang/cindex.py b/hotdoc/extensions/c/clang/cindex.py
-index fc93fda..2eb8eaf 100644
+index fc93fda..0a16651 100644
 --- a/hotdoc/extensions/c/clang/cindex.py
 +++ b/hotdoc/extensions/c/clang/cindex.py
-@@ -3937,20 +3937,23 @@ class Config:
-         if Config.library_file:
-             return Config.library_file
+@@ -3949,6 +3949,8 @@ class Config:
  
--        import platform
--        name = platform.system()
-+        if Config.library_path:
-+            import platform
-+            name = platform.system()
+         if Config.library_path:
+             file = Config.library_path + '/' + file
++        else:
++            file = "@libclang_lib_dir@" + '/' + file
  
--        if name == 'Darwin':
--            file = 'libclang.dylib'
--        elif name == 'Windows':
--            file = 'libclang.dll'
--        else:
--            file = 'libclang.so'
-+            if name == 'Darwin':
-+                file = 'libclang.dylib'
-+            elif name == 'Windows':
-+                file = 'libclang.dll'
-+            else:
-+                file = 'libclang.so'
+         return file
  
--        if Config.library_path:
--            file = Config.library_path + '/' + file
-+            if Config.library_path:
-+                file = Config.library_path + '/' + file
-+
-+            return file
- 
--        return file
-+        return "@libclang@"
- 
-     def get_cindex_library(self):
-         try:
diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/development/tools/hotdoc/default.nix
index 64f7538ca37b..47862db4d978 100644
--- a/pkgs/development/tools/hotdoc/default.nix
+++ b/pkgs/development/tools/hotdoc/default.nix
@@ -1,37 +1,21 @@
 {
   lib,
   stdenv,
-  buildPythonApplication,
+  python3Packages,
   fetchpatch,
   fetchPypi,
   replaceVars,
-  clang,
-  libclang,
-  pytestCheckHook,
   pkg-config,
   cmake,
   flex,
   glib,
   json-glib,
   libxml2,
-  appdirs,
-  backports-entry-points-selectable,
-  dbus-deviation,
-  faust-cchardet,
-  feedgen,
-  lxml,
-  networkx,
-  pkgconfig,
-  pyyaml,
-  schema,
-  setuptools,
-  toposort,
-  wheezy-template,
   llvmPackages,
   gst_all_1,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "hotdoc";
   version = "0.17.4";
   pyproject = true;
@@ -43,8 +27,8 @@ buildPythonApplication rec {
 
   patches = [
     (replaceVars ./clang.patch {
-      clang = lib.getExe clang;
-      libclang = "${lib.getLib libclang}/lib/libclang${stdenv.hostPlatform.extensions.sharedLibrary}";
+      clang = lib.getExe llvmPackages.clang;
+      libclang_lib_dir = "${lib.getLib llvmPackages.libclang}/lib";
     })
 
     # Fix build with gcc15
@@ -55,7 +39,9 @@ buildPythonApplication rec {
     })
   ];
 
-  build-system = [ setuptools ];
+  postPatch = ''
+    patch -p1 -d cmark -i ${./fix-cmake-4.patch}
+  '';
 
   nativeBuildInputs = [
     pkg-config
@@ -66,10 +52,12 @@ buildPythonApplication rec {
   buildInputs = [
     glib
     json-glib
-    libxml2.dev
+    libxml2
   ];
 
-  dependencies = [
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
     appdirs
     backports-entry-points-selectable
     dbus-deviation
@@ -85,7 +73,7 @@ buildPythonApplication rec {
     wheezy-template
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];
 
   # CMake is used to build CMARK, but the build system is still python
   dontUseCmakeConfigure = true;
@@ -103,14 +91,6 @@ buildPythonApplication rec {
     "hotdoc"
   ];
 
-  disabledTestPaths = [
-    # Executing hotdoc exits with code 1
-    "tests/test_hotdoc.py::TestHotdoc::test_basic"
-    "tests/test_hotdoc.py::TestHotdoc::test_explicit_conf_file"
-    "tests/test_hotdoc.py::TestHotdoc::test_implicit_conf_file"
-    "tests/test_hotdoc.py::TestHotdoc::test_private_folder"
-  ];
-
   disabledTests = [
     # Test does not correctly handle path normalization for test comparison
     "test_cli_overrides"
@@ -120,20 +100,6 @@ buildPythonApplication rec {
     "test_index"
   ];
 
-  postPatch =
-    # Hardcode libclang paths
-    ''
-      substituteInPlace hotdoc/extensions/c/c_extension.py \
-        --replace "shutil.which('llvm-config')" 'True' \
-        --replace "subprocess.check_output(['llvm-config', '--version']).strip().decode()" '"${lib.versions.major llvmPackages.libclang.version}"' \
-        --replace "subprocess.check_output(['llvm-config', '--prefix']).strip().decode()" '"${lib.getLib llvmPackages.libclang}"' \
-        --replace "subprocess.check_output(['llvm-config', '--libdir']).strip().decode()" '"${lib.getLib llvmPackages.libclang}/lib"'
-    ''
-    # <https://github.com/MathieuDuponchelle/cmark/pull/2>
-    + ''
-      patch -p1 -d cmark -i ${./fix-cmake-4.patch}
-    '';
-
   # Make pytest run from a temp dir to have it pick up installed package for cmark
   preCheck = ''
     pushd $TMPDIR
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 001ee576682d..8420aa185a95 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2505,7 +2505,7 @@ with pkgs;
 
   host = bind.host;
 
-  hotdoc = python3Packages.callPackage ../development/tools/hotdoc { };
+  hotdoc = callPackage ../development/tools/hotdoc { };
 
   hpccm = with python3Packages; toPythonApplication hpccm;
 

From eeb1649a2fa25faf1c8cfdfe009dc7f174f12c4b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 5 May 2026 08:04:28 -0700
Subject: [PATCH 0063/1209] python3Packages.xmltodict: 1.0.2 -> 1.0.4

Diff: https://github.com/martinblech/xmltodict/compare/v1.0.2...v1.0.4

Changelog: https://github.com/martinblech/xmltodict/blob/v1.0.4/CHANGELOG.md
---
 pkgs/development/python-modules/xmltodict/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xmltodict/default.nix b/pkgs/development/python-modules/xmltodict/default.nix
index 9d1c01842a42..bd22bc108bbe 100644
--- a/pkgs/development/python-modules/xmltodict/default.nix
+++ b/pkgs/development/python-modules/xmltodict/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "xmltodict";
-  version = "1.0.2";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "martinblech";
     repo = "xmltodict";
     tag = "v${version}";
-    hash = "sha256-gnTNkh0GLfRmjMsLhfvpNrewfinNOhem0i3wzIZvKpA=";
+    hash = "sha256-G7hVtS6toUJC0YY1AXBOJSc3wnAZyWilLnT/5vvFRRw=";
   };
 
   build-system = [ setuptools ];

From 00c938cad9fb1ad0f5e332811ea923879f2a1c7b Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Tue, 5 May 2026 17:06:35 +0200
Subject: [PATCH 0064/1209] hotdoc: move to pkgs/by-name

---
 pkgs/{development/tools => by-name/ho}/hotdoc/clang.patch       | 0
 pkgs/{development/tools => by-name/ho}/hotdoc/fix-cmake-4.patch | 0
 .../tools/hotdoc/default.nix => by-name/ho/hotdoc/package.nix}  | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 4 files changed, 2 deletions(-)
 rename pkgs/{development/tools => by-name/ho}/hotdoc/clang.patch (100%)
 rename pkgs/{development/tools => by-name/ho}/hotdoc/fix-cmake-4.patch (100%)
 rename pkgs/{development/tools/hotdoc/default.nix => by-name/ho/hotdoc/package.nix} (100%)

diff --git a/pkgs/development/tools/hotdoc/clang.patch b/pkgs/by-name/ho/hotdoc/clang.patch
similarity index 100%
rename from pkgs/development/tools/hotdoc/clang.patch
rename to pkgs/by-name/ho/hotdoc/clang.patch
diff --git a/pkgs/development/tools/hotdoc/fix-cmake-4.patch b/pkgs/by-name/ho/hotdoc/fix-cmake-4.patch
similarity index 100%
rename from pkgs/development/tools/hotdoc/fix-cmake-4.patch
rename to pkgs/by-name/ho/hotdoc/fix-cmake-4.patch
diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/by-name/ho/hotdoc/package.nix
similarity index 100%
rename from pkgs/development/tools/hotdoc/default.nix
rename to pkgs/by-name/ho/hotdoc/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8420aa185a95..51279ac2fd72 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2505,8 +2505,6 @@ with pkgs;
 
   host = bind.host;
 
-  hotdoc = callPackage ../development/tools/hotdoc { };
-
   hpccm = with python3Packages; toPythonApplication hpccm;
 
   html-proofer = callPackage ../tools/misc/html-proofer { };

From 230567bf2bf1a6cecd3a3a2c956eeb02cf451c29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 5 May 2026 08:07:33 -0700
Subject: [PATCH 0065/1209] python3Packages.xmltodict: add dotlambda to
 maintainers

---
 pkgs/development/python-modules/xmltodict/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/xmltodict/default.nix b/pkgs/development/python-modules/xmltodict/default.nix
index bd22bc108bbe..0c928c0aa158 100644
--- a/pkgs/development/python-modules/xmltodict/default.nix
+++ b/pkgs/development/python-modules/xmltodict/default.nix
@@ -29,6 +29,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/martinblech/xmltodict";
     changelog = "https://github.com/martinblech/xmltodict/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.dotlambda ];
   };
 }

From 19df48b95abeaa4a18df925c21356d5d994e21c6 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 5 May 2026 20:52:17 +0100
Subject: [PATCH 0066/1209] hunspell: 1.7.2 -> 1.7.3

Changes: https://github.com/hunspell/hunspell/releases/tag/v1.7.3
---
 pkgs/by-name/hu/hunspell/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hu/hunspell/package.nix b/pkgs/by-name/hu/hunspell/package.nix
index ce0e7db16a7b..398c9e9e453b 100644
--- a/pkgs/by-name/hu/hunspell/package.nix
+++ b/pkgs/by-name/hu/hunspell/package.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hunspell";
-  version = "1.7.2";
+  version = "1.7.3";
 
   outputs = [
     "bin"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "hunspell";
     repo = "hunspell";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-x2FXxnVIqsf5/UEQcvchAndXBv/3mW8Z55djQAFgNA8=";
+    hash = "sha256-NoLlH+4Hb6w+HYl2fSBzroav1Pb3GojFSTJGBxlteBM=";
   };
 
   patches = [ ./0001-Make-hunspell-look-in-XDG_DATA_DIRS-for-dictionaries.patch ];

From 16ed2d73444b123572b501142e046265b8013b3a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 00:52:44 +0000
Subject: [PATCH 0067/1209] djvulibre: 3.5.29 -> 3.5.30

---
 pkgs/by-name/dj/djvulibre/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dj/djvulibre/package.nix b/pkgs/by-name/dj/djvulibre/package.nix
index f6eb3ccbb140..13563f3242b8 100644
--- a/pkgs/by-name/dj/djvulibre/package.nix
+++ b/pkgs/by-name/dj/djvulibre/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "djvulibre";
-  version = "3.5.29";
+  version = "3.5.30";
 
   src = fetchurl {
     url = "mirror://sourceforge/djvu/djvulibre-${finalAttrs.version}.tar.gz";
-    hash = "sha256-07SwOuK9yoUWo2726ye3d/BSjJ7aJnRdmWKCSj/f7M8=";
+    hash = "sha256-7l5FfUz+vlZvlLmeXj08x/XHndt0HCrCui5FbwAylkQ=";
   };
 
   outputs = [

From dd134e69e6f64e4a7f6f6e260dfc25776cd89b93 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 15:15:05 +0000
Subject: [PATCH 0068/1209] minimal-bootstrap: fix early-musl-userland flake on
 parallel builds

---
 .../linux/minimal-bootstrap/gnumake/musl.nix           |  9 +++++++++
 .../linux/minimal-bootstrap/gnused/default.nix         | 10 ++++++++++
 .../os-specific/linux/minimal-bootstrap/gnutar/mes.nix | 10 ++++++++++
 .../linux/minimal-bootstrap/gnutar/musl.nix            | 10 ++++++++++
 4 files changed, 39 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
index 1913ce85927b..7476143d3469 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
@@ -4,6 +4,7 @@
   hostPlatform,
   fetchurl,
   bash,
+  coreutils,
   tinycc,
   gnumakeBoot,
   gnupatch,
@@ -37,6 +38,7 @@ bash.runCommand "${pname}-${version}"
     inherit pname version meta;
 
     nativeBuildInputs = [
+      coreutils
       tinycc.compiler
       gnumakeBoot
       gnupatch
@@ -59,6 +61,13 @@ bash.runCommand "${pname}-${version}"
     tar xzf ${src}
     cd make-${version}
 
+    # Defeat parallel-build automake regen race, see gnused/default.nix.
+    touch Makefile.in Makefile aclocal.m4 config.h.in configure 2>/dev/null || true
+    for f in */Makefile.in; do touch "$f" 2>/dev/null || true; done
+    chmod +x configure config.guess config.sub install-sh missing compile \
+      depcomp mkinstalldirs help2man 2>/dev/null || true
+    [ -d build-aux ] && chmod +x build-aux/* 2>/dev/null || true
+
     # Patch
     ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
index 267f1f12dd20..260f9103c756 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
@@ -4,6 +4,7 @@
   hostPlatform,
   fetchurl,
   bash,
+  coreutils,
   gnumake,
   tinycc,
   gnused,
@@ -33,6 +34,7 @@ bash.runCommand "${pname}-${version}"
     inherit pname version meta;
 
     nativeBuildInputs = [
+      coreutils
       gnumake
       tinycc.compiler
       gnused
@@ -53,6 +55,14 @@ bash.runCommand "${pname}-${version}"
     tar xzf ${src}
     cd sed-${version}
 
+    # Defeat parallel-build automake regen race: refresh generated-file
+    # mtimes and restore +x on autotools helpers.
+    touch Makefile.in Makefile aclocal.m4 config.h.in configure 2>/dev/null || true
+    for f in */Makefile.in; do touch "$f" 2>/dev/null || true; done
+    chmod +x configure config.guess config.sub install-sh missing compile \
+      depcomp mkinstalldirs help2man 2>/dev/null || true
+    [ -d build-aux ] && chmod +x build-aux/* 2>/dev/null || true
+
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
     export LD=tcc
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
index 2580347d7102..f38f8e262854 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
@@ -4,6 +4,7 @@
   hostPlatform,
   fetchurl,
   bash,
+  coreutils,
   tinycc,
   gnumake,
   gnused,
@@ -25,6 +26,7 @@ bash.runCommand "${pname}-${version}"
     inherit pname version meta;
 
     nativeBuildInputs = [
+      coreutils
       tinycc.compiler
       gnumake
       gnused
@@ -45,6 +47,14 @@ bash.runCommand "${pname}-${version}"
     rm tar.tar
     cd tar-${version}
 
+    # untar drops mtimes and +x on autotools helpers, restore them so
+    # parallel builds don't trip into automake regeneration.
+    touch Makefile.in Makefile aclocal.m4 config.h.in configure 2>/dev/null || true
+    for f in */Makefile.in; do touch "$f" 2>/dev/null || true; done
+    chmod +x configure config.guess config.sub install-sh missing compile \
+      depcomp mkinstalldirs help2man 2>/dev/null || true
+    [ -d build-aux ] && chmod +x build-aux/* 2>/dev/null || true
+
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
     bash ./configure \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
index c3e967ebe53d..09d2d260b895 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
@@ -4,6 +4,7 @@
   hostPlatform,
   fetchurl,
   bash,
+  coreutils,
   tinycc,
   gnumake,
   gnugrep,
@@ -26,6 +27,7 @@ bash.runCommand "${pname}-${version}"
     inherit pname version meta;
 
     nativeBuildInputs = [
+      coreutils
       tinycc.compiler
       gnumake
       gnused
@@ -46,6 +48,14 @@ bash.runCommand "${pname}-${version}"
     rm tar.tar
     cd tar-${version}
 
+    # untar drops mtimes and +x on autotools helpers, restore them so
+    # parallel builds don't trip into automake regeneration.
+    touch Makefile.in Makefile aclocal.m4 config.h.in configure 2>/dev/null || true
+    for f in */Makefile.in; do touch "$f" 2>/dev/null || true; done
+    chmod +x configure config.guess config.sub install-sh missing compile \
+      depcomp mkinstalldirs help2man 2>/dev/null || true
+    [ -d build-aux ] && chmod +x build-aux/* 2>/dev/null || true
+
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
     export LD=tcc

From 08521f3b58242c879b96105dc23102c8ea708d5f Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:32 +0000
Subject: [PATCH 0069/1209] minimal-bootstrap.binutils:
 --disable-{gold,plugins}

---
 pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix | 2 ++
 pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix  | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
index 4ba20f13192e..eb34c121e9da 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
@@ -54,6 +54,8 @@ let
     # libbfd and libopcodes into a default visibility. Drop default lib
     # path to force users to declare their use of these libraries.
     "--with-lib-path=:"
+    "--disable-gold"
+    "--disable-plugins"
   ];
 in
 bash.runCommand "${pname}-${version}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
index fd0681ca4d41..90e2eb8126ea 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
@@ -56,6 +56,8 @@ let
     # libbfd and libopcodes into a default visibility. Drop default lib
     # path to force users to declare their use of these libraries.
     "--with-lib-path=:"
+    "--disable-gold"
+    "--disable-plugins"
   ];
 in
 bash.runCommand "${pname}-${version}"

From 9eb073dafa87aa513a1ac5e353c3c9948903f072 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:32 +0000
Subject: [PATCH 0070/1209] minimal-bootstrap.glibc:
 --disable-{nscd,build-nscd,profile,timezone-tools,mathvec}

---
 pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
index b1df854db276..f156f862ecc0 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
@@ -104,7 +104,12 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --with-headers=${linux-headers}/include \
-      --disable-dependency-tracking
+      --disable-dependency-tracking \
+      --disable-nscd \
+      --disable-build-nscd \
+      --disable-profile \
+      --disable-timezone-tools \
+      --disable-mathvec
 
     # Build
     make -j $NIX_BUILD_CORES

From 4791df2472f2b75a852a49306884d9b88e2e6c56 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:32 +0000
Subject: [PATCH 0071/1209] minimal-bootstrap.gcc46-cxx:
 --disable-{libsanitizer,shared}

---
 pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
index 9eb873ea0da5..3016e751e72f 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
@@ -155,7 +155,9 @@ bash.runCommand "${pname}-${version}"
       --disable-libstdcxx-pch \
       --disable-lto \
       --disable-multilib \
-      --disable-nls
+      --disable-nls \
+      --disable-libsanitizer \
+      --disable-shared
 
     # Build
     make -j $NIX_BUILD_CORES

From 1ea118f2b0a43aa573848517968a1ac90ff3e225 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:33 +0000
Subject: [PATCH 0072/1209] minimal-bootstrap.gcc10: drop ISL,
 --disable-{libstdcxx-filesystem-ts,shared}

---
 pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
index 3146c350dddb..25b06eb13f00 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
@@ -48,12 +48,6 @@ let
     url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
     hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
   };
-
-  islVersion = "0.24";
-  isl = fetchurl {
-    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
-    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
-  };
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -112,13 +106,11 @@ bash.runCommand "${pname}-${version}"
     tar xf ${gmp}
     tar xf ${mpfr}
     tar xf ${mpc}
-    tar xf ${isl}
     cd gcc-${version}
 
     ln -s ../gmp-${gmpVersion} gmp
     ln -s ../mpfr-${mpfrVersion} mpfr
     ln -s ../mpc-${mpcVersion} mpc
-    ln -s ../isl-${islVersion} isl
 
     # Patch
     # doesn't recognise musl
@@ -157,7 +149,10 @@ bash.runCommand "${pname}-${version}"
       --disable-lto \
       --disable-multilib \
       --disable-nls \
-      --disable-plugin
+      --disable-plugin \
+      --without-isl \
+      --disable-libstdcxx-filesystem-ts \
+      --disable-shared
 
     # Build
     make -j $NIX_BUILD_CORES

From 9ced5a330a4bca970d931aa622ddab02eef359bc Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:33 +0000
Subject: [PATCH 0073/1209] minimal-bootstrap.gcc-latest: drop ISL,
 --disable-shared

---
 .../linux/minimal-bootstrap/gcc/latest.nix           | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
index 287f894626e0..d003f164abad 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
@@ -45,12 +45,6 @@ let
     url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
     hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
   };
-
-  islVersion = "0.24";
-  isl = fetchurl {
-    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
-    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
-  };
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -109,13 +103,11 @@ bash.runCommand "${pname}-${version}"
     tar xf ${gmp}
     tar xf ${mpfr}
     tar xf ${mpc}
-    tar xf ${isl}
     cd gcc-${version}
 
     ln -s ../gmp-${gmpVersion} gmp
     ln -s ../mpfr-${mpfrVersion} mpfr
     ln -s ../mpc-${mpcVersion} mpc
-    ln -s ../isl-${islVersion} isl
 
     # Patch
     # force musl even if host triple is gnu
@@ -151,7 +143,9 @@ bash.runCommand "${pname}-${version}"
       --disable-lto \
       --disable-multilib \
       --disable-nls \
-      --disable-plugin
+      --disable-plugin \
+      --without-isl \
+      --disable-shared
 
     # Build
     make -j $NIX_BUILD_CORES

From 0571f521a81fbd72eda2f9c8dae949ad54594f1c Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:33 +0000
Subject: [PATCH 0074/1209] minimal-bootstrap.gcc-glibc: drop ISL,
 --disable-libstdcxx-{backtrace,filesystem-ts}

---
 .../linux/minimal-bootstrap/gcc/glibc.nix           | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
index eb8da7723f98..3188453cea74 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
@@ -52,12 +52,6 @@ let
     url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
     hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
   };
-
-  islVersion = "0.24";
-  isl = fetchurl {
-    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
-    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
-  };
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -115,13 +109,11 @@ bash.runCommand "${pname}-${version}"
     tar xf ${gmp}
     tar xf ${mpfr}
     tar xf ${mpc}
-    tar xf ${isl}
     cd gcc-${version}
 
     ln -s ../gmp-${gmpVersion} gmp
     ln -s ../mpfr-${mpfrVersion} mpfr
     ln -s ../mpc-${mpcVersion} mpc
-    ln -s ../isl-${islVersion} isl
 
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
@@ -152,7 +144,10 @@ bash.runCommand "${pname}-${version}"
       --disable-multilib \
       --disable-nls \
       --disable-plugin \
-      --with-specs="%x{-dynamic-linker=${glibc}/lib/${linkerName}} %x{-L${glibc}/lib/} -B${glibc}/lib"
+      --with-specs="%x{-dynamic-linker=${glibc}/lib/${linkerName}} %x{-L${glibc}/lib/} -B${glibc}/lib" \
+      --without-isl \
+      --disable-libstdcxx-backtrace \
+      --disable-libstdcxx-filesystem-ts
 
     # Build
     make -j $NIX_BUILD_CORES

From 04d4126705c928fc30af301c62d98ef2fb4e3c75 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 18:17:20 +0000
Subject: [PATCH 0075/1209] amf-headers: 1.5.0 -> 1.5.2

---
 pkgs/by-name/am/amf-headers/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/am/amf-headers/package.nix b/pkgs/by-name/am/amf-headers/package.nix
index b1f1dcc0e174..a03ba327914d 100644
--- a/pkgs/by-name/am/amf-headers/package.nix
+++ b/pkgs/by-name/am/amf-headers/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "amf-headers";
-  version = "1.5.0";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "GPUOpen-LibrariesAndSDKs";
     repo = "AMF";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-ZVC1e4S5CNpfl3ewHR9aVfYwxDBE7/BJ6OyH2kF00fQ=";
+    sha256 = "sha256-+jVYm/Zmt+1bzKnKTiClgoMRsyhqpuKZj79DvGHpPTM=";
   };
 
   installPhase = ''

From 6517fae64e6b483e510f46db6d0f970f1fbdcf84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 26 Feb 2026 18:44:27 +0100
Subject: [PATCH 0076/1209] pypy3Packages.meson: fix postPatch

---
 pkgs/by-name/me/meson/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 4f48831753c4..edd39a451200 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -72,11 +72,11 @@ python3.pkgs.buildPythonApplication rec {
     if python3.isPyPy then
       ''
         substituteInPlace mesonbuild/modules/python.py \
-          --replace-fail "PythonExternalProgram('python3', mesonlib.python_command)" \
-                         "PythonExternalProgram('${python3.meta.mainProgram}', mesonlib.python_command)"
+          --replace-fail "PythonExternalProgram('python3', mesonlib.python_command" \
+                         "PythonExternalProgram('${python3.meta.mainProgram}', mesonlib.python_command"
         substituteInPlace mesonbuild/modules/python3.py \
-          --replace-fail "state.environment.lookup_binary_entry(mesonlib.MachineChoice.HOST, 'python3')" \
-                         "state.environment.lookup_binary_entry(mesonlib.MachineChoice.HOST, '${python3.meta.mainProgram}')"
+          --replace-fail "state.environment.lookup_binary_entry(mesonlib.MachineChoice.HOST, 'python3'" \
+                         "state.environment.lookup_binary_entry(mesonlib.MachineChoice.HOST, '${python3.meta.mainProgram}'"
         substituteInPlace "test cases"/*/*/*.py "test cases"/*/*/*/*.py \
           --replace-quiet '#!/usr/bin/env python3' '#!/usr/bin/env pypy3' \
           --replace-quiet '#! /usr/bin/env python3' '#!/usr/bin/env pypy3'
@@ -141,6 +141,8 @@ python3.pkgs.buildPythonApplication rec {
       ++ lib.optionals python3.isPyPy [
         # fails for unknown reason
         "test cases/python/4 custom target depends extmodule"
+        # we patch the path to the binary...
+        "test cases/common/26 find program"
       ]
     ))
     ++ [

From 8a07895dc2b3ecb7fec03b14ced0d3fe533c4884 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 26 Feb 2026 18:44:39 +0100
Subject: [PATCH 0077/1209] pypy3Packages.sphinx: update disabled test paths

but cannot currently be tested due to pypy not understanding the type
keyword
---
 pkgs/development/python-modules/sphinx/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index fb99c84de0bd..b0733c1289e5 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -95,11 +95,11 @@ buildPythonPackage rec {
 
   disabledTestPaths = lib.optionals isPyPy [
     # internals are asserted which are sightly different in PyPy
-    "tests/test_extensions/test_ext_autodoc.py"
-    "tests/test_extensions/test_ext_autodoc_autoclass.py"
-    "tests/test_extensions/test_ext_autodoc_autofunction.py"
-    "tests/test_extensions/test_ext_autodoc_automodule.py"
-    "tests/test_extensions/test_ext_autodoc_preserve_defaults.py"
+    "tests/test_ext_autodoc/test_ext_autodoc.py"
+    "tests/test_ext_autodoc/test_ext_autodoc_autoclass.py"
+    "tests/test_ext_autodoc/test_ext_autodoc_autofunction.py"
+    "tests/test_ext_autodoc/test_ext_autodoc_automodule.py"
+    "tests/test_ext_autodoc/test_ext_autodoc_preserve_defaults.py"
     "tests/test_util/test_util_inspect.py"
     "tests/test_util/test_util_typing.py"
   ];

From 957d7443453c3d11cb74aa35c181d1ec9f75ca20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 26 Feb 2026 18:45:00 +0100
Subject: [PATCH 0078/1209] pypy3Packages.zopfli: replace setuptools version
 pin for pypy

---
 pkgs/development/python-modules/zopfli/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/zopfli/default.nix b/pkgs/development/python-modules/zopfli/default.nix
index 5d6b2f1ef79f..e602cd3ce333 100644
--- a/pkgs/development/python-modules/zopfli/default.nix
+++ b/pkgs/development/python-modules/zopfli/default.nix
@@ -17,6 +17,11 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-qO6ZKyVJ4JDNPwF4v2Bt1Bop4GE6BM31BUIkZixy3OY=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools<72.2.0" "setuptools"
+  '';
+
   build-system = [ setuptools-scm ];
 
   buildInputs = [ zopfli ];

From a6a281823a9daf610ca1dd7b4247d2fde394fda2 Mon Sep 17 00:00:00 2001
From: Tyler Langlois <tjl@byu.net>
Date: Wed, 6 May 2026 15:16:18 -0600
Subject: [PATCH 0079/1209] libcap: 2.77 -> 2.78

Removes the manually-applied patch for Makefile workaround, included
in the 2.78 release.
---
 pkgs/by-name/li/libcap/package.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/li/libcap/package.nix b/pkgs/by-name/li/libcap/package.nix
index c9c5813a16c1..19dc58048530 100644
--- a/pkgs/by-name/li/libcap/package.nix
+++ b/pkgs/by-name/li/libcap/package.nix
@@ -3,7 +3,6 @@
   lib,
   buildPackages,
   fetchurl,
-  fetchpatch,
   runtimeShell,
   pkgsBuildHost,
   usePam ? !isStatic,
@@ -31,11 +30,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.77";
+  version = "2.78";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    hash = "sha256-iXvBi0Svwmxw54zq09uzHhVKzCS+4IWloJB5qI2/b1I=";
+    hash = "sha256-DWIeVi/ZMsz2e5Zg+wGORopoPXuCdUHfJ4EyKMmWuxE=";
   };
 
   outputs = [
@@ -76,13 +75,6 @@ stdenv.mkDerivation rec {
     "LIBCSTATIC=yes"
   ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://git.kernel.org/pub/scm/libs/libcap/libcap.git/patch/?id=d628b3bfe40338d4efff6b0ae50f250a0eb884c7";
-      hash = "sha256-Eiv/BOJZkduL+hOEJd8K1LQd9wvOeCKchE2GaLcerVc=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs ./progs/mkcapshdoc.sh
 

From 2bb9b3d1669a9bd7c6425c84da9732759c7bedb0 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 8 May 2026 15:55:03 +0200
Subject: [PATCH 0080/1209] gnutls: remove unused inputs

You can tell it doesn't autoreconf, because if you apply a patch that
forces it to, it refuses because 2.6.9 is too old.
---
 pkgs/by-name/gn/gnutls/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/by-name/gn/gnutls/package.nix b/pkgs/by-name/gn/gnutls/package.nix
index aba0f7388bb2..a56c842c68da 100644
--- a/pkgs/by-name/gn/gnutls/package.nix
+++ b/pkgs/by-name/gn/gnutls/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  buildPackages,
   fetchurl,
   zlib,
   libtasn1,
@@ -9,7 +8,6 @@
   pkg-config,
   perl,
   gmp,
-  automake,
   libidn2,
   libiconv,
   texinfo,
@@ -170,10 +168,6 @@ stdenv.mkDerivation rec {
     pkg-config
     texinfo
   ]
-  ++ [
-    buildPackages.autoconf269
-    automake
-  ]
   ++ lib.optionals doCheck [
     which
     net-tools

From 9fafdc761f765fd292105a2050be9c6fe279eade Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 8 May 2026 00:22:14 +0200
Subject: [PATCH 0081/1209] Reapply "nodejs_24: fix majorVersion check"

This reverts commit 99a42f0985699d53321dec8877b246c102381fe2.
---
 pkgs/development/web/nodejs/nodejs.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index b89c24b6cc87..36f8b1feb0d3 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -130,9 +130,9 @@ let
 
   useSharedAdaAndSimd = lib.versionAtLeast version "22.2";
   useSharedGtestAndHistogram = lib.versionAtLeast version (
-    if majorVersion == 24 then "24.14.0" else "25.4"
+    if majorVersion == "24" then "24.14.0" else "25.4"
   );
-  useSharedNBytes = lib.versionAtLeast version (if majorVersion == 24 then "24.14.0" else "25.5");
+  useSharedNBytes = lib.versionAtLeast version (if majorVersion == "24" then "24.14.0" else "25.5");
   useSharedLief = lib.versionAtLeast version "25.6";
   useSharedMerve = lib.versionAtLeast version (if majorVersion == 24 then "24.14.0" else "25.6.1");
   useSharedSQLite = lib.versionAtLeast version "22.5";

From 02d2fdd686118eed0091ea82b41310dc74e571fd Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Tue, 28 Apr 2026 21:53:45 +0200
Subject: [PATCH 0082/1209] openapv: 0.2.1.2 -> 0.2.1.3

changelog: https://github.com/AcademySoftwareFoundation/openapv/releases/tag/v0.2.1.3-fix

diff: https://github.com/AcademySoftwareFoundation/openapv/compare/v0.2.1.2...v0.2.1.3-fix
---
 pkgs/by-name/op/openapv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/openapv/package.nix b/pkgs/by-name/op/openapv/package.nix
index b153552d6f17..27d31127a004 100644
--- a/pkgs/by-name/op/openapv/package.nix
+++ b/pkgs/by-name/op/openapv/package.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openapv";
-  version = "0.2.1.2";
+  version = "0.2.1.3";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openapv";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-wxncN7j5p0GXpWhOx4Ix0oTgGK2sIrfJgQ45fFwmQBI=";
+    tag = "v${finalAttrs.version}-fix"; # Remove the `-fix` suffix after the next version
+    hash = "sha256-lc/x2dWh6T8c63siHB32ka+SPVYTTyaO4YrQ12EbGqw=";
   };
 
   postPatch = ''

From d37588dfa3c8eb4d90c07d8b6b429c75a90d4019 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 8 May 2026 20:00:21 +0000
Subject: [PATCH 0083/1209] doxygen: 1.16.1 -> 1.17.0

---
 pkgs/by-name/do/doxygen/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/do/doxygen/package.nix b/pkgs/by-name/do/doxygen/package.nix
index eb701a89dc89..9ab45d795aa9 100644
--- a/pkgs/by-name/do/doxygen/package.nix
+++ b/pkgs/by-name/do/doxygen/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doxygen";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "doxygen";
     repo = "doxygen";
     tag = "Release_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-MszJpYdXaC8BYK1lSV1LpJncKN1LrFoyJXZajpz0HIA=";
+    hash = "sha256-SSq/sFB9y2CFMeL58vgcHa2ulo+tPPUGT347ABoHoD4=";
   };
 
   # https://github.com/doxygen/doxygen/issues/10928#issuecomment-2179320509

From 4cdf41c344968cf9f49cfcf46f71dab1c4586475 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?=
 =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?=
 =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= <regime_skylark.0y@icloud.com>
Date: Thu, 7 May 2026 18:00:15 -0400
Subject: [PATCH 0084/1209] libfyaml: patch for C11 atomics detection and
 macros

---
 pkgs/by-name/li/libfyaml/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/li/libfyaml/package.nix b/pkgs/by-name/li/libfyaml/package.nix
index ebbaae3748d8..26cc0461020b 100644
--- a/pkgs/by-name/li/libfyaml/package.nix
+++ b/pkgs/by-name/li/libfyaml/package.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/pantoniou/libfyaml/commit/0982fcefc6a16d4c8cb5b06747d3fc8e630de3ae.diff";
       hash = "sha256-aDubIn+et+1fWE7XU7a5AGZVacVFbAbC1PoSDrA6hXw=";
     })
+    # backport "Fix C11 atomics detection and buggy macros for C++ compatibility"
+    (fetchpatch {
+      url = "https://github.com/pantoniou/libfyaml/commit/1026d76850909dc9b1c5f95b8cd94e865a313fd5.diff";
+      hash = "sha256-0YfOqdqHdELFMqr52TDAC3BNFLkcuxvuJY5b9yZ7NFk=";
+    })
     (fetchpatch {
       url = "https://github.com/pantoniou/libfyaml/commit/9192deaac095f9881cc1e5756dede683f36b09d6.diff";
       hash = "sha256-cNL9wQtxIRg/ShZLJP4qHYNFRrYo9kRG+/U+3FiUeaI=";

From 6cf5d0644f4b3dc950fe87c9d61682f049bade27 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 9 May 2026 00:40:55 +0000
Subject: [PATCH 0085/1209] libedit: 20251016-3.1 -> 20260508-3.1

---
 pkgs/by-name/li/libedit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libedit/package.nix b/pkgs/by-name/li/libedit/package.nix
index 30a316d0074d..11712e641d99 100644
--- a/pkgs/by-name/li/libedit/package.nix
+++ b/pkgs/by-name/li/libedit/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libedit";
-  version = "20251016-3.1";
+  version = "20260508-3.1";
 
   src = fetchurl {
     url = "https://thrysoee.dk/editline/libedit-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ITYrAGU7v8HHH3GnV42ma1tSA1WdQxNNLddxnjE84EE=";
+    hash = "sha256-kfQtZXHdjZL67dE0ETTOWrygxdC0s1KBQYbTPysRJy4=";
   };
 
   outputs = [

From cf414a6ba870d43b7778da985b82ef6b8cbefebf Mon Sep 17 00:00:00 2001
From: Cameron Brown <me@cbrxyz.com>
Date: Sat, 9 May 2026 14:17:35 -0400
Subject: [PATCH 0086/1209] python3Packages.isort: 7.0.0 -> 8.0.1

---
 pkgs/development/python-modules/isort/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/isort/default.nix b/pkgs/development/python-modules/isort/default.nix
index 3e79a6888b69..6d404805eb06 100644
--- a/pkgs/development/python-modules/isort/default.nix
+++ b/pkgs/development/python-modules/isort/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "isort";
-  version = "7.0.0";
+  version = "8.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = "isort";
     tag = version;
-    hash = "sha256-GN76dLk+Ju+Do/BymIuHD/9KAjYZ3sKvfz2cvNEnF5U=";
+    hash = "sha256-adEAWbRY+bCji4TfnS8W5p5KvuSjmLQrqhi+n8mSQPA=";
   };
 
   build-system = [

From 00b0ebee830ecfdb7d54efef0d57b07bd78ab2d6 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 9 May 2026 22:46:35 +0100
Subject: [PATCH 0087/1209] dash: 0.5.13.3 -> 0.5.13.4

Changes: https://git.kernel.org/pub/scm/utils/dash/dash.git/log/?h=v0.5.13.4
---
 pkgs/by-name/da/dash/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/da/dash/package.nix b/pkgs/by-name/da/dash/package.nix
index eb5da071f472..ada4d8812cb9 100644
--- a/pkgs/by-name/da/dash/package.nix
+++ b/pkgs/by-name/da/dash/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dash";
-  version = "0.5.13.3";
+  version = "0.5.13.4";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/dash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-qDcnwSmaxMPZ1Dl5OTs6TrACddVjauAlJueXnVHW+9E=";
+    hash = "sha256-0Q39Qc2lkWVWDbOcqRXCxKdjb/8EKB2NLfd62Sx1Pis=";
   };
 
   strictDeps = true;

From 5e1b98759ee1c37fd8e516cae6779581f758dd47 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 10 May 2026 10:34:45 +0100
Subject: [PATCH 0088/1209] yara: fix the hash

Without the change `staging` fails as:

```
$ nix build github:NixOS/nixpkgs/staging#yara.src
error: hash mismatch in fixed-output derivation '/nix/store/b4i6zf2vr4qvjkjy5sgbayia2iqxz491-source.drv':
         specified: sha256-G1f0o7wsds4Mz4Whz35JdSKIkPIqea5Fe5rB8vMdkZU=
            got:    sha256-vzYH56BC0Stb2I4U5VzxA0xG46xZkWmbTIC6BtzeNQ8=
error: build of resolved derivation '/nix/store/b4i6zf2vr4qvjkjy5sgbayia2iqxz491-source.drv' failed
```
---
 pkgs/by-name/ya/yara/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ya/yara/package.nix b/pkgs/by-name/ya/yara/package.nix
index 905561b69435..1200538d3211 100644
--- a/pkgs/by-name/ya/yara/package.nix
+++ b/pkgs/by-name/ya/yara/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "VirusTotal";
     repo = "yara";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G1f0o7wsds4Mz4Whz35JdSKIkPIqea5Fe5rB8vMdkZU=";
+    hash = "sha256-vzYH56BC0Stb2I4U5VzxA0xG46xZkWmbTIC6BtzeNQ8=";
   };
 
   nativeBuildInputs = [

From 32f67f000b22d422e36befbbabd36279e2a660a2 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 10 May 2026 15:19:19 +0200
Subject: [PATCH 0089/1209] openexr: 3.4.10 -> 3.4.11

changelog: https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.11

diff: https://github.com/AcademySoftwareFoundation/openexr/compare/v3.4.10...v3.4.11
---
 pkgs/development/libraries/openexr/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 11d5c376c025..f81d46c321ef 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.4.10";
+  version = "3.4.11";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-jXio+PvagKTR8NjcYIQ/j8LOMNc/0sQBuaixKk/0V3k=";
+    hash = "sha256-5dx2tag6XyuJfNfJgc68X+VWKXaHOL3M7ZJEQbQwFDA=";
   };
 
   outputs = [

From 04928a618027c1780f162aab5880d304d2c356bc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 10 May 2026 17:02:06 +0200
Subject: [PATCH 0090/1209] python314: 3.14.4 -> 3.14.5

https://docs.python.org/release/3.14.5/whatsnew/changelog.html

Fixes: CVE 2026-3219
---
 ...hacl-static-ldeps-for-static-modules.patch | 50 -------------------
 .../interpreters/python/cpython/default.nix   |  5 --
 .../interpreters/python/default.nix           |  4 +-
 3 files changed, 2 insertions(+), 57 deletions(-)
 delete mode 100644 pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch

diff --git a/pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch b/pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch
deleted file mode 100644
index 8501ab38a940..000000000000
--- a/pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From ee1b8479cff97ca7e5ed4d51d6aa24ccb47deb8b Mon Sep 17 00:00:00 2001
-From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-Date: Sat, 21 Mar 2026 18:34:50 -0400
-Subject: [PATCH] gh-146264: Use static HACL deps for static module builds
-
----
- .../next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst  | 3 +++
- configure                                                      | 2 +-
- configure.ac                                                   | 2 +-
- 3 files changed, 5 insertions(+), 2 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst
-
-diff --git a/Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst b/Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst
-new file mode 100644
-index 00000000000..1fdafe56043
---- /dev/null
-+++ b/Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst
-@@ -0,0 +1,3 @@
-+Fix static module builds on non-WASI targets by linking HACL dependencies as
-+static libraries when ``MODULE_BUILDTYPE=static``, preventing duplicate
-+``_Py_LibHacl_*`` symbol errors at link time.
-diff --git a/configure b/configure
-index 23f24d51c79..db5c861f601 100755
---- a/configure
-+++ b/configure
-@@ -33009,7 +33009,7 @@ fi
- 
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for HACL* library linking type" >&5
- printf %s "checking for HACL* library linking type... " >&6; }
--if test "$ac_sys_system" = "WASI"; then
-+if test "$ac_sys_system" = "WASI" || test "$MODULE_BUILDTYPE" = "static"; then
-   LIBHACL_LDEPS_LIBTYPE=STATIC
-   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: static" >&5
- printf "%s\n" "static" >&6; }
-diff --git a/configure.ac b/configure.ac
-index 635fce3f2e6..59166d63e63 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -8171,7 +8171,7 @@ AC_SUBST([LIBHACL_BLAKE2_SIMD256_OBJS])
- # HACL*-based cryptographic primitives
- 
- AC_MSG_CHECKING([for HACL* library linking type])
--if test "$ac_sys_system" = "WASI"; then
-+if test "$ac_sys_system" = "WASI" || test "$MODULE_BUILDTYPE" = "static"; then
-   LIBHACL_LDEPS_LIBTYPE=STATIC
-   AC_MSG_RESULT([static])
- else
--- 
-2.53.0
-
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index a4149eeeb8af..e674de90810f 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -427,11 +427,6 @@ stdenv.mkDerivation (finalAttrs: {
     # backport fix for https://github.com/python/cpython/issues/95855
     ./platform-triplet-detection.patch
   ]
-  ++ optionals (pythonAtLeast "3.14" && pythonOlder "3.15") [
-    # https://github.com/python/cpython/issues/146264
-    # https://github.com/python/cpython/pull/146265
-    ./3.14/hacl-static-ldeps-for-static-modules.patch
-  ]
   ++ optionals (version == "3.13.10" || version == "3.14.1") [
     # https://github.com/python/cpython/issues/142218
     ./${lib.versions.majorMinor version}/gh-142218.patch
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 11a150d78506..1e70883b03a2 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -79,10 +79,10 @@
       sourceVersion = {
         major = "3";
         minor = "14";
-        patch = "4";
+        patch = "5";
         suffix = "";
       };
-      hash = "sha256-2SPFEwPjjiSRNvwb3zVo1W7LAyFO/e9IUWF209f6rvg=";
+      hash = "sha256-fjJZe5nl2aOavtNd5Gk/oWnfPlhQ1MM0M3/9ahmjbbY=";
       inherit passthruFun;
     };
 

From 194e729c3a36c371590d4f3f6f8d610253f75da2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 10 May 2026 17:05:43 +0200
Subject: [PATCH 0091/1209] cpython: kill dead code

---
 pkgs/development/interpreters/python/cpython/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index e674de90810f..ab24113d07ab 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -133,7 +133,6 @@ let
     getLib
     optionals
     optionalString
-    replaceStrings
     ;
 
   withLibxcrypt =
@@ -427,10 +426,6 @@ stdenv.mkDerivation (finalAttrs: {
     # backport fix for https://github.com/python/cpython/issues/95855
     ./platform-triplet-detection.patch
   ]
-  ++ optionals (version == "3.13.10" || version == "3.14.1") [
-    # https://github.com/python/cpython/issues/142218
-    ./${lib.versions.majorMinor version}/gh-142218.patch
-  ]
   ++ optionals (stdenv.hostPlatform.isMinGW) (
     let
       # https://src.fedoraproject.org/rpms/mingw-python3

From 778a572c94d6f2d89b83f4aa2b6fa902633eb9dd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 10 May 2026 22:55:29 +0000
Subject: [PATCH 0092/1209] prek: 0.3.11 -> 0.3.13

---
 pkgs/by-name/pr/prek/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index 32b40a198cfd..4f4920e06410 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.3.11";
+  version = "0.3.13";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Vd4XmO+Z0Zs5kE/PMesnr6q+JUz+DGXWKVoHsPZPKwM=";
+    hash = "sha256-OPH1H571jw0b8EsyzRcVdG54sQ7KeOclmnHCeVGteRI=";
   };
 
-  cargoHash = "sha256-AggCANaSMeKftOlan8TpgLgpYgaLCpYBBbBOeLKCCVo=";
+  cargoHash = "sha256-lvB09qOvVXmSdhR1TRJQ3rvYyn6cFSOGpogJZDajPuQ=";
 
   nativeBuildInputs = [
     installShellFiles

From 4ed3b8cbf6e463ee73eecfe45e5adea72985492e Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 11 May 2026 09:00:04 +0200
Subject: [PATCH 0093/1209] spandsp3: fix test failure on musl

(Due to a buffer overrun affecting all platforms.)
---
 pkgs/development/libraries/spandsp/3.nix      |  5 ++++
 .../Fix-buffer-overrun-in-t85-tests.patch     | 29 +++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch

diff --git a/pkgs/development/libraries/spandsp/3.nix b/pkgs/development/libraries/spandsp/3.nix
index 5a7f0005a407..3d10c91e4b4e 100644
--- a/pkgs/development/libraries/spandsp/3.nix
+++ b/pkgs/development/libraries/spandsp/3.nix
@@ -12,6 +12,11 @@
     rev = "6ec23e5a7e411a22d59e5678d12c4d2942c4a4b6"; # upstream does not seem to believe in tags
     sha256 = "03w0s99y3zibi5fnvn8lk92dggfgrr0mz5255745jfbz28b2d5y7";
   };
+
+  patches = [
+    # https://github.com/freeswitch/spandsp/pull/120
+    ./Fix-buffer-overrun-in-t85-tests.patch
+  ];
 }).overrideAttrs
   (
     finalAttrs: previousAttrs: {
diff --git a/pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch b/pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch
new file mode 100644
index 000000000000..de78212f7379
--- /dev/null
+++ b/pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch
@@ -0,0 +1,29 @@
+From bc1c899fa1b6746d430f7b3d7ee288506d50441a Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Mon, 11 May 2026 08:51:29 +0200
+Subject: [PATCH] Fix buffer overrun in t85 tests
+
+The variable length tests involve reading an extra row from
+test_image, which would previously read past the end of test_image.
+
+Identified with fortify-headers.
+---
+ tests/t85_tests.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/t85_tests.c b/tests/t85_tests.c
+index 436dfca..671ee6c 100644
+--- a/tests/t85_tests.c
++++ b/tests/t85_tests.c
+@@ -55,7 +55,7 @@ in ITU specifications T.85.
+ #include "spandsp.h"
+ 
+ #define TESTBUF_SIZE        400000
+-#define TEST_IMAGE_SIZE     (1951*1960/8)
++#define TEST_IMAGE_SIZE     (1952*1960/8)
+ 
+ uint8_t testbuf[TESTBUF_SIZE];
+ uint8_t test_image[TEST_IMAGE_SIZE];
+-- 
+2.53.0
+

From f97af3c9f75fea16d1a022937633cc75deda12d6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 11 May 2026 11:17:01 +0000
Subject: [PATCH 0094/1209] libgpg-error: 1.59 -> 1.61

---
 pkgs/by-name/li/libgpg-error/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libgpg-error/package.nix b/pkgs/by-name/li/libgpg-error/package.nix
index 0b933048fc0e..c086abb3c806 100644
--- a/pkgs/by-name/li/libgpg-error/package.nix
+++ b/pkgs/by-name/li/libgpg-error/package.nix
@@ -25,11 +25,11 @@ in
 stdenv.mkDerivation (
   rec {
     pname = "libgpg-error";
-    version = "1.59";
+    version = "1.61";
 
     src = fetchurl {
       url = "mirror://gnupg/libgpg-error/libgpg-error-${version}.tar.bz2";
-      hash = "sha256-oZvFCH/ZcCbZPLS0XVFjjRolICpeH7w5BXmfQkz6YTQ=";
+      hash = "sha256-eoVBPyvDVPT4qoMrcYrxIuSJZeng65AS7mWcE8Y4XJM=";
     };
 
     postPatch = ''

From b78dd5d217924d72cb1e058422e01a0f43714c1a Mon Sep 17 00:00:00 2001
From: Birdee <85372418+BirdeeHub@users.noreply.github.com>
Date: Sun, 10 May 2026 16:47:11 -0700
Subject: [PATCH 0095/1209] luaPackages.luarocks_bootstrap: properly configure
 luarocks to set LUA_LIBDIR

---
 pkgs/development/tools/misc/luarocks/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 9ad31b6e78cd..10a1ff3b4699 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -58,6 +58,10 @@ stdenv.mkDerivation (finalAttrs: {
     if test -n "$lua_inc"; then
         appendToVar configureFlags "--with-lua-include=$lua_inc"
     fi
+    lua_lib="${lua}/lib"
+    if test -d "$lua_lib"; then
+        appendToVar configureFlags "--with-lua-lib=$lua_lib"
+    fi
   '';
 
   nativeBuildInputs = [

From 3803be5263c98b9e52d0e6f791272137f5e1e193 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 11 Apr 2026 21:47:48 +0100
Subject: [PATCH 0096/1209] simdjson: 4.6.0 -> 4.6.4

Changes:
- https://github.com/simdjson/simdjson/releases/tag/v4.6.1
- https://github.com/simdjson/simdjson/releases/tag/v4.6.2
- https://github.com/simdjson/simdjson/releases/tag/v4.6.3
- https://github.com/simdjson/simdjson/releases/tag/v4.6.4
---
 pkgs/by-name/si/simdjson/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/si/simdjson/package.nix b/pkgs/by-name/si/simdjson/package.nix
index e1cc6c566ebb..44942f163cab 100644
--- a/pkgs/by-name/si/simdjson/package.nix
+++ b/pkgs/by-name/si/simdjson/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simdjson";
-  version = "4.6.0";
+  version = "4.6.4";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VGErBWAHk63XMv8yC+Na+gXHByhYhtIEMSBySwIDlXk=";
+    hash = "sha256-8oQzsR7DSaNTN9su1uI9tRQ9HvOwXShPwSrnQj8+lGM=";
   };
 
   nativeBuildInputs = [ cmake ];

From fe1ca2c575fa37169ccb114ffc9a5581aa44860d Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 11 May 2026 17:42:53 -0400
Subject: [PATCH 0097/1209] expat: 2.8.0 -> 2.8.1

Changelog: https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes
Diff: https://github.com/libexpat/libexpat/compare/R_2_8_0...R_2_8_1

Fixes: CVE-2026-45186
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index cf55e71a2037..78ff9e9253b0 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.8.0";
+  version = "2.8.1";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-o3v64KqXdb2FIevYXcRW1Ibw/zETj2yR/ZAupzJiRUI=";
+    hash = "sha256-ELGV7ngWCpCDiBgKj+NgPU6aEvR1X79fOBayOp11DaA=";
   };
 
   strictDeps = true;

From 18366e70a82125a938b33f5eceaafd762c768768 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 11 May 2026 23:01:12 +0100
Subject: [PATCH 0098/1209] gdb: 17.1 -> 17.2

Changes: https://www.sourceware.org/gdb/download/ANNOUNCEMENT
---
 pkgs/by-name/gd/gdb/package.nix | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/gd/gdb/package.nix b/pkgs/by-name/gd/gdb/package.nix
index 361ad20350b4..0199d4ad285c 100644
--- a/pkgs/by-name/gd/gdb/package.nix
+++ b/pkgs/by-name/gd/gdb/package.nix
@@ -5,7 +5,6 @@
 
   # Build time
   fetchurl,
-  fetchpatch,
   pkg-config,
   perl,
   texinfo,
@@ -66,11 +65,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "17.1";
+  version = "17.2";
 
   src = fetchurl {
     url = "mirror://gnu/gdb/gdb-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FJlvX3TJ9o9aVD/cRbyngAIH+R+SrupsLnkYIsfG2HY=";
+    hash = "sha256-HANsDXLks9H7XJTIhjKt1vnXb018TS6nk8EqnxmjIow=";
   };
 
   postPatch =
@@ -88,17 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./debug-info-from-env.patch
-
-    (fetchurl {
-      name = "musl.patch";
-      url = "https://inbox.sourceware.org/gdb-patches/20260324164527.1446549-2-sunilkumar.dora@windriver.com/raw";
-      hash = "sha256-FC4DDVS4wtE/HXtbUqvkxu9+e7nE3DYi1zIuQP9yQO8=";
-    })
-    (fetchpatch {
-      name = "musl-aarch64.patch";
-      url = "https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=1ccc3f6a2e28fa1f3357826374cba165b3ba3ff7";
-      hash = "sha256-Q2oTo2b+9yNN3PSsxqgxV4/9/05uFE/JMLe1CPs9Y7I=";
-    })
   ]
   ++ optionals stdenv.hostPlatform.isDarwin [
     ./darwin-target-match.patch

From 00cd8e646c7da669125ae26acf4b47079826e1f0 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas.gerbet@3ds.com>
Date: Tue, 12 May 2026 13:58:14 +0200
Subject: [PATCH 0099/1209] libcaca: apply patch for CVE-2026-42046

Fixes https://github.com/NixOS/nixpkgs/issues/519387
---
 pkgs/by-name/li/libcaca/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/li/libcaca/package.nix b/pkgs/by-name/li/libcaca/package.nix
index 689257d7ff8e..d233cdabfe87 100644
--- a/pkgs/by-name/li/libcaca/package.nix
+++ b/pkgs/by-name/li/libcaca/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   imlib2,
   libxext,
@@ -23,6 +24,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-N0Lfi0d4kjxirEbIjdeearYWvStkKMyV6lgeyNKXcVw=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-42046.patch";
+      url = "https://github.com/cacalabs/libcaca/commit/fb77acff9ba6bb01d53940da34fb10f20b156a23.patch";
+      hash = "sha256-AdpiE5Gw/CVET//7TTYZCb0glW5HY+T8xZkYs1XCBvY=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

From 1860b778a5a8abe503b0f6098d292514bc8560ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?=
 =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?=
 =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= <regime_skylark.0y@icloud.com>
Date: Tue, 12 May 2026 07:24:24 -0400
Subject: [PATCH 0100/1209] libfyaml: fixing pflag mismatched intention

the assumption of the code is that if there are no lib flags set, then
just use the fallback of lpthread.

BUT! The way libSystem passes to it nothing because it's trying to
communicate that it's taking care of it using PTHREAD_CFLAGS. It leads
to this weird situation where both are passed!
---
 pkgs/by-name/li/libfyaml/package.nix          |  4 ++++
 pkgs/by-name/li/libfyaml/pthread-darwin.patch | 12 ++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/by-name/li/libfyaml/pthread-darwin.patch

diff --git a/pkgs/by-name/li/libfyaml/package.nix b/pkgs/by-name/li/libfyaml/package.nix
index 26cc0461020b..7a7e5dc089c6 100644
--- a/pkgs/by-name/li/libfyaml/package.nix
+++ b/pkgs/by-name/li/libfyaml/package.nix
@@ -34,6 +34,10 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/pantoniou/libfyaml/commit/9192deaac095f9881cc1e5756dede683f36b09d6.diff";
       hash = "sha256-cNL9wQtxIRg/ShZLJP4qHYNFRrYo9kRG+/U+3FiUeaI=";
     })
+    # On Darwin, AX_PTHREAD returns empty PTHREAD_LIBS with -pthread in PTHREAD_CFLAGS;
+    # don't force -lpthread when PTHREAD_CFLAGS already provides pthread support.
+    # Pending PR: https://github.com/pantoniou/libfyaml/pull/294
+    ./pthread-darwin.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libfyaml/pthread-darwin.patch b/pkgs/by-name/li/libfyaml/pthread-darwin.patch
new file mode 100644
index 000000000000..bada0d80d142
--- /dev/null
+++ b/pkgs/by-name/li/libfyaml/pthread-darwin.patch
@@ -0,0 +1,12 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -99,6 +99,7 @@
+ AX_PTHREAD([], [AC_MSG_ERROR("Missing required pthread support")])
+ 
+-# in some cases PTHREAD_LIBS is empty - force -lpthread */
+-if test "x$PTHREAD_LIBS" = "x"; then
++# In some cases PTHREAD_LIBS is empty; force -lpthread only when PTHREAD_CFLAGS
++# also provides no pthread support (e.g. on Darwin, -pthread in CFLAGS suffices).
++if test "x$PTHREAD_LIBS" = "x" && test "x$PTHREAD_CFLAGS" = "x"; then
+ 	PTHREAD_LIBS="-lpthread"
+ fi

From 59edd93aa956ce3b5ec85c492bbc70c3fc932fa7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?=
 =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?=
 =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= <regime_skylark.0y@icloud.com>
Date: Tue, 12 May 2026 10:03:46 -0400
Subject: [PATCH 0101/1209] libfyaml: patch for libm "none required" issues

---
 pkgs/by-name/li/libfyaml/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/li/libfyaml/package.nix b/pkgs/by-name/li/libfyaml/package.nix
index 7a7e5dc089c6..4804f7bb9645 100644
--- a/pkgs/by-name/li/libfyaml/package.nix
+++ b/pkgs/by-name/li/libfyaml/package.nix
@@ -38,6 +38,16 @@ stdenv.mkDerivation (finalAttrs: {
     # don't force -lpthread when PTHREAD_CFLAGS already provides pthread support.
     # Pending PR: https://github.com/pantoniou/libfyaml/pull/294
     ./pthread-darwin.patch
+
+    # backport "build: don't output 'none required' to LIBM if no linker flags needed for it"
+    (fetchpatch {
+      url = "https://github.com/pantoniou/libfyaml/commit/24b18e7363b336962fe160c1dc05ca57ba95783c.diff";
+      hash = "sha256-g5QKI4HuS8MEQ9ddIQNC0j+28Dh9zLAp5RaZX5SWBHk=";
+    })
+    (fetchpatch {
+      url = "https://github.com/pantoniou/libfyaml/commit/9f2492ca27bb1fda64f2b12edc2da17406208b93.diff";
+      hash = "sha256-E4wS+P7R3VGrBpD7swWMMi/QPTF+9rzAeEyxhbmdiwk=";
+    })
   ];
 
   nativeBuildInputs = [

From e8372172633233072f78e86b325b4526557eac8c Mon Sep 17 00:00:00 2001
From: Philipp Aigner <info@aignerelektronik.at>
Date: Tue, 12 May 2026 13:16:02 +0200
Subject: [PATCH 0102/1209] auto-patchelf: catch OSError for ZSTD-compressed
 ELF sections

pyelftools raises OSError: [Errno 22] Invalid argument (not ELFError)
when calling stream.seek() on ZSTD-compressed ELF sections (SHF_COMPRESSED).
This breaks builds of packages like vscode >= 1.118 that ship such binaries.

Extend the except clauses in populate_cache and auto_patchelf_file to also
catch OSError, consistent with the existing intent of skipping non-parseable
files.

Fixes #519275
---
 pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
index 33813168f560..bda5329a1df3 100644
--- a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
+++ b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 
 import argparse
+import errno
 import os
 import pprint
 import subprocess
@@ -195,6 +196,12 @@ def populate_cache(initial: list[Path], recursive: bool =False) -> None:
             except ELFError:
                 # Not an ELF file in the right format
                 pass
+            except OSError as e:
+                if e.errno == errno.EINVAL:
+                    # pyelftools can raise EINVAL for certain compressed sections.
+                    pass
+                else:
+                    raise
 
 
 def find_dependency(soname: str, soarch: str, soabi: str) -> Optional[Path]:
@@ -343,6 +350,10 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app
 
     except ELFError:
         return []
+    except OSError as e:
+        if e.errno == errno.EINVAL:
+            return []
+        raise
 
     # these platforms are packaged in nixpkgs with ld.so in a separate derivation
     # than libc.so and friends. keep_libc is mandatory.

From 37cad8f4e382617c3a98aa5af8b1efb4acac5e81 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 12 May 2026 15:40:54 +0000
Subject: [PATCH 0103/1209] catch2_3: 3.14.0 -> 3.15.0

---
 pkgs/by-name/ca/catch2_3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/catch2_3/package.nix b/pkgs/by-name/ca/catch2_3/package.nix
index 525a410dbcba..4c931652b666 100644
--- a/pkgs/by-name/ca/catch2_3/package.nix
+++ b/pkgs/by-name/ca/catch2_3/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     tag = "v${version}";
-    hash = "sha256-tegAa+cNF7pJcW33B+VZ86ZlDG7dwS3o6QnN/XvTI2A=";
+    hash = "sha256-1GBzS8jgJXb82BMMRuHWqszB1Xwg6wohmCuINWE7QoU=";
   };
 
   patches = lib.optionals stdenv.cc.isClang [

From b2e8b0c6028f84faa0cf2b959732f30591c7f18f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 12 May 2026 18:27:09 +0200
Subject: [PATCH 0104/1209] Revert "groff: only apply the latest patch on linux
 for now"

This reverts commit 37a9427fd325fd4f815f4717a6280a7b076a173f.
---
 pkgs/by-name/gr/groff/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/groff/package.nix b/pkgs/by-name/gr/groff/package.nix
index a824d9a82f02..083b1493dcf6 100644
--- a/pkgs/by-name/gr/groff/package.nix
+++ b/pkgs/by-name/gr/groff/package.nix
@@ -48,8 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-dOKBl5W2r/QxrqyYPWOpyJaO6roqLrp9+LpMe0Hnz9g=";
   };
 
-  patches = lib.optionals stdenv.isLinux [
-    # TODO: apply everywhere on rebuild
+  patches = [
     # This revert a upstream refactor in continuous rendering mode, but this
     # causes a big performance regression for big manpages like
     # `man 5 configuration.nix`.

From 5198c49a5a58932c1a782aee9ad2fd6509f935e1 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Tue, 12 May 2026 19:03:20 +0200
Subject: [PATCH 0105/1209] libressl_4_3: backport executable stack fix

And also add an additional check to preCheck that will enable us to
catch executable stack issues earlier next time.
---
 pkgs/by-name/li/libressl/default.nix | 29 ++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index a4ac4000d452..4ccc79407ba7 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -61,6 +61,22 @@ let
 
       doCheck = !(stdenv.hostPlatform.isPower64 || stdenv.hostPlatform.isRiscV);
       preCheck = ''
+        # Bail if any shared object has executable stack enabled. This can
+        # happen when an object produced from an assmbly file in libcrypto is
+        # missing a .note.GNU-stack section. An executable stack is dangerous
+        # and unintentional, but without this check the derivation will build
+        # and even run if W^X is not enforced; it would fail dangerously.
+        objdump -p **/*.so | awk '
+          BEGIN { res = 0 }
+          /file format/ { file = $1 }
+          /STACK/ { stack = 1; next }
+          stack {
+            if ($0 ~ /flags.*x/) { print file " has executable stack"; res = 1 }
+            stack = 0
+          }
+          END { exit res }
+        '
+
         export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
         export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
       '';
@@ -139,5 +155,18 @@ in
   libressl_4_3 = generic {
     version = "4.3.1";
     hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
+    patches = [
+      # Fix for https://github.com/libressl/portable/issues/1278, where LibreSSL
+      # 4.3 started requiring executable stack because some objects were missing
+      # a .note.GNU-stack section; will probably be included in the next release.
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/libressl/portable/4dae91d056c6c75ba5cf2bc5e6148b8e02239119/patches/gnu-stack.patch";
+        hash = "sha256-Q1oWL4N8w5Zmjfq5QkTJR53NgZ4GqChSDaBicli5G2I=";
+        # This patch is written to be applied with -p0, with no leading path
+        # component, but Nix applies with -p1 by default, so we add it to not
+        # break compatibility with how other patches must be applied.
+        decode = "sed 's|^--- |--- a/|; s|^+++ |+++ b/|'";
+      })
+    ];
   };
 }

From 2b8ed1fe219eb6783afc4081e3ab62e8ee99ee39 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Tue, 12 May 2026 22:44:31 +0200
Subject: [PATCH 0106/1209] audit: 4.1.2-unstable-2025-09-06 -> 4.1.4

Upstream diff: https://github.com/linux-audit/audit-userspace/compare/cb13fe75ee2c36d5c525ed9de22aae10dbc8caf4...v4.1.4

Adds support for io_uring and syscalls of Linux 7.0 kernels.
---
 pkgs/by-name/au/audit/package.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix
index 197df3501597..3b2389e7843c 100644
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -30,13 +30,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "4.1.2-unstable-2025-09-06"; # fixes to non-static builds right after 4.1.2 release
+  version = "4.1.4";
 
   src = fetchFromGitHub {
     owner = "linux-audit";
     repo = "audit-userspace";
-    rev = "cb13fe75ee2c36d5c525ed9de22aae10dbc8caf4";
-    hash = "sha256-NX0TWA+LtcZgbM9aQfokWv2rGNAAb3ksGqAH8URAkYM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GdJ9nzlDAdOazOHH/YWuEoELrJh+G5ZJUKwIqAKAzpo=";
   };
 
   postPatch = ''
@@ -132,10 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Instead, we load audit rules in a dedicated module.
   postFixup = ''
     moveToOutput bin/augenrules $scripts
-    substituteInPlace $scripts/bin/augenrules \
-      --replace-fail "/sbin/auditctl -R" "$bin/bin/auditctl -R" \
-      --replace-fail "auditctl -s" "$bin/bin/auditctl -s" \
-      --replace-fail "/bin/ls" "ls"
     wrapProgram $scripts/bin/augenrules \
       --prefix PATH : ${
         lib.makeBinPath [

From 6c0ee887326898b4baae9a977347ca05b0fde76c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:37:53 +0300
Subject: [PATCH 0107/1209] glslang: 16.2.0 -> 16.3.0

Diff: https://github.com/KhronosGroup/glslang/compare/16.2.0...16.3.0
---
 pkgs/by-name/gl/glslang/external-gtest.patch | 69 --------------------
 pkgs/by-name/gl/glslang/package.nix          | 10 +--
 2 files changed, 2 insertions(+), 77 deletions(-)
 delete mode 100644 pkgs/by-name/gl/glslang/external-gtest.patch

diff --git a/pkgs/by-name/gl/glslang/external-gtest.patch b/pkgs/by-name/gl/glslang/external-gtest.patch
deleted file mode 100644
index 3477b7584bfc..000000000000
--- a/pkgs/by-name/gl/glslang/external-gtest.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From ab20ba112e6fa5117bfeadde199fdc6c18cbdfb5 Mon Sep 17 00:00:00 2001
-From: OPNA2608 <opna2608@protonmail.com>
-Date: Mon, 12 Jan 2026 16:41:53 +0100
-Subject: [PATCH] Look for external gtest build, if not building in-tree
-
----
- CMakeLists.txt        | 12 ++++++++++++
- gtests/CMakeLists.txt |  8 +++-----
- 2 files changed, 15 insertions(+), 5 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 1e7d3ec9..ecda9c53 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -321,6 +321,18 @@ if(ENABLE_GLSLANG_BINARIES)
-     add_subdirectory(StandAlone)
- endif()
- 
-+option(ALLOW_EXTERNAL_GTEST "Allows to build against installed googletest. This is unsupported if the commit isn't the one in known_good.json")
-+set(GMOCK_TARGET gmock)
-+if(NOT TARGET ${GMOCK_TARGET})
-+    if(ALLOW_EXTERNAL_GTEST)
-+        message(STATUS "Trying to find local googletest")
-+        find_package(GTest)
-+        if(TARGET GTest::gmock)
-+            set(GMOCK_TARGET GTest::gmock)
-+        endif()
-+    endif()
-+endif()
-+
- if(GLSLANG_TESTS)
-     enable_testing()
-     add_subdirectory(gtests)
-diff --git a/gtests/CMakeLists.txt b/gtests/CMakeLists.txt
-index 27a5500c..21125775 100644
---- a/gtests/CMakeLists.txt
-+++ b/gtests/CMakeLists.txt
-@@ -32,7 +32,7 @@
- # POSSIBILITY OF SUCH DAMAGE.
- 
- if(GLSLANG_TESTS)
--    if(TARGET gmock)
-+    if(TARGET ${GMOCK_TARGET})
-         message(STATUS "Google Mock found - building tests")
- 
-         set(TEST_SOURCES
-@@ -76,9 +76,7 @@ if(GLSLANG_TESTS)
-                                    PRIVATE GLSLANG_TEST_BUILD=1)
-         target_include_directories(glslangtests PRIVATE
-                                    ${CMAKE_CURRENT_SOURCE_DIR}
--                                   ${PROJECT_SOURCE_DIR}
--                                   ${gmock_SOURCE_DIR}/include
--                                   ${gtest_SOURCE_DIR}/include)
-+                                   ${PROJECT_SOURCE_DIR})
- 
-         if(ENABLE_OPT)
-             target_link_libraries(glslangtests
-@@ -90,7 +88,7 @@ if(GLSLANG_TESTS)
-             glslang glslang-default-resource-limits
-             $<$<AND:$<CXX_COMPILER_ID:GNU>,$<VERSION_LESS:$<CXX_COMPILER_VERSION>,9.0>>:stdc++fs>)
- 
--        target_link_libraries(glslangtests PRIVATE ${LIBRARIES} gmock)
-+        target_link_libraries(glslangtests PRIVATE ${LIBRARIES} ${GMOCK_TARGET})
- 
-         # The TARGET_RUNTIME_DLL_DIRS feature requires CMake 3.27 or greater.
-         if(WIN32 AND BUILD_SHARED_LIBS AND CMAKE_VERSION VERSION_LESS "3.27")
--- 
-2.51.2
-
diff --git a/pkgs/by-name/gl/glslang/package.nix b/pkgs/by-name/gl/glslang/package.nix
index 3af77636355d..0d7fe92908c8 100644
--- a/pkgs/by-name/gl/glslang/package.nix
+++ b/pkgs/by-name/gl/glslang/package.nix
@@ -12,21 +12,15 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "glslang";
-  version = "16.2.0";
+  version = "16.3.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     tag = finalAttrs.version;
-    hash = "sha256-2uWnZZNGdZorHaiLzMb/rpM6bL9oBClKqiFkUH3krJQ=";
+    hash = "sha256-wclcJ0NfqFXSUHGVsxjn2I8XxWbrkzOB4WXqsN1XtmE=";
   };
 
-  patches = [
-    # Allow building against our already-built gtest, without eating a rebuild
-    # https://github.com/KhronosGroup/glslang/pull/4140
-    ./external-gtest.patch
-  ];
-
   outputs = [
     "bin"
     "out"

From b3147b179a9b64b835c6cc6ad88c3dc5021b3739 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:37:57 +0300
Subject: [PATCH 0108/1209] vulkan-headers: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-Headers/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-headers/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-headers/package.nix b/pkgs/by-name/vu/vulkan-headers/package.nix
index 65d0a32fdfd9..956a3725941a 100644
--- a/pkgs/by-name/vu/vulkan-headers/package.nix
+++ b/pkgs/by-name/vu/vulkan-headers/package.nix
@@ -7,7 +7,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-headers";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   # Adding `ninja` here to enable Ninja backend. Otherwise on gcc-14 or
   # later the build fails as:
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-R/t0mAhNX+jREDVIFnv0agB9qtcnRb06K4OHtLRxWow=";
+    hash = "sha256-RcUVurC+Rc0MyWpQLaLVmdn7FZO1GWWzTZZAOwvKwb4=";
   };
 
   passthru.updateScript = ./update.sh;

From c2b36e9c51e7c167e296b0fc9c95968731efefff Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:00 +0300
Subject: [PATCH 0109/1209] vulkan-loader: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-Loader/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-loader/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-loader/package.nix b/pkgs/by-name/vu/vulkan-loader/package.nix
index a0f31bfc1014..3987debfef12 100644
--- a/pkgs/by-name/vu/vulkan-loader/package.nix
+++ b/pkgs/by-name/vu/vulkan-loader/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-loader";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-OcguNyi1yZ2OMnI2HSrx+pYvk4RHbn6IGZqnYwWGmB0=";
+    hash = "sha256-jgibBetbMpqRJ+OJpJgNxgC6phECewNqtla9CCJj56U=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];

From 353dd30c46cf461890e9903976178e16f6cfff4e Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:05 +0300
Subject: [PATCH 0110/1209] vulkan-validation-layers: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-ValidationLayers/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-validation-layers/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-validation-layers/package.nix b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
index 5e4834e111a2..432825de08fc 100644
--- a/pkgs/by-name/vu/vulkan-validation-layers/package.nix
+++ b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-validation-layers";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-xUeMqtQ7bR3P50yQN5TXVzCO9Ugp9tUyFMtYnvc3g8s=";
+    hash = "sha256-3qUZP/R29eqTR4IAWH6jBGgmRqE0d1ahcdKbxUOAmTY=";
   };
 
   strictDeps = true;

From f86d7dfdee90d252f21603919561f662a39f3588 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:08 +0300
Subject: [PATCH 0111/1209] vulkan-tools: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-Tools/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-tools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-tools/package.nix b/pkgs/by-name/vu/vulkan-tools/package.nix
index 826602ba462e..f6bbd8c69f5b 100644
--- a/pkgs/by-name/vu/vulkan-tools/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-+5BL28h7+r+mLr1Tr7UT4UEB8jRrIc2JwoasJ7HzxI0=";
+    hash = "sha256-qtEq1ZQT5JXE4bXzy8W053CRF/dOFVV7d7NE9uNYssI=";
   };
 
   patches = [ ./wayland-scanner.patch ];

From de214862bb241fe227fb8f3993afcadcc1a41c14 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:12 +0300
Subject: [PATCH 0112/1209] vulkan-tools-lunarg: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/LunarG/VulkanTools/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-tools-lunarg/package.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
index 89c59d98e8e2..7ccc9cfa11cc 100644
--- a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-tools-lunarg";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "LunarG";
     repo = "VulkanTools";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-y/xTeEBjhDBlB0qcWUe159SvsRa5tBLUy6FZSmupQsU=";
+    hash = "sha256-tKt/OrGIVfg2/aK9dYPuOB4+05ayUheP9T7Ny5MfWTk=";
   };
 
   nativeBuildInputs = [
@@ -61,7 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxcb-keysyms
     libxcb-wm
     qt6.qtbase
-    qt6.qtwayland
   ];
 
   cmakeFlags = [

From 8924c245e7e8c9ae432e405038eb778022e2eb20 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:16 +0300
Subject: [PATCH 0113/1209] vulkan-extension-layer: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-ExtensionLayer/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-extension-layer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-extension-layer/package.nix b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
index 1be76857c00f..eb36c08cf7ce 100644
--- a/pkgs/by-name/vu/vulkan-extension-layer/package.nix
+++ b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-extension-layer";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-Qj2sZ9O3WNDb7thv5PzWmONIKBO6hXwz0wQ0PobFgvg=";
+    hash = "sha256-6ZtPp6OqzzppmijIU1/77qcUvwCck/eMZOUh5pSwVc8=";
   };
 
   nativeBuildInputs = [

From e494c9581f738b7ec34c1e972308a5226ab557d8 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:19 +0300
Subject: [PATCH 0114/1209] vulkan-utility-libraries: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-Utility-Libraries/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-utility-libraries/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
index b6f8c7ff3e5b..2ea2fc62a0be 100644
--- a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
+++ b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-QB9U7Nj2jRTYlHql/qUuwpWoEQ+/T/cVYvs+zKXUUfw=";
+    hash = "sha256-E0T5eSI30eDB7//6srjwlkX9HfUp1UiyCPWDyK+ZEi8=";
   };
 
   nativeBuildInputs = [

From b0cff5e20f3598e0bf581ab2942614bb49a69d00 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:39:35 +0300
Subject: [PATCH 0115/1209] spirv-cross: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/SPIRV-Cross/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0

Changelog: https://github.com/KhronosGroup/SPIRV-Cross/releases/tag/vulkan-sdk-1.4.350.0
---
 pkgs/by-name/sp/spirv-cross/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sp/spirv-cross/package.nix b/pkgs/by-name/sp/spirv-cross/package.nix
index 81ba6c313fa8..ed353a8f884a 100644
--- a/pkgs/by-name/sp/spirv-cross/package.nix
+++ b/pkgs/by-name/sp/spirv-cross/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-F3/j2+B/qv3sDiOiOy1OhR9G+DnM7I4LJqljZXL4S7Q=";
+    hash = "sha256-JdVAS5uVSfe0mOGtyodkgmvgD4of9Amq8PbDSAtgaXc=";
   };
 
   nativeBuildInputs = [

From c832986da6f651660d271194dad9f951c1719fa9 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:22 +0300
Subject: [PATCH 0116/1209] vulkan-volk: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/zeux/volk/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-volk/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-volk/package.nix b/pkgs/by-name/vu/vulkan-volk/package.nix
index 52ae5b0de349..613867ceee19 100644
--- a/pkgs/by-name/vu/vulkan-volk/package.nix
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "volk";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-jAXUwejUJGc8H+2lDGLHIlrI0sdzQbnJ+ZNbZHYdFX8=";
+    hash = "sha256-7JsOWhMTnxeJfsTVgnnHQt5gYJ8tqELT+s3VDHTPof8=";
   };
 
   nativeBuildInputs = [ cmake ];

From ea3998dd4348525ca588cb7ffa797b57f8457ba6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:39:40 +0300
Subject: [PATCH 0117/1209] spirv-tools: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/SPIRV-Tools/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/sp/spirv-tools/package.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sp/spirv-tools/package.nix b/pkgs/by-name/sp/spirv-tools/package.nix
index e08ae33d33e6..16a2bdef93e7 100644
--- a/pkgs/by-name/sp/spirv-tools/package.nix
+++ b/pkgs/by-name/sp/spirv-tools/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   python3,
   spirv-headers,
@@ -9,18 +10,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-tools";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-8haVqfmTBvNuv5jEc/LaAO34pWjTZAJ04FIxuxfJNUc=";
+    hash = "sha256-tR3POZH/LXaAljMUS9aHBBvIvlr6o7d6+YUtJCRMS1w=";
   };
 
   patches = [
     # https://github.com/KhronosGroup/SPIRV-Tools/pull/6483
     ./0001-Fix-generated-pkg-config-modules-with-absolute-insta.patch
+
+    # backport to fix glslang tests
+    # FIXME: remove in next update
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/2ec8457ab33d539b6f1fecc998360c0b8b05ed4f.diff";
+      hash = "sha256-YHbYBwXMm4rTKpmMW6I3LUafhA4RuNUdXqUBUAXwXpE=";
+    })
   ]
   # The cmake options are sufficient for turning on static building, but not
   # for disabling shared building, just trim the shared lib from the CMake

From bbfc13f3fe4253beda6d14bc9dcaa84cdd4e08da Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:25 +0300
Subject: [PATCH 0118/1209] spirv-headers: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/SPIRV-Headers/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/sp/spirv-headers/package.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sp/spirv-headers/package.nix b/pkgs/by-name/sp/spirv-headers/package.nix
index 95a5f55b4cf2..3f4c75ed5962 100644
--- a/pkgs/by-name/sp/spirv-headers/package.nix
+++ b/pkgs/by-name/sp/spirv-headers/package.nix
@@ -2,20 +2,30 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-headers";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-aYKFJxRDoY/Cor8gYVoR/YSyXWSNtcRG0HK8BZH0Ztk=";
+    hash = "sha256-nwzhJlkdN8DaExHvnuVc5rZmlrkPYb7Qmj1fx3O5Zpw=";
   };
 
+  patches = [
+    # backport to fix glslang tests
+    # FIXME: remove in next update
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/1a22b167081842915a1c78a0b5b5a353a23284aa.diff";
+      hash = "sha256-XUHfPHnk7bWK4vnozfW/84vaZN+rbFJUZSa6Og8GUAU=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   meta = {

From 3b9aea2467ea586ad703b1e390fd7f0a47f4a206 Mon Sep 17 00:00:00 2001
From: Vilem Liepelt <17603372+buggymcbugfix@users.noreply.github.com>
Date: Wed, 13 May 2026 10:36:23 +0200
Subject: [PATCH 0119/1209] sqlite: 3.51.2 -> 3.53.1

---
 pkgs/development/libraries/sqlite/default.nix | 6 +++---
 pkgs/development/libraries/sqlite/tools.nix   | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 54b4ef4557f2..bc27578cda3d 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -28,17 +28,17 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.51.2";
+  version = "3.53.1";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2026/sqlite-src-${archiveVersion version}.zip";
-    hash = "sha256-hREPdi1QeUFNmd1deRe8P/fgWHbmzL0T2ElqOBfyCCk=";
+    hash = "sha256-GytXVdkGTE1dGwv1MHtIsImWPikcQMxzUTGKobYcRg4=";
   };
   docsrc = fetchurl {
     url = "https://sqlite.org/2026/sqlite-doc-${archiveVersion version}.zip";
-    hash = "sha256-xuMNB8XpwSaQHFTY18kKnBo3B4JFUX8GCzxpxN5Dv10=";
+    hash = "sha256-n9Bgv33YwseOdBHQb7gdyKqgWeth7sgMZeBlioVFtDM=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 932366a1b595..9755b3733273 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -19,14 +19,14 @@ let
     }:
     stdenv.mkDerivation rec {
       inherit pname;
-      version = "3.51.2";
+      version = "3.53.1";
 
       # nixpkgs-update: no auto update
       src =
         assert version == sqlite.version;
         fetchurl {
           url = "https://sqlite.org/2026/sqlite-src-${archiveVersion version}.zip";
-          hash = "sha256-hREPdi1QeUFNmd1deRe8P/fgWHbmzL0T2ElqOBfyCCk=";
+          hash = "sha256-GytXVdkGTE1dGwv1MHtIsImWPikcQMxzUTGKobYcRg4=";
         };
 
       nativeBuildInputs = [ unzip ];

From fad1bd870d529e9739978d06206156d64034da8e Mon Sep 17 00:00:00 2001
From: n0099 <git@n0099.com>
Date: Wed, 13 May 2026 12:48:32 +0000
Subject: [PATCH 0120/1209] guile: set `meta.mainProgram`

---
 pkgs/development/interpreters/guile/3.0.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index d400a4059cec..beddf97c4dde 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -193,5 +193,6 @@ builder rec {
     license = lib.licenses.lgpl3Plus;
     maintainers = [ ];
     platforms = lib.platforms.all;
+    mainProgram = "guile";
   };
 }

From 61b63e8b5a57f9d3a75b03f698e1f31cc5ce55c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 13 May 2026 20:09:18 +0200
Subject: [PATCH 0121/1209] python314Packages.gast: remove astunparse

Not required since https://github.com/serge-sans-paille/gast/commit/c9d91d26a21d9951f43f4ea5beeafa682757644f
---
 pkgs/development/python-modules/gast/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/gast/default.nix b/pkgs/development/python-modules/gast/default.nix
index 35f3906c1576..8151bbace629 100644
--- a/pkgs/development/python-modules/gast/default.nix
+++ b/pkgs/development/python-modules/gast/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  astunparse,
   buildPythonPackage,
   fetchFromGitHub,
   pytestCheckHook,
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
   nativeCheckInputs = [
-    astunparse
     pytestCheckHook
   ];
 

From fbe89543131df4abbc8fb9b368bdbe0a42566e1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 13 May 2026 02:41:42 +0200
Subject: [PATCH 0122/1209] python314Packages.astunparse: drop not required
 wheel dependency

---
 pkgs/development/python-modules/astunparse/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/astunparse/default.nix b/pkgs/development/python-modules/astunparse/default.nix
index fdff2e83ebf9..558d7bd2dea8 100644
--- a/pkgs/development/python-modules/astunparse/default.nix
+++ b/pkgs/development/python-modules/astunparse/default.nix
@@ -3,7 +3,6 @@
   fetchPypi,
   buildPythonPackage,
   six,
-  wheel,
 }:
 
 buildPythonPackage rec {
@@ -18,7 +17,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     six
-    wheel
   ];
 
   # tests not included with pypi release

From a14b8f95cc4d7f8b2e75f701501c0544c417a041 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 13 May 2026 02:41:52 +0200
Subject: [PATCH 0123/1209] python314Packages.astunparse: set pyproject = true

---
 pkgs/development/python-modules/astunparse/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/astunparse/default.nix b/pkgs/development/python-modules/astunparse/default.nix
index 558d7bd2dea8..8f367a1a15ee 100644
--- a/pkgs/development/python-modules/astunparse/default.nix
+++ b/pkgs/development/python-modules/astunparse/default.nix
@@ -2,20 +2,23 @@
   lib,
   fetchPypi,
   buildPythonPackage,
+  setuptools,
   six,
 }:
 
 buildPythonPackage rec {
   pname = "astunparse";
   version = "1.6.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "5ad93a8456f0d084c3456d059fd9a92cce667963232cbf763eac3bc5b7940872";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     six
   ];
 

From f52e868a2efa822f943113badb06dad709ade9c1 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Wed, 13 May 2026 16:05:47 -0400
Subject: [PATCH 0124/1209] buildGoModule: supported structuredAttrs with
 subPackages

---
 pkgs/build-support/go/module.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index ea266422c6d8..a98f89f5e730 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -320,10 +320,15 @@ lib.extendMkDerivation {
               }
 
               getGoDirs() {
-                local type;
-                type="$1"
-                if [ -n "$subPackages" ]; then
-                  echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+                local -r type="$1"
+
+                # Support strucuredAttrs, they are not space seperated
+                local -a subPackagesArray
+                concatTo subPackagesArray subPackages
+
+                # Outputs each element prefixed with './' if the array is not empty
+                if [[ ''${#subPackagesArray[@]} -gt 0 ]]; then
+                  echo "''${subPackagesArray[*]/#/./}"
                 else
                   find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
                 fi

From 4f7994e44a1e5893a8400dd97e26b2ed2c523f72 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Wed, 13 May 2026 16:08:13 -0400
Subject: [PATCH 0125/1209] neo-cowsaw: to __structuredAttrs = true

test for structuredAttrs & subPackages
---
 pkgs/by-name/ne/neo-cowsay/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ne/neo-cowsay/package.nix b/pkgs/by-name/ne/neo-cowsay/package.nix
index efcb0d4c60b8..209951938481 100644
--- a/pkgs/by-name/ne/neo-cowsay/package.nix
+++ b/pkgs/by-name/ne/neo-cowsay/package.nix
@@ -15,6 +15,7 @@ buildGoModule (finalAttrs: {
     hash = "sha256-DmIjqBTIzwkQ8aJ6xCgIwjDtczlTH5AKbPKFUGx3qQ8=";
   };
 
+  __structuredAttrs = true;
   vendorHash = "sha256-gBURmodXkod4fukw6LWEY+MBxPcf4vn/f6K78UR77n0=";
 
   modRoot = "./cmd";

From b7da8e825ddf25cf8d6df1eb9ef2165a2804f944 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Sun, 3 May 2026 18:14:12 -0500
Subject: [PATCH 0126/1209] luaPackages.dkjson: 2.8-2 -> 2.9-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index d2a2d743fb19..fd51a4161f37 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -720,15 +720,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "dkjson";
-      version = "2.8-2";
+      version = "2.9-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/dkjson-2.8-2.rockspec";
-          sha256 = "0hr4vfmf64kvmqbnr1vx4p6gl3mmiq1hg5jd60rqwplsiaib2r67";
+          url = "mirror://luarocks/dkjson-2.9-1.rockspec";
+          sha256 = "1nxm2ncjdx1yh4lb4v5jab826069idimqbxikapf6hdv0n9m1h90";
         }).outPath;
       src = fetchurl {
-        url = "https://dkolf.de/dkjson-lua/dkjson-2.8.tar.gz";
-        sha256 = "0chmlcv8498n313x19aampwvz2s1pp4zpcvvxdhwihcixcxwvs14";
+        url = "https://dkolf.de/dkjson-lua/dkjson-2.9.tar.gz";
+        sha256 = "0qwszsny4g58pb8hzm1wlsp6gvmjiywgcydim6w1bgdnq66x5dvs";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.6";

From 8e730cb76072abfa046465399edad890ca75328e Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Wed, 13 May 2026 19:37:45 -0500
Subject: [PATCH 0127/1209] luaPackages.dkjson: 2.9-1 -> 2.10-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index fd51a4161f37..75393ee5533b 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -720,15 +720,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "dkjson";
-      version = "2.9-1";
+      version = "2.10-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/dkjson-2.9-1.rockspec";
-          sha256 = "1nxm2ncjdx1yh4lb4v5jab826069idimqbxikapf6hdv0n9m1h90";
+          url = "mirror://luarocks/dkjson-2.10-1.rockspec";
+          sha256 = "0h49fv93h6n32xwwgwvrhb6w5rzvgjzyls6m9xhmcd94pbkih8v2";
         }).outPath;
       src = fetchurl {
-        url = "https://dkolf.de/dkjson-lua/dkjson-2.9.tar.gz";
-        sha256 = "0qwszsny4g58pb8hzm1wlsp6gvmjiywgcydim6w1bgdnq66x5dvs";
+        url = "https://dkolf.de/dkjson-lua/dkjson-2.10.tar.gz";
+        sha256 = "092v9m13h7zl89qfgywbs22wdvniwr2lr3shjqrn91f4nl39xiz8";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.6";

From 2351a8df54be7484c7da7f6fbe1f24ac1db7a0e4 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 12 May 2026 18:15:13 -0400
Subject: [PATCH 0128/1209] minimal-bootstrap: only create one derivation for
 mes sources

Co-authored-by: Aleksi Hannula <ahannula4+nixgit@gmail.com>
---
 .../linux/minimal-bootstrap/mes/default.nix   |   61 +-
 .../minimal-bootstrap/mes/gen-sources.sh      |   32 +-
 .../linux/minimal-bootstrap/mes/libc.nix      |   28 +-
 .../linux/minimal-bootstrap/mes/sources.json  | 2348 +----------------
 4 files changed, 110 insertions(+), 2359 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
index 36849236ee6c..7c3335ed1f21 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
@@ -1,3 +1,8 @@
+let
+  sourcesJson = (builtins.fromJSON (builtins.readFile ./sources.json));
+  inherit (builtins) split filter isString;
+in
+
 {
   lib,
   fetchurl,
@@ -57,7 +62,7 @@ let
     }
     .${buildPlatform.system};
 
-  sources = (lib.importJSON ./sources.json).${arch}.linux.mescc;
+  sources = sourcesJson."${arch}.linux.mescc";
 
   inherit (sources)
     libc_mini_SOURCES
@@ -67,7 +72,7 @@ let
     ;
 
   # add symlink() to libc+tcc so we can use it in ln-boot
-  libc_tcc_SOURCES = sources.libc_tcc_SOURCES ++ [ "lib/linux/symlink.c" ];
+  libc_tcc_SOURCES = "${sources.libc_tcc_SOURCES} lib/linux/symlink.c";
   setjmp_x86_64 = ./setjmp_x86_64.c;
 
   meta = {
@@ -254,39 +259,31 @@ let
 
   CC = toString ([ cc ] ++ ccArgs);
 
-  stripExt = source: lib.replaceStrings [ ".c" ] [ "" ] (baseNameOf source);
-
-  compile =
-    source:
-    kaem.runCommand (stripExt source) { } ''
-      mkdir ''${out}
-      cd ''${out}
-      ${CC} -c ${srcPrefix}/${source}
-    '';
-
-  crt1 = compile "/lib/linux/${arch}-mes-mescc/crt1.c";
-
-  getRes = suffix: res: "${res}/${res.name}${suffix}";
-
-  archive = out: sources: "catm ${out} ${lib.concatMapStringsSep " " (getRes ".o") sources}";
-  sourceArchive = out: sources: "catm ${out} ${lib.concatMapStringsSep " " (getRes ".s") sources}";
+  crt1 =
+    kaem.runCommand "${pname}-crt1-${version}"
+      {
+        inherit meta;
+      }
+      ''
+        mkdir ''${out}
+        cd ''${out}
+        ${CC} -c ${srcPrefix}/lib/linux/${arch}-mes-mescc/crt1.c
+      '';
 
   mkLib =
     libname: sources:
-    let
-      os = map compile sources;
-    in
     kaem.runCommand "${pname}-${libname}-${version}"
       {
         inherit meta;
       }
       ''
+        cd ${srcPost}/mes-${version}
         LIBDIR=''${out}/lib
         mkdir -p ''${LIBDIR}
-        cd ''${LIBDIR}
+        catm ''${LIBDIR}/${libname}.c ${sources}
 
-        ${archive "${libname}.a" os}
-        ${sourceArchive "${libname}.s" os}
+        ${CC} -S -o ''${LIBDIR}/${libname}.s ''${out}/lib/${libname}.c
+        ${CC} -c -o ''${LIBDIR}/${libname}.a ''${LIBDIR}/${libname}.s
       '';
 
   libc-mini = mkLib "libc-mini" libc_mini_SOURCES;
@@ -338,6 +335,9 @@ let
 
   # Build mes itself
   compiler =
+    let
+      objs = filter isString (split " " mes_SOURCES);
+    in
     kaem.runCommand "${pname}-${version}"
       {
         inherit pname version;
@@ -353,8 +353,19 @@ let
       }
       ''
         mkdir -p ''${out}/bin
+        ${lib.concatMapStringsSep "\n" (obj: ''
+          ${srcPost.bin}/bin/mes-m2 -e main ${srcPost.bin}/bin/mescc.scm -- \
+            -D HAVE_CONFIG_H=1 \
+            -I ${srcPrefix}/include \
+            -I ${srcPrefix}/include/linux/${arch} \
+            -I ${srcPost}/mes-${version}/src \
+            -c \
+            -o ${lib.removePrefix "src/" obj}.o \
+            ${srcPost}/mes-${version}/${obj}
+        '') objs}
 
         ${srcPost.bin}/bin/mes-m2 -e main ${srcPost.bin}/bin/mescc.scm -- \
+          -I ${srcPost}/mes-${version}/src \
           -L ''${srcPrefix}/lib \
           -L ${libs}/lib \
           -lc \
@@ -362,7 +373,7 @@ let
           -nostdlib \
           -o ''${out}/bin/mes \
           ${libs}/lib/${arch}-mes/crt1.o \
-          ${lib.concatMapStringsSep " " (getRes ".o") (map compile mes_SOURCES)}
+          ${lib.concatMapStringsSep " " (obj: "${lib.removePrefix "src/" obj}.o") objs}
       '';
 in
 {
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh b/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
index fcee9605e42c..a3a0b5c2e05c 100755
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
@@ -17,13 +17,15 @@ ARCHS="x86 x86_64"
 KERNELS="linux"
 COMPILERS="mescc gcc"
 
+to_json_joined_string() {
+  printf '%s\n' "$@" | jq --raw-input --null-input '[inputs]|join(" ")'
+}
 
-to_json_array() {
-  if [ $# -eq 0 ]; then
-    echo '[]'
-  else
-    printf '%s\n' "$@" | jq --raw-input --null-input '[inputs]'
-  fi
+to_json_joined_string_1() {
+  printf '%s\n' "$@" | jq --raw-input --null-input '[inputs]|.[0:100]|join(" ")'
+}
+to_json_joined_string_2() {
+  printf '%s\n' "$@" | jq --raw-input --null-input '[inputs]|.[100:]|join(" ")'
 }
 
 gen_sources() {
@@ -38,20 +40,22 @@ gen_sources() {
 
   jq --null-input \
     --arg key "$mes_cpu.$mes_kernel.$compiler" \
-    --argjson libc_mini_SOURCES "$(to_json_array $libc_mini_SOURCES)" \
-    --argjson libmescc_SOURCES "$(to_json_array $libmescc_SOURCES)" \
-    --argjson libtcc1_SOURCES "$(to_json_array $libtcc1_SOURCES)" \
-    --argjson libc_SOURCES "$(to_json_array $libc_SOURCES)" \
-    --argjson libc_tcc_SOURCES "$(to_json_array $libc_tcc_SOURCES)" \
-    --argjson libc_gnu_SOURCES "$(to_json_array $libc_gnu_SOURCES)" \
-    --argjson mes_SOURCES "$(to_json_array $mes_SOURCES)" \
+    --argjson libc_mini_SOURCES "$(to_json_joined_string $libc_mini_SOURCES)" \
+    --argjson libmescc_SOURCES "$(to_json_joined_string $libmescc_SOURCES)" \
+    --argjson libtcc1_SOURCES "$(to_json_joined_string $libtcc1_SOURCES)" \
+    --argjson libc_SOURCES "$(to_json_joined_string $libc_SOURCES)" \
+    --argjson libc_tcc_SOURCES "$(to_json_joined_string $libc_tcc_SOURCES)" \
+    --argjson libc_gnu1_SOURCES "$(to_json_joined_string_1 $libc_gnu_SOURCES)" \
+    --argjson libc_gnu2_SOURCES "$(to_json_joined_string_2 $libc_gnu_SOURCES)" \
+    --argjson mes_SOURCES "$(to_json_joined_string $mes_SOURCES)" \
     '{($key): {
       libc_mini_SOURCES: $libc_mini_SOURCES,
       libmescc_SOURCES: $libmescc_SOURCES,
       libtcc1_SOURCES: $libtcc1_SOURCES,
       libc_SOURCES: $libc_SOURCES,
       libc_tcc_SOURCES: $libc_tcc_SOURCES,
-      libc_gnu_SOURCES: $libc_gnu_SOURCES,
+      libc_gnu1_SOURCES: $libc_gnu1_SOURCES,
+      libc_gnu2_SOURCES: $libc_gnu2_SOURCES,
       mes_SOURCES: $mes_SOURCES
     }}'
 }
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
index d6dc9fa97787..edf1a2f15640 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
@@ -1,9 +1,12 @@
+let
+  sourcesJson = (builtins.fromJSON (builtins.readFile ./sources.json));
+in
+
 {
   lib,
   kaem,
   ln-boot,
   mes,
-  mes-libc,
   buildPlatform,
   fetchurl,
 }:
@@ -18,8 +21,13 @@ let
     }
     .${buildPlatform.system};
 
-  sources = (lib.importJSON ./sources.json).${arch}.linux.gcc;
-  inherit (sources) libtcc1_SOURCES libc_gnu_SOURCES;
+  sources = sourcesJson."${arch}.linux.gcc";
+  inherit (sources) libtcc1_SOURCES libc_gnu1_SOURCES libc_gnu2_SOURCES;
+
+  ldexpl = fetchurl {
+    url = "https://gitlab.com/janneke/mes/-/raw/c837abed8edb341d4e56913729fbe9803b4de47c/lib/math/ldexpl.c";
+    hash = "sha256-3QoFZZIqVmlMUosEqOdYIMEHzYgQ7GJ7Hz0Bf/1iIig=";
+  };
 
   # Concatenate all source files into a convenient bundle
   # "gcc" variants of source files (eg. "lib/linux/x86-mes-gcc") can also be
@@ -27,14 +35,14 @@ let
   #
   # Passing this many arguments is too much for kaem so we need to split
   # the operation in two
-  firstLibc = (lib.take 100 libc_gnu_SOURCES) ++ [ ./ldexpl.c ];
-  lastLibc = lib.drop 100 libc_gnu_SOURCES;
+  firstLibc = libc_gnu1_SOURCES + " ${ldexpl}";
+  lastLibc = libc_gnu2_SOURCES;
 in
 kaem.runCommand "${pname}-${version}"
   {
     inherit pname version;
 
-    nativeBuildInputs = [ ln-boot ];
+    extraPath = "${ln-boot}/bin";
 
     passthru.CFLAGS = "-std=c11";
 
@@ -56,8 +64,8 @@ kaem.runCommand "${pname}-${version}"
     mkdir -p ''${out}/lib/${arch}-mes
 
     # libc.c
-    catm ''${TMPDIR}/first.c ${lib.concatStringsSep " " firstLibc}
-    catm ''${out}/lib/libc.c ''${TMPDIR}/first.c ${lib.concatStringsSep " " lastLibc}
+    catm ''${TMPDIR}/first.c ${firstLibc}
+    catm ''${out}/lib/libc.c ''${TMPDIR}/first.c ${lastLibc}
 
     # crt{1,n,i}.c
     cp lib/linux/${arch}-mes-gcc/crt1.c ''${out}/lib
@@ -65,11 +73,11 @@ kaem.runCommand "${pname}-${version}"
     cp lib/linux/${arch}-mes-gcc/crti.c ''${out}/lib
 
     # libtcc1.c
-    catm ''${out}/lib/libtcc1.c ${lib.concatStringsSep " " libtcc1_SOURCES}
+    catm ''${out}/lib/libtcc1.c ${libtcc1_SOURCES}
 
     # getopt.c
     cp lib/posix/getopt.c ''${out}/lib/libgetopt.c
 
     # Install headers
-    ln -s ${mes.srcPrefix}/include ''${out}/include
+    ${ln-boot}/bin/ln -s ${mes.srcPrefix}/include ''${out}/include
   ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.json b/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.json
index cca800e197c5..8ca28a1366f5 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.json
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.json
@@ -1,2314 +1,42 @@
 {
-  "x86": {
-    "linux": {
-      "gcc": {
-        "libc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-gcc/_exit.c",
-          "lib/linux/x86-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c"
-        ],
-        "libc_gnu_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-gcc/_exit.c",
-          "lib/linux/x86-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86-mes-gcc/setjmp.c",
-          "lib/ctype/isalnum.c",
-          "lib/ctype/isalpha.c",
-          "lib/ctype/isascii.c",
-          "lib/ctype/iscntrl.c",
-          "lib/ctype/isgraph.c",
-          "lib/ctype/isprint.c",
-          "lib/ctype/ispunct.c",
-          "lib/math/ceil.c",
-          "lib/math/fabs.c",
-          "lib/math/floor.c",
-          "lib/mes/fdgets.c",
-          "lib/posix/alarm.c",
-          "lib/posix/execl.c",
-          "lib/posix/execlp.c",
-          "lib/posix/mktemp.c",
-          "lib/posix/pathconf.c",
-          "lib/posix/sbrk.c",
-          "lib/posix/sleep.c",
-          "lib/posix/unsetenv.c",
-          "lib/stdio/clearerr.c",
-          "lib/stdio/feof.c",
-          "lib/stdio/fgets.c",
-          "lib/stdio/fileno.c",
-          "lib/stdio/freopen.c",
-          "lib/stdio/fscanf.c",
-          "lib/stdio/perror.c",
-          "lib/stdio/vfscanf.c",
-          "lib/stdlib/__exit.c",
-          "lib/stdlib/abort.c",
-          "lib/stdlib/abs.c",
-          "lib/stdlib/alloca.c",
-          "lib/stdlib/atexit.c",
-          "lib/stdlib/atof.c",
-          "lib/stdlib/atol.c",
-          "lib/stdlib/mbstowcs.c",
-          "lib/string/bcmp.c",
-          "lib/string/bcopy.c",
-          "lib/string/bzero.c",
-          "lib/string/index.c",
-          "lib/string/rindex.c",
-          "lib/string/strcspn.c",
-          "lib/string/strdup.c",
-          "lib/string/strerror.c",
-          "lib/string/strncat.c",
-          "lib/string/strpbrk.c",
-          "lib/string/strspn.c",
-          "lib/stub/__cleanup.c",
-          "lib/stub/atan2.c",
-          "lib/stub/bsearch.c",
-          "lib/stub/chown.c",
-          "lib/stub/cos.c",
-          "lib/stub/ctime.c",
-          "lib/stub/exp.c",
-          "lib/stub/fpurge.c",
-          "lib/stub/freadahead.c",
-          "lib/stub/frexp.c",
-          "lib/stub/getgrgid.c",
-          "lib/stub/getgrnam.c",
-          "lib/stub/getlogin.c",
-          "lib/stub/getpgid.c",
-          "lib/stub/getpgrp.c",
-          "lib/stub/getpwnam.c",
-          "lib/stub/getpwuid.c",
-          "lib/stub/gmtime.c",
-          "lib/stub/log.c",
-          "lib/stub/mktime.c",
-          "lib/stub/modf.c",
-          "lib/stub/pclose.c",
-          "lib/stub/popen.c",
-          "lib/stub/pow.c",
-          "lib/stub/rand.c",
-          "lib/stub/rewind.c",
-          "lib/stub/setbuf.c",
-          "lib/stub/setgrent.c",
-          "lib/stub/setlocale.c",
-          "lib/stub/setvbuf.c",
-          "lib/stub/sigaddset.c",
-          "lib/stub/sigblock.c",
-          "lib/stub/sigdelset.c",
-          "lib/stub/sigsetmask.c",
-          "lib/stub/sin.c",
-          "lib/stub/sqrt.c",
-          "lib/stub/strftime.c",
-          "lib/stub/sys_siglist.c",
-          "lib/stub/system.c",
-          "lib/stub/times.c",
-          "lib/stub/ttyname.c",
-          "lib/stub/utime.c",
-          "lib/linux/getegid.c",
-          "lib/linux/geteuid.c",
-          "lib/linux/getgid.c",
-          "lib/linux/getppid.c",
-          "lib/linux/getrusage.c",
-          "lib/linux/getuid.c",
-          "lib/linux/ioctl.c",
-          "lib/linux/mknod.c",
-          "lib/linux/readlink.c",
-          "lib/linux/setgid.c",
-          "lib/linux/settimer.c",
-          "lib/linux/setuid.c",
-          "lib/linux/signal.c",
-          "lib/linux/sigprogmask.c"
-        ],
-        "libc_mini_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-gcc/_exit.c",
-          "lib/linux/x86-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/mes/write.c"
-        ],
-        "libc_tcc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-gcc/_exit.c",
-          "lib/linux/x86-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86-mes-gcc/setjmp.c"
-        ],
-        "libmescc_SOURCES": [
-          "lib/mes/globals.c",
-          "lib/linux/x86-mes-gcc/syscall-internal.c"
-        ],
-        "libtcc1_SOURCES": [
-          "lib/libtcc1.c"
-        ],
-        "mes_SOURCES": [
-          "src/builtins.c",
-          "src/cc.c",
-          "src/core.c",
-          "src/display.c",
-          "src/eval-apply.c",
-          "src/gc.c",
-          "src/globals.c",
-          "src/hash.c",
-          "src/lib.c",
-          "src/math.c",
-          "src/mes.c",
-          "src/module.c",
-          "src/posix.c",
-          "src/reader.c",
-          "src/stack.c",
-          "src/string.c",
-          "src/struct.c",
-          "src/symbol.c",
-          "src/variable.c",
-          "src/vector.c"
-        ]
-      },
-      "mescc": {
-        "libc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-mescc/_exit.c",
-          "lib/linux/x86-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c"
-        ],
-        "libc_gnu_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-mescc/_exit.c",
-          "lib/linux/x86-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86-mes-mescc/setjmp.c",
-          "lib/ctype/isalnum.c",
-          "lib/ctype/isalpha.c",
-          "lib/ctype/isascii.c",
-          "lib/ctype/iscntrl.c",
-          "lib/ctype/isgraph.c",
-          "lib/ctype/isprint.c",
-          "lib/ctype/ispunct.c",
-          "lib/math/ceil.c",
-          "lib/math/fabs.c",
-          "lib/math/floor.c",
-          "lib/mes/fdgets.c",
-          "lib/posix/alarm.c",
-          "lib/posix/execl.c",
-          "lib/posix/execlp.c",
-          "lib/posix/mktemp.c",
-          "lib/posix/pathconf.c",
-          "lib/posix/sbrk.c",
-          "lib/posix/sleep.c",
-          "lib/posix/unsetenv.c",
-          "lib/stdio/clearerr.c",
-          "lib/stdio/feof.c",
-          "lib/stdio/fgets.c",
-          "lib/stdio/fileno.c",
-          "lib/stdio/freopen.c",
-          "lib/stdio/fscanf.c",
-          "lib/stdio/perror.c",
-          "lib/stdio/vfscanf.c",
-          "lib/stdlib/__exit.c",
-          "lib/stdlib/abort.c",
-          "lib/stdlib/abs.c",
-          "lib/stdlib/alloca.c",
-          "lib/stdlib/atexit.c",
-          "lib/stdlib/atof.c",
-          "lib/stdlib/atol.c",
-          "lib/stdlib/mbstowcs.c",
-          "lib/string/bcmp.c",
-          "lib/string/bcopy.c",
-          "lib/string/bzero.c",
-          "lib/string/index.c",
-          "lib/string/rindex.c",
-          "lib/string/strcspn.c",
-          "lib/string/strdup.c",
-          "lib/string/strerror.c",
-          "lib/string/strncat.c",
-          "lib/string/strpbrk.c",
-          "lib/string/strspn.c",
-          "lib/stub/__cleanup.c",
-          "lib/stub/atan2.c",
-          "lib/stub/bsearch.c",
-          "lib/stub/chown.c",
-          "lib/stub/cos.c",
-          "lib/stub/ctime.c",
-          "lib/stub/exp.c",
-          "lib/stub/fpurge.c",
-          "lib/stub/freadahead.c",
-          "lib/stub/frexp.c",
-          "lib/stub/getgrgid.c",
-          "lib/stub/getgrnam.c",
-          "lib/stub/getlogin.c",
-          "lib/stub/getpgid.c",
-          "lib/stub/getpgrp.c",
-          "lib/stub/getpwnam.c",
-          "lib/stub/getpwuid.c",
-          "lib/stub/gmtime.c",
-          "lib/stub/log.c",
-          "lib/stub/mktime.c",
-          "lib/stub/modf.c",
-          "lib/stub/pclose.c",
-          "lib/stub/popen.c",
-          "lib/stub/pow.c",
-          "lib/stub/rand.c",
-          "lib/stub/rewind.c",
-          "lib/stub/setbuf.c",
-          "lib/stub/setgrent.c",
-          "lib/stub/setlocale.c",
-          "lib/stub/setvbuf.c",
-          "lib/stub/sigaddset.c",
-          "lib/stub/sigblock.c",
-          "lib/stub/sigdelset.c",
-          "lib/stub/sigsetmask.c",
-          "lib/stub/sin.c",
-          "lib/stub/sqrt.c",
-          "lib/stub/strftime.c",
-          "lib/stub/sys_siglist.c",
-          "lib/stub/system.c",
-          "lib/stub/times.c",
-          "lib/stub/ttyname.c",
-          "lib/stub/utime.c",
-          "lib/linux/getegid.c",
-          "lib/linux/geteuid.c",
-          "lib/linux/getgid.c",
-          "lib/linux/getppid.c",
-          "lib/linux/getrusage.c",
-          "lib/linux/getuid.c",
-          "lib/linux/ioctl.c",
-          "lib/linux/mknod.c",
-          "lib/linux/readlink.c",
-          "lib/linux/setgid.c",
-          "lib/linux/settimer.c",
-          "lib/linux/setuid.c",
-          "lib/linux/signal.c",
-          "lib/linux/sigprogmask.c"
-        ],
-        "libc_mini_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-mescc/_exit.c",
-          "lib/linux/x86-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/mes/write.c"
-        ],
-        "libc_tcc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-mescc/_exit.c",
-          "lib/linux/x86-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86-mes-mescc/setjmp.c"
-        ],
-        "libmescc_SOURCES": [
-          "lib/mes/globals.c",
-          "lib/linux/x86-mes-mescc/syscall-internal.c"
-        ],
-        "libtcc1_SOURCES": [
-          "lib/libtcc1.c"
-        ],
-        "mes_SOURCES": [
-          "src/builtins.c",
-          "src/cc.c",
-          "src/core.c",
-          "src/display.c",
-          "src/eval-apply.c",
-          "src/gc.c",
-          "src/globals.c",
-          "src/hash.c",
-          "src/lib.c",
-          "src/math.c",
-          "src/mes.c",
-          "src/module.c",
-          "src/posix.c",
-          "src/reader.c",
-          "src/stack.c",
-          "src/string.c",
-          "src/struct.c",
-          "src/symbol.c",
-          "src/variable.c",
-          "src/vector.c"
-        ]
-      }
-    }
+  "x86.linux.gcc": {
+    "libc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-gcc/_exit.c lib/linux/x86-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c",
+    "libc_gnu1_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-gcc/_exit.c lib/linux/x86-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c",
+    "libc_gnu2_SOURCES": "lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86-mes-gcc/setjmp.c lib/ctype/isalnum.c lib/ctype/isalpha.c lib/ctype/isascii.c lib/ctype/iscntrl.c lib/ctype/isgraph.c lib/ctype/isprint.c lib/ctype/ispunct.c lib/math/ceil.c lib/math/fabs.c lib/math/floor.c lib/mes/fdgets.c lib/posix/alarm.c lib/posix/execl.c lib/posix/execlp.c lib/posix/mktemp.c lib/posix/pathconf.c lib/posix/sbrk.c lib/posix/sleep.c lib/posix/unsetenv.c lib/stdio/clearerr.c lib/stdio/feof.c lib/stdio/fgets.c lib/stdio/fileno.c lib/stdio/freopen.c lib/stdio/fscanf.c lib/stdio/perror.c lib/stdio/vfscanf.c lib/stdlib/__exit.c lib/stdlib/abort.c lib/stdlib/abs.c lib/stdlib/alloca.c lib/stdlib/atexit.c lib/stdlib/atof.c lib/stdlib/atol.c lib/stdlib/mbstowcs.c lib/string/bcmp.c lib/string/bcopy.c lib/string/bzero.c lib/string/index.c lib/string/rindex.c lib/string/strcspn.c lib/string/strdup.c lib/string/strerror.c lib/string/strncat.c lib/string/strpbrk.c lib/string/strspn.c lib/stub/__cleanup.c lib/stub/atan2.c lib/stub/bsearch.c lib/stub/chown.c lib/stub/cos.c lib/stub/ctime.c lib/stub/exp.c lib/stub/fpurge.c lib/stub/freadahead.c lib/stub/frexp.c lib/stub/getgrgid.c lib/stub/getgrnam.c lib/stub/getlogin.c lib/stub/getpgid.c lib/stub/getpgrp.c lib/stub/getpwnam.c lib/stub/getpwuid.c lib/stub/gmtime.c lib/stub/log.c lib/stub/mktime.c lib/stub/modf.c lib/stub/pclose.c lib/stub/popen.c lib/stub/pow.c lib/stub/rand.c lib/stub/rewind.c lib/stub/setbuf.c lib/stub/setgrent.c lib/stub/setlocale.c lib/stub/setvbuf.c lib/stub/sigaddset.c lib/stub/sigblock.c lib/stub/sigdelset.c lib/stub/sigsetmask.c lib/stub/sin.c lib/stub/sqrt.c lib/stub/strftime.c lib/stub/sys_siglist.c lib/stub/system.c lib/stub/times.c lib/stub/ttyname.c lib/stub/utime.c lib/linux/getegid.c lib/linux/geteuid.c lib/linux/getgid.c lib/linux/getppid.c lib/linux/getrusage.c lib/linux/getuid.c lib/linux/ioctl.c lib/linux/mknod.c lib/linux/readlink.c lib/linux/setgid.c lib/linux/settimer.c lib/linux/setuid.c lib/linux/signal.c lib/linux/sigprogmask.c",
+    "libc_mini_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-gcc/_exit.c lib/linux/x86-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/mes/write.c",
+    "libc_tcc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-gcc/_exit.c lib/linux/x86-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86-mes-gcc/setjmp.c",
+    "libmescc_SOURCES": "lib/mes/globals.c lib/linux/x86-mes-gcc/syscall-internal.c",
+    "libtcc1_SOURCES": "lib/libtcc1.c",
+    "mes_SOURCES": "src/builtins.c src/cc.c src/core.c src/display.c src/eval-apply.c src/gc.c src/globals.c src/hash.c src/lib.c src/math.c src/mes.c src/module.c src/posix.c src/reader.c src/stack.c src/string.c src/struct.c src/symbol.c src/variable.c src/vector.c"
   },
-  "x86_64": {
-    "linux": {
-      "gcc": {
-        "libc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-gcc/_exit.c",
-          "lib/linux/x86_64-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c"
-        ],
-        "libc_gnu_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-gcc/_exit.c",
-          "lib/linux/x86_64-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86_64-mes-gcc/setjmp.c",
-          "lib/ctype/isalnum.c",
-          "lib/ctype/isalpha.c",
-          "lib/ctype/isascii.c",
-          "lib/ctype/iscntrl.c",
-          "lib/ctype/isgraph.c",
-          "lib/ctype/isprint.c",
-          "lib/ctype/ispunct.c",
-          "lib/math/ceil.c",
-          "lib/math/fabs.c",
-          "lib/math/floor.c",
-          "lib/mes/fdgets.c",
-          "lib/posix/alarm.c",
-          "lib/posix/execl.c",
-          "lib/posix/execlp.c",
-          "lib/posix/mktemp.c",
-          "lib/posix/pathconf.c",
-          "lib/posix/sbrk.c",
-          "lib/posix/sleep.c",
-          "lib/posix/unsetenv.c",
-          "lib/stdio/clearerr.c",
-          "lib/stdio/feof.c",
-          "lib/stdio/fgets.c",
-          "lib/stdio/fileno.c",
-          "lib/stdio/freopen.c",
-          "lib/stdio/fscanf.c",
-          "lib/stdio/perror.c",
-          "lib/stdio/vfscanf.c",
-          "lib/stdlib/__exit.c",
-          "lib/stdlib/abort.c",
-          "lib/stdlib/abs.c",
-          "lib/stdlib/alloca.c",
-          "lib/stdlib/atexit.c",
-          "lib/stdlib/atof.c",
-          "lib/stdlib/atol.c",
-          "lib/stdlib/mbstowcs.c",
-          "lib/string/bcmp.c",
-          "lib/string/bcopy.c",
-          "lib/string/bzero.c",
-          "lib/string/index.c",
-          "lib/string/rindex.c",
-          "lib/string/strcspn.c",
-          "lib/string/strdup.c",
-          "lib/string/strerror.c",
-          "lib/string/strncat.c",
-          "lib/string/strpbrk.c",
-          "lib/string/strspn.c",
-          "lib/stub/__cleanup.c",
-          "lib/stub/atan2.c",
-          "lib/stub/bsearch.c",
-          "lib/stub/chown.c",
-          "lib/stub/cos.c",
-          "lib/stub/ctime.c",
-          "lib/stub/exp.c",
-          "lib/stub/fpurge.c",
-          "lib/stub/freadahead.c",
-          "lib/stub/frexp.c",
-          "lib/stub/getgrgid.c",
-          "lib/stub/getgrnam.c",
-          "lib/stub/getlogin.c",
-          "lib/stub/getpgid.c",
-          "lib/stub/getpgrp.c",
-          "lib/stub/getpwnam.c",
-          "lib/stub/getpwuid.c",
-          "lib/stub/gmtime.c",
-          "lib/stub/log.c",
-          "lib/stub/mktime.c",
-          "lib/stub/modf.c",
-          "lib/stub/pclose.c",
-          "lib/stub/popen.c",
-          "lib/stub/pow.c",
-          "lib/stub/rand.c",
-          "lib/stub/rewind.c",
-          "lib/stub/setbuf.c",
-          "lib/stub/setgrent.c",
-          "lib/stub/setlocale.c",
-          "lib/stub/setvbuf.c",
-          "lib/stub/sigaddset.c",
-          "lib/stub/sigblock.c",
-          "lib/stub/sigdelset.c",
-          "lib/stub/sigsetmask.c",
-          "lib/stub/sin.c",
-          "lib/stub/sqrt.c",
-          "lib/stub/strftime.c",
-          "lib/stub/sys_siglist.c",
-          "lib/stub/system.c",
-          "lib/stub/times.c",
-          "lib/stub/ttyname.c",
-          "lib/stub/utime.c",
-          "lib/linux/getegid.c",
-          "lib/linux/geteuid.c",
-          "lib/linux/getgid.c",
-          "lib/linux/getppid.c",
-          "lib/linux/getrusage.c",
-          "lib/linux/getuid.c",
-          "lib/linux/ioctl.c",
-          "lib/linux/mknod.c",
-          "lib/linux/readlink.c",
-          "lib/linux/setgid.c",
-          "lib/linux/settimer.c",
-          "lib/linux/setuid.c",
-          "lib/linux/signal.c",
-          "lib/linux/sigprogmask.c"
-        ],
-        "libc_mini_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-gcc/_exit.c",
-          "lib/linux/x86_64-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/mes/write.c"
-        ],
-        "libc_tcc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-gcc/_exit.c",
-          "lib/linux/x86_64-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86_64-mes-gcc/setjmp.c"
-        ],
-        "libmescc_SOURCES": [
-          "lib/mes/globals.c",
-          "lib/linux/x86_64-mes-gcc/syscall-internal.c"
-        ],
-        "libtcc1_SOURCES": [
-          "lib/libtcc1.c"
-        ],
-        "mes_SOURCES": [
-          "src/builtins.c",
-          "src/cc.c",
-          "src/core.c",
-          "src/display.c",
-          "src/eval-apply.c",
-          "src/gc.c",
-          "src/globals.c",
-          "src/hash.c",
-          "src/lib.c",
-          "src/math.c",
-          "src/mes.c",
-          "src/module.c",
-          "src/posix.c",
-          "src/reader.c",
-          "src/stack.c",
-          "src/string.c",
-          "src/struct.c",
-          "src/symbol.c",
-          "src/variable.c",
-          "src/vector.c"
-        ]
-      },
-      "mescc": {
-        "libc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-mescc/_exit.c",
-          "lib/linux/x86_64-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c"
-        ],
-        "libc_gnu_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-mescc/_exit.c",
-          "lib/linux/x86_64-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86_64-mes-mescc/setjmp.c",
-          "lib/ctype/isalnum.c",
-          "lib/ctype/isalpha.c",
-          "lib/ctype/isascii.c",
-          "lib/ctype/iscntrl.c",
-          "lib/ctype/isgraph.c",
-          "lib/ctype/isprint.c",
-          "lib/ctype/ispunct.c",
-          "lib/math/ceil.c",
-          "lib/math/fabs.c",
-          "lib/math/floor.c",
-          "lib/mes/fdgets.c",
-          "lib/posix/alarm.c",
-          "lib/posix/execl.c",
-          "lib/posix/execlp.c",
-          "lib/posix/mktemp.c",
-          "lib/posix/pathconf.c",
-          "lib/posix/sbrk.c",
-          "lib/posix/sleep.c",
-          "lib/posix/unsetenv.c",
-          "lib/stdio/clearerr.c",
-          "lib/stdio/feof.c",
-          "lib/stdio/fgets.c",
-          "lib/stdio/fileno.c",
-          "lib/stdio/freopen.c",
-          "lib/stdio/fscanf.c",
-          "lib/stdio/perror.c",
-          "lib/stdio/vfscanf.c",
-          "lib/stdlib/__exit.c",
-          "lib/stdlib/abort.c",
-          "lib/stdlib/abs.c",
-          "lib/stdlib/alloca.c",
-          "lib/stdlib/atexit.c",
-          "lib/stdlib/atof.c",
-          "lib/stdlib/atol.c",
-          "lib/stdlib/mbstowcs.c",
-          "lib/string/bcmp.c",
-          "lib/string/bcopy.c",
-          "lib/string/bzero.c",
-          "lib/string/index.c",
-          "lib/string/rindex.c",
-          "lib/string/strcspn.c",
-          "lib/string/strdup.c",
-          "lib/string/strerror.c",
-          "lib/string/strncat.c",
-          "lib/string/strpbrk.c",
-          "lib/string/strspn.c",
-          "lib/stub/__cleanup.c",
-          "lib/stub/atan2.c",
-          "lib/stub/bsearch.c",
-          "lib/stub/chown.c",
-          "lib/stub/cos.c",
-          "lib/stub/ctime.c",
-          "lib/stub/exp.c",
-          "lib/stub/fpurge.c",
-          "lib/stub/freadahead.c",
-          "lib/stub/frexp.c",
-          "lib/stub/getgrgid.c",
-          "lib/stub/getgrnam.c",
-          "lib/stub/getlogin.c",
-          "lib/stub/getpgid.c",
-          "lib/stub/getpgrp.c",
-          "lib/stub/getpwnam.c",
-          "lib/stub/getpwuid.c",
-          "lib/stub/gmtime.c",
-          "lib/stub/log.c",
-          "lib/stub/mktime.c",
-          "lib/stub/modf.c",
-          "lib/stub/pclose.c",
-          "lib/stub/popen.c",
-          "lib/stub/pow.c",
-          "lib/stub/rand.c",
-          "lib/stub/rewind.c",
-          "lib/stub/setbuf.c",
-          "lib/stub/setgrent.c",
-          "lib/stub/setlocale.c",
-          "lib/stub/setvbuf.c",
-          "lib/stub/sigaddset.c",
-          "lib/stub/sigblock.c",
-          "lib/stub/sigdelset.c",
-          "lib/stub/sigsetmask.c",
-          "lib/stub/sin.c",
-          "lib/stub/sqrt.c",
-          "lib/stub/strftime.c",
-          "lib/stub/sys_siglist.c",
-          "lib/stub/system.c",
-          "lib/stub/times.c",
-          "lib/stub/ttyname.c",
-          "lib/stub/utime.c",
-          "lib/linux/getegid.c",
-          "lib/linux/geteuid.c",
-          "lib/linux/getgid.c",
-          "lib/linux/getppid.c",
-          "lib/linux/getrusage.c",
-          "lib/linux/getuid.c",
-          "lib/linux/ioctl.c",
-          "lib/linux/mknod.c",
-          "lib/linux/readlink.c",
-          "lib/linux/setgid.c",
-          "lib/linux/settimer.c",
-          "lib/linux/setuid.c",
-          "lib/linux/signal.c",
-          "lib/linux/sigprogmask.c"
-        ],
-        "libc_mini_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-mescc/_exit.c",
-          "lib/linux/x86_64-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/mes/write.c"
-        ],
-        "libc_tcc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-mescc/_exit.c",
-          "lib/linux/x86_64-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86_64-mes-mescc/setjmp.c"
-        ],
-        "libmescc_SOURCES": [
-          "lib/mes/globals.c",
-          "lib/linux/x86_64-mes-mescc/syscall-internal.c"
-        ],
-        "libtcc1_SOURCES": [
-          "lib/libtcc1.c"
-        ],
-        "mes_SOURCES": [
-          "src/builtins.c",
-          "src/cc.c",
-          "src/core.c",
-          "src/display.c",
-          "src/eval-apply.c",
-          "src/gc.c",
-          "src/globals.c",
-          "src/hash.c",
-          "src/lib.c",
-          "src/math.c",
-          "src/mes.c",
-          "src/module.c",
-          "src/posix.c",
-          "src/reader.c",
-          "src/stack.c",
-          "src/string.c",
-          "src/struct.c",
-          "src/symbol.c",
-          "src/variable.c",
-          "src/vector.c"
-        ]
-      }
-    }
+  "x86.linux.mescc": {
+    "libc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-mescc/_exit.c lib/linux/x86-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c",
+    "libc_gnu1_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-mescc/_exit.c lib/linux/x86-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c",
+    "libc_gnu2_SOURCES": "lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86-mes-mescc/setjmp.c lib/ctype/isalnum.c lib/ctype/isalpha.c lib/ctype/isascii.c lib/ctype/iscntrl.c lib/ctype/isgraph.c lib/ctype/isprint.c lib/ctype/ispunct.c lib/math/ceil.c lib/math/fabs.c lib/math/floor.c lib/mes/fdgets.c lib/posix/alarm.c lib/posix/execl.c lib/posix/execlp.c lib/posix/mktemp.c lib/posix/pathconf.c lib/posix/sbrk.c lib/posix/sleep.c lib/posix/unsetenv.c lib/stdio/clearerr.c lib/stdio/feof.c lib/stdio/fgets.c lib/stdio/fileno.c lib/stdio/freopen.c lib/stdio/fscanf.c lib/stdio/perror.c lib/stdio/vfscanf.c lib/stdlib/__exit.c lib/stdlib/abort.c lib/stdlib/abs.c lib/stdlib/alloca.c lib/stdlib/atexit.c lib/stdlib/atof.c lib/stdlib/atol.c lib/stdlib/mbstowcs.c lib/string/bcmp.c lib/string/bcopy.c lib/string/bzero.c lib/string/index.c lib/string/rindex.c lib/string/strcspn.c lib/string/strdup.c lib/string/strerror.c lib/string/strncat.c lib/string/strpbrk.c lib/string/strspn.c lib/stub/__cleanup.c lib/stub/atan2.c lib/stub/bsearch.c lib/stub/chown.c lib/stub/cos.c lib/stub/ctime.c lib/stub/exp.c lib/stub/fpurge.c lib/stub/freadahead.c lib/stub/frexp.c lib/stub/getgrgid.c lib/stub/getgrnam.c lib/stub/getlogin.c lib/stub/getpgid.c lib/stub/getpgrp.c lib/stub/getpwnam.c lib/stub/getpwuid.c lib/stub/gmtime.c lib/stub/log.c lib/stub/mktime.c lib/stub/modf.c lib/stub/pclose.c lib/stub/popen.c lib/stub/pow.c lib/stub/rand.c lib/stub/rewind.c lib/stub/setbuf.c lib/stub/setgrent.c lib/stub/setlocale.c lib/stub/setvbuf.c lib/stub/sigaddset.c lib/stub/sigblock.c lib/stub/sigdelset.c lib/stub/sigsetmask.c lib/stub/sin.c lib/stub/sqrt.c lib/stub/strftime.c lib/stub/sys_siglist.c lib/stub/system.c lib/stub/times.c lib/stub/ttyname.c lib/stub/utime.c lib/linux/getegid.c lib/linux/geteuid.c lib/linux/getgid.c lib/linux/getppid.c lib/linux/getrusage.c lib/linux/getuid.c lib/linux/ioctl.c lib/linux/mknod.c lib/linux/readlink.c lib/linux/setgid.c lib/linux/settimer.c lib/linux/setuid.c lib/linux/signal.c lib/linux/sigprogmask.c",
+    "libc_mini_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-mescc/_exit.c lib/linux/x86-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/mes/write.c",
+    "libc_tcc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-mescc/_exit.c lib/linux/x86-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86-mes-mescc/setjmp.c",
+    "libmescc_SOURCES": "lib/mes/globals.c lib/linux/x86-mes-mescc/syscall-internal.c",
+    "libtcc1_SOURCES": "lib/libtcc1.c",
+    "mes_SOURCES": "src/builtins.c src/cc.c src/core.c src/display.c src/eval-apply.c src/gc.c src/globals.c src/hash.c src/lib.c src/math.c src/mes.c src/module.c src/posix.c src/reader.c src/stack.c src/string.c src/struct.c src/symbol.c src/variable.c src/vector.c"
+  },
+  "x86_64.linux.gcc": {
+    "libc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-gcc/_exit.c lib/linux/x86_64-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c",
+    "libc_gnu1_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-gcc/_exit.c lib/linux/x86_64-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c",
+    "libc_gnu2_SOURCES": "lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86_64-mes-gcc/setjmp.c lib/ctype/isalnum.c lib/ctype/isalpha.c lib/ctype/isascii.c lib/ctype/iscntrl.c lib/ctype/isgraph.c lib/ctype/isprint.c lib/ctype/ispunct.c lib/math/ceil.c lib/math/fabs.c lib/math/floor.c lib/mes/fdgets.c lib/posix/alarm.c lib/posix/execl.c lib/posix/execlp.c lib/posix/mktemp.c lib/posix/pathconf.c lib/posix/sbrk.c lib/posix/sleep.c lib/posix/unsetenv.c lib/stdio/clearerr.c lib/stdio/feof.c lib/stdio/fgets.c lib/stdio/fileno.c lib/stdio/freopen.c lib/stdio/fscanf.c lib/stdio/perror.c lib/stdio/vfscanf.c lib/stdlib/__exit.c lib/stdlib/abort.c lib/stdlib/abs.c lib/stdlib/alloca.c lib/stdlib/atexit.c lib/stdlib/atof.c lib/stdlib/atol.c lib/stdlib/mbstowcs.c lib/string/bcmp.c lib/string/bcopy.c lib/string/bzero.c lib/string/index.c lib/string/rindex.c lib/string/strcspn.c lib/string/strdup.c lib/string/strerror.c lib/string/strncat.c lib/string/strpbrk.c lib/string/strspn.c lib/stub/__cleanup.c lib/stub/atan2.c lib/stub/bsearch.c lib/stub/chown.c lib/stub/cos.c lib/stub/ctime.c lib/stub/exp.c lib/stub/fpurge.c lib/stub/freadahead.c lib/stub/frexp.c lib/stub/getgrgid.c lib/stub/getgrnam.c lib/stub/getlogin.c lib/stub/getpgid.c lib/stub/getpgrp.c lib/stub/getpwnam.c lib/stub/getpwuid.c lib/stub/gmtime.c lib/stub/log.c lib/stub/mktime.c lib/stub/modf.c lib/stub/pclose.c lib/stub/popen.c lib/stub/pow.c lib/stub/rand.c lib/stub/rewind.c lib/stub/setbuf.c lib/stub/setgrent.c lib/stub/setlocale.c lib/stub/setvbuf.c lib/stub/sigaddset.c lib/stub/sigblock.c lib/stub/sigdelset.c lib/stub/sigsetmask.c lib/stub/sin.c lib/stub/sqrt.c lib/stub/strftime.c lib/stub/sys_siglist.c lib/stub/system.c lib/stub/times.c lib/stub/ttyname.c lib/stub/utime.c lib/linux/getegid.c lib/linux/geteuid.c lib/linux/getgid.c lib/linux/getppid.c lib/linux/getrusage.c lib/linux/getuid.c lib/linux/ioctl.c lib/linux/mknod.c lib/linux/readlink.c lib/linux/setgid.c lib/linux/settimer.c lib/linux/setuid.c lib/linux/signal.c lib/linux/sigprogmask.c",
+    "libc_mini_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-gcc/_exit.c lib/linux/x86_64-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/mes/write.c",
+    "libc_tcc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-gcc/_exit.c lib/linux/x86_64-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86_64-mes-gcc/setjmp.c",
+    "libmescc_SOURCES": "lib/mes/globals.c lib/linux/x86_64-mes-gcc/syscall-internal.c",
+    "libtcc1_SOURCES": "lib/libtcc1.c",
+    "mes_SOURCES": "src/builtins.c src/cc.c src/core.c src/display.c src/eval-apply.c src/gc.c src/globals.c src/hash.c src/lib.c src/math.c src/mes.c src/module.c src/posix.c src/reader.c src/stack.c src/string.c src/struct.c src/symbol.c src/variable.c src/vector.c"
+  },
+  "x86_64.linux.mescc": {
+    "libc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-mescc/_exit.c lib/linux/x86_64-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c",
+    "libc_gnu1_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-mescc/_exit.c lib/linux/x86_64-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c",
+    "libc_gnu2_SOURCES": "lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86_64-mes-mescc/setjmp.c lib/ctype/isalnum.c lib/ctype/isalpha.c lib/ctype/isascii.c lib/ctype/iscntrl.c lib/ctype/isgraph.c lib/ctype/isprint.c lib/ctype/ispunct.c lib/math/ceil.c lib/math/fabs.c lib/math/floor.c lib/mes/fdgets.c lib/posix/alarm.c lib/posix/execl.c lib/posix/execlp.c lib/posix/mktemp.c lib/posix/pathconf.c lib/posix/sbrk.c lib/posix/sleep.c lib/posix/unsetenv.c lib/stdio/clearerr.c lib/stdio/feof.c lib/stdio/fgets.c lib/stdio/fileno.c lib/stdio/freopen.c lib/stdio/fscanf.c lib/stdio/perror.c lib/stdio/vfscanf.c lib/stdlib/__exit.c lib/stdlib/abort.c lib/stdlib/abs.c lib/stdlib/alloca.c lib/stdlib/atexit.c lib/stdlib/atof.c lib/stdlib/atol.c lib/stdlib/mbstowcs.c lib/string/bcmp.c lib/string/bcopy.c lib/string/bzero.c lib/string/index.c lib/string/rindex.c lib/string/strcspn.c lib/string/strdup.c lib/string/strerror.c lib/string/strncat.c lib/string/strpbrk.c lib/string/strspn.c lib/stub/__cleanup.c lib/stub/atan2.c lib/stub/bsearch.c lib/stub/chown.c lib/stub/cos.c lib/stub/ctime.c lib/stub/exp.c lib/stub/fpurge.c lib/stub/freadahead.c lib/stub/frexp.c lib/stub/getgrgid.c lib/stub/getgrnam.c lib/stub/getlogin.c lib/stub/getpgid.c lib/stub/getpgrp.c lib/stub/getpwnam.c lib/stub/getpwuid.c lib/stub/gmtime.c lib/stub/log.c lib/stub/mktime.c lib/stub/modf.c lib/stub/pclose.c lib/stub/popen.c lib/stub/pow.c lib/stub/rand.c lib/stub/rewind.c lib/stub/setbuf.c lib/stub/setgrent.c lib/stub/setlocale.c lib/stub/setvbuf.c lib/stub/sigaddset.c lib/stub/sigblock.c lib/stub/sigdelset.c lib/stub/sigsetmask.c lib/stub/sin.c lib/stub/sqrt.c lib/stub/strftime.c lib/stub/sys_siglist.c lib/stub/system.c lib/stub/times.c lib/stub/ttyname.c lib/stub/utime.c lib/linux/getegid.c lib/linux/geteuid.c lib/linux/getgid.c lib/linux/getppid.c lib/linux/getrusage.c lib/linux/getuid.c lib/linux/ioctl.c lib/linux/mknod.c lib/linux/readlink.c lib/linux/setgid.c lib/linux/settimer.c lib/linux/setuid.c lib/linux/signal.c lib/linux/sigprogmask.c",
+    "libc_mini_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-mescc/_exit.c lib/linux/x86_64-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/mes/write.c",
+    "libc_tcc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-mescc/_exit.c lib/linux/x86_64-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86_64-mes-mescc/setjmp.c",
+    "libmescc_SOURCES": "lib/mes/globals.c lib/linux/x86_64-mes-mescc/syscall-internal.c",
+    "libtcc1_SOURCES": "lib/libtcc1.c",
+    "mes_SOURCES": "src/builtins.c src/cc.c src/core.c src/display.c src/eval-apply.c src/gc.c src/globals.c src/hash.c src/lib.c src/math.c src/mes.c src/module.c src/posix.c src/reader.c src/stack.c src/string.c src/struct.c src/symbol.c src/variable.c src/vector.c"
   }
 }

From a7338726f54dca2fbb8d0f5eb1297af20febd57e Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 12 May 2026 18:52:45 -0400
Subject: [PATCH 0129/1209] minimal-bootstrap: avoid forcing meta definition

The result of commonMeta is never actually needed if assertValidity goes
away, and `.meta` is never accessed from the derivation. We perform a
similar optimization in stdenv.mkDerivation.
---
 pkgs/os-specific/linux/minimal-bootstrap/utils.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
index 180d55a91494..1339b4ca13c7 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
@@ -23,7 +23,8 @@ rec {
       baseDrv = derivation (
         {
           inherit (buildPlatform) system;
-          inherit (meta) name;
+          # redefining from meta to avoid forcing the thunk until it's used
+          name = attrs.name or "${attrs.pname}-${attrs.version}";
         }
         // maybeContentAddressed
         // (removeAttrs attrs [

From d240d8ae80d9cf1b76c59375f1c90cdee2eb190b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 14 May 2026 23:04:02 +0100
Subject: [PATCH 0130/1209] libmd: 1.1.0 -> 1.2.0

Changes: https://git.hadrons.org/cgit/libmd.git/log/?h=1.2.0
---
 pkgs/by-name/li/libmd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libmd/package.nix b/pkgs/by-name/li/libmd/package.nix
index 3ecb7834f29b..14abb0cfab4f 100644
--- a/pkgs/by-name/li/libmd/package.nix
+++ b/pkgs/by-name/li/libmd/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmd";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchurl {
     urls = [
       "https://archive.hadrons.org/software/libmd/libmd-${finalAttrs.version}.tar.xz"
       "https://libbsd.freedesktop.org/releases/libmd-${finalAttrs.version}.tar.xz"
     ];
-    sha256 = "sha256-G9aqQidTE68xQcfPLluWTosf1IgCXK8vlx9DsAd2szI=";
+    hash = "sha256-rBX/uEMFAvuszexmxagu4OqwsPNiIN9WcQ/q3+sT0KA=";
   };
 
   enableParallelBuilding = true;

From 757acf21b82a3ca9a070e0267acc10faced77bb3 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 13 May 2026 15:08:53 -0700
Subject: [PATCH 0131/1209] x265: 4.1 -> 4.2

Changelog: https://x265.readthedocs.io/en/master/releasenotes.html#version-4-2
---
 pkgs/by-name/x2/x265/package.nix | 24 ++----------------------
 1 file changed, 2 insertions(+), 22 deletions(-)

diff --git a/pkgs/by-name/x2/x265/package.nix b/pkgs/by-name/x2/x265/package.nix
index 80ef96001f7c..c51679eca4e7 100644
--- a/pkgs/by-name/x2/x265/package.nix
+++ b/pkgs/by-name/x2/x265/package.nix
@@ -36,7 +36,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "x265";
-  version = "4.1";
+  version = "4.2";
 
   outputs = [
     "out"
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   # whether we fetch a source tarball or a tag from the git repo
   src = fetchurl {
     url = "https://bitbucket.org/multicoreware/x265_git/downloads/x265_${finalAttrs.version}.tar.gz";
-    hash = "sha256-oxaZxqiYBrdLAVHl5qffZd5LSQUEgv5ev4pDedevjyk=";
+    hash = "sha256-QLHqBFPgMJ8OupNODd9TP49ilZZmeeiJTo8cHI1eEhA=";
   };
 
   patches = [
@@ -55,26 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
     # fix compilation with gcc15
     # https://bitbucket.org/multicoreware/x265_git/pull-requests/36
     ./gcc15-fixes.patch
-
-    # Fix the build with CMake 4.
-    (fetchpatch {
-      name = "x265-fix-cmake-4-1.patch";
-      url = "https://bitbucket.org/multicoreware/x265_git/commits/b354c009a60bcd6d7fc04014e200a1ee9c45c167/raw";
-      stripLen = 1;
-      hash = "sha256-kS+hYZb5dnIlNoZ8ABmNkLkPx+NqCPy+DonXktBzJAE=";
-    })
-    (fetchpatch {
-      name = "x265-fix-cmake-4-2.patch";
-      url = "https://bitbucket.org/multicoreware/x265_git/commits/51ae8e922bcc4586ad4710812072289af91492a8/raw";
-      stripLen = 1;
-      hash = "sha256-ZrpyfSnijUgdyVscW73K48iEXa9k85ftNaQdr0HWSYg=";
-    })
-    (fetchpatch {
-      name = "x265-fix-cmake-4-3.patch";
-      url = "https://bitbucket.org/multicoreware/x265_git/commits/78e5ac35c13c5cbccc5933083edceb0d3eaeaa21/raw";
-      stripLen = 1;
-      hash = "sha256-qEihgUKGEdthbKz67s+/hS/qdpzl+3tEB3gx2tarax4=";
-    })
   ]
   # TODO: remove after update to version 4.2
   ++ lib.optionals (stdenv.hostPlatform.isAarch32 && stdenv.hostPlatform.isLinux) [

From a7daddef5b46fd55f43e3aad943882516d5609c7 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 13 May 2026 18:14:53 -0700
Subject: [PATCH 0132/1209] handbrake: 1.10.2 -> 1.11.1

---
 pkgs/by-name/ha/handbrake/package.nix | 149 +++++++++++++++-----------
 1 file changed, 85 insertions(+), 64 deletions(-)

diff --git a/pkgs/by-name/ha/handbrake/package.nix b/pkgs/by-name/ha/handbrake/package.nix
index ce91685cf0b2..edc886281aca 100644
--- a/pkgs/by-name/ha/handbrake/package.nix
+++ b/pkgs/by-name/ha/handbrake/package.nix
@@ -10,7 +10,10 @@
 {
   stdenv,
   lib,
+  applyPatches,
   fetchFromGitHub,
+  fetchFromGitLab,
+  fetchpatch2,
   # For tests
   testers,
   runCommand,
@@ -26,7 +29,7 @@
   numactl,
   writeText,
   # Processing, video codecs, containers
-  ffmpeg_7-full,
+  ffmpeg_8-full,
   nv-codec-headers,
   libogg,
   x264,
@@ -85,14 +88,35 @@
 }:
 
 let
-  version = "1.10.2";
+  version = "1.11.1";
 
-  src = fetchFromGitHub {
-    owner = "HandBrake";
-    repo = "HandBrake";
-    # uses version commit for logic in version.txt
-    rev = "dddf75f756e56d2b8dbb0609175bc12047a4841d";
-    hash = "sha256-CIMpJDJ0IIz95f3/zxeQqpCFpHWEmdgA+VaaUDY516A=";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "HandBrake";
+      repo = "HandBrake";
+      # uses version commit for logic in version.txt
+      rev = "4ce99a885cde39b3511016efdb5124726819defb";
+      hash = "sha256-oWXNiRK0wbmINnjM3GrOIawcSULTuy3yANfgW8li9F0=";
+    };
+
+    patches = [
+      # Only needed so the subsequent patch applies
+      (fetchpatch2 {
+        url = "https://github.com/HandBrake/HandBrake/commit/c8e16778a330881af36fa32004f887bd73874d15.patch";
+        hash = "sha256-i3/X9opDzsZIO7bjLHHZltuQH93uENRF0t7FP7DDdBM=";
+      })
+      # Update x265 submodule to v4.2, drop in next release
+      (fetchpatch2 {
+        url = "https://github.com/HandBrake/HandBrake/commit/432514bf839e7280511e4a7afc35fb4868ef4d0b.patch";
+        excludes = [
+          "contrib/x265/module.defs"
+          "contrib/x265_8bit/module.defs"
+          "contrib/x265_10bit/module.defs"
+          "contrib/x265_12bit/module.defs"
+        ];
+        hash = "sha256-xwIY1pO9mKbrQFjQCENuvntIoiZTHeUVg8axrl3zxxo=";
+      })
+    ];
   };
 
   # Handbrake maintains a set of ffmpeg patches. In particular, these
@@ -100,70 +124,67 @@ let
   # https://github.com/HandBrake/HandBrake/issues/4029
   # base ffmpeg version is specified in:
   # https://github.com/HandBrake/HandBrake/blob/master/contrib/ffmpeg/module.defs
-  ffmpeg-version = "7.1.1";
-  ffmpeg-hb =
-    (ffmpeg_7-full.override {
-      version = ffmpeg-version;
-      hash = "sha256-GyS8imOqfOUPxXrzCiQtzCQIIH6bvWmQAB0fKUcRsW4=";
-    }).overrideAttrs
-      (old: {
-        patches = (old.patches or [ ]) ++ [
-          "${src}/contrib/ffmpeg/A01-mov-read-name-track-tag-written-by-movenc.patch"
-          "${src}/contrib/ffmpeg/A02-movenc-write-3gpp-track-titl-tag.patch"
-          "${src}/contrib/ffmpeg/A03-mov-read-3gpp-udta-tags.patch"
-          "${src}/contrib/ffmpeg/A04-movenc-write-3gpp-track-names-tags-for-all-available.patch"
-          "${src}/contrib/ffmpeg/A05-avformat-mov-add-support-audio-fallback-track-ref.patch"
-          "${src}/contrib/ffmpeg/A06-dvdsubdec-fix-processing-of-partial-packets.patch"
-          "${src}/contrib/ffmpeg/A07-dvdsubdec-return-number-of-bytes-used.patch"
-          "${src}/contrib/ffmpeg/A08-dvdsubdec-use-pts-of-initial-packet.patch"
-          "${src}/contrib/ffmpeg/A09-dvdsubdec-add-an-option-to-output-subtitles-with-emp.patch"
-          "${src}/contrib/ffmpeg/A10-ccaption_dec-fix-pts-in-real_time-mode.patch"
-          "${src}/contrib/ffmpeg/A11-avformat-matroskaenc-return-error-if-aac-extradata-c.patch"
-          "${src}/contrib/ffmpeg/A12-videotoolbox-disable-H.264-10-bit-on-Intel-macOS-it-.patch"
-
-          # patch to fix <https://github.com/HandBrake/HandBrake/issues/5011>
-          # commented out because it causes ffmpeg's filter-pixdesc-p010le test to fail.
-          # "${src}/contrib/ffmpeg/A13-libswscale-fix-yuv420p-to-p01xle-color-conversion-bu.patch"
-
-          "${src}/contrib/ffmpeg/A14-hevc_mp4toannexb.c-fix-qsv-decode-of-10bit-hdr.patch"
-          "${src}/contrib/ffmpeg/A15-Expose-the-unmodified-Dolby-Vision-RPU-T35-buffers.patch"
-          "${src}/contrib/ffmpeg/A16-avcodec-amfenc-Add-support-for-on-demand-key-frames.patch"
-          "${src}/contrib/ffmpeg/A17-avcodec-amfenc-properly-set-primaries-transfer-and-m.patch"
-          "${src}/contrib/ffmpeg/A18-libavcodec-qsvenc-update-has_b_frames-value.patch"
-          "${src}/contrib/ffmpeg/A19-libavcodec-qsv-enable-av1-scc.patch"
-          "${src}/contrib/ffmpeg/A20-Revert-avcodec-amfenc-GPU-driver-version-check.patch"
-          "${src}/contrib/ffmpeg/A21-lavc-pgssubdec-Add-graphic-plane-and-cropping.patch"
-          "${src}/contrib/ffmpeg/A22-avformat-mov-read-and-write-additional-iTunes-style-.patch"
-          "${src}/contrib/ffmpeg/A23-avformat-movenc-write-iTunEXTC-and-iTunMOVI-metadata.patch"
-          "${src}/contrib/ffmpeg/A24-AV1-videotoolbox.patch"
-          "${src}/contrib/ffmpeg/A25-videotoolbox-speedup-decoding.patch"
-          "${src}/contrib/ffmpeg/A28-enable-av1_mf-encoder.patch"
-          "${src}/contrib/ffmpeg/A30-qsv-fixed-BT2020-BT709-conversion.patch"
-          "${src}/contrib/ffmpeg/A31-Parse-EAC3-Atmos-ComplexityIndex-for-MP4-remuxing.patch"
-        ];
-      });
+  ffmpeg-hb = ffmpeg_8-full.overrideAttrs (old: {
+    patches = (old.patches or [ ]) ++ [
+      "${src}/contrib/ffmpeg/A01-mov-read-name-track-tag-written-by-movenc.patch"
+      "${src}/contrib/ffmpeg/A02-movenc-write-3gpp-track-titl-tag.patch"
+      "${src}/contrib/ffmpeg/A03-mov-read-3gpp-udta-tags.patch"
+      "${src}/contrib/ffmpeg/A04-movenc-write-3gpp-track-names-tags-for-all-available.patch"
+      "${src}/contrib/ffmpeg/A05-avformat-mov-add-support-audio-fallback-track-ref.patch"
+      "${src}/contrib/ffmpeg/A06-avformat-mov-read-and-write-additional-iTunes-style-.patch"
+      "${src}/contrib/ffmpeg/A07-avformat-movenc-write-iTunEXTC-and-iTunMOVI-metadata.patch"
+      "${src}/contrib/ffmpeg/A08-dvdsubdec-fix-processing-of-partial-packets.patch"
+      "${src}/contrib/ffmpeg/A09-dvdsubdec-return-number-of-bytes-used.patch"
+      "${src}/contrib/ffmpeg/A10-dvdsubdec-use-pts-of-initial-packet.patch"
+      "${src}/contrib/ffmpeg/A11-dvdsubdec-add-an-option-to-output-subtitles-with-emp.patch"
+      "${src}/contrib/ffmpeg/A12-ccaption_dec-fix-pts-in-real_time-mode.patch"
+      "${src}/contrib/ffmpeg/A13-avformat-matroskaenc-return-error-if-aac-extradata-c.patch"
+      "${src}/contrib/ffmpeg/A14-Expose-the-unmodified-Dolby-Vision-RPU-T35-buffers.patch"
+      "${src}/contrib/ffmpeg/A15-lavc-pgssubdec-Add-graphic-plane-and-cropping.patch"
+      "${src}/contrib/ffmpeg/A16-libavcodec-qsvenc.c-update-has_b_frames-value-after-.patch"
+      "${src}/contrib/ffmpeg/A17-qsv-enable-av1-scc.patch"
+      "${src}/contrib/ffmpeg/A18-fixed-BT2020-BT709-conversion-via-VPP.patch"
+      "${src}/contrib/ffmpeg/A19-videotoolbox-disable-H.264-10-bit-on-Intel-macOS-it-.patch"
+      "${src}/contrib/ffmpeg/A20-videotoolbox-speedup-decoding.patch"
+      "${src}/contrib/ffmpeg/A21-Revert-avcodec-amfenc-GPU-driver-version-check.patch"
+      "${src}/contrib/ffmpeg/A22-fix-d3d11-static-pool-size-error.patch"
+      "${src}/contrib/ffmpeg/A23-movenc-set-the-chapters-track-language-to-the-same-a.patch"
+      "${src}/contrib/ffmpeg/A24-movenc-use-version-2-audio-descriptor-for-2-channels.patch"
+    ];
+  });
 
   x265-hb = x265.overrideAttrs (old: {
-    version = "4.1";
-    sourceRoot = "x265_4.1/source";
+    version = "4.2";
+    sourceRoot = "x265_4.2/source";
     src = fetchurl {
-      url = "https://bitbucket.org/multicoreware/x265_git/downloads/x265_4.1.tar.gz";
-      hash = "sha256-oxaZxqiYBrdLAVHl5qffZd5LSQUEgv5ev4pDedevjyk=";
+      url = "https://bitbucket.org/multicoreware/x265_git/downloads/x265_4.2.tar.gz";
+      hash = "sha256-QLHqBFPgMJ8OupNODd9TP49ilZZmeeiJTo8cHI1eEhA=";
     };
     # nixpkgs' x265 sourceRoot is x265-.../source whereas handbrake's x265 patches
     # are written with respect to the parent directory instead of that source directory.
     # patches which don't cleanly apply are commented out.
     postPatch = (old.postPatch or "") + ''
       pushd ..
-      patch -p1 < ${src}/contrib/x265/A01-Do-not-set-thread-priority-on-Windows.patch
-      patch -p1 < ${src}/contrib/x265/A02-Apple-Silicon-tuning.patch
-      patch -p1 < ${src}/contrib/x265/A03-Implement-ambient-viewing-environment-sei.patch
-      patch -p1 < ${src}/contrib/x265/A04-add-new-matrix-coefficients-from-H.273-v3.patch
-      patch -p1 < ${src}/contrib/x265/A05-Fix-Dolby-Vision-RPU-memory-management.patch
-      # patch -p1 < ${src}/contrib/x265/A06-Update-version-strings.patch
-      patch -p1 < ${src}/contrib/x265/A07-Fix-macOS-cross-compilation.patch
-      # patch -p1 < ${src}/contrib/x265/A08-Fix-inconsistent-bitrate-in-second-pass.patch
-      patch -p1 < ${src}/contrib/x265/A09-Ensuring-the-mvdLX-is-compliant.patch
+        for p in ${src}/contrib/x265/*.patch; do
+          patch -p1 < "$p"
+        done
+      popd
+    '';
+  });
+
+  svt-av1-hb = svt-av1.overrideAttrs (old: rec {
+    version = "4.0.1";
+    src = fetchFromGitLab {
+      owner = "AOMediaCodec";
+      repo = "SVT-AV1";
+      rev = "v${version}";
+      hash = "sha256-7krVkLZxgolqPTkuyKAx07BekAPacftcGZ44lQTQFZQ=";
+    };
+    postPatch = (old.postPatch or "") + ''
+      pushd ..
+        for p in ${src}/contrib/svt-av1/*.patch; do
+          patch -p1 < "$p"
+        done
       popd
     '';
   });
@@ -268,7 +289,7 @@ let
       libvpx
       libxml2
       speex
-      svt-av1
+      svt-av1-hb
       x264
       x265-hb
       xz

From 3cb487b5a903b0f20e76344ccf3e3784ad4ca0d0 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Fri, 15 May 2026 18:40:37 +0200
Subject: [PATCH 0133/1209] icu: advance the default to icu78

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 28b84eabe323..7c5b9beceb6e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6411,7 +6411,7 @@ with pkgs;
     icu78
     ;
 
-  icu = icu76;
+  icu = icu78;
 
   idasen = with python3Packages; toPythonApplication idasen;
 

From ecc16d328b05308abd7b80af1fdb33def80ffd6b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 15 May 2026 19:04:04 +0000
Subject: [PATCH 0134/1209] tinyxxd: 1.3.15 -> 1.3.16

---
 pkgs/by-name/ti/tinyxxd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ti/tinyxxd/package.nix b/pkgs/by-name/ti/tinyxxd/package.nix
index c149c0f7c3b6..2c0cc51b5520 100644
--- a/pkgs/by-name/ti/tinyxxd/package.nix
+++ b/pkgs/by-name/ti/tinyxxd/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tinyxxd";
-  version = "1.3.15";
+  version = "1.3.16";
 
   src = fetchFromGitHub {
     repo = "tinyxxd";
     owner = "xyproto";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JLu3x54/kpKhvfTeWovxmV+/bEB4MqaNlFPrHnM/+ko=";
+    hash = "sha256-SaxjQFQ//xxRCIx4FMx1exGGOGEKN/evgABTquL92WM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

From c8a15a9b709bd7bb191ad7587a9ea55e54116f7b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 15 May 2026 21:16:22 +0100
Subject: [PATCH 0135/1209] libei: 1.5.0 -> 1.6.0

Changes: https://gitlab.freedesktop.org/libinput/libei/-/releases/1.6.0
---
 pkgs/by-name/li/libei/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libei/package.nix b/pkgs/by-name/li/libei/package.nix
index 93e90b41467c..4724fb81451f 100644
--- a/pkgs/by-name/li/libei/package.nix
+++ b/pkgs/by-name/li/libei/package.nix
@@ -27,14 +27,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libei";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libinput";
     repo = "libei";
     rev = finalAttrs.version;
-    hash = "sha256-PqQpJz88tDzjwsBuwxpWcGAWz6Gp6A/oAOS87uxGOGs=";
+    hash = "sha256-fUeMdRK7uoRvgvY3INMorwnTleLrLA5xOeYBFp1qXeI=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isBSD [

From 3c52efb060ec585d4b6adbf09822ab75f3476ecb Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sat, 16 May 2026 05:11:20 -0400
Subject: [PATCH 0136/1209] libunistring: enable __structuredAttrs

This is early in the bootstrap process.

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/development/libraries/libunistring/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 9a0bb2387e80..c0c8c61e64d7 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libunistring";
   version = "1.4.2";
 
+  __structuredAttrs = true;
+
   src = fetchurl {
     url = "mirror://gnu/libunistring/libunistring-${finalAttrs.version}.tar.gz";
     hash = "sha256-6CZksXAGTmIzGWISayWdRS1Tsie7SpOrIAQNhG/sAdg=";

From 65c17bdbe095b5ab84f03b2d8214d596573b1ca0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 16 May 2026 18:41:32 +0000
Subject: [PATCH 0137/1209] utf8cpp: 4.0.9 -> 4.1.0

---
 pkgs/by-name/ut/utf8cpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/utf8cpp/package.nix b/pkgs/by-name/ut/utf8cpp/package.nix
index a97a1043b555..c801aca45475 100644
--- a/pkgs/by-name/ut/utf8cpp/package.nix
+++ b/pkgs/by-name/ut/utf8cpp/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "utf8cpp";
-  version = "4.0.9";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "nemtrif";
     repo = "utfcpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0FgMKHymFOA3BM7VS8US2is8TmQlL/wWj4nSRihqcDo=";
+    hash = "sha256-Jh/sdWx+FWR70iqmPqDI/ZcyHBoSQFcGrQSICipdXbA=";
   };
 
   nativeBuildInputs = [ cmake ];

From 35441d748159534185e67177d683e3c58a41321e Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sat, 16 May 2026 15:53:16 -0400
Subject: [PATCH 0138/1209] c-ares: enable strictDeps, structuredAttrs

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/c-/c-ares/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/c-/c-ares/package.nix b/pkgs/by-name/c-/c-ares/package.nix
index 4e7a3b2e97ba..35d956d9d5b1 100644
--- a/pkgs/by-name/c-/c-ares/package.nix
+++ b/pkgs/by-name/c-/c-ares/package.nix
@@ -20,6 +20,9 @@ stdenv.mkDerivation rec {
   pname = "c-ares";
   version = "1.34.6";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchurl {
     # Note: tag name varies in some versions, e.g. v1.30.0, c-ares-1_17_0.
     url = "https://github.com/c-ares/c-ares/releases/download/v${version}/c-ares-${version}.tar.gz";

From 01e4dac6b3c1ca14ebebe2b59b06f48c692a9be6 Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Wed, 13 May 2026 14:48:35 +0200
Subject: [PATCH 0139/1209] boost: strictDeps

---
 pkgs/development/libraries/boost/generic.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 09e6aa28c567..5f219a93418a 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -423,5 +423,7 @@ stdenv.mkDerivation {
   ];
   setOutputFlags = false;
 
+  strictDeps = true;
+
   __structuredAttrs = true;
 }

From 097b8a0ef0503be85b9845d483a5445b567e4160 Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Sat, 16 May 2026 23:49:04 +0200
Subject: [PATCH 0140/1209] python3Packages.boost: fix use of user-config.jam

---
 pkgs/development/libraries/boost/generic.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 5f219a93418a..2c5bcf0c7c0e 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -74,6 +74,7 @@ let
 
   needUserConfig =
     stdenv.hostPlatform != stdenv.buildPlatform
+    || enablePython
     || useMpi
     || (stdenv.hostPlatform.isDarwin && enableShared);
 

From 52a17d79945fd79d6ef161d708b3a277336a9b7a Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Tue, 5 May 2026 11:25:50 +0200
Subject: [PATCH 0141/1209] boost191: init at 1.91.0

---
 pkgs/by-name/bo/boost-build/package.nix      |  4 ++-
 pkgs/development/libraries/boost/1.91.nix    | 26 ++++++++++++++++++++
 pkgs/development/libraries/boost/default.nix |  1 +
 pkgs/top-level/all-packages.nix              |  1 +
 4 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/libraries/boost/1.91.nix

diff --git a/pkgs/by-name/bo/boost-build/package.nix b/pkgs/by-name/bo/boost-build/package.nix
index f789f8c0cb82..b3f17995518a 100644
--- a/pkgs/by-name/bo/boost-build/package.nix
+++ b/pkgs/by-name/bo/boost-build/package.nix
@@ -35,7 +35,9 @@ stdenv.mkDerivation {
   patches =
     useBoost.boostBuildPatches or [ ]
     ++ lib.optional (
-      useBoost ? version && lib.versionAtLeast useBoost.version "1.81"
+      useBoost ? version
+      && lib.versionAtLeast useBoost.version "1.81"
+      && lib.versionOlder useBoost.version "1.88"
     ) ./fix-clang-target.patch;
 
   postPatch =
diff --git a/pkgs/development/libraries/boost/1.91.nix b/pkgs/development/libraries/boost/1.91.nix
new file mode 100644
index 000000000000..6a0587e5cc38
--- /dev/null
+++ b/pkgs/development/libraries/boost/1.91.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  callPackage,
+  fetchurl,
+  ...
+}@args:
+
+callPackage ./generic.nix (
+  args
+  // rec {
+    version = "1.91.0";
+
+    src =
+      let
+        underVersion = lib.replaceString "." "_" version;
+      in
+      fetchurl {
+        urls = [
+          "https://archives.boost.io/release/${version}/source/boost_${underVersion}.tar.bz2"
+          # "mirror://sourceforge/boost/boost_${underVersion}.tar.bz2" 1.91.0.beta1 is available, but not 1.91.0
+        ];
+        # SHA256 from https://www.boost.org/releases/1.91.0/
+        sha256 = "de5e6b0e4913395c6bdfa90537febd9028ea4c0735d2cdb0cd9b45d5f51264f5";
+      };
+  }
+)
diff --git a/pkgs/development/libraries/boost/default.nix b/pkgs/development/libraries/boost/default.nix
index 930cfab4e8bf..c9eb8ec98b63 100644
--- a/pkgs/development/libraries/boost/default.nix
+++ b/pkgs/development/libraries/boost/default.nix
@@ -31,4 +31,5 @@ in
   boost188 = makeBoost ./1.88.nix;
   boost189 = makeBoost ./1.89.nix;
   boost190 = makeBoost ./1.90.nix;
+  boost191 = makeBoost ./1.91.nix;
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dad4830b1531..5f2e711b1dca 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6023,6 +6023,7 @@ with pkgs;
     boost188
     boost189
     boost190
+    boost191
     ;
 
   boost = boost189;

From e7c432489f86d2650d6dd9bc95ea01cf46c86257 Mon Sep 17 00:00:00 2001
From: Jack Rosenberg <mail@jackr.eu>
Date: Tue, 5 May 2026 10:35:37 +0200
Subject: [PATCH 0142/1209] fuse3: 3.17.4 -> 3.18.2
 https://github.com/libfuse/libfuse/blob/fuse-3.18.2/ChangeLog.rst
 https://github.com/libfuse/libfuse/compare/fuse-3.17.2...fuse-3.18.2

---
 pkgs/os-specific/linux/fuse/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 41c8e32a27ec..983bb378d7c0 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -14,7 +14,7 @@ in
   };
 
   fuse_3 = mkFuse {
-    version = "3.17.4";
-    hash = "sha256-G3+cBp8q8S8oLIcgWp0p+TAtzqXlKYbRSY/5Y3L7QO4=";
+    version = "3.18.2";
+    hash = "sha256-QArQMSStVxwUo6CgU2JlXBdFWjzlGXfZk1AVGLGeE70=";
   };
 }

From c7c2309c84a1729387b3a315b373c97de8f8833a Mon Sep 17 00:00:00 2001
From: Jack Rosenberg <mail@jackr.eu>
Date: Tue, 5 May 2026 10:48:39 +0200
Subject: [PATCH 0143/1209] fuse3: modernize

---
 pkgs/os-specific/linux/fuse/common.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index 726032f36d26..130d3e8c846c 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -20,22 +20,25 @@
 let
   isFuse3 = lib.hasPrefix "3" version;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fuse";
   inherit version;
 
   src = fetchFromGitHub {
     owner = "libfuse";
     repo = "libfuse";
-    rev = "${pname}-${version}";
+    tag = "fuse-${version}";
     inherit hash;
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   patches =
     lib.optional (!isFuse3 && (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isLoongArch64))
       (fetchpatch {
         url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
-        sha256 = "1w4j6f1awjrycycpvmlv0x5v9gprllh4dnbjxl4dyl2jgbkaw6pa";
+        hash = "sha256-UsLE14P50Ell0xo3PESk5tIHH2HLalsaWiEubO9KdPE=";
       })
     ++ (
       if isFuse3 then
@@ -48,7 +51,7 @@ stdenv.mkDerivation rec {
           ./fuse2-Do-not-set-FUSERMOUNT_DIR.patch
           (fetchpatch {
             url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-fs/fuse/files/fuse-2.9.9-closefrom-glibc-2-34.patch?id=8a970396fca7aca2d5a761b8e7a8242f1eef14c9";
-            sha256 = "sha256-ELYBW/wxRcSMssv7ejCObrpsJHtOPJcGq33B9yHQII4=";
+            hash = "sha256-ELYBW/wxRcSMssv7ejCObrpsJHtOPJcGq33B9yHQII4=";
           })
           ./fuse2-gettext-0.25.patch
         ]
@@ -145,4 +148,4 @@ stdenv.mkDerivation rec {
     ];
     outputsToInstall = [ "bin" ];
   };
-}
+})

From 329b59d07d7f527a9dcb25481b3504804b8cd70b Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 19 Jan 2026 19:38:26 -0500
Subject: [PATCH 0144/1209] dbus: fix install name on installed binaries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some binaries have incorrect install names. They should be the absolute
path, but they have `@rpath` instead. This something that Meson should
handle automatically, but it’s not happening for these binaries.
---
 pkgs/by-name/db/dbus/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/db/dbus/package.nix b/pkgs/by-name/db/dbus/package.nix
index b754f292c7c3..7084c73c5085 100644
--- a/pkgs/by-name/db/dbus/package.nix
+++ b/pkgs/by-name/db/dbus/package.nix
@@ -156,6 +156,14 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'DBUS_DAEMONDIR"/dbus-daemon"' '"/run/current-system/sw/bin/dbus-daemon"'
   '';
 
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # For some reason, only these binaries reference the dylib by rpath instead of by an absolute install name.
+    for exe in bin/dbus-daemon bin/dbus-run-session libexec/dbus-daemon-launch-helper; do
+      install_name_tool "$out/$exe" \
+        -change "@rpath/libdbus-1.3.dylib" "$lib/lib/libdbus-1.3.dylib"
+    done
+  '';
+
   postFixup = ''
     # It's executed from $lib by absolute path
     moveToOutput bin/dbus-launch "$lib"

From 171926f883a3ea50add3939d569a75417982f72c Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 19 Jan 2026 19:38:26 -0500
Subject: [PATCH 0145/1209] dbus: default to using tmpdir instead of launchd
 activation

This matches the default behavior on Linux. If D-Bus defaults to launchd
activation, all packages or tests using `dbus-run-session` will fail due
the launch agent not being installed and available.
---
 pkgs/by-name/db/dbus/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/db/dbus/package.nix b/pkgs/by-name/db/dbus/package.nix
index 7084c73c5085..264f6d944497 100644
--- a/pkgs/by-name/db/dbus/package.nix
+++ b/pkgs/by-name/db/dbus/package.nix
@@ -129,6 +129,9 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dselinux=disabled"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # D-Bus defaults to launchd-activation on Darwin, but that requires the launch agent be installed. It also breaks
+    # anything that uses `dbus-run-session` in tests. Changing the default aligns Darwin with other UNIX platforms.
+    "-Ddbus_session_bus_listen_address=unix:tmpdir=/tmp"
     # `launchctl` is only needed at runtime. Lie to `find_program` because it will always be present on a Darwin host.
     "--cross-file=${writeText "darwin.ini" ''
       [binaries]

From 033d41e2e542a1449f933113a601e77220755897 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0146/1209] darwin.sourceRelease: 26.3 -> 26.4

IOAudioFamily: 700.2 -> 740.1
IOHIDFamily: 2222.80.22 -> 2238.100.59
IOKitUser: 100222.80.4 -> 100231.100.18.0.1
IONetworkingFamily: 186 -> 188
IOStorageFamily: 333.40.1 -> 337.100.1
Libc: 1725.40.4 -> 1752.100.10
Libnotify: 344.0.1 -> 48.100.7
Security: 61901.80.25 -> 61901.101.4
configd: 1385.80.4 -> 1405.100.8
eap8021x: 368.60.2 -> 368.101.1
hfs: 704.60.4 -> 715.100.10
libdispatch: 1542.0.4 -> 1542.100.32
libmalloc: 792.80.2 -> 812.100.31
libplatform: 359.80.2 -> 375.100.10
libpthread: 539.80.3 -> 539.100.4
mDNSResponder: 2881.80.4.0.1 -> 2881.100.56.0.1
objc4: 951.1 -> 951.7
ppp: 1023 -> 1025
xnu: 12377.81.4 -> 12377.101.15
---
 .../darwin/sourceRelease/versions.json        | 76 +++++++++----------
 1 file changed, 38 insertions(+), 38 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 352df185452c..d51fffa33a75 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -21,7 +21,7 @@
   },
   "IOAudioFamily": {
     "hash": "sha256-A3iiAjjP29VdjMj40tLS5Q/ni4qeh9bBpnmNzeG2pIY=",
-    "version": "700.2"
+    "version": "740.1"
   },
   "IOBDStorageFamily": {
     "hash": "sha256-OcQUJ3nEfrpvWX/npnedJ4PECIGWFSLiM0PKoiH911w=",
@@ -56,40 +56,40 @@
     "version": "262"
   },
   "IOGraphics": {
-    "hash": "sha256-iysZE42mOKZbFxSZBNspaBTCRKEKK38DFGBxZWQxZxI=",
-    "version": "599"
+    "hash": "sha256-+9DtN1aRQQXLl+OaMZNXdD7ae+NZw3eSWpVhRY5qvhw=",
+    "version": "600"
   },
   "IOHIDFamily": {
-    "hash": "sha256-EJg5lL5uuFCzeOjKDeNZCRYlinwt4WDci0Lr8rJ4Q9k=",
-    "version": "2222.80.22"
+    "hash": "sha256-BORZA8jiVFq/HHY6AnSotKyERkWAN1jK555ZNPW4G1M=",
+    "version": "2238.100.59"
   },
   "IOKitTools": {
     "hash": "sha256-Oknsvzn4nv77WU7f0WPS446iwR2BM2q4iw46r/qctAE=",
     "version": "125"
   },
   "IOKitUser": {
-    "hash": "sha256-bT6CIKd4/Ea17jWd74FWvz5dsmdyDRGU+D5/VydAjrA=",
-    "version": "100222.80.4"
+    "hash": "sha256-PPsD3JGEJlwe9qJdlduQP4q13DtUT3Eak7W1WhlUdn4=",
+    "version": "100231.100.18.0.1"
   },
   "IONetworkingFamily": {
-    "hash": "sha256-ZF5ML41Y1l1liQn32qTkcl4mMvx9Xdizb9VgvTzVTL4=",
-    "version": "186"
+    "hash": "sha256-zSmOsiCh+W1k9d6G2+/FD0KPrrtjQTkZscyKgKIa3UU=",
+    "version": "188"
   },
   "IOSerialFamily": {
     "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
     "version": "93"
   },
   "IOStorageFamily": {
-    "hash": "sha256-5oUSyzMxniNHG7rPkuxb31v4QcOmXNCriI3Jku2VOTY=",
-    "version": "333.40.1"
+    "hash": "sha256-whybjI8XIaihvo16oLq6xP5pNRPZeG7Jdy5jbyWqG1k=",
+    "version": "337.100.1"
   },
   "IOUSBFamily": {
     "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
     "version": "630.4.5"
   },
   "Libc": {
-    "hash": "sha256-3r3IFwONIg+4Oe99IRJ4jvyevZRmIuFmjVL+JMrfw/M=",
-    "version": "1725.40.4"
+    "hash": "sha256-+40LeOU1ViMKBXCSvJXQi1N8NSAhL/rlucR32KZ+Chw=",
+    "version": "1752.100.10"
   },
   "Libinfo": {
     "hash": "sha256-4InBEPi0n2EMo/8mIBib1Im4iTKRcRJ4IlAcLCigVGk=",
@@ -100,8 +100,8 @@
     "version": "2026"
   },
   "Libnotify": {
-    "hash": "sha256-p8cJZlBYOFmI1NDHXGYjgcv8z9Ldc1amZuYlxxJfeVY=",
-    "version": "344.0.1"
+    "hash": "sha256-5ZpFParMjqf3nwsjx3Y1SCTXmTUtHX9eDkVJTW59Ppg=",
+    "version": "348.100.7"
   },
   "Librpcsvc": {
     "hash": "sha256-UWYdCQ9QsBqwM01bWr+igINAHSdSluB/FrOclC5AjTI=",
@@ -120,8 +120,8 @@
     "version": "1846.81.1"
   },
   "Security": {
-    "hash": "sha256-+Rt3+bwj7++u8Pm5V6QgIQUpugwcY2gjqkCWZ2xqGqw=",
-    "version": "61901.80.25"
+    "hash": "sha256-1ka7ws6POwm+WKwB/VYZX/uQTQccJe5r9tYDHgoqHp0=",
+    "version": "61901.101.4"
   },
   "adv_cmds": {
     "hash": "sha256-QSqEchXCBSUo6kpGb1FyCcrZx1RFfUP/9hoNbQK2lF8=",
@@ -140,8 +140,8 @@
     "version": "138"
   },
   "configd": {
-    "hash": "sha256-OJhJocVQvIaulSK65z2URATB+NTnFdOXyunjcBGr08k=",
-    "version": "1385.80.4"
+    "hash": "sha256-3GiQlhfYhemK37ue0KY8Q3CDQK2TMFRDFnoxFeJzO+k=",
+    "version": "1405.100.8"
   },
   "copyfile": {
     "hash": "sha256-I9uDi5BDQKa7mO3XpHxv0d6PiROW2ueZ3vGfrsG0OJo=",
@@ -168,16 +168,16 @@
     "version": "1340"
   },
   "eap8021x": {
-    "hash": "sha256-To9CIsN0oXRmtUjPojXYfUmaoOOdrNbq3AYwghxzoQs=",
-    "version": "368.60.2"
+    "hash": "sha256-nwCp5QgtXC2X3y5eR3DnXkdpECNkLmejM2iGQ6nuPaQ=",
+    "version": "368.101.1"
   },
   "file_cmds": {
     "hash": "sha256-1hdTjg1Nf31gAhwjQEhRZQhaqayC8x7PGHAwZ1aEIm8=",
     "version": "475"
   },
   "hfs": {
-    "hash": "sha256-WqXzEVvveaOvTbVN/HzKdDxeHYmxEfLhV3WjO/S+u1E=",
-    "version": "704.60.4"
+    "hash": "sha256-GOI7U2J4vy5GQRubSWqx0xZFtE4e/hq7SsUuqptrYR0=",
+    "version": "715.100.10"
   },
   "launchd": {
     "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
@@ -188,8 +188,8 @@
     "version": "96"
   },
   "libdispatch": {
-    "hash": "sha256-L0+Ho9dAlMXVpqFEGIcIMsJc0gULckRulUImNEZe5MU=",
-    "version": "1542.0.4"
+    "hash": "sha256-1PHHUzPipwUdzk9uMHweG64J4EU4lixPApV7qwPBpWY=",
+    "version": "1542.100.32"
   },
   "libffi": {
     "hash": "sha256-xHefZVsZg9kUXV0t/HLdjPkkD/hn/4bvdRVJ4PsQLeM=",
@@ -200,20 +200,20 @@
     "version": "113"
   },
   "libmalloc": {
-    "hash": "sha256-FYWPf6UwDfmWtde2xW1EuBfygv43bvzGncKEMUHY3Qc=",
-    "version": "792.80.2"
+    "hash": "sha256-kwJ6vfk1PzDdE0n3Ba+3hXLSf63YmMgPluxrEuvOpF0=",
+    "version": "812.100.31"
   },
   "libpcap": {
     "hash": "sha256-G7CL3pCCmxOoZ+ouA+xfOeDgvLcT9AN9zyrx+cL2Ge4=",
     "version": "144"
   },
   "libplatform": {
-    "hash": "sha256-m1g1suIbEA4g7vWEKYR9x+g0aaXSjvR0IRy4jCU+y0w=",
-    "version": "359.80.2"
+    "hash": "sha256-bghS+sClE2nygZMahh1udoMZmGvRSCKn+W4ywTi51Zw=",
+    "version": "375.100.10"
   },
   "libpthread": {
     "hash": "sha256-3Xoe0gYZ6RbMZqzsAG8ynnFb3cqypFYImPNYA5H6P9s=",
-    "version": "539.80.3"
+    "version": "539.100.4"
   },
   "libresolv": {
     "hash": "sha256-SDdF7foz8DFUXmXEznwusNMkXFHrPkdLWQM8xfxb0gc=",
@@ -224,8 +224,8 @@
     "version": "73"
   },
   "mDNSResponder": {
-    "hash": "sha256-Wa6IM6qz/gjO1GwER7KkPEiknEJbkntA2Q92Bc/YMoY=",
-    "version": "2881.80.4.0.1"
+    "hash": "sha256-0u2c3b0rmOFock4wIWg6n16XZWEr+bsj2r5JwgUOr7o=",
+    "version": "2881.100.56.0.1"
   },
   "mail_cmds": {
     "hash": "sha256-peoaHopJaYDqyE4TGfLx7W1K2KsFZmHLWr8Er/HpA90=",
@@ -240,16 +240,16 @@
     "version": "730.80.3"
   },
   "objc4": {
-    "hash": "sha256-imgOe9mr5HnvTAupIEj1UwS7tbmk3coqNf5BQgI32lE=",
-    "version": "951.1"
+    "hash": "sha256-vonl+pqJurD7ozdZ8AQokvtlgKXCk+BP/vFfoyGJiUQ=",
+    "version": "951.7"
   },
   "patch_cmds": {
     "hash": "sha256-fDY2NOT3DnU5pm06cHSs+JJcA/EFP8Lxjg7sErUerJ0=",
     "version": "72"
   },
   "ppp": {
-    "hash": "sha256-N8e3BvyxTvb+mAhNHuCWVGqEyEE89G2zNQDL/mro+X0=",
-    "version": "1023"
+    "hash": "sha256-syc0tbDPACswBNNrTaOsC6Lyix6d7O9634PBCjnuqOs=",
+    "version": "1025"
   },
   "remote_cmds": {
     "hash": "sha256-8c/NgQZ+K6jJ3aoYK78/BsEkM1gmRS+9z0437+SvcCw=",
@@ -276,7 +276,7 @@
     "version": "144"
   },
   "xnu": {
-    "hash": "sha256-ci4Rsa1nRpS9qYBUxnaQokrtBzApGF/kQXugGusb9ok=",
-    "version": "12377.81.4"
+    "hash": "sha256-TpT7j7jgcibaHd7cqGbyfDRO0XkjKJNf/tPrdnVVpUw=",
+    "version": "12377.101.15"
   }
 }

From 5663b16973445e8f1c58057f55599b3c9882cbc7 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0147/1209] darwin.adv_cmds: fix build after 26.4 source
 release update

---
 pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix b/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix
index 3ded625c156b..3f0e13b38f2a 100644
--- a/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix
@@ -14,7 +14,7 @@
 let
   Libc = sourceRelease "Libc";
   libplatform = sourceRelease "libplatform";
-  xnu = sourceRelease "xnu";
+  xnu = sourceRelease "xnu"; # Can’t use xnuHeaders because adv_cmds is a transitive dependency of xnuHeaders.
 
   privateHeaders = stdenvNoCC.mkDerivation {
     name = "adv_cmds-deps-private-headers";
@@ -27,6 +27,9 @@ let
       install -D -m644 -t "$out/include/System/sys" \
         '${xnu}/bsd/sys/persona.h' \
         '${xnu}/bsd/sys/proc.h'
+
+      install -D -m644 -t "$out/include/sys" \
+        '${xnu}/bsd/sys/proc_private.h'
     '';
   };
 in

From 63d7cdac01939aa8fd7dd5561a63b152dc2d63aa Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0148/1209] darwin.AvailabilityVersions: 155 -> 157.2

https://github.com/apple-oss-distributions/AvailabilityVersions/compare/AvailabilityVersions-155...AvailabilityVersions-157.2
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index d51fffa33a75..0f3e475e2d53 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -1,7 +1,7 @@
 {
   "AvailabilityVersions": {
-    "hash": "sha256-WcRJx/dt4DdEZ+lQBGgLwRYv1zlSwyNeKUTtuKH1fzE=",
-    "version": "155"
+    "hash": "sha256-v+ikUET6ByNEBRbPbl7ivqTJKJkZQDGG7Q20tIMt8pU=",
+    "version": "157.2"
   },
   "CarbonHeaders": {
     "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",

From 10bb94fb92560bd6a169b4b106098ddc0f17bfed Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0149/1209] darwin.copyfile: 230.0.1.0.1 -> 240

https://github.com/apple-oss-distributions/copyfile/compare/copyfile-230.0.1.0.1...copyfile-240
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 0f3e475e2d53..786fc6a5c49e 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -144,8 +144,8 @@
     "version": "1405.100.8"
   },
   "copyfile": {
-    "hash": "sha256-I9uDi5BDQKa7mO3XpHxv0d6PiROW2ueZ3vGfrsG0OJo=",
-    "version": "230.0.1.0.1"
+    "hash": "sha256-IPwDBOtzdUiS1M4ZlhJ44z8Rv7Ot21QnKGxwUW8UZ8c=",
+    "version": "240"
   },
   "developer_cmds": {
     "hash": "sha256-4DDyWuRbxpwDLkbfJIwYp6DKcEDByDiGUmsdOmwq5fI=",

From 89251e8199cd1bf5740e8088e85d6afe24aa093e Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0150/1209] darwin.developer_cmds: 87 -> 89

https://github.com/apple-oss-distributions/developer_cmds/compare/developer_cmds-87...developer_cmds-89
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 786fc6a5c49e..0ee3deb8ca03 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -148,8 +148,8 @@
     "version": "240"
   },
   "developer_cmds": {
-    "hash": "sha256-4DDyWuRbxpwDLkbfJIwYp6DKcEDByDiGUmsdOmwq5fI=",
-    "version": "87"
+    "hash": "sha256-MX7PIvmWvu/QTUqgzjMu0NntcZuFTL35faec3IkWHBE=",
+    "version": "89"
   },
   "diskdev_cmds": {
     "hash": "sha256-WDedl0pv/AReA96Gh+v2MwoX+QGrekK7YXEGw3aWB5Q=",

From 3ea2eff071bad9cb03b3582c2e02309125be3011 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0151/1209] darwin.diskdev_cmds: 751.80.2 -> 757

https://github.com/apple-oss-distributions/diskdev_cmds/compare/diskdev_cmds-751.80.2...diskdev_cmds-757
---
 pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix b/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix
index a9e5571a8954..7a16dbe68484 100644
--- a/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix
@@ -48,7 +48,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-qyQM+48PKKWUmdoBprpDf4DXIVAtd3EKCU+ZD/EhNXQ=";
+  xcodeHash = "sha256-mlTUd9eTBQhJa1hzAKzBpw6+702C4dwUjwZvJs/EKyw=";
 
   postPatch =
     # Fix incompatible pointer to integer conversion. The last parameter is size_t not a pointer.
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 0ee3deb8ca03..a60760db5da6 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -152,8 +152,8 @@
     "version": "89"
   },
   "diskdev_cmds": {
-    "hash": "sha256-WDedl0pv/AReA96Gh+v2MwoX+QGrekK7YXEGw3aWB5Q=",
-    "version": "751.80.2"
+    "hash": "sha256-SciJme+LNmkKkxEO77P0kRGMhtw2ZXSKKMSp55YbdIo=",
+    "version": "757"
   },
   "doc_cmds": {
     "hash": "sha256-nnwKXKKjgJXcLCArD38Dme2L1WyR1U0rwn7zI+NCftw=",

From ad15de5dbd17c591bc755ead6f2981d0d8d28f61 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0152/1209] darwin.dyld: 1340 -> 1376.6

https://github.com/apple-oss-distributions/dyld/compare/dyld-1340...dyld-1376.6
---
 .../darwin/by-name/dy/dyld/meson.build.in     | 178 ++++++++++++++++--
 .../darwin/by-name/dy/dyld/package.nix        |  22 ++-
 .../darwin/sourceRelease/versions.json        |   4 +-
 3 files changed, 175 insertions(+), 29 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/dy/dyld/meson.build.in b/pkgs/os-specific/darwin/by-name/dy/dyld/meson.build.in
index 5bbef54de647..467f425e1cc0 100644
--- a/pkgs/os-specific/darwin/by-name/dy/dyld/meson.build.in
+++ b/pkgs/os-specific/darwin/by-name/dy/dyld/meson.build.in
@@ -9,6 +9,7 @@ project(
     version : '@version@'
 )
 add_project_arguments(
+    '-DLD_VERSION=@version@',
     # Prevent build failures due to these targets not being defined
     '-DTARGET_OS_BRIDGE=0',
     '-DTARGET_OS_EXCLAVEKIT=0',
@@ -63,6 +64,32 @@ corecrypto_dep = declare_dependency(
     link_with : corecrypto,
 )
 
+common = static_library(
+    'common',
+    dependencies : [ corecrypto_dep ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'lsl',
+        'other-tools',
+    ],
+    sources : [
+        'common/CRC32c.cpp',
+        'common/CachePatching.cpp',
+        'common/Diagnostics.cpp',
+        'common/DyldSharedCache.cpp',
+        'common/MachOFile.cpp',
+        'common/MachOLayout.cpp',
+        'common/MachOLoaded.cpp',
+        'common/TargetPolicy.cpp',
+        'common/Utilities.cpp',
+    ],
+)
+common_dep = declare_dependency(
+    include_directories : [ 'common' ],
+    link_with : common,
+)
+
 lsl = static_library(
     'lsl',
     cpp_args : [
@@ -77,7 +104,6 @@ lsl = static_library(
     ],
     sources : [
         'lsl/Allocator.cpp',
-        'lsl/CRC32c.cpp',
         'lsl/PVLEInt64.cpp',
     ],
 )
@@ -107,7 +133,7 @@ libmach_o = static_library(
         'mach_o/FunctionStarts.cpp',
         'mach_o/FunctionVariants.cpp',
         'mach_o/GradedArchitectures.cpp',
-        'mach_o/Header.cpp',
+        'mach_o/LazyLoadDylib.cpp',
         'mach_o/Image.cpp',
         'mach_o/Instructions.cpp',
         # 'mach_o/LinkerOptimizationHints.cpp',
@@ -121,6 +147,7 @@ libmach_o = static_library(
         'mach_o/SplitSeg.cpp',
         'mach_o/Symbol.cpp',
         'mach_o/Universal.cpp',
+        'mach_o/UnsafeHeader.cpp',
         'mach_o/Version32.cpp',
         'mach_o/Version64.cpp',
     ],
@@ -147,12 +174,12 @@ libmach_o_writer = static_library(
         'mach_o_writer/ExportsTrieWriter.cpp',
         'mach_o_writer/FunctionStartsWriter.cpp',
         'mach_o_writer/FunctionVariantsWriter.cpp',
-        'mach_o_writer/HeaderWriter.cpp',
         'mach_o_writer/LinkerOptimizationHintsWriter.cpp',
         'mach_o_writer/NListSymbolTableWriter.cpp',
         'mach_o_writer/RebaseOpcodesWriter.cpp',
         'mach_o_writer/SplitSegWriter.cpp',
         'mach_o_writer/UniversalWriter.cpp',
+        'mach_o_writer/UnsafeHeaderWriter.cpp',
     ],
 )
 libmach_o_writer_dep = declare_dependency(
@@ -170,7 +197,11 @@ libminidyld = static_library(
         '-DPRIVATE',
         '-DBUILDING_LIBDYLD=1',
     ],
-    dependencies : [ corecrypto_dep, lsl_dep ],
+    dependencies : [
+        common_dep,
+        corecrypto_dep,
+        lsl_dep
+    ],
     include_directories : [
         common_inc,
         'cache_builder',
@@ -178,9 +209,6 @@ libminidyld = static_library(
         'libdyld_introspection',
     ],
     sources : [
-        'common/CachePatching.cpp',
-        'common/MachOLayout.cpp',
-        'common/MachOLoaded.cpp',
         'libdyld/CrashReporterAnnotations.c',
     ],
 )
@@ -189,6 +217,7 @@ libdsc_extractor = shared_library(
     'dsc_extractor',
     cpp_args : [ '-DBUILDING_SHARED_CACHE_EXTRACTOR=1' ],
     dependencies : [
+        common_dep,
         corecrypto_dep,
         libmach_o_dep,
         lsl_dep
@@ -204,13 +233,8 @@ libdsc_extractor = shared_library(
     name_prefix : '',
     name_suffix : 'bundle',
     sources : [
-        'common/DyldSharedCache.cpp',
-        'common/MachOFile.cpp',
-        'common/TargetPolicy.cpp',
         'other-tools/dsc_extractor.cpp',
         'other-tools/dsc_iterator.cpp',
-        'common/MachOLayout.cpp',
-        'common/Diagnostics.cpp',
     ],
 )
 
@@ -223,6 +247,30 @@ executable(
     sources : [ 'other-tools/dsc_extractor_bin.cpp' ],
 )
 
+
+executable(
+    'dyld_analyzer',
+    cpp_args : [ '-DBUILDING_LEGACY_TOOL' ],
+    dependencies : [
+        common_dep,
+        libmach_o_dep,
+        lsl_dep,
+    ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'other-tools',
+    ],
+    install : true,
+    link_with : [ libminidyld ],
+    sources : [
+        'other-tools/dyld_analyzer.cpp',
+        'other-tools/FileUtils.cpp',
+        'other-tools/MiscFileUtils.cpp',
+        'other-tools/Tool.cpp',
+    ],
+)
+
 executable(
     'dyld_info',
     cpp_args : [
@@ -230,6 +278,7 @@ executable(
         '-DBUILDING_FOR_TOOLCHAIN=1',
     ],
     dependencies : [
+        common_dep,
         corecrypto_dep,
         libmach_o_dep,
         llvm_dep,
@@ -244,13 +293,6 @@ executable(
     link_args : [ '-Wl,-weak-lLTO' ],
     link_with : [ libminidyld ],
     sources : [
-        'common/Diagnostics.cpp',
-        'common/DyldSharedCache.cpp',
-        'common/MachOAnalyzer.cpp',
-        'common/MachOFile.cpp',
-        'common/MetadataVisitor.cpp',
-        'common/SwiftVisitor.cpp',
-        'common/TargetPolicy.cpp',
         'other-tools/dyld_info.cpp',
         'other-tools/FileUtils.cpp',
         'other-tools/MiscFileUtils.cpp',
@@ -258,3 +300,101 @@ executable(
     ],
 )
 install_man('doc/man/man1/dyld_info.1')
+
+# Requires headers from unpublished ld-prime sources
+# executable(
+#     'libtool',
+#     dependencies : [ lsl_dep ],
+#     include_directories : [
+#         common_inc,
+#         'cache_builder',
+#         'mach_o_writer',
+#     ],
+#     install : true,
+#     sources : [
+#         'other-tools/libtool.cpp',
+#         'other-tools/Tool.cpp',
+#     ],
+# )
+# install_man('doc/man/man1/libtool.1')
+#
+# # ranlib is a symlink to libtool
+# install_man('doc/man/man1/ranlib.1')
+
+# Requires headers from unpublished ld-prime sources
+# executable(
+#     'lipo',
+#     dependencies : [ lsl_dep ],
+#     include_directories : [ common_inc ],
+#     install : true,
+#     sources : [
+#         'other-tools/lipo.cpp',
+#         'other-tools/Tool.cpp',
+#     ],
+# )
+
+executable(
+    'nm',
+    cpp_args : [ '-DBUILDING_LEGACY_TOOL' ],
+    dependencies : [
+        common_dep,
+        libmach_o_dep,
+        lsl_dep,
+    ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'other-tools',
+    ],
+    install : true,
+    link_with : [ libminidyld ],
+    sources : [
+        'other-tools/MiscFileUtils.cpp',
+        'other-tools/nm.cpp',
+        'other-tools/Tool.cpp',
+    ],
+)
+
+executable(
+    'strings',
+    cpp_args : [ '-DBUILDING_LEGACY_TOOL' ],
+    dependencies : [
+        common_dep,
+        libmach_o_dep,
+        lsl_dep,
+    ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'other-tools',
+    ],
+    install : true,
+    link_with : [ libminidyld ],
+    sources : [
+        'other-tools/MiscFileUtils.cpp',
+        'other-tools/strings.cpp',
+        'other-tools/Tool.cpp',
+    ],
+)
+
+executable(
+    'size',
+    cpp_args : [ '-DBUILDING_LEGACY_TOOL' ],
+    dependencies : [
+        common_dep,
+        libmach_o_dep,
+        lsl_dep,
+    ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'other-tools',
+    ],
+    install : true,
+    link_with : [ libminidyld ],
+    sources : [
+        'other-tools/MiscFileUtils.cpp',
+        'other-tools/size.cpp',
+        'other-tools/Tool.cpp',
+    ],
+)
diff --git a/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix b/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
index a92bdb13e3ad..27ae0af42ab1 100644
--- a/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
+++ b/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
@@ -10,6 +10,7 @@
   pkgsBuildHost,
   sourceRelease,
   stdenvNoCC,
+  xnuHeaders,
 }:
 
 let
@@ -70,18 +71,19 @@ let
 
       install -D -m644 -t "$out/include/os" \
         '${xnu}/libsyscall/os/tsd.h' \
-        '${xnu}/libkern/os/atomic_private.h' \
-        '${xnu}/libkern/os/atomic_private_arch.h' \
-        '${xnu}/libkern/os/atomic_private_impl.h' \
-        '${xnu}/libkern/os/base_private.h' \
+        '${xnuHeaders}/Library/Frameworks/Kernel.framework/Versions/A/PrivateHeaders/os/atomic_private.h' \
+        '${xnuHeaders}/Library/Frameworks/Kernel.framework/Versions/A/PrivateHeaders/os/atomic_private_arch.h' \
+        '${xnuHeaders}/Library/Frameworks/Kernel.framework/Versions/A/PrivateHeaders/os/atomic_private_impl.h' \
+        '${xnuHeaders}/Library/Frameworks/Kernel.framework/Versions/A/PrivateHeaders/os/base_private.h' \
         '${libplatform}/private/os/lock_private.h'
 
       substituteInPlace "$out/include/os/lock_private.h" \
         --replace-fail ', bridgeos(4.0)' ""
 
       install -D -m644 -t "$out/include/sys" \
-        '${xnu}/bsd/sys/kern_memorystatus.h' \
-        '${xnu}/bsd/sys/reason.h'
+        '${xnuHeaders}/include/sys/commpage_private.h' \
+        '${xnuHeaders}/include/sys/kern_memorystatus.h' \
+        '${xnuHeaders}/include/sys/reason.h'
 
       # This file is part of ld-prime, which is unhelpfully not included in the dyld source release.
       # Fortunately, nothing in it is actually needed to build `dyld_info` and `dsc_extractor`.
@@ -100,7 +102,7 @@ mkAppleDerivation {
 
   propagatedBuildOutputs = [ ];
 
-  xcodeHash = "sha256-F/V1XzBP1qEDpUDTz+jyp5dbcfqdQp8s9NW2OBoU5x0=";
+  xcodeHash = "sha256-eECKavCwz8NDqPOgW1YZ4ldQQHSUdBvAGRtYcVgEX/w=";
 
   patches = [
     # Disable use of private kdebug API
@@ -134,7 +136,8 @@ mkAppleDerivation {
       --replace-fail '__API_UNAVAILABLE(ios, tvos, watchos) __API_UNAVAILABLE(bridgeos)' ""
 
     substituteInPlace include/mach-o/utils_priv.h \
-      --replace-fail 'SPI_AVAILABLE(macos(15.0), ios(18.0), tvos(18.0), watchos(11.0))' ""
+      --replace-fail 'SPI_AVAILABLE' "__SPI_AVAILABLE" \
+      --replace-fail '____SPI_AVAILABLE' "__SPI_AVAILABLE"
 
     substituteInPlace libdyld/utils.cpp \
       --replace-fail 'DYLD_EXCLAVEKIT_UNAVAILABLE' ""
@@ -146,6 +149,9 @@ mkAppleDerivation {
         = { CRASHREPORTER_ANNOTATIONS_VERSION, 0, 0, 0, 0, 0, 0 };
     EOF
 
+    substituteInPlace other-tools/Tool.cpp \
+      --replace-fail 'bridgeOS 6,' ""
+
     # Fix header includes
     substituteInPlace libdyld_introspection/dyld_introspection.cpp \
       --replace-fail 'dyld_introspection.h' 'mach-o/dyld_introspection.h'
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index a60760db5da6..7a8bc75624eb 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -164,8 +164,8 @@
     "version": "413"
   },
   "dyld": {
-    "hash": "sha256-rvWFiQVLJKqL0hOL2nRqwRkyPc/OvGnL0GEBymq7Fio=",
-    "version": "1340"
+    "hash": "sha256-uXFAHIgSrAR2duFhSvOXdaa0x8GTj4Qjq9TNGOZRGhU=",
+    "version": "1376.6"
   },
   "eap8021x": {
     "hash": "sha256-nwCp5QgtXC2X3y5eR3DnXkdpECNkLmejM2iGQ6nuPaQ=",

From ca6d6d5817edb91338ff221a63f30fb38bd33589 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0153/1209] darwin.file_cmds: 475 -> 479

https://github.com/apple-oss-distributions/file_cmds/compare/file_cmds-475...file_cmds-479
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 7a8bc75624eb..933aa066417e 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -172,8 +172,8 @@
     "version": "368.101.1"
   },
   "file_cmds": {
-    "hash": "sha256-1hdTjg1Nf31gAhwjQEhRZQhaqayC8x7PGHAwZ1aEIm8=",
-    "version": "475"
+    "hash": "sha256-4Ii7dbijMCYq0IyAYXt1wm+9igSqUCtS60hsAm8+dM8=",
+    "version": "479"
   },
   "hfs": {
     "hash": "sha256-GOI7U2J4vy5GQRubSWqx0xZFtE4e/hq7SsUuqptrYR0=",

From 4c124e96a89c72f71026522204a1c6b8bb13600a Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0154/1209] darwin.ICU: 76142.3.1.1 -> 76142.4.7

https://github.com/apple-oss-distributions/ICU/compare/ICU-76142.3.1.1...ICU-76142.4.7

Contrary to the version convention, this ICU is based on ICU 78. One can
confirm by checking `$dev/include/unicode/uvernum.h`, which shows 78.
---
 .../darwin/by-name/ic/ICU/package.nix         |  8 +++---
 .../0001-suppress-icu-check-crash.patch       | 25 +++++++++++++++++++
 .../patches/suppress-icu-check-crash.patch    | 13 ----------
 .../darwin/sourceRelease/versions.json        |  4 +--
 4 files changed, 32 insertions(+), 18 deletions(-)
 create mode 100644 pkgs/os-specific/darwin/by-name/ic/ICU/patches/0001-suppress-icu-check-crash.patch
 delete mode 100644 pkgs/os-specific/darwin/by-name/ic/ICU/patches/suppress-icu-check-crash.patch

diff --git a/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix b/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
index f742f4743807..d2678d47b0bc 100644
--- a/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
@@ -3,7 +3,7 @@
   bootstrapStdenv,
   buildPackages,
   fetchpatch2,
-  icu76, # The ICU version should correspond to the same one used by Apple’s ICU package
+  icu78, # The ICU version should correspond to the same one used by Apple’s ICU package
   mkAppleDerivation,
   python3,
   stdenvNoCC,
@@ -40,9 +40,11 @@ let
 
     patches = [
       # Skip MessageFormatTest test, which is known to crash sometimes and should be suppressed if it does.
-      ./patches/suppress-icu-check-crash.patch
+      ./patches/0001-suppress-icu-check-crash.patch
     ];
 
+    patchFlags = [ "-p4" ];
+
     preConfigure = ''
       sed -i -e "s|/bin/sh|${stdenv.shell}|" configure
       patchShebangs --build .
@@ -118,7 +120,7 @@ let
 
           # Add missing test data. It’s not included in the source release.
           chmod u+w "$NIX_BUILD_TOP/source/icu"
-          tar -C "$NIX_BUILD_TOP/source" -axf ${lib.escapeShellArg icu76.src} icu/testdata
+          tar -C "$NIX_BUILD_TOP/source" -axf ${lib.escapeShellArg icu78.src} icu/testdata
         ''
         + lib.optionalString stdenv.hostPlatform.isx86_64 ''
           # These tests fail under Rosetta 2 with a floating-point exception.
diff --git a/pkgs/os-specific/darwin/by-name/ic/ICU/patches/0001-suppress-icu-check-crash.patch b/pkgs/os-specific/darwin/by-name/ic/ICU/patches/0001-suppress-icu-check-crash.patch
new file mode 100644
index 000000000000..b9018766b838
--- /dev/null
+++ b/pkgs/os-specific/darwin/by-name/ic/ICU/patches/0001-suppress-icu-check-crash.patch
@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Fri, 8 May 2026 21:00:49 -0400
+Subject: [PATCH] suppress-icu-check-crash
+
+---
+ icu/icu4c/source/test/cintltst/cmsgtst.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/icu/icu4c/source/test/cintltst/cmsgtst.c b/icu/icu4c/source/test/cintltst/cmsgtst.c
+index 16263b5c7..fccc2753d 100644
+--- a/icu/icu4c/source/test/cintltst/cmsgtst.c
++++ b/icu/icu4c/source/test/cintltst/cmsgtst.c
+@@ -231,7 +231,7 @@ static void MessageFormatTest( void )
+                         austrdup(result), austrdup(testResultStrings[i]) );
+                 }
+ 
+-#if (U_PLATFORM == U_PF_LINUX || U_PLATFORM == U_PF_QNX) /* add platforms here .. */
++#if (U_PLATFORM == U_PF_LINUX || U_PLATFORM == U_PF_DARWIN || U_PLATFORM == U_PF_QNX) /* add platforms here .. */
+                 log_verbose("Skipping potentially crashing test for mismatched varargs.\n");
+ #else
+                 log_verbose("Note: the next is a platform dependent test. If it crashes, add an exclusion for your platform near %s:%d\n", __FILE__, __LINE__); 
+-- 
+2.51.2
+
diff --git a/pkgs/os-specific/darwin/by-name/ic/ICU/patches/suppress-icu-check-crash.patch b/pkgs/os-specific/darwin/by-name/ic/ICU/patches/suppress-icu-check-crash.patch
deleted file mode 100644
index 23a5ac307c80..000000000000
--- a/pkgs/os-specific/darwin/by-name/ic/ICU/patches/suppress-icu-check-crash.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/test/cintltst/cmsgtst.c b/test/cintltst/cmsgtst.c
-index cb328707..1073e6c1 100644
---- a/test/cintltst/cmsgtst.c
-+++ b/test/cintltst/cmsgtst.c
-@@ -231,7 +231,7 @@ static void MessageFormatTest( void )
-                         austrdup(result), austrdup(testResultStrings[i]) );
-                 }
- 
--#if (U_PLATFORM == U_PF_LINUX) /* add platforms here .. */
-+#if (U_PLATFORM == U_PF_LINUX || U_PLATFORM == U_PF_DARWIN) /* add platforms here .. */
-                 log_verbose("Skipping potentially crashing test for mismatched varargs.\n");
- #else
-                 log_verbose("Note: the next is a platform dependent test. If it crashes, add an exclusion for your platform near %s:%d\n", __FILE__, __LINE__); 
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 933aa066417e..de9dff82d2cb 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -16,8 +16,8 @@
     "version": "88"
   },
   "ICU": {
-    "hash": "sha256-qtv+IUEjdY5I87wDEIO9cWFAh1WmnIDVIzIyyL9NTd8=",
-    "version": "76142.3.1.1"
+    "hash": "sha256-NnTaNtYDDSNe7wLr9U/raaCXGBDWHMt91HJcumY0qTQ=",
+    "version": "76142.4.7"
   },
   "IOAudioFamily": {
     "hash": "sha256-A3iiAjjP29VdjMj40tLS5Q/ni4qeh9bBpnmNzeG2pIY=",

From 6575bc0242017976bd3924c72d6d498f79f014bf Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0155/1209] darwin.libiconv: 113 -> 115.100.1

https://github.com/apple-oss-distributions/libiconv/compare/libiconv-113...libiconv-115.100.1
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index de9dff82d2cb..b2cc513862a5 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -196,8 +196,8 @@
     "version": "40"
   },
   "libiconv": {
-    "hash": "sha256-MboAwJvpO0ix7XsAuKUUxipv8ecxD2OjDgD5bQbygr8=",
-    "version": "113"
+    "hash": "sha256-iPPdwts6kALf2lGnYnXfMTuBa2lYrDt7rySiUmraJqs=",
+    "version": "115.100.1"
   },
   "libmalloc": {
     "hash": "sha256-kwJ6vfk1PzDdE0n3Ba+3hXLSf63YmMgPluxrEuvOpF0=",

From 0d5d9a512954686344ed5e5346bab660983c5cfc Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0156/1209] darwin.libpcap: 144 -> 146

https://github.com/apple-oss-distributions/libpcap/compare/libpcap-144...libpcap-146
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index b2cc513862a5..63ca1def35c4 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -204,8 +204,8 @@
     "version": "812.100.31"
   },
   "libpcap": {
-    "hash": "sha256-G7CL3pCCmxOoZ+ouA+xfOeDgvLcT9AN9zyrx+cL2Ge4=",
-    "version": "144"
+    "hash": "sha256-imKN9h6AfSyjjOjp9AX68LNXybh/pitXDM35N/3/Tls=",
+    "version": "146"
   },
   "libplatform": {
     "hash": "sha256-bghS+sClE2nygZMahh1udoMZmGvRSCKn+W4ywTi51Zw=",

From 11e16349972656869ac34c91b73ea50fecb82f17 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0157/1209] darwin.libresolv: 93 -> 96

https://github.com/apple-oss-distributions/libresolv/compare/libresolv-93...libresolv-96
---
 pkgs/os-specific/darwin/by-name/li/libresolv/package.nix | 9 ++++++---
 pkgs/os-specific/darwin/sourceRelease/versions.json      | 4 ++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix b/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix
index 6e8cf1f8e394..f38797fd2ce9 100644
--- a/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix
+++ b/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  fetchFromGitHub,
   mkAppleDerivation,
   sourceRelease,
   stdenvNoCC,
@@ -23,8 +22,12 @@ let
         '${dyld}/include/mach-o/dyld_priv.h'
 
       substituteInPlace "$out/include/mach-o/dyld_priv.h" \
-        --replace-fail ', bridgeos(3.0)' "" \
-        --replace-fail '//@VERSION_DEFS@' 'const dyld_build_version_t dyld_2024_SU_E_os_versions = { 1 /* macOS */, 150400 };'
+        --replace-fail ', bridgeos(3.0)' ""
+
+      cat <<EOF > "$out/include/mach-o/dyld_version_defines.h"
+      #pragma once
+      const dyld_build_version_t dyld_2024_SU_E_os_versions = { 1 /* macOS */, 150400 };
+      EOF
     '';
   };
 in
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 63ca1def35c4..e77862dd91a3 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -216,8 +216,8 @@
     "version": "539.100.4"
   },
   "libresolv": {
-    "hash": "sha256-SDdF7foz8DFUXmXEznwusNMkXFHrPkdLWQM8xfxb0gc=",
-    "version": "93"
+    "hash": "sha256-MAfzoyww1UK0o5TJ7XI4A9vi1T09Nz6Yb9iMrS/wX78=",
+    "version": "96"
   },
   "libutil": {
     "hash": "sha256-64+1CIRpYBon7skJRKdaXcxucPh9GrhAbUERhL2PLXA=",

From a90fc6279376633863e9f9bd52d1a9719630a9fe Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0158/1209] darwin.mail_cmds: 41 -> 43

https://github.com/apple-oss-distributions/mail_cmds/compare/mail_cmds-41...mail_cmds-43
---
 pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix b/pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix
index b29e711251d6..01eb728f2eb6 100644
--- a/pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix
@@ -14,7 +14,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-6rBflDgQkqWDc8XPLgKIO703bMamg2QlhUnP71hBX3I=";
+  xcodeHash = "sha256-X9WKaCXm7gJI04iOJ3upmqTwZ6Lw+JjH0xSs+ng/9J0=";
 
   meta.description = "Traditional mail command for Darwin";
 }
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index e77862dd91a3..6e4f2b81be0d 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -228,8 +228,8 @@
     "version": "2881.100.56.0.1"
   },
   "mail_cmds": {
-    "hash": "sha256-peoaHopJaYDqyE4TGfLx7W1K2KsFZmHLWr8Er/HpA90=",
-    "version": "41"
+    "hash": "sha256-xAU0HNDC2jmzYqnWWIzUjV0Kldl3SHMvM66Pl6kK8/0=",
+    "version": "43"
   },
   "misc_cmds": {
     "hash": "sha256-04uBS16nNrg73Fqh4Obev7nQDjTTlY4f5+pEv3i0FIU=",

From 362d374daf44df736ebbbd86288f66669476cd4f Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0159/1209] darwin.network_cmds: 730.80.3 -> 741.100.2

https://github.com/apple-oss-distributions/network_cmds/compare/network_cmds-730.80.3...network_cmds-741.100.2
---
 pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix | 3 +++
 pkgs/os-specific/darwin/sourceRelease/versions.json         | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix b/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
index 1504ebf59590..51455f86897f 100644
--- a/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
@@ -119,6 +119,9 @@ let
       #include <${xnuHeaders}/include/netinet6/nd6.h>
       EOF
 
+      install -D -t "$out/include/netkey" \
+        '${xnuHeaders}/include/netkey/keysock_private.h'
+
       install -D -t "$out/include/os" \
         '${xnuHeaders}/Library/Frameworks/Kernel.framework/PrivateHeaders/os/atomic_private.h' \
         '${xnuHeaders}/Library/Frameworks/Kernel.framework/PrivateHeaders/os/atomic_private_arch.h' \
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 6e4f2b81be0d..39acfc776ad4 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -236,8 +236,8 @@
     "version": "45"
   },
   "network_cmds": {
-    "hash": "sha256-WlO668xfWOJk9QkTDJBqBVfXK52yg2Ofdjcdk6pQvIo=",
-    "version": "730.80.3"
+    "hash": "sha256-GXtGhkmTrpYHZj5ufpx2aOMRTMjCe8/H425OWBluKeU=",
+    "version": "741.100.2"
   },
   "objc4": {
     "hash": "sha256-vonl+pqJurD7ozdZ8AQokvtlgKXCk+BP/vFfoyGJiUQ=",

From 857fccfb375188654f8947495860739c4e898dd9 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0160/1209] darwin.patch_cmds: 72 -> 75

https://github.com/apple-oss-distributions/patch_cmds/compare/patch_cmds-72...patch_cmds-75
---
 .../darwin/by-name/pa/patch_cmds/package.nix  | 12 +++++--
 .../patches/0001-Fall-back-to-scandir.patch   | 32 +++++++++++++++++++
 .../darwin/sourceRelease/versions.json        |  4 +--
 3 files changed, 44 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/os-specific/darwin/by-name/pa/patch_cmds/patches/0001-Fall-back-to-scandir.patch

diff --git a/pkgs/os-specific/darwin/by-name/pa/patch_cmds/package.nix b/pkgs/os-specific/darwin/by-name/pa/patch_cmds/package.nix
index 30f1eef87c27..5be1753d589a 100644
--- a/pkgs/os-specific/darwin/by-name/pa/patch_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/pa/patch_cmds/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  apple-sdk,
+  apple-sdk_26,
   libutil,
   mkAppleDerivation,
   pkg-config,
@@ -14,11 +14,19 @@ mkAppleDerivation {
     "man"
   ];
 
+  patches = [
+    # Use `scandir` on versions of macOS older than 26.4.
+    ./patches/0001-Fall-back-to-scandir.patch
+  ];
+
   xcodeHash = "sha256-Ox8Ii2sUuledUttZ64DaHC0iFlUybs3lNZ23IDeziPM=";
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ libutil ];
+  buildInputs = [
+    apple-sdk_26
+    libutil
+  ];
 
   meta = {
     description = "BSD patch commands for Darwin";
diff --git a/pkgs/os-specific/darwin/by-name/pa/patch_cmds/patches/0001-Fall-back-to-scandir.patch b/pkgs/os-specific/darwin/by-name/pa/patch_cmds/patches/0001-Fall-back-to-scandir.patch
new file mode 100644
index 000000000000..bcc6279d081e
--- /dev/null
+++ b/pkgs/os-specific/darwin/by-name/pa/patch_cmds/patches/0001-Fall-back-to-scandir.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Fri, 8 May 2026 19:34:31 -0400
+Subject: [PATCH] Fall-back-to-scandir
+
+---
+ diff/diffdir.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/diff/diffdir.c b/diff/diffdir.c
+index 7583f98..cc476bc 100644
+--- a/diff/diffdir.c
++++ b/diff/diffdir.c
+@@ -92,8 +92,13 @@ vscandir(struct inodetree *tree, const char *path, struct dirent ***dirp,
+ 		*dirp = NULL;
+ 		return (0);
+ 	}
+-	if ((ret = fdscandir(fd, dirp, select, compar)) < 0)
+-		goto fail;
++	if (__builtin_available(macOS 26.4, *)) {
++		if ((ret = fdscandir(fd, dirp, select, compar)) < 0)
++			goto fail;
++	} else {
++		if ((ret = scandir(path, dirp, select, compar)) < 0)
++			goto fail;
++	}
+ 	RB_INSERT(inodetree, tree, ino);
+ 	close(fd);
+ 	return (ret);
+-- 
+2.51.2
+
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 39acfc776ad4..e475e820ec8f 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -244,8 +244,8 @@
     "version": "951.7"
   },
   "patch_cmds": {
-    "hash": "sha256-fDY2NOT3DnU5pm06cHSs+JJcA/EFP8Lxjg7sErUerJ0=",
-    "version": "72"
+    "hash": "sha256-XoLEVrvu9pfHPalkBQDH0IfzcX8FLkcEBmW03cq2jQY=",
+    "version": "75"
   },
   "ppp": {
     "hash": "sha256-syc0tbDPACswBNNrTaOsC6Lyix6d7O9634PBCjnuqOs=",

From 68030807a152264bfedb00dafacdc71a3ded0874 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0161/1209] darwin.PowerManagement: 1846.81.1 -> 1846.101.2

https://github.com/apple-oss-distributions/PowerManagement/compare/PowerManagement-1846.81.1...PowerManagement-1846.101.2
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index e475e820ec8f..088a6f64dc15 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -116,8 +116,8 @@
     "version": "146"
   },
   "PowerManagement": {
-    "hash": "sha256-KqpAUjwqENbx3qPxhkK6OFARjBGSMEpaGz5ozo9vtSY=",
-    "version": "1846.81.1"
+    "hash": "sha256-2vtld72nBFzgqh3vAh8L0PR3RORaXRojQZDc4OH4MVQ=",
+    "version": "1846.101.2"
   },
   "Security": {
     "hash": "sha256-1ka7ws6POwm+WKwB/VYZX/uQTQccJe5r9tYDHgoqHp0=",

From b850d4728a31bb7922d3e912a95712dbe18bef2a Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0162/1209] darwin.remote_cmds: 306 -> 308

https://github.com/apple-oss-distributions/remote_cmds/compare/remote_cmds-306...remote_cmds-308
---
 pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in | 1 +
 pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix    | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json           | 4 ++--
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in b/pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in
index 137397b3abbc..646143084e2c 100644
--- a/pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in
+++ b/pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in
@@ -53,6 +53,7 @@ executable(
         '-DCOLLATE_DEBUG',
         '-DYY_NO_UNPUT',
     ],
+    include_directories: [ 'wall' ],
     install : true,
     sources : [
         'talkd/announce.c',
diff --git a/pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix b/pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix
index 8029d2982acd..523c67f88645 100644
--- a/pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix
@@ -14,7 +14,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-+hC3yJwwwXr01Aa47K5dv4gL0+IlTQZU9YYgygXkTSI=";
+  xcodeHash = "sha256-SdeF6Jp+KuVTUawJdvpw53qr3gIPEhVzqgQxAau19C0=";
 
   postPatch = ''
     # Avoid a conflict with the definition in SDK’s headers.
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 088a6f64dc15..ad26933183ea 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -252,8 +252,8 @@
     "version": "1025"
   },
   "remote_cmds": {
-    "hash": "sha256-8c/NgQZ+K6jJ3aoYK78/BsEkM1gmRS+9z0437+SvcCw=",
-    "version": "306"
+    "hash": "sha256-aTcoaFbKhVrhGQyVRvqb/Iwm0sqUn5HMO19sBpdt428=",
+    "version": "308"
   },
   "removefile": {
     "hash": "sha256-Z5UD0mk/s80CQB0PZWDzSl2JWXmnVmwUvlNb28+hR3k=",

From 03761fb93a51622cc14c1f20aa17dfaf8a121341 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0163/1209] darwin.removefile: 84 -> 85.100.6

https://github.com/apple-oss-distributions/removefile/compare/removefile-84...removefile-85.100.6
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index ad26933183ea..0739d0bf2b9f 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -256,8 +256,8 @@
     "version": "308"
   },
   "removefile": {
-    "hash": "sha256-Z5UD0mk/s80CQB0PZWDzSl2JWXmnVmwUvlNb28+hR3k=",
-    "version": "84"
+    "hash": "sha256-4E0LsE6b83AqP90tpIhnRdtSekToY7JUWa7lQ3+y3WI=",
+    "version": "85.100.6"
   },
   "shell_cmds": {
     "hash": "sha256-hoMssbZCrmzyJTgEAzOS4L7DhY9z/yXIcvHRhL6W5qc=",

From 4c232cc2669e1e272771a095719af84748c15f57 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0164/1209] darwin.shell_cmds: 326 -> 329

https://github.com/apple-oss-distributions/shell_cmds/compare/shell_cmds-326...shell_cmds-329
---
 pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix b/pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix
index 88f7885ce814..955a2bc84542 100644
--- a/pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix
@@ -24,7 +24,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-fY8k7qzqqiv/KvGIB4a82qbNsm23QPnGOadrZmNoi54=";
+  xcodeHash = "sha256-sbgPFMMXgUp+F1IRLiaFto+PsfMHBd23KQ1sQK7tP7A=";
 
   postPatch = ''
     # Fix `mktemp` templates
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 0739d0bf2b9f..bc50c75fe4e1 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -260,8 +260,8 @@
     "version": "85.100.6"
   },
   "shell_cmds": {
-    "hash": "sha256-hoMssbZCrmzyJTgEAzOS4L7DhY9z/yXIcvHRhL6W5qc=",
-    "version": "326"
+    "hash": "sha256-mZ8DuxAMrv96gDnIG3nNXY906wNVDmjymOv/t3wDr2Q=",
+    "version": "329"
   },
   "system_cmds": {
     "hash": "sha256-OYLCu2pPe10apZEK5kgINcEvxRFFPYquPzcRNkvtJKI=",

From 7a1aca160150d04be12b8b00ba56aa1b21914888 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0165/1209] darwin.system_cmds: 1039 -> 1042.100.6.0.1

https://github.com/apple-oss-distributions/system_cmds/compare/system_cmds-1039...system_cmds-1042.100.6.0.1
---
 pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix | 5 +++--
 pkgs/os-specific/darwin/sourceRelease/versions.json        | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix b/pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix
index 1fdb00d9a735..8a780069d52d 100644
--- a/pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix
@@ -18,7 +18,7 @@ let
 
   libplatform = sourceRelease "libplatform";
 
-  xnu = sourceRelease "xnu";
+  xnu = sourceRelease "xnu"; # Can’t use xnuHeaders because adv_cmds is a transitive dependency of xnuHeaders.
 
   privateHeaders = stdenvNoCC.mkDerivation {
     name = "system_cmds-deps-private-headers";
@@ -71,10 +71,11 @@ let
       install -D -t "$out/include/sys" \
         '${xnu}/bsd/sys/csr.h' \
         '${xnu}/bsd/sys/event_private.h' \
-        '${xnu}/bsd/sys/pgo.h' \
         '${xnu}/bsd/sys/kdebug_private.h' \
         '${xnu}/bsd/sys/kern_memorystatus.h' \
+        '${xnu}/bsd/sys/pgo.h' \
         '${xnu}/bsd/sys/proc_info_private.h' \
+        '${xnu}/bsd/sys/proc_private.h' \
         '${xnu}/bsd/sys/reason.h' \
         '${xnu}/bsd/sys/resource.h' \
         '${xnu}/bsd/sys/resource_private.h' \
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index bc50c75fe4e1..dca0e584e990 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -264,8 +264,8 @@
     "version": "329"
   },
   "system_cmds": {
-    "hash": "sha256-OYLCu2pPe10apZEK5kgINcEvxRFFPYquPzcRNkvtJKI=",
-    "version": "1039"
+    "hash": "sha256-zG5N06b1/X6bCPWFME10w8XoLqwGKvrAmNihLy0cxl4=",
+    "version": "1042.100.6.0.1"
   },
   "text_cmds": {
     "hash": "sha256-SDH74Pwy/kPiApisuUFBrDVQ7swCsinMK7zkpm82rnw=",

From 976af9cac6bf77cea6594526473cdf68df3fc5bf Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0166/1209] darwin.text_cmds: 197 -> 199

https://github.com/apple-oss-distributions/text_cmds/compare/text_cmds-197...text_cmds-199
---
 pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix b/pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix
index 8a757030dd9b..d91a37359c32 100644
--- a/pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix
@@ -45,7 +45,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-4nwDGUBSx5jjeLQ3EGQFdPZE2MfNGcBvlTU/Sye6OIk=";
+  xcodeHash = "sha256-8Z6Goz94xP3HqAaSnFUurhZE8l3G1mK5KviXtxSPQhI=";
 
   postPatch = ''
     # Improve compatiblity with libmd in nixpkgs.
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index dca0e584e990..78e9ad87a6bf 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -268,8 +268,8 @@
     "version": "1042.100.6.0.1"
   },
   "text_cmds": {
-    "hash": "sha256-SDH74Pwy/kPiApisuUFBrDVQ7swCsinMK7zkpm82rnw=",
-    "version": "197"
+    "hash": "sha256-Z2SKmsmCRX/CnRC9kkgCb8ozK+nit4GYsv1rrEWL3qs=",
+    "version": "199"
   },
   "top": {
     "hash": "sha256-F+P7yRQw4qa73JmQrMVgy3lVQRDBrFDy9kkOUJ135ys=",

From 127450a4fc9134531b214aa72d467232fc7e4e0f Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0167/1209] ld64: 956.6 -> 957.1

https://github.com/apple-oss-distributions/ld64/compare/ld64-956.6...ld64-957.1
---
 pkgs/by-name/ld/ld64/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ld/ld64/package.nix b/pkgs/by-name/ld/ld64/package.nix
index 8699a4132d4a..f21f90a37929 100644
--- a/pkgs/by-name/ld/ld64/package.nix
+++ b/pkgs/by-name/ld/ld64/package.nix
@@ -47,7 +47,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ld64";
-  version = "956.6";
+  version = "957.1";
 
   outputs = [
     "out"
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "apple-oss-distributions";
     repo = "ld64";
     tag = "ld64-${finalAttrs.version}";
-    hash = "sha256-2VlBjlCZ+ZPKGZ0f5UuG3jJTLZIBXf8IZOiD6snheh4=";
+    hash = "sha256-KUkEKz2jQq815ls25u0JMYmad4cN9PS/nC3E5eV19co=";
   };
 
   patches = [

From a81408d15c1368116b81656f2074d4f405e333e1 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 11 May 2026 19:31:44 -0400
Subject: [PATCH 0168/1209] apple-sdk_26: 26.4 -> 26.5

---
 pkgs/by-name/ap/apple-sdk/metadata/versions.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ap/apple-sdk/metadata/versions.json b/pkgs/by-name/ap/apple-sdk/metadata/versions.json
index 3002a9226cc5..d655c7ebada9 100644
--- a/pkgs/by-name/ap/apple-sdk/metadata/versions.json
+++ b/pkgs/by-name/ap/apple-sdk/metadata/versions.json
@@ -17,10 +17,10 @@
   },
   "26": {
     "urls": [
-      "https://swcdn.apple.com/content/downloads/32/53/047-96692-A_OAHIHT53YB/ybtshxmrcju8m2qvw3w5elr4rajtg1x3y3/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20260406133131/https://swcdn.apple.com/content/downloads/32/53/047-96692-A_OAHIHT53YB/ybtshxmrcju8m2qvw3w5elr4rajtg1x3y3/CLTools_macOSNMOS_SDK.pkg"
+      "https://swcdn.apple.com/content/downloads/09/08/047-91568-A_Y1CFZWQCD4/4xekpyz43i26dbp4enxfro8eb1q7wiujh5/CLTools_macOSNMOS_SDK.pkg",
+      "https://web.archive.org/web/20260512015547/https://swcdn.apple.com/content/downloads/09/08/047-91568-A_Y1CFZWQCD4/4xekpyz43i26dbp4enxfro8eb1q7wiujh5/CLTools_macOSNMOS_SDK.pkg"
     ],
-    "version": "26.4",
-    "hash": "sha256-7nrbCv1pNlpzEqwZWVfUPCvDfXEJJNOl7ApkeFpIOC0="
+    "version": "26.5",
+    "hash": "sha256-IkDNtiO7PP4GI6OszCNWE1Xb4iepCUKwQHYUyc9NgNA="
   }
 }

From 516deee1c136242d983d0f510ecb7ca42d885aff Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 0169/1209] xar: 501 -> 503

https://github.com/apple-oss-distributions/xar/compare/xar-501...xar-503
---
 pkgs/by-name/xa/xar/package.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/xa/xar/package.nix b/pkgs/by-name/xa/xar/package.nix
index 53583b24caf3..b9e477ca6194 100644
--- a/pkgs/by-name/xa/xar/package.nix
+++ b/pkgs/by-name/xa/xar/package.nix
@@ -31,13 +31,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xar${lib.optionalString (e2fsprogs == null) "-minimal"}";
-  version = "501";
+  version = "503";
 
   src = fetchFromGitHub {
     owner = "apple-oss-distributions";
     repo = "xar";
     rev = "xar-${finalAttrs.version}";
-    hash = "sha256-Fq+Re0LCBIGhW2FR+pgV8SWtaDOEFgTh+rQ8JFWK/k0=";
+    hash = "sha256-QdK7NTN3A/EWr+vdfT5ZLTdX+wOmfnqvL5yJeiiPwtM=";
   };
 
   # Update patch set with
@@ -48,11 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   #   # …
   #   rm -r ../pkgs/by-name/xa/xar/patches
   #   git format-patch --zero-commit --output-directory ../pkgs/by-name/xa/xar/patches main
-  patches =
-    # Avoid Darwin rebuilds on staging-next
-    lib.filter (
-      p: stdenv.hostPlatform.isDarwin -> baseNameOf p != "0020-Fall-back-to-readlink-on-Linux.patch"
-    ) (lib.filesystem.listFilesRecursive ./patches);
+  patches = lib.filesystem.listFilesRecursive ./patches;
 
   # We do not use or modify files outside of the xar subdirectory.
   patchFlags = [ "-p2" ];

From 6d8c12b2b36e3d5993c522516e533a4c740c27fd Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 17 May 2026 19:48:32 +0100
Subject: [PATCH 0170/1209] lttng-ust: 2.14.0 -> 2.15.0

Changes: https://lore.kernel.org/lkml/9592e7ac-2ff5-4fc4-94cc-ee3de89fa541@efficios.com/
---
 pkgs/by-name/lt/lttng-ust/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lt/lttng-ust/package.nix b/pkgs/by-name/lt/lttng-ust/package.nix
index 0455146aaed8..164510c209ce 100644
--- a/pkgs/by-name/lt/lttng-ust/package.nix
+++ b/pkgs/by-name/lt/lttng-ust/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lttng-ust";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "lttng";
     repo = "lttng-ust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9WZDjOGfflEc6BUUO3W70KeLcZnTaePkF8eg8Ns/lQc=";
+    hash = "sha256-LOZo/sVb9eG39Gg1PBs2FoLHTeOD5us9wW4kUwNo8o0=";
   };
 
   outputs = [

From facfd506e2abbe3375c7ad8a13a36d6b1f2d4f35 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Thu, 15 Jan 2026 09:04:21 +0000
Subject: [PATCH 0171/1209] avahi: fix static build

fixes `nix-build -A pkgsStatic.avahi`
---
 pkgs/by-name/av/avahi/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/av/avahi/package.nix b/pkgs/by-name/av/avahi/package.nix
index 09b9a602af55..c96fa61ee92e 100644
--- a/pkgs/by-name/av/avahi/package.nix
+++ b/pkgs/by-name/av/avahi/package.nix
@@ -11,6 +11,7 @@
   expat,
   gettext,
   glib,
+  autoconf-archive,
   autoreconfHook,
   libiconv,
   libevent,
@@ -142,6 +143,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    # Remove the vendored ACX_PTHREAD macro in favor of the more up-to-date
+    # implementation from autoconf-archive, especially to support static builds.
+    rm common/acx_pthread.m4
+  '';
+
   depsBuildBuild = [
     pkg-config
   ];
@@ -150,6 +157,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     glib
+    autoconf-archive
     autoreconfHook
   ];
 

From 8a93a5d60f68c890877555cdfe449017da27cf1b Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Mon, 17 Nov 2025 01:40:07 -0500
Subject: [PATCH 0172/1209] bmake: fix cross

---
 pkgs/by-name/bm/bmake/package.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/bm/bmake/package.nix b/pkgs/by-name/bm/bmake/package.nix
index 8c7c6841cf3e..48b329c659b4 100644
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -91,7 +91,11 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    ./boot-strap --prefix=$out -o . op=install
+    # `boot-strap op=install` runs the built bmake, which breaks cross builds.
+    install -Dm755 bmake $out/bin/bmake
+    install -Dm644 bmake.1 $man/share/man/man1/bmake.1
+    mkdir -p $out/share
+    cp -r mk $out/share
 
     runHook postInstall
   '';

From d6937f6ae7b9e1f2e5f50e6020e5b4db864d7691 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Sun, 17 May 2026 15:26:51 -0700
Subject: [PATCH 0173/1209] x265: fix i686 build

---
 pkgs/by-name/x2/x265/fix-plt-rel.patch | 11 +++++++++++
 pkgs/by-name/x2/x265/package.nix       |  3 +++
 2 files changed, 14 insertions(+)
 create mode 100644 pkgs/by-name/x2/x265/fix-plt-rel.patch

diff --git a/pkgs/by-name/x2/x265/fix-plt-rel.patch b/pkgs/by-name/x2/x265/fix-plt-rel.patch
new file mode 100644
index 000000000000..23b5472bea4f
--- /dev/null
+++ b/pkgs/by-name/x2/x265/fix-plt-rel.patch
@@ -0,0 +1,11 @@
+--- a/common/x86/cpu-a.asm
++++ b/common/x86/cpu-a.asm
+@@ -177,7 +177,7 @@ cglobal safe_intel_cpu_indicator_init
+ %if WIN64
+     lea rax, [intel_cpu_indicator_init]
+     call rax
+-%elif FORMAT_ELF
++%elif UNIX64 && FORMAT_ELF
+     call [rel intel_cpu_indicator_init wrt ..plt]
+ %else
+     call intel_cpu_indicator_init
diff --git a/pkgs/by-name/x2/x265/package.nix b/pkgs/by-name/x2/x265/package.nix
index c51679eca4e7..e55d07e6ae4d 100644
--- a/pkgs/by-name/x2/x265/package.nix
+++ b/pkgs/by-name/x2/x265/package.nix
@@ -55,6 +55,9 @@ stdenv.mkDerivation (finalAttrs: {
     # fix compilation with gcc15
     # https://bitbucket.org/multicoreware/x265_git/pull-requests/36
     ./gcc15-fixes.patch
+    # fix i686-linux build
+    # https://bitbucket.org/multicoreware/x265_git/issues/1030
+    ./fix-plt-rel.patch
   ]
   # TODO: remove after update to version 4.2
   ++ lib.optionals (stdenv.hostPlatform.isAarch32 && stdenv.hostPlatform.isLinux) [

From f6172a101fe458c28e6d70de9e530b2699693d0d Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 17 May 2026 21:16:45 -0400
Subject: [PATCH 0174/1209] libass: remove libiconv dependency on darwin

This is already in stdenv.
---
 pkgs/by-name/li/libass/package.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libass/package.nix b/pkgs/by-name/li/libass/package.nix
index 61b8611327f0..045b0d926bdb 100644
--- a/pkgs/by-name/li/libass/package.nix
+++ b/pkgs/by-name/li/libass/package.nix
@@ -44,9 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     fribidi
     harfbuzz
   ]
-  ++ lib.optional fontconfigSupport fontconfig
-  # TODO: remove dep after branchoff (in darwin stdenv)
-  ++ lib.optional stdenv.hostPlatform.isDarwin libiconv.out;
+  ++ lib.optional fontconfigSupport fontconfig;
 
   meta = {
     description = "Portable ASS/SSA subtitle renderer";

From bbad6942e5605f0aa12a8de3e8a290181f23f58a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 02:27:35 +0000
Subject: [PATCH 0175/1209] libusb1: 1.0.29 -> 1.0.30

---
 pkgs/by-name/li/libusb1/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libusb1/package.nix b/pkgs/by-name/li/libusb1/package.nix
index 4676098bff3e..06f18ee6e5ca 100644
--- a/pkgs/by-name/li/libusb1/package.nix
+++ b/pkgs/by-name/li/libusb1/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libusb";
-  version = "1.0.29";
+  version = "1.0.30";
 
   src = fetchFromGitHub {
     owner = "libusb";
     repo = "libusb";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-m1w+uF8+2WCn72LvoaGUYa+R0PyXHtFFONQjdRfImYY=";
+    sha256 = "sha256-qgs8h1vSqJg2muBDWN5nJlvaMjGYZnwMg1m07rqzHco=";
   };
 
   outputs = [

From 963f597bc3ffcf2c03004e6df66537a0741b5036 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 09:19:18 +0000
Subject: [PATCH 0176/1209] publicsuffix-list: 0-unstable-2026-03-26 ->
 0-unstable-2026-05-13

---
 pkgs/by-name/pu/publicsuffix-list/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index 72c500777df2..ea3f3d9fa1e4 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2026-03-26";
+  version = "0-unstable-2026-05-13";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "d333b72b39575da1ce6932b01d7c421a4107c620";
-    hash = "sha256-LWnvQrIyj+iq96T1u9WEq+HGOZ5sJYN5nCintEr6sBk=";
+    rev = "e452c7058d6946bd76952b128c12f5ce87a5acb8";
+    hash = "sha256-5D4RZAyJOL4hMU32Rmp3SYmjgqEtF36mZJr4YBG0k7E=";
   };
 
   dontBuild = true;

From 030523c9b86d56c75841ac0381cf6478f7493041 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 11:49:31 +0000
Subject: [PATCH 0177/1209] maturin: 1.12.6 -> 1.13.3

---
 pkgs/by-name/ma/maturin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 8c08f6a0643f..2fe364f2bfa3 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "maturin";
-  version = "1.12.6";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NQ94RdQTQlRR5+2dC95cFNhwYliHmkD11JWyGt6BV6g=";
+    hash = "sha256-xVR/R/aQ6Kvx7w/X9gedjJLzlxz+5nhnwjxsiyKcg0A=";
   };
 
-  cargoHash = "sha256-9VqS9wvQAsSYNhH7B9WlD6SZjXR4S2sYzYoNy6vbYBM=";
+  cargoHash = "sha256-awdc2SLEfMP4cLG+RvQbeYPn1o9Ft7sqOnRy8iQqjB0=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv

From fea908fde99e4dc812e973459875a082c72523f4 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 18 May 2026 13:43:58 +0200
Subject: [PATCH 0178/1209] stdenv: do not leak outputName out of loop

This is an implementation detail leaking out into the bash environment
and it did manange to confuse me as potentially being a way to get the "default"
output name when structuredAttrs is enabled, because of the "outputName" derivation attribute.
---
 pkgs/stdenv/generic/setup.sh | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 1c5c82be25b7..98eeded49b8c 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -29,10 +29,15 @@ if [[ -n "${NIX_ATTRS_JSON_FILE:-}" ]]; then
     __structuredAttrs=1
     echo "structuredAttrs is enabled"
 
-    for outputName in "${!outputs[@]}"; do
-        # ex: out=/nix/store/...
-        export "$outputName=${outputs[$outputName]}"
-    done
+    _exportOutputsByName() {
+        local outputName
+        for outputName in "${!outputs[@]}"; do
+            # ex: out=/nix/store/...
+            export "$outputName=${outputs[$outputName]}"
+        done
+    }
+
+    _exportOutputsByName
 else
     __structuredAttrs=
     : "${outputs:=out}"

From a0ee89704420278abb4c28c7b974500b0d19d39c Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 19 Apr 2026 11:24:01 +0200
Subject: [PATCH 0179/1209] wrapGAppsHook: prepare for structuredAttrs

This hook is called in the fixupPhase via

```
local output
for output in $(getAllOutputNames); do
  prefix="${!output}" runHook fixupOutput
done
```

Without `__structuredAttrs`, `getAllOutputNames` returns the `output` array, in order.
However, with `__structuredAttrs`, it returns the keys of the `output` associative array,
which are no longer necessarily ordered in the same way.

In the case of some packages (e.g. `mate-panel-with-applets`) this means that instead of
`[ "out" "man" ]`, we process `[ "man" "out" ]`. Running the hook for `"man"` then sets
`wrapGAppsHookHasRun` and no wrapping is done for `"out"`, which is what was really needed.

Instead, keep track of whether the hook has run on a per-output basis. That way, the order
does not matter and any executables that are spread around multiple outputs are wrapped.
---
 .../setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh        | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
index 7487dabd5aad..ea3e81bfdf27 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -42,11 +42,13 @@ wrapGApp() {
     wrapProgram "$program" "${gappsWrapperArgs[@]}" "$@"
 }
 
+declare -gA wrapGAppsHookHasRunForOutput
+
 # Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set.
 wrapGAppsHook() {
-    # guard against running multiple times (e.g. due to propagation)
-    [ -z "$wrapGAppsHookHasRun" ] || return 0
-    wrapGAppsHookHasRun=1
+    # guard against running multiple times for the same output (e.g. due to propagation)
+    [ "${wrapGAppsHookHasRunForOutput["$output"]:-}" = 1 ] && return 0
+    wrapGAppsHookHasRunForOutput["$output"]=1
 
     if [[ -z "${dontWrapGApps:-}" ]]; then
         targetDirsThatExist=()

From 0ddb2c508c423ce9df7a073fbe1db2deb84b41ba Mon Sep 17 00:00:00 2001
From: FlashOnFire_ <flashonfire.dev@gmail.com>
Date: Sun, 12 Apr 2026 19:12:27 +0200
Subject: [PATCH 0180/1209] python3Packages.librt: fix cross compilation

Signed-off-by: FlashOnFire_ <flashonfire.dev@gmail.com>
---
 pkgs/development/python-modules/librt/default.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/python-modules/librt/default.nix b/pkgs/development/python-modules/librt/default.nix
index 044a9c742517..c1531eed6054 100644
--- a/pkgs/development/python-modules/librt/default.nix
+++ b/pkgs/development/python-modules/librt/default.nix
@@ -6,6 +6,7 @@
   mypy-extensions,
   python,
   pytest,
+  stdenv,
 }:
 
 buildPythonPackage rec {
@@ -23,6 +24,18 @@ buildPythonPackage rec {
   # https://github.com/mypyc/librt/blob/v0.7.8/.github/workflows/buildwheels.yml#L90-L93
   postPatch = ''
     cp -rv lib-rt/* .
+
+    # build_setup.py patches CCompiler.spawn to inject architecture-specific
+    # SIMD flags based on platform.machine() (which returns the build arch instead
+    # of the target arch). When cross-compiling, this causes the compiler to abort
+    # with "unrecognized command-line option" errors.
+    #
+    # The patch below forces the use of the target architecture, in order
+    # to keep SIMD flags for x86_64 targets while avoiding them elsewhere.
+    substituteInPlace build_setup.py \
+      --replace-fail \
+        'X86_64 = platform.machine() in ("x86_64", "AMD64", "amd64")' \
+        'X86_64 = ${if stdenv.hostPlatform.isx86_64 then "True" else "False"}'
   '';
 
   build-system = [

From 789f939dcb76779dca085fe9594c22bb2fd26648 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 05:16:06 -0700
Subject: [PATCH 0181/1209] gpgme: 2.0.1 -> 2.1.0

Changelog: https://dev.gnupg.org/source/gpgme/browse/master/NEWS;gpgme-2.1.0?as=remarkup
---
 pkgs/by-name/gp/gpgme/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gp/gpgme/package.nix b/pkgs/by-name/gp/gpgme/package.nix
index cd68dd81ec3b..33edca30f448 100644
--- a/pkgs/by-name/gp/gpgme/package.nix
+++ b/pkgs/by-name/gp/gpgme/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpgme";
-  version = "2.0.1";
+  version = "2.1.0";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/gpgme-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ghqwaVyELqtRdSqBmAySsEEMfq3QQQP3kdXSpSZ4SWY=";
+    hash = "sha256-hBxepT/CYln0+/DovemC3qG4ocoMt35oHIKwUFZr+Ss=";
   };
 
   postPatch = ''
@@ -110,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://gnupg.org/software/gpgme/index.html";
-    changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;f=NEWS;hb=gpgme-${finalAttrs.version}";
+    changelog = "https://dev.gnupg.org/source/gpgme/browse/master/NEWS;gpgme-${finalAttrs.version}?as=remarkup";
     description = "Library for making GnuPG easier to use";
     longDescription = ''
       GnuPG Made Easy (GPGME) is a library designed to make access to GnuPG

From fb0f146a68b5c7fe6f776a6f7a3aa7195ad54739 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 09:12:18 -0700
Subject: [PATCH 0182/1209] gpgmepp: 2.0.0 -> 2.1.0

Changelog: https://dev.gnupg.org/source/gpgmepp/browse/master/NEWS;gpgmepp-2.1.0?as=remarkup
---
 pkgs/by-name/gp/gpgmepp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gp/gpgmepp/package.nix b/pkgs/by-name/gp/gpgmepp/package.nix
index d0f6ce2ae37d..d82e0d1617ba 100644
--- a/pkgs/by-name/gp/gpgmepp/package.nix
+++ b/pkgs/by-name/gp/gpgmepp/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpgmepp";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgmepp/gpgmepp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-1HlgScBnCKJvMJb3SO8JU0fho8HlcFYXAf6VLD9WU4I=";
+    hash = "sha256-V/gERo8CBFBLFyxrE5ywUSS0JjvnrVFJMsfExQYqFuI=";
   };
 
   postPatch = ''

From ce52fbf05707870a85c04c6f428d1b6558a5b124 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 09:12:53 -0700
Subject: [PATCH 0183/1209] qt6Packages.qgpgme: 2.0.0 -> 2.1.0

Changelog: https://dev.gnupg.org/source/gpgmeqt/browse/master/NEWS;gpgmeqt-2.1.0?as=remarkup
---
 pkgs/development/libraries/qgpgme/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/qgpgme/default.nix b/pkgs/development/libraries/qgpgme/default.nix
index c3dbe6800552..d1f7e6ca669e 100644
--- a/pkgs/development/libraries/qgpgme/default.nix
+++ b/pkgs/development/libraries/qgpgme/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qgpgme";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "mirror://gnupg/qgpgme/qgpgme-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FWRbJHXMphGOsu0zGzqNlELJ1AGcOEa6P20lMhtKYa0=";
+    hash = "sha256-WzL+s+7kp/lALSK3IGSAkI3EO7TfOCkXwHXFEhFvjwg=";
   };
 
   patches = [
@@ -30,6 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
   ];
 
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_WITH_QT5" (lib.versions.major qtbase.version == "5"))
+    (lib.cmakeBool "BUILD_WITH_QT6" (lib.versions.major qtbase.version == "6"))
+  ];
+
   buildInputs = [
     qtbase
   ];

From a74e4f1c48e260b21410ca0143797b944f5eb9cf Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Mon, 18 May 2026 07:31:40 -0700
Subject: [PATCH 0184/1209] nix: remove util-linux test special-casing

Fixed-by: https://lore.kernel.org/util-linux/dryjs4vfzzysrhuxa4khf7frezdmouv6ys5nqsx7u46nvk4mg6@z4o37akcrh6y/T/#u
---
 .../nix/modular/tests/functional/package.nix              | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/pkgs/tools/package-management/nix/modular/tests/functional/package.nix b/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
index b8bf89d99f7f..597c89f08c4d 100644
--- a/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
+++ b/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
@@ -73,14 +73,6 @@ mkMesonDerivation (finalAttrs: {
       echo $PWD | grep tests/functional
     '';
 
-  # Test contains invocation of `script` broken by util-linux regression:
-  # https://github.com/util-linux/util-linux/commit/70507ab9eaed10b8dd77b77d4ea25c11ee726bed
-  preCheck =
-    assert util-linux.version == "2.42";
-    ''
-      echo "exit 77" > ../json.sh
-    '';
-
   mesonCheckFlags = [
     "--print-errorlogs"
   ];

From 28dd6b9df1650e52f3564ee98ec3ebea744b0ca8 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Mon, 18 May 2026 06:26:59 -0700
Subject: [PATCH 0185/1209] util-linux: 2.42 -> 2.42.1

---
 pkgs/by-name/ut/util-linux/package.nix | 36 ++------------------------
 1 file changed, 2 insertions(+), 34 deletions(-)

diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index 0c9c7542a23c..3c26f7b0d780 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -43,11 +43,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "util-linux" + lib.optionalString isMinimal "-minimal";
-  version = "2.42";
+  version = "2.42.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor finalAttrs.version}/util-linux-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NFKyYLuqd11udJrDuyIRF4UAP8H0RJcAJcjaJt+nWOk=";
+    hash = "sha256-gukVjrEqmwtWnYThaH/tndGP6JzNjvWsNCchinwNf38=";
   };
 
   # Note: fetchpatch/fetchpatch2 cause infinite recursion with util-linuxMinimal.
@@ -57,38 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
     # which isn't valid on NixOS (and a compatibility link on most other modern
     # distros anyway).
     ./rtcwake-search-PATH-for-shutdown.patch
-
-    # Fix compile of 2.42+ on Darwin.
-    # https://lore.kernel.org/util-linux/CAEUYr6ZjVX1bd-xcBGtFN_ZYwQnXDYsw7d1-7sTpF2BbgfrR+g@mail.gmail.com/T/#u
-    # Different fix than originally proposed; we just don't compile that file on Darwin now and the previous patch was able to be reverted.
-    # See: https://github.com/util-linux/util-linux/commit/6ccf20d2fd8e45eed70bd1b915c0d16f646bf133
-    (fetchurl {
-      name = "pidfd-utils-linux-only.patch";
-      url = "https://github.com/util-linux/util-linux/commit/afdade4a3d8e4e6070343c5576470c575719b81f.patch";
-      hash = "sha256-EnHsIhU6jaS4Qm+kQMP2an7Ay08nKbIO0MbU7Y2pwkU=";
-    })
-
-    # Musl does not define AT_HANDLE_FID, hard-code it if left undefined.
-    # https://github.com/util-linux/util-linux/pull/4203
-    (fetchurl {
-      name = "fix-musl-nsenter.patch";
-      url = "https://github.com/util-linux/util-linux/commit/000aff333e5c3a23967280cb0d6451fbbfc9c91b.patch";
-      hash = "sha256-6K3jRr2RsAfHnweBOlMn2F0h8hD3xjZobJ1pSlCQHw8=";
-    })
-
-    # `script` is broken with options after non-option args and has new memory leaks
-    # https://lore.kernel.org/util-linux/adi3573O-5gr9m2q@per.namespace.at/T/#t
-    # https://github.com/util-linux/util-linux/pull/4201
-    (fetchurl {
-      name = "script-fix-backwards-compat.patch";
-      url = "https://github.com/util-linux/util-linux/commit/70507ab9eaed10b8dd77b77d4ea25c11ee726bed.patch";
-      hash = "sha256-PpFtv8XOK36npCVSvdgKcxGQmkJtgdyMmlN+4yQuWS8=";
-    })
-    (fetchurl {
-      name = "script-fix-memory-leaks.patch";
-      url = "https://github.com/util-linux/util-linux/commit/2f1c12a49500ca7ed9c3d5e80664c1622925456b.patch";
-      hash = "sha256-9ZwA6sZwM1rQDoxV5x1KHLWxsFpI5CGWJqubtdEHj/I=";
-    })
   ];
 
   # We separate some of the utilities into their own outputs. This

From e07e1835f583ad3af59b8a0c5d93fc529bfec2ff Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 18 May 2026 21:31:08 +0100
Subject: [PATCH 0186/1209] libxi: 1.8.2 -> 1.8.3

Changes: https://lists.x.org/archives/xorg-announce/2026-May/003698.html
---
 pkgs/by-name/li/libxi/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libxi/package.nix b/pkgs/by-name/li/libxi/package.nix
index 3cbac22c36f3..0475ba395175 100644
--- a/pkgs/by-name/li/libxi/package.nix
+++ b/pkgs/by-name/li/libxi/package.nix
@@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxi";
-  version = "1.8.2";
+  version = "1.8.3";
 
   outputs = [
     "out"
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libXi-${finalAttrs.version}.tar.xz";
-    hash = "sha256-0OBVXlPW4hFOq/pEImuhYtJwhQGiXhjZnPs1wJTGwQQ=";
+    hash = "sha256-etYAVvAa9PeGz+k7OncHRHcRYm/I2iY3vscakECbq+U=";
   };
 
   strictDeps = true;

From b3e12e96da2fdb5c4bca369136dcb9e219002e20 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 23:27:00 +0000
Subject: [PATCH 0187/1209] libksba: 1.6.7 -> 1.8.0

---
 pkgs/by-name/li/libksba/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libksba/package.nix b/pkgs/by-name/li/libksba/package.nix
index 97736060a1ac..8ea24155784d 100644
--- a/pkgs/by-name/li/libksba/package.nix
+++ b/pkgs/by-name/li/libksba/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libksba";
-  version = "1.6.7";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "mirror://gnupg/libksba/libksba-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-z3JRC467TrZpPu92V0nYNnegPHkpGjEQQKW/15uqt2M=";
+    hash = "sha256-KWuduQlXSfKqEEIC16t/0JrRBxDgB4CnCcl1SxodkpI=";
   };
 
   outputs = [

From b54e4a6c055fcc26b8e22d76adf41e344b3aec06 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Tue, 19 May 2026 02:38:41 +0200
Subject: [PATCH 0188/1209] valgrind: remove pname substitution

---
 pkgs/by-name/va/valgrind/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index caf76027d8ee..62e1d381fd79 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   version = "3.27.0";
 
   src = fetchurl {
-    url = "https://sourceware.org/pub/${pname}/${pname}-${version}.tar.bz2";
+    url = "https://sourceware.org/pub/valgrind/valgrind-${version}.tar.bz2";
     hash = "sha256-W1k33oJX7o9RaY6nG5cRrc6YBhqgfapKaF78OvkhW+8=";
   };
 

From 4a8e8392a42c9668f1ba0af081b4f6195f2341cb Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 9 May 2026 12:06:55 +1000
Subject: [PATCH 0189/1209] glibc: 2.42-61 -> 2.42-67

---
 .../libraries/glibc/2.42-master.patch         | 759 ++++++++++++++++++
 pkgs/development/libraries/glibc/common.nix   |   6 +-
 2 files changed, 762 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/glibc/2.42-master.patch b/pkgs/development/libraries/glibc/2.42-master.patch
index 47ed7dd1183b..a7bdf93961db 100644
--- a/pkgs/development/libraries/glibc/2.42-master.patch
+++ b/pkgs/development/libraries/glibc/2.42-master.patch
@@ -7154,3 +7154,762 @@ index 00181cfefb..e83ea2b939 100644
    TEST_VERIFY (ret != 0);
    TEST_COMPARE (errno, EBUSY);
  }
+
+commit f13c1bb0f97fbc12a6ba1ab5669ce561ea32b80a
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Thu Apr 16 19:13:43 2026 +0200
+
+    Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
+    
+    Follow the example in iso-2022-jp-3.c and use the __count state
+    variable to store the pending character.  This avoids restarting
+    the conversion if the output buffer ends between two 4-byte UCS-4
+    code points, so that the assert reported in the bug can no longer
+    happen.
+    
+    Even though the fix is applied to ibm1364.c, the change is only
+    effective for the two HAS_COMBINED codecs for IBM1390, IBM1399.
+    
+    The test case was mostly auto-generated using
+    claude-4.6-opus-high-thinking, and composer-2-fast shows up in the
+    log as well.  During review, gpt-5.4-xhigh flagged that the original
+    version of the test case was not exercising the new character
+    flush logic.
+    
+    This fixes bug 33980.
+    
+    Assisted-by: LLM
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    (cherry picked from commit d6f08d1cf027f4eb2ba289a6cc66853722d4badc)
+
+diff --git a/iconvdata/Makefile b/iconvdata/Makefile
+index 5a2abeea24..cc689f63e9 100644
+--- a/iconvdata/Makefile
++++ b/iconvdata/Makefile
+@@ -76,7 +76,7 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
+ 	tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
+ 	bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \
+ 	bug-iconv13 bug-iconv14 bug-iconv15 \
+-	tst-iconv-iso-2022-cn-ext
++	tst-iconv-iso-2022-cn-ext tst-bug33980
+ ifeq ($(have-thread-library),yes)
+ tests += bug-iconv3
+ endif
+@@ -333,6 +333,8 @@ $(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \
+ 			  $(addprefix $(objpfx),$(modules.so))
+ $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) \
+ 					$(addprefix $(objpfx),$(modules.so))
++$(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \
++			   $(addprefix $(objpfx),$(modules.so))
+ 
+ $(objpfx)iconv-test.out: run-iconv-test.sh \
+ 			 $(addprefix $(objpfx), $(gconv-modules)) \
+diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
+index 45c62acee5..244c61ad7a 100644
+--- a/iconvdata/ibm1364.c
++++ b/iconvdata/ibm1364.c
+@@ -67,12 +67,29 @@
+ 
+ /* Since this is a stateful encoding we have to provide code which resets
+    the output state to the initial state.  This has to be done during the
+-   flushing.  */
++   flushing.  For the to-internal direction (FROM_DIRECTION is true),
++   there may be a pending character that needs flushing.  */
+ #define EMIT_SHIFT_TO_INIT \
+   if ((data->__statep->__count & ~7) != sb)				      \
+     {									      \
+       if (FROM_DIRECTION)						      \
+-	data->__statep->__count &= 7;					      \
++	{								      \
++	  uint32_t ch = data->__statep->__count >> 7;			      \
++	  if (__glibc_unlikely (ch != 0))				      \
++	    {								      \
++	      if (__glibc_unlikely (outend - outbuf < 4))		      \
++		status = __GCONV_FULL_OUTPUT;				      \
++	      else							      \
++		{							      \
++		  put32 (outbuf, ch);					      \
++		  outbuf += 4;						      \
++		  /* Clear character and db bit.  */			      \
++		  data->__statep->__count &= 7;				      \
++		}							      \
++	    }								      \
++	  else								      \
++	    data->__statep->__count &= 7;				      \
++	}								      \
+       else								      \
+ 	{								      \
+ 	  /* We are not in the initial state.  To switch back we have	      \
+@@ -99,11 +116,13 @@
+     *curcsp = save_curcs
+ 
+ 
+-/* Current codeset type.  */
++/* Current codeset type.  The bit is stored in the __count variable of
++   the conversion state.  If the db bit is set, bit 7 and above store
++   a pending UCS-4 code point if non-zero.  */
+ enum
+ {
+-  sb = 0,
+-  db = 64
++  sb = 0,			/* Single byte mode.  */
++  db = 64			/* Double byte mode.  */
+ };
+ 
+ 
+@@ -119,21 +138,29 @@ enum
+       }									      \
+     else								      \
+       {									      \
+-	/* This is a combined character.  Make sure we have room.  */	      \
+-	if (__glibc_unlikely (outptr + 8 > outend))			      \
+-	  {								      \
+-	    result = __GCONV_FULL_OUTPUT;				      \
+-	    break;							      \
+-	  }								      \
+-									      \
+ 	const struct divide *cmbp					      \
+ 	  = &DB_TO_UCS4_COMB[ch - __TO_UCS4_COMBINED_MIN];		      \
+ 	assert (cmbp->res1 != 0 && cmbp->res2 != 0);			      \
+ 									      \
+ 	put32 (outptr, cmbp->res1);					      \
+ 	outptr += 4;							      \
+-	put32 (outptr, cmbp->res2);					      \
+-	outptr += 4;							      \
++									      \
++	/* See whether we have room for the second character.  */	      \
++	if (outend - outptr >= 4)					      \
++	  {								      \
++	    put32 (outptr, cmbp->res2);					      \
++	    outptr += 4;						      \
++	  }								      \
++	else								      \
++	  {								      \
++	    /* Otherwise store only the first character now, and	      \
++	       put the second one into the queue.  */			      \
++	    curcs |= cmbp->res2 << 7;					      \
++	    inptr += 2;							      \
++	    /* Tell the caller why we terminate the loop.  */		      \
++	    result = __GCONV_FULL_OUTPUT;				      \
++	    break;							      \
++	  }								      \
+       }									      \
+   }
+ #else
+@@ -153,7 +180,20 @@ enum
+ #define LOOPFCT 		FROM_LOOP
+ #define BODY \
+   {									      \
+-    uint32_t ch = *inptr;						      \
++    uint32_t ch;							      \
++									      \
++    ch = curcs >> 7;							      \
++    if (__glibc_unlikely (ch != 0))					      \
++      {									      \
++	put32 (outptr, ch);						      \
++	outptr += 4;							      \
++	/* Remove the pending character, but preserve state bits.  */	      \
++	curcs &= (1 << 7) - 1;						      \
++	continue;							      \
++      }									      \
++									      \
++    /* Otherwise read the next input byte.  */				      \
++    ch = *inptr;							      \
+ 									      \
+     if (__builtin_expect (ch, 0) == SO)					      \
+       {									      \
+diff --git a/iconvdata/tst-bug33980.c b/iconvdata/tst-bug33980.c
+new file mode 100644
+index 0000000000..c9693e0efe
+--- /dev/null
++++ b/iconvdata/tst-bug33980.c
+@@ -0,0 +1,153 @@
++/* Test for bug 33980: combining characters in IBM1390/IBM1399.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <alloc_buffer.h>
++#include <errno.h>
++#include <iconv.h>
++#include <stdbool.h>
++#include <string.h>
++
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/support.h>
++
++/* Run iconv in a loop with a small output buffer of OUTBUFSIZE bytes
++   starting at OUTBUF.  OUTBUF should be right before an unmapped page
++   so that writing past the end will fault.  Skip SHIFT bytes at the
++   start of the input and output, to exercise different buffer
++   alignment.  TRUNCATE indicates skipped bytes at the end of
++   input (0 and 1 a valid).  */
++static void
++test_one (const char *encoding, unsigned int shift, unsigned int truncate,
++          char *outbuf, size_t outbufsize)
++{
++  /* In IBM1390 and IBM1399, the DBCS code 0xECB5 expands to two
++     Unicode code points when translated.  */
++  static char input[] =
++    {
++      /* 8 letters X.  */
++      0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7,
++      /* SO, 0xECB5, SI: shift to DBCS, special character, shift back.  */
++      0x0e, 0xec, 0xb5, 0x0f
++    };
++
++  /* Expected output after UTF-8 conversion.  */
++  static char expected[] =
++    {
++      'X', 'X', 'X', 'X', 'X', 'X', 'X', 'X',
++      /* U+304B (HIRAGANA LETTER KA).  */
++      0xe3, 0x81, 0x8b,
++      /* U+309A (COMBINING KATAKANA-HIRAGANA SEMI-VOICED SOUND MARK).  */
++      0xe3, 0x82, 0x9a
++    };
++
++  iconv_t cd = iconv_open ("UTF-8", encoding);
++  TEST_VERIFY_EXIT (cd != (iconv_t) -1);
++
++  char result_storage[64];
++  struct alloc_buffer result_buf
++    = alloc_buffer_create (result_storage, sizeof (result_storage));
++
++  char *inptr = &input[shift];
++  size_t inleft = sizeof (input) - shift - truncate;
++
++  while (inleft > 0)
++    {
++      char *outptr = outbuf;
++      size_t outleft = outbufsize;
++      size_t inleft_before = inleft;
++
++      size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft);
++      size_t produced = outptr - outbuf;
++      alloc_buffer_copy_bytes (&result_buf, outbuf, produced);
++
++      if (ret == (size_t) -1 && errno == E2BIG)
++        {
++          if (produced == 0 && inleft == inleft_before)
++            {
++              /* Output buffer too small to make progress.  This is
++                 expected for very small output buffer sizes.  */
++              TEST_VERIFY_EXIT (outbufsize < 3);
++              break;
++            }
++          continue;
++        }
++      if (ret == (size_t) -1)
++        FAIL_EXIT1 ("%s (outbufsize %zu): iconv: %m", encoding, outbufsize);
++      break;
++    }
++
++  /* Flush any pending state (e.g. a buffered combined character).
++     With outbufsize < 3, we could not store the first character, so
++     the second character did not become pending, and there is nothing
++     to flush.  */
++  {
++    char *outptr = outbuf;
++    size_t outleft = outbufsize;
++
++    size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft);
++    TEST_VERIFY_EXIT (ret == 0);
++    size_t produced = outptr - outbuf;
++    alloc_buffer_copy_bytes (&result_buf, outbuf, produced);
++
++    /* Second flush does not provide more data.  */
++    outptr = outbuf;
++    outleft = outbufsize;
++    ret = iconv (cd, NULL, NULL, &outptr, &outleft);
++    TEST_VERIFY_EXIT (ret == 0);
++    TEST_VERIFY (outptr == outbuf);
++  }
++
++  TEST_VERIFY_EXIT (!alloc_buffer_has_failed (&result_buf));
++  size_t result_used
++    = sizeof (result_storage) - alloc_buffer_size (&result_buf);
++
++  if (outbufsize >= 3)
++    {
++      TEST_COMPARE (inleft, 0);
++      TEST_COMPARE (result_used, sizeof (expected) - shift);
++      TEST_COMPARE_BLOB (result_storage, result_used,
++                         &expected[shift], sizeof (expected) - shift);
++    }
++  else
++    /* If the buffer is too small, only the leading X could be converted.  */
++    TEST_COMPARE (result_used, 8 - shift);
++
++  TEST_VERIFY_EXIT (iconv_close (cd) == 0);
++}
++
++static int
++do_test (void)
++{
++  struct support_next_to_fault ntf
++    = support_next_to_fault_allocate (8);
++
++  for (int shift = 0; shift <= 8; ++shift)
++    for (int truncate = 0; truncate < 2; ++truncate)
++      for (size_t outbufsize = 1; outbufsize <= 8; outbufsize++)
++        {
++          char *outbuf = ntf.buffer + ntf.length - outbufsize;
++          test_one ("IBM1390", shift, truncate, outbuf, outbufsize);
++          test_one ("IBM1399", shift, truncate, outbuf, outbufsize);
++        }
++
++  support_next_to_fault_free (&ntf);
++  return 0;
++}
++
++#include <support/test-driver.c>
+
+commit 12feedaf67e11c4618dc50c6aab4dbfd1e6d9531
+Author: DJ Delorie <dj@redhat.com>
+Date:   Mon Jan 26 22:24:42 2026 -0500
+
+    include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
+    
+    Including sys/mount.h should not implicitly include fcntl.h
+    as that causes namespace pollution and conflicts with kernel
+    headers.  It only needs O_CLOEXEC for OPEN_TREE_CLOEXEC
+    (although it shouldn't need that, but it's defined that way)
+    so we provide that define (via a private version) separately.
+    
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+    Tested-by: Florian Weimer <fweimer@redhat.com>
+    (cherry picked from commit 419245719ccbc7dad6a97f24465e7f09c090327a)
+
+diff --git a/io/fcntl.c b/io/fcntl.c
+index e88e28664c..b7dab1bb39 100644
+--- a/io/fcntl.c
++++ b/io/fcntl.c
+@@ -18,6 +18,10 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ 
++#ifndef __O_CLOEXEC
++# error __O_CLOEXEC not defined by fcntl.h/cloexec.h
++#endif
++
+ /* Perform file control operations on FD.  */
+ int
+ __fcntl (int fd, int cmd, ...)
+diff --git a/sysdeps/unix/sysv/linux/Makefile b/sysdeps/unix/sysv/linux/Makefile
+index c47cbdf428..053041f256 100644
+--- a/sysdeps/unix/sysv/linux/Makefile
++++ b/sysdeps/unix/sysv/linux/Makefile
+@@ -129,6 +129,7 @@ CFLAGS-test-errno-linux.c += $(no-fortify-source)
+ 
+ sysdep_headers += \
+   bits/a.out.h \
++  bits/cloexec.h \
+   bits/epoll.h \
+   bits/eventfd.h \
+   bits/inotify.h \
+diff --git a/sysdeps/unix/sysv/linux/alpha/bits/cloexec.h b/sysdeps/unix/sysv/linux/alpha/bits/cloexec.h
+new file mode 100644
+index 0000000000..f381f28a53
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/alpha/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 010000000
+diff --git a/sysdeps/unix/sysv/linux/bits/cloexec.h b/sysdeps/unix/sysv/linux/bits/cloexec.h
+new file mode 100644
+index 0000000000..3059fb6473
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 02000000
+diff --git a/sysdeps/unix/sysv/linux/bits/fcntl-linux.h b/sysdeps/unix/sysv/linux/bits/fcntl-linux.h
+index f425a4bf22..98954feaca 100644
+--- a/sysdeps/unix/sysv/linux/bits/fcntl-linux.h
++++ b/sysdeps/unix/sysv/linux/bits/fcntl-linux.h
+@@ -81,9 +81,7 @@
+ #ifndef __O_NOFOLLOW
+ # define __O_NOFOLLOW	0400000
+ #endif
+-#ifndef __O_CLOEXEC
+-# define __O_CLOEXEC   02000000
+-#endif
++#include <bits/cloexec.h>
+ #ifndef __O_DIRECT
+ # define __O_DIRECT	 040000
+ #endif
+diff --git a/sysdeps/unix/sysv/linux/hppa/bits/cloexec.h b/sysdeps/unix/sysv/linux/hppa/bits/cloexec.h
+new file mode 100644
+index 0000000000..f381f28a53
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/hppa/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 010000000
+diff --git a/sysdeps/unix/sysv/linux/sparc/bits/cloexec.h b/sysdeps/unix/sysv/linux/sparc/bits/cloexec.h
+new file mode 100644
+index 0000000000..6706eaa7d5
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/sparc/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 0x400000
+diff --git a/sysdeps/unix/sysv/linux/sys/mount.h b/sysdeps/unix/sysv/linux/sys/mount.h
+index b549e75148..365da1c296 100644
+--- a/sysdeps/unix/sysv/linux/sys/mount.h
++++ b/sysdeps/unix/sysv/linux/sys/mount.h
+@@ -21,7 +21,6 @@
+ #ifndef _SYS_MOUNT_H
+ #define _SYS_MOUNT_H	1
+ 
+-#include <fcntl.h>
+ #include <features.h>
+ #include <stdint.h>
+ #include <stddef.h>
+@@ -266,6 +265,11 @@ enum fsconfig_command
+ 
+ /* open_tree flags.  */
+ #define OPEN_TREE_CLONE    1         /* Clone the target tree and attach the clone */
++#ifndef O_CLOEXEC
++# include <bits/cloexec.h>
++# define O_CLOEXEC __O_CLOEXEC
++#endif
++#undef  OPEN_TREE_CLOEXEC
+ #define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
+ 
+ 
+diff --git a/sysdeps/unix/sysv/linux/tst-mount.c b/sysdeps/unix/sysv/linux/tst-mount.c
+index 40913c7082..78a2772b2f 100644
+--- a/sysdeps/unix/sysv/linux/tst-mount.c
++++ b/sysdeps/unix/sysv/linux/tst-mount.c
+@@ -20,6 +20,7 @@
+ #include <support/check.h>
+ #include <support/xunistd.h>
+ #include <support/namespace.h>
++#include <fcntl.h> /* For AT_ constants.  */
+ #include <sys/mount.h>
+ 
+ _Static_assert (sizeof (struct mount_attr) == MOUNT_ATTR_SIZE_VER0,
+
+commit 3ecfa68561d723564a1fb565366182eb4acb3e8f
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Wed Mar 4 18:32:36 2026 +0100
+
+    Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
+    
+    There is a conditional inclusion of <linux/mount.h> earlier in the file.
+    If that defines the macros, do not redefine them.  This addresses build
+    problems as the token sequence used by the UAPI macro definitions
+    changes between Linux versions.
+    
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+    (cherry picked from commit d12b017cddfeb9fe9920ba054ae3dfcb8e9238b8)
+
+diff --git a/sysdeps/unix/sysv/linux/sys/mount.h b/sysdeps/unix/sysv/linux/sys/mount.h
+index 365da1c296..30ba56c1e8 100644
+--- a/sysdeps/unix/sysv/linux/sys/mount.h
++++ b/sysdeps/unix/sysv/linux/sys/mount.h
+@@ -264,14 +264,16 @@ enum fsconfig_command
+ #define FSOPEN_CLOEXEC          0x00000001
+ 
+ /* open_tree flags.  */
+-#define OPEN_TREE_CLONE    1         /* Clone the target tree and attach the clone */
++#ifndef OPEN_TREE_CLONE
++# define OPEN_TREE_CLONE    1 /* Clone the target tree and attach the clone */
++#endif
+ #ifndef O_CLOEXEC
+ # include <bits/cloexec.h>
+ # define O_CLOEXEC __O_CLOEXEC
+ #endif
+-#undef  OPEN_TREE_CLOEXEC
+-#define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
+-
++#ifndef OPEN_TREE_CLOEXEC
++# define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
++#endif
+ 
+ __BEGIN_DECLS
+ 
+
+commit 3e87cf9be93acf19d685e8003fc649cdb052a891
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Mon Apr 13 10:46:42 2026 +0800
+
+    abilist.awk: Handle weak unversioned defined symbols
+    
+    After
+    
+    commit f685e3953f9a38a41bbd0a597f9882870cee13d5
+    Author: H.J. Lu <hjl.tools@gmail.com>
+    Date:   Wed Oct 29 09:49:57 2025 +0800
+    
+        elf: Don't set its DT_VERSYM entry for unversioned symbol
+    
+    ld no longer assigns version index 1 to unversioned defined symbol.
+    For libmachuser.so, "objdump --dynamic-syms" reports:
+    
+    0000dd30  w   DF .text  000000f8              processor_start
+    
+    instead of
+    
+    0000dd30  w   DF .text  000000f8 (Base)       processor_start
+    
+    Also allow NF == 6 for weak unversioned dynamic symbols.  This fixes BZ
+    33650.
+    
+    Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+    Reviewed-by: Sam James <sam@gentoo.org>
+    (cherry picked from commit ee5d1db2a81468413fbf7c82779ffa782f429d1a)
+
+diff --git a/scripts/abilist.awk b/scripts/abilist.awk
+index 6cc7af6ac8..7ea1edf8c0 100644
+--- a/scripts/abilist.awk
++++ b/scripts/abilist.awk
+@@ -38,7 +38,7 @@ $4 == "*UND*" { next }
+ $2 == "l" { next }
+ 
+ # If the target uses ST_OTHER, it will be output before the symbol name.
+-$2 == "g" || $2 == "w" && (NF == 7 || NF == 8) {
++$2 == "g" || $2 == "w" && (NF == 6 || NF == 7 || NF == 8) {
+   type = $3;
+   size = $5;
+   sub(/^0*/, "", size);
+
+commit b4bca35ab9e76890504c4dbdd5eaf15a93514580
+Author: Rocket Ma <marocketbd@gmail.com>
+Date:   Fri May 1 20:39:07 2026 -0700
+
+    libio: Fix ungetwc operating on byte stream [BZ #33998]
+    
+    * libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one
+    character, it accidently compare the wchar to push back with the last
+    char from byte stream, instead of wide stream. Under specific coding,
+    attacker may exploit this to leak information. This commit fix bug
+    33998, or CVE-2026-5928.
+    
+    Signed-off-by: Rocket Ma <marocketbd@gmail.com>
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    (cherry picked from commit ef3bfb5f910011f3780cb06aa47e730035f53285)
+
+diff --git a/libio/Makefile b/libio/Makefile
+index f020f8ec4d..fa2b8ae791 100644
+--- a/libio/Makefile
++++ b/libio/Makefile
+@@ -83,6 +83,7 @@ tests = \
+   bug-ungetwc1 \
+   bug-ungetwc2 \
+   bug-wfflush \
++  bug-wgenops-bz33998 \
+   bug-wmemstream1 \
+   bug-wsetpos \
+   test-fmemopen \
+diff --git a/libio/bug-wgenops-bz33998.c b/libio/bug-wgenops-bz33998.c
+new file mode 100644
+index 0000000000..cc4067da99
+--- /dev/null
++++ b/libio/bug-wgenops-bz33998.c
+@@ -0,0 +1,54 @@
++/* Regression test for ungetwc operating on byte stream (BZ #33998)
++   Copyright (C) 2026 The GNU Toolchain Authors.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include "support/temp_file.h"
++#include "support/xstdio.h"
++#include "support/xunistd.h"
++#include <stdlib.h>
++#include <unistd.h>
++#include <sys/mman.h>
++#include <stdio.h>
++#include <wchar.h>
++#include <support/check.h>
++
++static int
++do_test (void)
++{
++  char *filename;
++  int fd = create_temp_file ("tst-bz33998-", &filename);
++  TEST_VERIFY (fd != -1);
++  xwrite (fd, "A", sizeof ("A")); // write "A\0" by design
++  xclose (fd);
++
++  FILE *fp = xfopen (filename, "r+");
++  TEST_COMPARE (getwc (fp), L'A');
++  /* If the bug is fixed, then ungetwc should not touch byte stream.
++     If the bug is not fixed, ungetwc firstly match last read char, L'A',
++     failed, then the pbackfail branch, matching last read char in byte
++     stream, that is, '\0' (initialized when setup wide stream). */
++  char *old_read_ptr = fp->_IO_read_ptr;
++  TEST_COMPARE (ungetwc (L'\0', fp), L'\0');
++  TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr);
++
++  xfclose (fp);
++  free (filename);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/libio/wgenops.c b/libio/wgenops.c
+index 0a11d1b1de..9e0b2c00ea 100644
+--- a/libio/wgenops.c
++++ b/libio/wgenops.c
+@@ -108,8 +108,8 @@ _IO_wdefault_pbackfail (FILE *fp, wint_t c)
+ {
+   if (fp->_wide_data->_IO_read_ptr > fp->_wide_data->_IO_read_base
+       && !_IO_in_backup (fp)
+-      && (wint_t) fp->_IO_read_ptr[-1] == c)
+-    --fp->_IO_read_ptr;
++      && (wint_t) fp->_wide_data->_IO_read_ptr[-1] == c)
++    --fp->_wide_data->_IO_read_ptr;
+   else
+     {
+       /* Need to handle a filebuf in write mode (switch to read mode). FIXME!*/
+
+commit 4ebd33dd77eabe8d4c45232bed4b42a31d2f9edc
+Author: Rocket Ma <marocketbd@gmail.com>
+Date:   Fri Apr 17 23:48:41 2026 -0700
+
+    stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
+    
+    * stdio-common/vfscanf-internal.c: When enlarging allocated buffer with
+    format %mc or %mC, glibc allocates one byte less, leading to
+    user-controlled one byte overflow. This commit fixes BZ #34008, or
+    CVE-2026-5450.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Signed-off-by: Rocket Ma <marocketbd@gmail.com>
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    (cherry picked from commit 839898777226a3ed88c0859f25ffe712519b4ead)
+
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index 64b3575acb..e52c333808 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -347,6 +347,7 @@ tests := \
+   tst-vfprintf-user-type \
+   tst-vfprintf-width-i18n \
+   tst-vfprintf-width-prec-alloc \
++  tst-vfscanf-bz34008 \
+   tst-wc-printf \
+   tstdiomisc \
+   tstgetln \
+@@ -562,6 +563,9 @@ tst-printf-bz18872-ENV = MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace \
+ tst-vfprintf-width-prec-ENV = \
+   MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace \
+   LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
++tst-vfscanf-bz34008-ENV = \
++  MALLOC_CHECK_=3 \
++  LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+ tst-printf-bz25691-ENV = \
+   MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace \
+   LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+diff --git a/stdio-common/tst-vfscanf-bz34008.c b/stdio-common/tst-vfscanf-bz34008.c
+new file mode 100644
+index 0000000000..48371c8a3d
+--- /dev/null
++++ b/stdio-common/tst-vfscanf-bz34008.c
+@@ -0,0 +1,48 @@
++/* Regression test for vfscanf %Nmc out-of-bound write (BZ #34008)
++   Copyright (C) 2026 The GNU Toolchain Authors.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include "malloc/mcheck.h"
++#include <stddef.h>
++#include <stdio.h>
++#include <string.h>
++#include <wchar.h>
++#include <stdlib.h>
++#include <malloc.h>
++#include <support/check.h>
++
++#define WIDTH 0x410
++#define SCANFSTR "%1040mc"
++static int
++do_test (void)
++{
++  mcheck_pedantic (NULL);
++  char *input = malloc (WIDTH + 1);
++  TEST_VERIFY (input != NULL);
++  memset (input, 'A', WIDTH);
++  input[WIDTH] = '\0';
++
++  char *buf = NULL;
++  TEST_VERIFY (sscanf (input, SCANFSTR, &buf) != -1);
++  TEST_VERIFY (buf != NULL);
++
++  free (buf);
++  free (input);
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
+index 86ae5019a6..17b5565d0f 100644
+--- a/stdio-common/vfscanf-internal.c
++++ b/stdio-common/vfscanf-internal.c
+@@ -853,8 +853,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 			{
+ 			  /* Enlarge the buffer.  */
+ 			  size_t newsize
+-			    = strsize
+-			      + (strsize >= width ? width - 1 : strsize);
++			    = strsize + (strsize >= width ? width : strsize);
+ 
+ 			  str = (char *) realloc (*strptr, newsize);
+ 			  if (str == NULL)
+@@ -925,7 +924,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 		      && wstr == (wchar_t *) *strptr + strsize)
+ 		    {
+ 		      size_t newsize
+-			= strsize + (strsize > width ? width - 1 : strsize);
++			= strsize + (strsize >= width ? width : strsize);
+ 		      /* Enlarge the buffer.  */
+ 		      wstr = (wchar_t *) realloc (*strptr,
+ 						  newsize * sizeof (wchar_t));
+@@ -980,7 +979,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 		    && wstr == (wchar_t *) *strptr + strsize)
+ 		  {
+ 		    size_t newsize
+-		      = strsize + (strsize > width ? width - 1 : strsize);
++		      = strsize + (strsize >= width ? width : strsize);
+ 		    /* Enlarge the buffer.  */
+ 		    wstr = (wchar_t *) realloc (*strptr,
+ 						newsize * sizeof (wchar_t));
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index a013a2db2f0c..b6c6a6c86445 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -51,7 +51,7 @@
 
 let
   version = "2.42";
-  patchSuffix = "-61";
+  patchSuffix = "-67";
   sha256 = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8=";
 in
 
@@ -68,8 +68,8 @@ stdenv.mkDerivation (
     patches = [
       /*
         No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
-         $ git fetch --all -p && git checkout origin/release/2.40/master && git describe
-         glibc-2.42-61-ga56a2943d2
+         $ git fetch --all -p && git checkout origin/release/2.42/master && git describe
+         glibc-2.42-67-g4ebd33dd77
          $ git show --minimal --reverse glibc-2.42.. ':!ADVISORIES' > 2.42-master.patch
 
         To compare the archive contents zdiff can be used.

From 0d82881a6ad2273e718af745cabbcdfe4f7121a0 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Fri, 8 May 2026 14:58:23 +1000
Subject: [PATCH 0190/1209] linuxHeaders: 6.18.7 -> 7.0

---
 pkgs/os-specific/linux/kernel-headers/default.nix     | 4 ++--
 pkgs/os-specific/linux/kernel-headers/no-relocs.patch | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 7a7531738fae..e2ea04864000 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -152,13 +152,13 @@ in
 
   linuxHeaders =
     let
-      version = "6.18.7";
+      version = "7.0";
     in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-        hash = "sha256-tyak0Vz5rgYhm1bYeCB3bjTYn7wTflX7VKm5wwFbjx4=";
+        hash = "sha256-u39tgLOHx1e30Uu5MCj8uQ95PFwNNnc27oFaEAs4kfA=";
       };
       patches = [
         ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/pkgs/os-specific/linux/kernel-headers/no-relocs.patch b/pkgs/os-specific/linux/kernel-headers/no-relocs.patch
index 32c88224b867..a4e794cf3b26 100644
--- a/pkgs/os-specific/linux/kernel-headers/no-relocs.patch
+++ b/pkgs/os-specific/linux/kernel-headers/no-relocs.patch
@@ -2,6 +2,6 @@
 +++ b/arch/x86/Makefile
 @@ -231,3 +231,3 @@ endif
  archscripts: scripts_basic
--	$(Q)$(MAKE) $(build)=arch/x86/tools relocs
-+	$(Q)$(MAKE) $(build)=arch/x86/tools
+-	$(Q)$(MAKE) $(build)=arch/x86/tools relocs vdso2c
++	$(Q)$(MAKE) $(build)=arch/x86/tools vdso2c
  

From f39c427320106c7f59d11c7c03122972491bb37b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 17 May 2026 01:31:49 +0300
Subject: [PATCH 0191/1209] python3Packages.numpy: 2.4.4 -> 2.4.6

Diff: https://github.com/numpy/numpy/compare/v2.4.4...v2.4.6

Changelogs:
- https://github.com/numpy/numpy/releases/tag/v2.4.5
- https://github.com/numpy/numpy/releases/tag/v2.4.6
---
 pkgs/development/python-modules/numpy/2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index f336a573ca13..feaeaf93f9c1 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -34,7 +34,7 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 buildPythonPackage (finalAttrs: {
   pname = "numpy";
-  version = "2.4.4";
+  version = "2.4.6";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -42,7 +42,7 @@ buildPythonPackage (finalAttrs: {
     repo = "numpy";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-LAGXw4vFpjZjZ2s/dXdzXHDm6Ah3pronjScqK02wivY=";
+    hash = "sha256-jHi3cYiSwFRm3G0Dl4dL6yACSP4lAUECotVI+4KXMg8=";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [

From a700f706078ba51f1c7a7113cc47e3c5843954a1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 19 May 2026 11:20:13 +0000
Subject: [PATCH 0192/1209] libopenmpt: 0.8.6 -> 0.8.7

---
 pkgs/by-name/li/libopenmpt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libopenmpt/package.nix b/pkgs/by-name/li/libopenmpt/package.nix
index 0e7f01d0fe84..2cccd04d27e6 100644
--- a/pkgs/by-name/li/libopenmpt/package.nix
+++ b/pkgs/by-name/li/libopenmpt/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libopenmpt";
-  version = "0.8.6";
+  version = "0.8.7";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${finalAttrs.version}+release.autotools.tar.gz";
-    hash = "sha256-yqL6lZ44n0N02eLfOvXGM0UsEt2ARCy6LonLf/K5PFs=";
+    hash = "sha256-J1wp70e+mZL2KjX8yW98oFwG0v0FySmLje6fdD91sIk=";
   };
 
   enableParallelBuilding = true;

From 78f51bc5bcc5037966c06d952debc2e3c05f65ba Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 16:13:05 +0200
Subject: [PATCH 0193/1209] python3Packages.aiodns: 4.0.0 -> 4.0.3

https://github.com/saghul/aiodns/releases/tag/v4.0.1
https://github.com/saghul/aiodns/releases/tag/v4.0.2
https://github.com/saghul/aiodns/releases/tag/v4.0.3
---
 pkgs/development/python-modules/aiodns/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiodns/default.nix b/pkgs/development/python-modules/aiodns/default.nix
index 54b67a88be19..1a147d54fa04 100644
--- a/pkgs/development/python-modules/aiodns/default.nix
+++ b/pkgs/development/python-modules/aiodns/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiodns";
-  version = "4.0.0";
+  version = "4.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "saghul";
     repo = "aiodns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/iYkhzN01+NaUfMXaM39IvlEKfoKc29+f0S4y0y3GG8=";
+    hash = "sha256-a26n8n/nxq/LxgPCQJNFjU4yVSCL7YK1lBkiDdVDo2w=";
   };
 
   build-system = [ setuptools ];

From 70d339f357ec9f39f6afb6cdeab341b48f21aac7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 16:13:19 +0200
Subject: [PATCH 0194/1209] python3Packages.xmltodict: 1.0.2 -> 1.0.4

https://github.com/martinblech/xmltodict/blob/v1.0.4/CHANGELOG.md
---
 pkgs/development/python-modules/xmltodict/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xmltodict/default.nix b/pkgs/development/python-modules/xmltodict/default.nix
index 9d1c01842a42..bd22bc108bbe 100644
--- a/pkgs/development/python-modules/xmltodict/default.nix
+++ b/pkgs/development/python-modules/xmltodict/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "xmltodict";
-  version = "1.0.2";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "martinblech";
     repo = "xmltodict";
     tag = "v${version}";
-    hash = "sha256-gnTNkh0GLfRmjMsLhfvpNrewfinNOhem0i3wzIZvKpA=";
+    hash = "sha256-G7hVtS6toUJC0YY1AXBOJSc3wnAZyWilLnT/5vvFRRw=";
   };
 
   build-system = [ setuptools ];

From 7096ab788ff94e63a572f77862bcbfd5a8251a77 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Wed, 20 May 2026 08:44:08 +0800
Subject: [PATCH 0195/1209] spidermonkey_140: 140.9.0 -> 140.11.0

https://www.firefox.com/en-US/firefox/140.11.0/releasenotes/
---
 pkgs/development/interpreters/spidermonkey/140.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/spidermonkey/140.nix b/pkgs/development/interpreters/spidermonkey/140.nix
index f66957465bf9..49908ebc35ef 100644
--- a/pkgs/development/interpreters/spidermonkey/140.nix
+++ b/pkgs/development/interpreters/spidermonkey/140.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "140.9.0";
-  hash = "sha512-vAP9KnPQCoi9Cjye6u/mGP+zQib7e8L6xKAiRv8p/gOEI793U4Jz7m+sJfsePk+pi7UiAmrjQnoK1fQdLsa6mA==";
+  version = "140.11.0";
+  hash = "sha512-0GrbPvTeEyTj1hhy1w3jGrCKwBPzOQNUm+0oxuvMW03ulLs2OIKCwZNdd9GlZAefOtvwjWu4AoSomcuz2GEwDA==";
 }

From 8aa7c75b47254ac38ee2470c3ad42a7d6af5bb99 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 20 May 2026 02:10:28 +0000
Subject: [PATCH 0196/1209] libde265: 1.0.18 -> 1.0.19

---
 pkgs/by-name/li/libde265/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libde265/package.nix b/pkgs/by-name/li/libde265/package.nix
index 51e24c6ed5ac..65121864428c 100644
--- a/pkgs/by-name/li/libde265/package.nix
+++ b/pkgs/by-name/li/libde265/package.nix
@@ -15,14 +15,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.0.18";
+  version = "1.0.19";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N6K82ElrzrMSNKfPTDsc5onrxucIJ8niwFgbaEPPd2I=";
+    hash = "sha256-77OIclR2TwOigo/k5ps9S0TrDNvEjf290PqZyqBcydo=";
   };
 
   nativeBuildInputs = [

From 83594b903142a5f02015987a98b706416e4161ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 19 May 2026 20:09:22 -0700
Subject: [PATCH 0197/1209] python3Packages.python-multipart: 0.0.22 -> 0.0.29

Diff: https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.29

Changelog: https://github.com/Kludex/python-multipart/blob/0.0.29/CHANGELOG.md
---
 .../python-modules/python-multipart/default.nix  | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/python-multipart/default.nix b/pkgs/development/python-modules/python-multipart/default.nix
index 4781d391f0a2..ed476d568dd8 100644
--- a/pkgs/development/python-modules/python-multipart/default.nix
+++ b/pkgs/development/python-modules/python-multipart/default.nix
@@ -2,10 +2,8 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   hatchling,
   pytestCheckHook,
-  mock,
   pyyaml,
 
   # for passthru.tests
@@ -18,32 +16,22 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-multipart";
-  version = "0.0.22";
+  version = "0.0.29";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kludex";
     repo = "python-multipart";
     tag = finalAttrs.version;
-    hash = "sha256-UegnwGxiXQalbp18t1dl2JOQH6BY975cpBa9uo3SOuk=";
+    hash = "sha256-1aV7gWLuulINesm3L8Wm3+prmeD9+OY/ihm36rtQPRs=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2026-40347-part-1.patch";
-      url = "https://github.com/Kludex/python-multipart/commit/6a7b76dd2653d99d8e5981d7ff09a4a047750b37.patch";
-      hash = "sha256-W1nyYMMoaf+lsNze3ppPeAXN+swG1dScDibazePSt+k=";
-    })
-    ./CVE-2026-40347-part-2.patch
-  ];
-
   build-system = [ hatchling ];
 
   pythonImportsCheck = [ "python_multipart" ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    mock
     pyyaml
   ];
 

From 1355d225b662faa1bb9bdbbfce935c416e2a17a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 19 May 2026 20:11:39 -0700
Subject: [PATCH 0198/1209] python3Packages.asgi-csrf: mark broken

---
 pkgs/development/python-modules/asgi-csrf/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/asgi-csrf/default.nix b/pkgs/development/python-modules/asgi-csrf/default.nix
index f3ec2670d6f8..9c36730fd74c 100644
--- a/pkgs/development/python-modules/asgi-csrf/default.nix
+++ b/pkgs/development/python-modules/asgi-csrf/default.nix
@@ -49,6 +49,8 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "asgi_csrf" ];
 
   meta = {
+    # https://github.com/simonw/asgi-csrf/issues/38
+    broken = lib.versionAtLeast python-multipart.version "0.0.26";
     description = "ASGI middleware for protecting against CSRF attacks";
     license = lib.licenses.asl20;
     homepage = "https://github.com/simonw/asgi-csrf";

From 2ca587c6020fd949a963f8d30e0bcde6b0a72c60 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 20 May 2026 11:09:03 +0000
Subject: [PATCH 0199/1209] lcms: 2.18 -> 2.19.1

---
 pkgs/by-name/lc/lcms2/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lc/lcms2/package.nix b/pkgs/by-name/lc/lcms2/package.nix
index ecb0c3280adb..d07d8ca7ffa4 100644
--- a/pkgs/by-name/lc/lcms2/package.nix
+++ b/pkgs/by-name/lc/lcms2/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.18";
+  version = "2.19.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/lcms2-${version}.tar.gz";
-    hash = "sha256-7me+NWb0WTYsHuCU/eLBWdM/oDkKpO1fWvZ2+eUAQ0c=";
+    hash = "sha256-v8VPe6tZ+8khASAUqAMuTLpKvUbbR9RrdkFqjAsoFcg=";
   };
 
   outputs = [

From 2318abaa0baf8fb9db893bee05ba627773b4545b Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 20 May 2026 14:35:16 +0200
Subject: [PATCH 0200/1209] Revert "nodejs: re-introduce `nodejs.src`"

This reverts commit 9e26436f7e5e7a328dd169f8898f2747dee79031.
---
 pkgs/development/web/nodejs/symlink.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/development/web/nodejs/symlink.nix b/pkgs/development/web/nodejs/symlink.nix
index 538ac2311946..d2b0e6e19151 100644
--- a/pkgs/development/web/nodejs/symlink.nix
+++ b/pkgs/development/web/nodejs/symlink.nix
@@ -5,10 +5,7 @@
 }:
 (symlinkJoin {
   pname = "nodejs";
-  inherit (nodejs-slim) version meta;
-  passthru = nodejs-slim.passthru // {
-    inherit (nodejs-slim) src;
-  };
+  inherit (nodejs-slim) version passthru meta;
   paths = [
     nodejs-slim
     nodejs-slim.npm

From ba2df560b675f7f17843675cfce3422fb758745f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 09:17:04 -0700
Subject: [PATCH 0201/1209] python3Packages.frictionless: exclude datasette
 from nativeCheckInputs

Datasette depends on asgi-csrf which was broken by updating
python-multipart past version 0.0.26.
---
 pkgs/development/python-modules/frictionless/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/frictionless/default.nix b/pkgs/development/python-modules/frictionless/default.nix
index 80013e731fd4..68edce923de3 100644
--- a/pkgs/development/python-modules/frictionless/default.nix
+++ b/pkgs/development/python-modules/frictionless/default.nix
@@ -195,7 +195,8 @@ buildPythonPackage rec {
     openpyxl
     xlrd
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  # datasette is transitively broken by asgi-csrf
+  ++ lib.concatAttrValues (lib.removeAttrs optional-dependencies [ "datasette" ]);
 
   disabledTestPaths = [
     # Requires optional dependencies that have not been packaged (commented out above)

From 4d80938179e0f3f158caa76d43a019a9b203b46c Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 20 May 2026 13:05:03 +0000
Subject: [PATCH 0202/1209] python3Packages.sympy: build from GitHub sources,
 cleanup

---
 .../python-modules/sympy/default.nix          | 40 ++++++++++++++-----
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/sympy/default.nix b/pkgs/development/python-modules/sympy/default.nix
index ef1e4183e307..0ec139e9514c 100644
--- a/pkgs/development/python-modules/sympy/default.nix
+++ b/pkgs/development/python-modules/sympy/default.nix
@@ -1,30 +1,48 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  glibcLocales,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   mpmath,
 
+  # tests
+  glibcLocales,
+
   # Reverse dependency
   sage,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "sympy";
   version = "1.14.0";
-  format = "setuptools";
+  pyproject = true;
+  __structuredAttrs = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-09P+jfHloLQvDnvfUFQWl9vn0jdG6JSZDAMOKwXnJRc=";
+  src = fetchFromGitHub {
+    owner = "sympy";
+    repo = "sympy";
+    tag = "sympy-${finalAttrs.version}";
+    hash = "sha256-aSMQ/H5agjsa+Lp7o15/irLSTLtmF/VEqMCBGbXbvmM=";
   };
 
-  nativeCheckInputs = [ glibcLocales ];
+  build-system = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [ mpmath ];
+  pythonRelaxDeps = [
+    "mpmath"
+  ];
+  dependencies = [
+    mpmath
+  ];
 
   # tests take ~1h
   doCheck = false;
+  nativeCheckInputs = [ glibcLocales ];
   pythonImportsCheck = [ "sympy" ];
 
   passthru.tests = {
@@ -35,8 +53,10 @@ buildPythonPackage rec {
     description = "Python library for symbolic mathematics";
     mainProgram = "isympy";
     homepage = "https://www.sympy.org/";
+    downloadPage = "https://github.com/sympy/sympy";
+    changelog = "https://github.com/sympy/sympy/wiki/Release-Notes-for-${finalAttrs.version}";
     license = lib.licenses.bsd3;
     maintainers = [ ];
     teams = [ lib.teams.sage ];
   };
-}
+})

From db738de1ef7bacf19d46f56b7a8a448a0a87291a Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 20 May 2026 13:05:41 +0000
Subject: [PATCH 0203/1209] python3Packages.sympy: add GaetanLepage to
 maintainers

---
 pkgs/development/python-modules/sympy/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/sympy/default.nix b/pkgs/development/python-modules/sympy/default.nix
index 0ec139e9514c..575698e7a81c 100644
--- a/pkgs/development/python-modules/sympy/default.nix
+++ b/pkgs/development/python-modules/sympy/default.nix
@@ -56,7 +56,9 @@ buildPythonPackage (finalAttrs: {
     downloadPage = "https://github.com/sympy/sympy";
     changelog = "https://github.com/sympy/sympy/wiki/Release-Notes-for-${finalAttrs.version}";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+    ];
     teams = [ lib.teams.sage ];
   };
 })

From 470b4097c36f3cb48863f87fb56f86d832b2f2ac Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 20 May 2026 10:54:18 +0000
Subject: [PATCH 0204/1209] protobuf: enable __structuredAttrs

---
 pkgs/development/libraries/protobuf/generic.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/protobuf/generic.nix b/pkgs/development/libraries/protobuf/generic.nix
index 91e6bc878b01..b18ebd398a0b 100644
--- a/pkgs/development/libraries/protobuf/generic.nix
+++ b/pkgs/development/libraries/protobuf/generic.nix
@@ -28,6 +28,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "protobuf";
   inherit version;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "protocolbuffers";

From 6481565e50709a9e66e8eaea24f4a0900aad449b Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 19 May 2026 23:12:13 +0000
Subject: [PATCH 0205/1209] protobuf: 34.1 -> 35.0

Diff: https://github.com/protocolbuffers/protobuf/compare/v34.1...v35.0

Changelog: https://github.com/protocolbuffers/protobuf/releases/
---
 pkgs/development/libraries/protobuf/35.nix      | 9 +++++++++
 pkgs/development/libraries/protobuf/generic.nix | 4 ++--
 pkgs/development/python-modules/protobuf/7.nix  | 4 ++--
 pkgs/top-level/all-packages.nix                 | 4 +++-
 4 files changed, 16 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/development/libraries/protobuf/35.nix

diff --git a/pkgs/development/libraries/protobuf/35.nix b/pkgs/development/libraries/protobuf/35.nix
new file mode 100644
index 000000000000..0dba884f1ecf
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/35.nix
@@ -0,0 +1,9 @@
+{ callPackage, ... }@args:
+
+callPackage ./generic.nix (
+  {
+    version = "35.0";
+    hash = "sha256-J0NA19W44CzgSjKv3A+1An6vDRTDjaWMhDzQGEOtrCk=";
+  }
+  // args
+)
diff --git a/pkgs/development/libraries/protobuf/generic.nix b/pkgs/development/libraries/protobuf/generic.nix
index b18ebd398a0b..59de3e5e7f76 100644
--- a/pkgs/development/libraries/protobuf/generic.nix
+++ b/pkgs/development/libraries/protobuf/generic.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-rIP+Ft/SWVwh9Oy8y8GSUBgP6CtLCLvGmr6nOqmyHhY=";
       })
     ]
-    ++ lib.optionals (lib.versionAtLeast version "30") [
+    ++ lib.optionals ((lib.versionAtLeast version "30") && (lib.versionOlder version "35")) [
       # workaround nvcc bug in message_lite.h
       # https://github.com/protocolbuffers/protobuf/issues/21542
       # Caused by: https://github.com/protocolbuffers/protobuf/commit/8f7aab29b21afb89ea0d6e2efeafd17ca71486a9
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-2/vc4anc+kH7otfLHfBtW8dRowPyObiXZn0+HtQktak=";
       })
     ]
-    ++ lib.optionals (lib.versionAtLeast version "33") [
+    ++ lib.optionals ((lib.versionAtLeast version "33") && (lib.versionOlder version "35")) [
       # Fix protoc plugins crashing on big-endian platforms
       # https://github.com/protocolbuffers/protobuf/pull/25363
       (fetchpatch {
diff --git a/pkgs/development/python-modules/protobuf/7.nix b/pkgs/development/python-modules/protobuf/7.nix
index 2ca17523a3e6..3cb696c0110a 100644
--- a/pkgs/development/python-modules/protobuf/7.nix
+++ b/pkgs/development/python-modules/protobuf/7.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "protobuf";
-  version = "7.34.1";
+  version = "7.35.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-nOQiRecEzFAnvnl8HbHrkxhNRNHN1xgR+y2bJa1UEoA=";
+    hash = "sha256-ou/YRgX0HlWfGIGwkStECZ0KKsm/RrNHSCPxD7OTsOY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 20c57a760d92..90a4427cff92 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7081,10 +7081,11 @@ with pkgs;
 
   # this version should align with the static protobuf version linked into python3.pkgs.tensorflow
   # $ nix-shell -I nixpkgs=$(git rev-parse --show-toplevel) -p python3.pkgs.tensorflow --run "python3 -c 'import google.protobuf; print(google.protobuf.__version__)'"
-  protobuf = protobuf_34;
+  protobuf = protobuf_35;
 
   inherit
     ({
+      protobuf_35 = callPackage ../development/libraries/protobuf/35.nix { };
       protobuf_34 = callPackage ../development/libraries/protobuf/34.nix { };
       protobuf_33 = callPackage ../development/libraries/protobuf/33.nix { };
       protobuf_32 = callPackage ../development/libraries/protobuf/32.nix { };
@@ -7103,6 +7104,7 @@ with pkgs;
         abseil-cpp = abseil-cpp_202103;
       };
     })
+    protobuf_35
     protobuf_34
     protobuf_33
     protobuf_32

From 5dc0e319f9b90fdd54a556974c860a484ccf9d44 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 20 May 2026 23:34:40 +0000
Subject: [PATCH 0206/1209] protobuf_34: 34.1 -> 34.2

Diff: https://github.com/protocolbuffers/protobuf/compare/v34.1...v34.2

Changelog:
https://github.com/protocolbuffers/protobuf/releases/tag/v34.2
---
 pkgs/development/libraries/protobuf/34.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/protobuf/34.nix b/pkgs/development/libraries/protobuf/34.nix
index ec10fc8824d8..9962256b0d83 100644
--- a/pkgs/development/libraries/protobuf/34.nix
+++ b/pkgs/development/libraries/protobuf/34.nix
@@ -2,8 +2,8 @@
 
 callPackage ./generic.nix (
   {
-    version = "34.1";
-    hash = "sha256-PaIVJ8NtgnrqowbKLkX+uprsQjuxDch9AUxX4YBBNh4=";
+    version = "34.2";
+    hash = "sha256-5YZ8Q9uy7MDnLRmLkkEuqp0k6eJRvs/nPfyo33cJLgs=";
   }
   // args
 )

From 55a082e984daad073d56896b5673f865c0630ff2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 21 May 2026 05:47:41 +0100
Subject: [PATCH 0207/1209] valgrind: 3.27.0 -> 3.27.1

Changes: https://valgrind.org/docs/manual/dist.news.html
---
 pkgs/by-name/va/valgrind/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index 62e1d381fd79..df0e9ddf6d99 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
-  version = "3.27.0";
+  version = "3.27.1";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/valgrind/valgrind-${version}.tar.bz2";
-    hash = "sha256-W1k33oJX7o9RaY6nG5cRrc6YBhqgfapKaF78OvkhW+8=";
+    hash = "sha256-XViRUuuAccAv6rjOarcZ5DGh+8PisXAPVDJjKouSZNw=";
   };
 
   patches = [

From 0c98395be2ba98874b055e6ed709c385446bfe06 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Thu, 21 May 2026 09:28:33 +0200
Subject: [PATCH 0208/1209] unbound: 1.25.0 -> 1.25.1

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/by-name/un/unbound/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index 45cdc57ff0a8..935818521103 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -57,13 +57,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.25.0";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-BAqGNi5lfYYTQd7CPH0lssLc5/AkeuKSVEFcrF/cNyc=";
+    hash = "sha256-1PXnxCPxoB5IrVBQIsrxiWAq+IoH7Ma9T1TTJsoTJc4=";
   };
 
   outputs = [

From 52afc5fa587029d9eb09757b68199aea80226062 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 21 May 2026 11:38:44 +0300
Subject: [PATCH 0209/1209] qt5: 5.15.18 -> 5.15.19

---
 .../libraries/qt-5/5.15/srcs-generated.json   | 160 +++++++++---------
 pkgs/development/libraries/qt-5/5.15/srcs.nix |   2 +-
 2 files changed, 81 insertions(+), 81 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index fd5fcefbff34..57473c4f5a29 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,202 +1,202 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "208f5835e6c2415c9dc5cbe92bba83aa28bab7ea",
-    "sha256": "0zqvdq5y25b1w7agx5wlr16p1wrx54086r0xcdfg9wx8dayhh1md"
+    "rev": "c3892c3ee3c0a2b8a050d0a1532f34806636eade",
+    "sha256": "0y3f4pr0vr7cpwmjxqspv79p7rljgc913fl8nqpv8y2aw8i5r4ly"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "e4c93bc7cac45bac6bccda3310947e8fe026a9ed",
-    "sha256": "1qq6jvqkl4ff7sw20pi1mawh5pypv7vxmj56d38z6p06r1azkvls"
+    "rev": "e85773764374878adc197b6a45ae8ec3ff44dafa",
+    "sha256": "1sbayayxgjj8jfi3apxw6m8qsmkba0gph2rm1wsnzjsa80zr17ia"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "4928bd58dbc1cdcf44a7e454e3d4654c3c2016f1",
-    "sha256": "02rsh60lyl6bn2jhx0ajn43safbi904nhwvdpikanrmdbg0z6dpp"
+    "rev": "14a14b137f0d794278947e980d99c47e6929e5e2",
+    "sha256": "0nvyxjm5qfq7sk22rp9hxrf8gvs6jq4i3kww1s0i8lsr69fl9biz"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "bebdfd54917e25d1c100e6bd9f5dd53c2e645fd8",
-    "sha256": "0bg36lxngkq2k11bhqdyfvbc1qyqaghwsi446zfn67vxvyxya3hx"
+    "rev": "fbed962c3195ab3952fa54d40e012ad1a4fdc42b",
+    "sha256": "1gnbgs7kh0vxjh3spv5g5zaaj1z1b0h8752pqi4lqg6jd1js2bpl"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "1093fb53ced126100d14af30a8adffd29b7ef855",
-    "sha256": "0cnlg59l743milkki8mjbrfd4cx5ycbqw73apcrnrsag9dqdbw41"
+    "rev": "16e9aff210cd4de7192adfc6cd91cdd44ba45a3d",
+    "sha256": "02virkb7h8hhkdsqpv2qg3lly4msf648f7421z10acxhin6ypw5i"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "f1be05c8efeb65b77a8bfd21763ab55bb5c04906",
-    "sha256": "1vl7wfw9sd8qfl8ixzl5wz4v5km5zdf9bii53q3pw4f2lplsralq"
+    "rev": "7e29434e06372efbb2127d0ef41538ff9aec1597",
+    "sha256": "1wv9bh13rq6mnnzsh6g88a2kj2j4nfv83vqpbdxmyavdf349pwdj"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "d9b988d3c5f9f34b97f3a9ac1347bfb55464cd60",
-    "sha256": "09jk32kw7wgcrd117a9lsm5w7jszsdhdslk10qn631wz203zbs4i"
+    "rev": "b52063032fda9af894ca0e582774364ce8caf0f8",
+    "sha256": "1zbfx7hqh1ydi2vx8pj6dxlrrc7wf8sqcwxzx8acphdyj66zcmch"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "1189557a50f11e7bc5716467a149cd09987a9f88",
-    "sha256": "0cd89d8i8chy1j1yanp1cq5s7467qr24b9c7cx9qw0nb0rf6f8qr"
+    "rev": "5bc1ac07b2d2c7839368084a4bb97e4c67eb8294",
+    "sha256": "0xpq0xjiscx72dcyg0lpr90ag5q7gypzcqnwbsnh401jrxn2pll1"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "ddb2afda6f713259fc8d95fb22a1c96bb448c36a",
-    "sha256": "0nk2vwl0ppix794xzj8nqrhsc333v8v4vr1rmwddymwlrdqlqd5d"
+    "rev": "385efd460ec13a465765fc30dd11217ae46d1846",
+    "sha256": "0djflkibfgjp8gr16hiv6nipj4q4xyclgv84f3d951dj2q7779v6"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "269fc0731f6838a1c02877a83c0ada23659c69fc",
-    "sha256": "06jhby671yzbj753yb0lnk4bv2r0nxxibq7fq1yljxdms0rc72iz"
+    "rev": "9b69ae558f0f9feffe30b0aa8993e270dfcc81ff",
+    "sha256": "056b39r4jsag5d7f5m04vmpydvnwpfs5mcynsdx717qdginlmiam"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "dfb2e7b2c98a9b7185c300d0b92b4048f5d89ba5",
-    "sha256": "1sn46lmq0y56mw0q11sgaijr2vg1wpp6lj237finp6vr3bji2816"
+    "rev": "551732fb1d963e53af437e3982a010f69eb76253",
+    "sha256": "1pyjb66nhlhin6ysm4005ng4m2ak857ai761rqx8l2h4fscgwvhf"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "c91e4c63c1eaf1e23806d9df10e3d5a9ae353c1d",
-    "sha256": "0q0vcymiqfyz8sfs9wdkhhwff55acj2rsmrb8w6yikmwcmcxp2a3"
+    "rev": "4076e38d68f05f5e1bcdedb79442d9008f18702c",
+    "sha256": "1kgvs3jgs2qysrx2kr4vn68h9gjv6ir1nd4hg0m2fbsjk644aa8w"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "ba48a8b5cedd157d972c08d371ac2581db166bf7",
-    "sha256": "00kwv405qq9q8fcwar33s2wvs1dm10fb8plxbz1q0jqcjs2ips6x"
+    "rev": "81f560be2274958011c255efa1d2d573874bed11",
+    "sha256": "1lpxngppxkhych9pkkcvw7ypw02cd324pw0z9hd9kqcd803p2017"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "27ed5a3c95a0810a96fac2a8661ea94d8ea3c44e",
-    "sha256": "04ivyxnn8d3pkjsbx0gwyj3f5if4m4cih6wyavm8bd2m2kkszx35"
+    "rev": "5f1be885cf4ee0f1eb5400bf0c5d138818fc01d0",
+    "sha256": "01880y8r2acnzfg09qm031kx99vp3zjv3zi38sh17shgcipx1fxp"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "fc7e9f41d9cec2df05c1d38d6e55d3a0d501dd25",
-    "sha256": "07q1arvdjwmbrayp2b213b8gqm4psczhx9z1m83invwmbs8iqj07"
+    "rev": "722060e4edff268feb2dda1298a7837c90f6262f",
+    "sha256": "1fqw1p6vx3gqw1sf1yk4cz1cb3d1xrbjq0p22gi0pspll314c8x0"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "ff83d119c75cd8406f73ccc08958fe36747e7390",
-    "sha256": "09jadnvphilcxxy85dlsr8a6x5w32r1c2hrbh93qbvvf9zlg60ld"
+    "rev": "8ddc44103baf166525d6650c842d7f08f651e7bb",
+    "sha256": "0akj2d8b6kdy125ggs9cd7pra3vm47frqpn6p756jafsxylkqwbh"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "510687fa4fdee84dd3d6d166e8f080c484016199",
-    "sha256": "0a8abmql94wxpfvdj5a1rnh3xsd49c5z8x93hm311sgjkd0aajx7"
+    "rev": "d1ce24a72122c315e3d190c9ebc26ed603b90057",
+    "sha256": "1wcw26x38k619xavrwav21w0vrzb24bn6ncxllcwd9bdn7vvn1wr"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "8e9a5ec9f68639162c85c198b28e072e7150883c",
-    "sha256": "04pmwqnw907dg0hpas0pdrh2fxcqn2mvqz82b1vkviksg8ny3saw"
+    "rev": "b471c6ca3edfa5ba459b8694622825b9e776bed6",
+    "sha256": "1plwpxasiw2sx76a294i4i92vk5g5gaigjfy284jpmaargxsyd7k"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "47a325358078b72016081a86be628411df2728a9",
-    "sha256": "18h309g6ni6y4bcss930g04z8ymhl2nfm3sv5s4h2fz3dl0xsqwr"
+    "rev": "4e85bd063c726f015dc8afb05834de7a71bf6a1b",
+    "sha256": "0k6wjkr2jyc1v6xrm34dnlbbdnippiph5jxzjxawlxijzzvmgcp5"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "0c3c18bf8bdac1ef1afdb8aade903edb5c2bc041",
-    "sha256": "0h8bhrbgfcf7nbfppah8lxnhvygc09983qrvp935r5sw7251km4d"
+    "rev": "af7fc486c8910b51733e1c7e758d50ca1a158b36",
+    "sha256": "1nbgpnz2qi8g24cmli25a9319vgqmk9vgngb12q2j8c8k3nlhhfs"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "e464888c53a641ee44a34ff2350cfb156c8ed59f",
-    "sha256": "08lnqz6v48j1hi6dpll7a052p6r5qfb32md16fppqzn6g5jg9ir2"
+    "rev": "5b808e0995d018c6de9f075d4a61f58d3641c11b",
+    "sha256": "1a65j06nzlxl1hmdh5li1gglcrqms0g560c2cj9vqzqm551krdj8"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "43130f2681b76a8d743a04704465b716b6b2faee",
-    "sha256": "1z1avxxq9d9nzqyxy5pq5maj73cf6dvsn5k83p3sf5kq3x0y75cj"
+    "rev": "ea9d6c4d5a0a172b4778e8f37d694d02aab83f37",
+    "sha256": "0170n0mcrf8phh3nsg2f904p8vxwmw8lks48zkpnbvyrj4gzqcr2"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "b2740a7c7f5b6ac810240404a947ca5cff9de5f7",
-    "sha256": "1jxlwc2y165fxdalcr4iqq55gsg5x4nxqd8wdq3dc1824yfnzm6i"
+    "rev": "48d10f341279e08c1bc4abb764c2d3ab9a259a51",
+    "sha256": "0523n172f96w474y804sanppfx2zkgsm342vwa6ailrcfkjw8v58"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "57491f554bc53bd020978b5744437b7ac7e56a27",
-    "sha256": "00mvwgb3xr116nl7649zq7ai2074clzw760c140sy91zqgqkjsx4"
+    "rev": "edc6f0dd5e806cced1937b2b853717f588e14fd2",
+    "sha256": "1072slgrvy910mxxqsvf7fgi237mjnbd2b8amw1srqzqj2bmnsj3"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "50a61b360877e7c1300df76b5aabf8d75554a398",
-    "sha256": "0giqwn4grg9999y31avh7ajsv9gkcfzf0xndx8bvv79si0wp59g6"
+    "rev": "8c6d11df60d4d783869c2d81568e3178f5ae75ce",
+    "sha256": "18jc5nncmpmbf758mcj9wj6dfn87hl51zp0ihqcvk6k6a8ra6l7p"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "c23069351ec31563c9ea9fcdce42ccdba95ea518",
-    "sha256": "1qgxlgnl53gabrfqihxwygdbdiqjvn2hfajmwb3h44srpq0srk33"
+    "rev": "6734222bccc5541f9527281c810c6b5f8fdd092f",
+    "sha256": "0ragq01wdwqwqp9720i3xan3a4xnkkvgc8gjy1wgwmdrs0mlb49z"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "b64a7eeda9b6a65b5ed01b1b40b07177f0aa4c0f",
-    "sha256": "134mn0njfvmzgrf325bikazkiq4xdn5wjhj56kxh1hhaz3q25hyp"
+    "rev": "ca1f2486527e7acf87d466062c035845f9774573",
+    "sha256": "0xdywglxh9sxs2s60shwf6c4m5w20h77l9d58rganqwpbrh49vkj"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "aa2376f9b1302222edcd16b4641bbd7004318c00",
-    "sha256": "0vcxgkymzhaw01f26zlny4bka9k829rwzkwk95rr3dfq7wlyxshz"
+    "rev": "a384f0d4fb8a2d0743d5dfdf12e40f6d76f8714c",
+    "sha256": "0imn7jskjvz30xnbg1z8wxkcw82hb6v92xls327385wxxj0a5i6r"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "b74f7291f343dcbcb487b020868f042d8fe83098",
-    "sha256": "1n0sjn8h5k2sh8p2a85cxdpqbnd63gz4rf9wwbshhd13w623f9s8"
+    "rev": "d2abfb9cb1f036446e5913fadb0f065dab9f0159",
+    "sha256": "048lbk25rbfbd2c8pbsifdxjcxb2003hi04lfsmgh7xr27x55gch"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "fa40a2d3373b89be0cd0a43fe0c1d047e3d34058",
-    "sha256": "06kr88gmwc7xh1whdbcg84y1naak5rv99jkscjbhzyz3z91xy7hl"
+    "rev": "3e3ab58b40734a1b9bbb7e72b2969d1f752351b1",
+    "sha256": "18dmmw1r13in7h90y3637jw3sc2pvv33bfr1bs11dyp951spw8d3"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "3cbcceb8e3e2e63a4022f1be946c7118c527a83e",
-    "sha256": "15lw5snqfkwwcsazh02lhiia39gy08nfijdpkzvll2qvg4b58zkn"
+    "rev": "388e4f32ed4b28d92bd61b917ba0e6b910e2784d",
+    "sha256": "1k76zl5c1x9q8kid3sjv4d66wy9ryl24fyiabrg32c7nbn53pbd4"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "859d2a6ee329cc08414410b2ef8c0af77a6853d3",
-    "sha256": "06sdpcanzp1a71d99rjivrbjp780mvwssc4w1sap2gskcmmgkwbs"
+    "rev": "4fc9919ee3fad1d520d0921ba3069dca3c34ff78",
+    "sha256": "12kn69l34s1r6s9w7cw9l5524kwrx8xrxwbx4hw059jns1pqac0d"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "df49b9f3badce793a0a9ea850cf1a02cc5bafef6",
-    "sha256": "01xm2r1pv7kxb4aj72ldfzmax6d799h6bj4h2xhpcii812wf5lda"
+    "rev": "605b8bc942ab263b9d1892af33a81b408f522ccc",
+    "sha256": "09vrd62ikxzjpv6awi7n34pswg4w5yvmac5ckc6ma6rqvps7mbip"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "2a157921861e651f43456cb7941b250c89feb736",
-    "sha256": "1w58b602f20mppd0zfr9yvfdn1xwfkfclnjs0p5mgymq6d946dyk"
+    "rev": "6a20afaeba182ce6e3faee592e1e85a0d3ec0fc6",
+    "sha256": "18jfxpasn47qd4glkgvps7nzm07dag6w9jbkq9l7fzbkpcbnqykb"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "b9aaac72d0853ba48f6bfd710a43df94d83d4701",
-    "sha256": "07zx55f52jgk31bm6c68iydknrih245ndnvz714l6kxw66fv4rjq"
+    "rev": "2a8ce0a61b4b9e892d948948182d935fa6792a1b",
+    "sha256": "10n50frndssj3vmmhghlw48dn0c9b26zgkgjvkza8x234j9dijv2"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "0f910acb737cefc889ce1088fc60d15bc18efe9c",
-    "sha256": "1ba9ll28hznd6qpjjiqvc2z6gaz2qgq7105dd0w810xpbaiixy0a"
+    "rev": "10eb706b24aa05f4ee69c2f2fec99b21994dfe2b",
+    "sha256": "1k01s4qkpzsjy7lygb0nhniym6g7yinih3sc16l3kljkabw44rx0"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "34342073a59f3a27ef3de02f6b21337c4f8db6cf",
-    "sha256": "1h6n7dkd6mjclxllyw2brz8wv4d68dx2ykckbwb3bkxyd6rmg1f6"
+    "rev": "043cb7c0eaf8d1bcee56a62d6a102f727a22fcbc",
+    "sha256": "0ha0ksbxm21hj37z7yk3f09ncgchw78cpcrxv56a205i2f04370d"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "5e5ae2b77078dbe51fb798743de606e6f9a5e19d",
-    "sha256": "04x8ax197z0dr01nxrb6bh4q8c077ny5n812fx5mq56l54v2m1ks"
+    "rev": "0704d01ff1218c2f32a194e38005e625c579222c",
+    "sha256": "0fsfrs770cia9i9ijvx1jyh0mjiza1cn1l7fm1a877h2qbd20l9f"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "c44c4fa86fa0794c25baef4ee1f6272aca8c511a",
-    "sha256": "0287cvs9wqlzz6gnj81gi8rp50s2rdnigcmld3fgddsg8f3v7hdj"
+    "rev": "6695a3df4460577b3fcb5546b45a0c5cb3addac4",
+    "sha256": "1xjdicq8kf6816hgnz4hc7ykcfngispm8xzv3bxacf98zicmy9rm"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "0b644263abca66503db1ce8a4e126cf358a34685",
-    "sha256": "1b1zzglvcdp7wvlpgk1gj8gmyy2r21yi6p8xiyvbccq5bbjpn0hw"
+    "rev": "ed3b333aa56ac193e969725e3c34be9070441271",
+    "sha256": "0s0z9dbivrq5pva6psfcfclw4816zb1rlr9ns03lf286iy196368"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 87a7bb97707d..ec5fdc9d5646 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "5.15.18";
+  version = "5.15.19";
 
   mk = name: args: {
     inherit version;

From e9b7cf21331391509ae684ab5530fd43373dbd0c Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 21 May 2026 15:20:19 +0200
Subject: [PATCH 0210/1209] nodejs_24: 24.15.0 -> 24.16.0

---
 pkgs/development/web/nodejs/v24.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 69004825bea2..914ab1479370 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "24.15.0";
-  sha256 = "a4f653d79ed140aaad921e8c22a3b585ca85cfdab80d4030f6309e4663a8a1c8";
+  version = "24.16.0";
+  sha256 = "2ff84a6de70b6165290111b0fc656ded1ad207a799816fe720cc7c31232df30f";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -56,13 +56,6 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
-      # https://github.com/NixOS/nixpkgs/pull/507974#issuecomment-4249433124
-      # OpenSSL reports different errors
-      # https://github.com/nodejs/node/pull/62629
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/dd25d8f29d3ddadcf5a5ebfdf98ece55f9df96c6.patch?full_index=1";
-        hash = "sha256-6cxRN7TyWmJgUZt3jp2YXbVIjrDb2BNep5LxBOtT3Q0=";
-      })
 
       # Patch for nghttp2 1.69 support
       (fetchpatch2 {

From aac6f377a01906dd907e0ccfb6f4d2c4fb76b467 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 21 May 2026 16:09:05 +0000
Subject: [PATCH 0211/1209] gn: 0-unstable-2026-03-05 -> 0-unstable-2026-04-01

---
 pkgs/by-name/gn/gn/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gn/gn/package.nix b/pkgs/by-name/gn/gn/package.nix
index 66f02fcc542a..f640662eedf4 100644
--- a/pkgs/by-name/gn/gn/package.nix
+++ b/pkgs/by-name/gn/gn/package.nix
@@ -11,11 +11,11 @@
   version ?
     # This is a workaround for update-source-version to be able to update this
     let
-      _version = "0-unstable-2026-03-05";
+      _version = "0-unstable-2026-04-01";
     in
     _version,
-  rev ? "d8c2f07d653520568da7cace755a87dad241b72d",
-  hash ? "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y=",
+  rev ? "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
+  hash ? "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ=",
 }:
 
 stdenv.mkDerivation {

From 6a792a71bfd22611ad167767298bee9244d5c339 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 22 May 2026 01:30:05 +0000
Subject: [PATCH 0212/1209] libaec: 1.1.6 -> 1.1.7

---
 pkgs/by-name/li/libaec/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libaec/package.nix b/pkgs/by-name/li/libaec/package.nix
index 9c44a97c5540..7b4e5df0356a 100644
--- a/pkgs/by-name/li/libaec/package.nix
+++ b/pkgs/by-name/li/libaec/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libaec";
-  version = "1.1.6";
+  version = "1.1.7";
 
   src = fetchFromGitLab {
     domain = "gitlab.dkrz.de";
     owner = "k202009";
     repo = "libaec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cxDP+JNwokxgzH9hO2zw+rIcz8XG7E8ujbAbWpgUEW8=";
+    hash = "sha256-aBm+CXCq7sdJb6Qq9sNuTzNj0nRwTJI20HsqUg1Qi/8=";
   };
 
   nativeBuildInputs = [

From ace84983c415e2f4c20bcb3e561f1bde840ae5e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 22 May 2026 08:00:28 +0200
Subject: [PATCH 0213/1209] gtk4: make patch unconditional

The condition was just to avoid rebuilds at that moment.
---
 pkgs/by-name/gt/gtk4/package.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/gt/gtk4/package.nix b/pkgs/by-name/gt/gtk4/package.nix
index 28fd6efc8850..9b7807508a35 100644
--- a/pkgs/by-name/gt/gtk4/package.nix
+++ b/pkgs/by-name/gt/gtk4/package.nix
@@ -95,11 +95,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Ub2fYMfSOmZaVWxzZMIfsuTiglZrPn4JJFXo+RAzCJM=";
   };
 
-  patches = lib.optional stdenv.hostPlatform.is32bit (fetchpatch {
-    name = "fix-32bit-VkImage-null.patch";
-    url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/10d43de8f4f942cb591ada3103474bd7213425f1.patch";
-    hash = "sha256-DJIL6M3XcsjBoMO77OxNi84d1DxAphAfot3N7Nq1QqQ=";
-  });
+  patches = [
+    (fetchpatch {
+      name = "fix-32bit-VkImage-null.patch";
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/10d43de8f4f942cb591ada3103474bd7213425f1.patch";
+      hash = "sha256-DJIL6M3XcsjBoMO77OxNi84d1DxAphAfot3N7Nq1QqQ=";
+    })
+  ];
 
   depsBuildBuild = [
     pkg-config

From a53c6a389758b5517c67c2481d49656191a20880 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 22 May 2026 11:05:40 -0700
Subject: [PATCH 0214/1209] python3Packages.aiodns: 4.0.3 -> 4.0.4

Diff: https://github.com/saghul/aiodns/compare/v4.0.3...v4.0.4

Changelog: https://github.com/saghul/aiodns/releases/tag/v4.0.4
---
 pkgs/development/python-modules/aiodns/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiodns/default.nix b/pkgs/development/python-modules/aiodns/default.nix
index 1a147d54fa04..21251500362e 100644
--- a/pkgs/development/python-modules/aiodns/default.nix
+++ b/pkgs/development/python-modules/aiodns/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiodns";
-  version = "4.0.3";
+  version = "4.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "saghul";
     repo = "aiodns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a26n8n/nxq/LxgPCQJNFjU4yVSCL7YK1lBkiDdVDo2w=";
+    hash = "sha256-TLiiSRhZaEbHeyrQPk8uvj10VEttRanYEgkBy7DxH4Y=";
   };
 
   build-system = [ setuptools ];

From c18979f7b2d585ff869d16429675618584d1c1c5 Mon Sep 17 00:00:00 2001
From: roconnor <roconnor@r6.ca>
Date: Fri, 22 May 2026 15:00:55 -0400
Subject: [PATCH 0215/1209] rhash: disable compile-time SHA-NI for x86_64
 compatibility

Since https://github.com/rhash/RHash/commit/e5b0cb6e7092798b14d2e4d85c49e6367a5f7432 rhash,
by default, hardcodes SHA-NI instructions at compile time.
However, these instructions are not available on older x86_64 CPUs.

In particular, rhash is a dependency of cmake, meaning that no cmake builds can run on CPUs
without SHA-NI instructions with the default configuration.

This patch disables SHA-NI in rhash.

Fixes https://github.com/NixOS/nixpkgs/issues/519825.

See also the parallel Debian fix:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1113938
---
 pkgs/by-name/rh/rhash/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix
index adb2c682ce6d..e8ef05814fee 100644
--- a/pkgs/by-name/rh/rhash/package.nix
+++ b/pkgs/by-name/rh/rhash/package.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [
     "--ar=${stdenv.cc.targetPrefix}ar"
     "--target=${stdenv.hostPlatform.config}"
+    "--disable-shani"
     (lib.enableFeature enableStatic "static")
     (lib.enableFeature enableStatic "lib-static")
   ];

From 5131deab4ec023f576cd4e6b0519c282dab8206d Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Fri, 22 May 2026 21:28:20 -0400
Subject: [PATCH 0216/1209] libgcrypt: 1.11.2 -> 1.12.2

1.12.0: https://dev.gnupg.org/T7643, https://lists.gnupg.org/pipermail/gnupg-announce/2026q1/000502.html
1.12.1: https://dev.gnupg.org/T8067
1.12.2: https://dev.gnupg.org/T8114, https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html
---
 pkgs/by-name/li/libgcrypt/package.nix | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/li/libgcrypt/package.nix b/pkgs/by-name/li/libgcrypt/package.nix
index 9317da7494fd..08fa5886de73 100644
--- a/pkgs/by-name/li/libgcrypt/package.nix
+++ b/pkgs/by-name/li/libgcrypt/package.nix
@@ -17,11 +17,11 @@ assert enableCapabilities -> stdenv.hostPlatform.isLinux;
 
 stdenv.mkDerivation rec {
   pname = "libgcrypt";
-  version = "1.11.2";
+  version = "1.12.2";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2";
-    hash = "sha256-a6Wd0ZInDowdIt20GgfZXc28Hw+wLQPEtUsjWBQzCqw=";
+    hash = "sha256-fOM8JJIiGgQ2+WqFACFenz49y1/SanV81BXnqEO6vV4=";
   };
 
   outputs = [
@@ -73,17 +73,6 @@ stdenv.mkDerivation rec {
   postConfigure = ''
     sed -i configure \
         -e 's/NOEXECSTACK_FLAGS=$/NOEXECSTACK_FLAGS="-Wa,--noexecstack"/'
-  ''
-  # The cipher/simd-common-riscv.h wasn't added to the release tarball, please remove this hack on next version update
-  # https://dev.gnupg.org/T7647
-  + lib.optionalString stdenv.hostPlatform.isRiscV ''
-    cp ${
-      fetchurl {
-        url = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob_plain;f=cipher/simd-common-riscv.h;h=8381000f9ac148c60a6963a1d9ec14a3fee1c576;hb=81ce5321b1b79bde6dfdc3c164efb40c13cf656b";
-        hash = "sha256-Toe15YLAOYULnLc2fGMMv/xzs/q1t3LsyiqtL7imc+8=";
-        name = "simd-common-riscv.h";
-      }
-    } cipher/simd-common-riscv.h
   '';
 
   enableParallelBuilding = true;

From 8007e967b33514b9b71ac6a0245c53ebff775d4e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 23 May 2026 06:55:50 +0000
Subject: [PATCH 0217/1209] duckdb: 1.5.2 -> 1.5.3

---
 pkgs/by-name/du/duckdb/versions.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index 6b16dcfd94a2..aa83cd89b603 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,6 +1,6 @@
 {
-  "version": "1.5.2",
-  "rev": "8a5851971fae891f292c2714d86046ee018e9737",
-  "hash": "sha256-FWoVF7s/n28NN1HtnO0Cr3YyoIDgJcWBtBiO7vWiSOU=",
-  "python_hash": "sha256-B14dXW5pPnToiKbSD9ACzNksIhBG+ui1P9l67Qyke8o="
+  "version": "1.5.3",
+  "rev": "14eca11bd9d4a0de2ea0f078be588a9c1c5b279c",
+  "hash": "sha256-k7mtYXHS8IcBAuOCJ/09lPYLxF3RMODIeDaz3tKmQAA=",
+  "python_hash": "sha256-r0jfYIyBHN5z4QKKxS/yjnkGjUy/yg9Kt/O6adBbH7Q="
 }

From 963d350eecafb5555700ca2a6ec857fc739409cc Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 23 May 2026 09:47:23 +0100
Subject: [PATCH 0218/1209] which: 2.23 -> 2.25

Changes: https://cgit.git.savannah.gnu.org/cgit/which.git/tree/NEWS?id=dbc1ccf36a920a216d290a0ccb1ee425e2cef0bc
---
 pkgs/by-name/wh/which/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wh/which/package.nix b/pkgs/by-name/wh/which/package.nix
index a8f4f1f53d02..6c28c95eb844 100644
--- a/pkgs/by-name/wh/which/package.nix
+++ b/pkgs/by-name/wh/which/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "which";
-  version = "2.23";
+  version = "2.25";
 
   src = fetchurl {
     url = "mirror://gnu/which/which-${finalAttrs.version}.tar.gz";
-    hash = "sha256-osVYIm/E2eTOMxvS/Tw/F/lVEV0sAORHYYpO+ZeKKnM=";
+    hash = "sha256-HLg+T3AuYLghGrXsTCr7qxsd7IAglFan0vr3WE7SJeo=";
   };
   patches = [
     ./gcc15.patch

From ce3f5238f07e55b399acd5d8b5939972730f20ca Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 23 May 2026 11:40:47 +0100
Subject: [PATCH 0219/1209] utf8cpp: 4.1.0 -> 4.1.1

Changes: https://github.com/nemtrif/utfcpp/releases/tag/v4.1.1
---
 pkgs/by-name/ut/utf8cpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/utf8cpp/package.nix b/pkgs/by-name/ut/utf8cpp/package.nix
index c801aca45475..9d383273519a 100644
--- a/pkgs/by-name/ut/utf8cpp/package.nix
+++ b/pkgs/by-name/ut/utf8cpp/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "utf8cpp";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "nemtrif";
     repo = "utfcpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jh/sdWx+FWR70iqmPqDI/ZcyHBoSQFcGrQSICipdXbA=";
+    hash = "sha256-0NbbQMsucrbOGEWAVZGSFp7f4dp31XrurPVVjcYsH+I=";
   };
 
   nativeBuildInputs = [ cmake ];

From 66adfb9dab823f579f9d45ee241731a10fb4e7eb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 May 2026 14:53:37 +0300
Subject: [PATCH 0220/1209] kdePackages.plasma-workspace: backport patch for Qt
 6.11.1 regression

---
 pkgs/kde/plasma/plasma-workspace/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/kde/plasma/plasma-workspace/default.nix b/pkgs/kde/plasma/plasma-workspace/default.nix
index 0a02c8e424cd..195fc3c9183d 100644
--- a/pkgs/kde/plasma/plasma-workspace/default.nix
+++ b/pkgs/kde/plasma/plasma-workspace/default.nix
@@ -24,6 +24,7 @@
   libqalculate,
   pipewire,
   gpsd,
+  fetchpatch,
 }:
 mkKdeDerivation {
   pname = "plasma-workspace";
@@ -41,6 +42,12 @@ mkKdeDerivation {
 
     # stop accidentally duplicating fontconfig configs
     ./fontconfig.patch
+
+    # backport qt 6.11.1 regression workaround
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/plasma-workspace/-/commit/31a64dfa1a71ab1b6a495f2f44132c86858acb8f.diff";
+      hash = "sha256-j+AEdDlutDuXmYdK8BJH8bgDF9gieCkbFJK8di+9nxk=";
+    })
   ];
 
   outputs = [

From 1b3320b2d9c665aa4689ea2661221a7753afb974 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 May 2026 14:53:51 +0300
Subject: [PATCH 0221/1209] qt6: 6.11.0 -> 6.11.1

---
 pkgs/development/libraries/qt-6/fetch.sh      |   2 +-
 .../libraries/qt-6/modules/qtbase/default.nix |   5 -
 .../qt-6/modules/qtdeclarative/default.nix    |   6 +
 .../libraries/qt-6/modules/qtmqtt.nix         |   4 +-
 pkgs/development/libraries/qt-6/srcs.nix      | 336 +++++++++---------
 5 files changed, 177 insertions(+), 176 deletions(-)

diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index 73d170689480..bd94b3ae2c48 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.0/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.1/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index a340abb9ed00..425a17b56234 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -246,11 +246,6 @@ stdenv.mkDerivation {
     # don't pass qtbase's QML directory to qmlimportscanner if it's empty
     ./skip-missing-qml-directory.patch
 
-    # backport crash fix
-    (fetchpatch {
-      url = "https://github.com/qt/qtbase/commit/1466f88633b2c29a6159a0c2eacd0c0d6601aa5e.diff";
-      hash = "sha256-ubDAXF47SYagRAJ5SYyBxXl2PiHjAZo3xlYPDz1jRYM=";
-    })
     # another crash fix
     (fetchpatch {
       url = "https://github.com/qt/qtbase/commit/515cbbacfba9f4259c9c3b0714a31222c2b4c879.diff";
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 786229c5651b..2f19e06a67fa 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -43,6 +43,12 @@ qtModule {
       hash = "sha256-ESy35OlmsvI4yFQ/rFT8oelOUBCwCmlcbQJvwcTrCig=";
       revert = true;
     })
+
+    # backport fix recommended by KDE
+    (fetchpatch {
+      url = "https://github.com/qt/qtdeclarative/commit/8a2c82be6ad90e3f2a0760d8bab1e3a8cdb2473a.diff";
+      hash = "sha256-3KbyoQPAiRyCwGnwwYV3y0yz2i6UAJcX70EPsXV0ZZM=";
+    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index effea1d03ab4..c70d2cbd1f88 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.11.0";
+  version = "6.11.1";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-7X+HWAftWHn40RPFQD3/f+bp00LQk8Vsb871WfxdZSE=";
+    hash = "sha256-GWaF4iCPtATL1mJkPHVY0rom8R2FMNWGahE3KWBlfV8=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 73067dc5fd5c..93c206858d18 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,339 +4,339 @@
 
 {
   qt3d = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qt3d-everywhere-src-6.11.0.tar.xz";
-      sha256 = "086xpissihbil51ryl83dlcpkpv3pp3ryj0712x9k9z6756j7ks0";
-      name = "qt3d-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt3d-everywhere-src-6.11.1.tar.xz";
+      sha256 = "01q11bs7vjz1s5wdrdjq904dgl2m6l7r8d3vd2kyf7lx0j78qvd6";
+      name = "qt3d-everywhere-src-6.11.1.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qt5compat-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0gn6sj136y8yl1c00nbm81rmhws0mgx35ny7llx74j97ddj58ag6";
-      name = "qt5compat-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt5compat-everywhere-src-6.11.1.tar.xz";
+      sha256 = "06qndy534rzabxk9yq07dsl8fj1vd72lmck11r5xbajil3d9zjyg";
+      name = "qt5compat-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtactiveqt-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1kbqa0gx41s097281g4zym9jmjs2ffc75p3rgkbs6bvnlrvl0h89";
-      name = "qtactiveqt-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtactiveqt-everywhere-src-6.11.1.tar.xz";
+      sha256 = "05hcnhxkajry4ha7ykmqr83p16qjipspwxid8l2rxgz80wy6aadv";
+      name = "qtactiveqt-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtbase = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtbase-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0pkmrd8ypw1v21cx0890gc6z4v0xr5qip2jnr56r2kc6g5cxh6i3";
-      name = "qtbase-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtbase-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1b616gr7k8byfr2ns4vczs4kj3sznhlrlw9inpb3m8la48qllnfr";
+      name = "qtbase-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtcanvaspainter = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtcanvaspainter-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1gmgzmh81wrnj81xsmilqwhc1wv7j2avg91mww8jlrv5rplzynjl";
-      name = "qtcanvaspainter-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1l08zp68q3wcr9v5hh82kw6jqvc1wmnrjn7h9959psx520dwcdly";
+      name = "qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtcharts-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1dcldlw24qd9swynxcdsxnk8haiv442wx323j7qgfwjp13a9nh5c";
-      name = "qtcharts-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcharts-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0p2icmrwb6am7x2kgk9pnpa8ypi7jiscyaawgi0x31iaihqyvqrz";
+      name = "qtcharts-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtconnectivity-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0fhrqqz58h3smkksfgnax73bmsiz7q9a1w9vhwd83vs9r0jc3w60";
-      name = "qtconnectivity-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtconnectivity-everywhere-src-6.11.1.tar.xz";
+      sha256 = "14g5h0wixqy981cnn5f8gkjbji804f18gfjkzbanxd0lljg2h191";
+      name = "qtconnectivity-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtdatavis3d-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1jr3bkvp4wj1jdafc64ziq4raxbya6jk6s0d4mq0w2kr7zpqrggf";
-      name = "qtdatavis3d-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdatavis3d-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1b4kcqfq5q79lm70f08qiksxl36laa9dgx9ladjk2xwl1af7n6hy";
+      name = "qtdatavis3d-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtdeclarative-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1sgxxmg49flana7mylyz4c5mf5hr00kzl8nkwwj87pqx8dlybv2f";
-      name = "qtdeclarative-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdeclarative-everywhere-src-6.11.1.tar.xz";
+      sha256 = "193ar0fcfzjjr7mi8i2622vip95qrr3qry949d9lyc5hf3v71rjj";
+      name = "qtdeclarative-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtdoc-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1wwl2vr1qs2lqmz45iqpkzkxqp97g0yzfmz0kb5wpi8sys7c07bx";
-      name = "qtdoc-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdoc-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1hd5z6prx2sbr3wxzkynrn2iyjllvkids505l2xg3p272j4b5306";
+      name = "qtdoc-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtgraphs-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0nxifvs5042pzyd5syhgpmxzsq07fhpbbm57ckwzsn55q14cnvyz";
-      name = "qtgraphs-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgraphs-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0qh43qxqg4biyrrsd78nmi4dm3dnbswa95cq8db2k3lans517cc4";
+      name = "qtgraphs-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtgrpc-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0yd8jjxigaynv386f3cs1i743nm7yngciw346xqfil3chd8wpvcx";
-      name = "qtgrpc-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgrpc-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0l52w91hd2crq6zyh5a8arv07yixnwcr2pya74bxpk2hqpq08ys3";
+      name = "qtgrpc-everywhere-src-6.11.1.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qthttpserver-everywhere-src-6.11.0.tar.xz";
-      sha256 = "16wqglm8ws63qs7i769xy94bygwbhkz7hjfw27hnps7d4yirb41b";
-      name = "qthttpserver-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qthttpserver-everywhere-src-6.11.1.tar.xz";
+      sha256 = "01p7li9fvwnz2shx3d9wj9nnnnipya2q0whchyvgjqb8yzy71gq4";
+      name = "qthttpserver-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtimageformats-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1j0cjj7gxjbprszw349janl3zk38rkby1bmxil329zp2qlmb1bfk";
-      name = "qtimageformats-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtimageformats-everywhere-src-6.11.1.tar.xz";
+      sha256 = "04y4pa5krrpyiqn039d6m8bzcxj6pa1m850rz3bmw5xc8ml6rgxj";
+      name = "qtimageformats-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtlanguageserver-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1gq5yjvk6iyg606pgpxkb136qlz9hpb7ngll81nhiyb1ym1y9j0v";
-      name = "qtlanguageserver-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlanguageserver-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1vwavpi8swgs88pfjfddnb9cmsb4k1sjcgywp2rsnm6ay8vqa02h";
+      name = "qtlanguageserver-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtlocation-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1vxb6n8xf98zcg2bw29gsaqa74sg6jn9ilzs8c5b9q79i9m3if49";
-      name = "qtlocation-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlocation-everywhere-src-6.11.1.tar.xz";
+      sha256 = "06z4hbiqki5chhmph131s71czyrjpnjvy3rxb4560vwy55vwx49p";
+      name = "qtlocation-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtlottie-everywhere-src-6.11.0.tar.xz";
-      sha256 = "02ndplkk4bq01b0fh9l2ykw09v0k5nbsayrs9wcjwrdwg5law8rg";
-      name = "qtlottie-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlottie-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0y969gp64imwh49d5zbnw0wi2yva9fsp6qn58617rs9kvkdzml70";
+      name = "qtlottie-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtmultimedia-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0h30l8zflkla7rcshgs0jfjbjwvq9rqx0wq83f6vd0x9lz0cmi4h";
-      name = "qtmultimedia-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtmultimedia-everywhere-src-6.11.1.tar.xz";
+      sha256 = "02lvq1jk6m67m6z0w7vdzxhzmi441j8avvp79mfclfpfvm98w3rr";
+      name = "qtmultimedia-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtnetworkauth-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1mqly8had79f54dlygh42jr0c0jfiv4j4w2rbr0s7qx9nk9ig342";
-      name = "qtnetworkauth-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtnetworkauth-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0gan2qjv97d1387jqaiis2gigm6lz5jbk1k10x13w0yc5kr5n7cz";
+      name = "qtnetworkauth-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtopenapi = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtopenapi-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1h2pcq6i72yic0r7ns36vj678d1xqy291jamqd6b6jkjddmj1hlg";
-      name = "qtopenapi-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtopenapi-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0nzl95w5pbfd6mfb6rzv6arz09pcm6siz1n07pgm9rrdr6z083a4";
+      name = "qtopenapi-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtpositioning-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1scnnz65qyfg0nl9vjkqcss8xsw3yf91w71d9p1kwlfybscd07yn";
-      name = "qtpositioning-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtpositioning-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1xbq1xjjbhb41lfp9mli8a5rgqf5pniswv0161v6wa5f04cbkrnm";
+      name = "qtpositioning-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquick3d-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1549gdb3yxj1bpl54kgnkkhzjx0zxqi71ssp4rj6qnz56fxh085l";
-      name = "qtquick3d-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3d-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0vs5bcz62r32gin0g4lb6wdmqrv0ypzar1s9wsza98la7zg8asy7";
+      name = "qtquick3d-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquick3dphysics-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0dcx9913xss435cijx5bzckvsn66qfi6c39rx0gyv9iiys76qym5";
-      name = "qtquick3dphysics-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1bvrmjb6m0ynq00ybdghvkbmwm237vff23ng8n4njysf05pns26i";
+      name = "qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquickeffectmaker-everywhere-src-6.11.0.tar.xz";
-      sha256 = "05fpv497rmx2lw7gx05sxyxjwx8gq8fbbnkzhnw73pk2xqzq20mc";
-      name = "qtquickeffectmaker-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0sqk8hkkdibv0ayxrvpcbgj3dcwfngpd6qjp2xm15pcbx1q3xrng";
+      name = "qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquicktimeline-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1micycw7m25gw0bgbfq7bnr7cg7qrjj2r69320rglc8lak6f3nq6";
-      name = "qtquicktimeline-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquicktimeline-everywhere-src-6.11.1.tar.xz";
+      sha256 = "09wcx83yxif8r4v81h2jfj3wlj60wnc9k4dsp7hlah4yzm1zclxg";
+      name = "qtquicktimeline-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtremoteobjects-everywhere-src-6.11.0.tar.xz";
-      sha256 = "15yykbaxqc6v2flgjvn92w7gwfvi820dg4cxkjxcfhpix2m21571";
-      name = "qtremoteobjects-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtremoteobjects-everywhere-src-6.11.1.tar.xz";
+      sha256 = "06hiiyjpcgn8dp9jmgxj30nlrw73rqb869f0m63scccmqsarhqj0";
+      name = "qtremoteobjects-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtscxml-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1rylchpvzldy7hhr3icr85w8m4hf7wch17yqh368yrn3q19klf3c";
-      name = "qtscxml-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtscxml-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0gr0j09isxgii3aivfvr35x40d9n0kj0g2icc7g7bzniwm2m4jcf";
+      name = "qtscxml-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtsensors-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1iy33w7gjp06xi4342si979q9w84cvbbk90kxmk2gx69icjjja21";
-      name = "qtsensors-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsensors-everywhere-src-6.11.1.tar.xz";
+      sha256 = "13ygry3lybkgci6gkrd7k081l01icavzkiyy4g82drbvv9i70q93";
+      name = "qtsensors-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtserialbus-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1qfs9zqvz3hf16w8gg6nlwxcv6sz72546pds02dabhkcw47nqvmh";
-      name = "qtserialbus-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialbus-everywhere-src-6.11.1.tar.xz";
+      sha256 = "02pj4jnxc4afl5ymv7w8asggpg0hdj3dbnwwcqd305b8il69qv64";
+      name = "qtserialbus-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtserialport-everywhere-src-6.11.0.tar.xz";
-      sha256 = "111pmva70mcffhq09q2h1gcr03fivs9j2ywx4ib00pbyxfvr4ii6";
-      name = "qtserialport-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialport-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0x1r5l3kx7riprf0b2api0bcg0z755fq9vbgmx7px6pxiy4imwws";
+      name = "qtserialport-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtshadertools-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0jp1sb9pl7y821awln7rpk0hz7d5ipwnkqhy51caich9i2pb2g74";
-      name = "qtshadertools-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtshadertools-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1z42r414jid12jmhm1yf5kw44j886w01igav0kggkg13kcphax90";
+      name = "qtshadertools-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtspeech-everywhere-src-6.11.0.tar.xz";
-      sha256 = "08fv8v6rvcv0pa6r52kr2na2rcpjr3yk556ksinnh6aslv8qbid9";
-      name = "qtspeech-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtspeech-everywhere-src-6.11.1.tar.xz";
+      sha256 = "051z4yf22hkqhy3pkgxq8s77x06k4cd70i9jcmd8f99004cc6df0";
+      name = "qtspeech-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtsvg-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1rih59jsn0wq12gq5gbs1cz9by27x2x4wjpd0ya7s207pr9xda6z";
-      name = "qtsvg-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsvg-everywhere-src-6.11.1.tar.xz";
+      sha256 = "154adaicyy5wyz6yc95g3lm4iw9v2zdsd7l5qp107gr490pz0g3z";
+      name = "qtsvg-everywhere-src-6.11.1.tar.xz";
     };
   };
   qttasktree = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qttasktree-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0kxkm3qvzw5i5x2ads6skpz8z6shbn2msznmr614yvsdgiga4yjr";
-      name = "qttasktree-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttasktree-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1mjdwy3i24ggn2g82z5pg3grzhnaxmq7nmvdc7ba8dsdixzvjam2";
+      name = "qttasktree-everywhere-src-6.11.1.tar.xz";
     };
   };
   qttools = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qttools-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0xpwv483zrw3jkajhv9sbr7bm95qahxg770vn1jqk10hg8yrkcfg";
-      name = "qttools-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttools-everywhere-src-6.11.1.tar.xz";
+      sha256 = "03gmr9zpf0raqcvqk2cpw9lblw907hsl5cb5c2fgm4wwcxd86qcf";
+      name = "qttools-everywhere-src-6.11.1.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qttranslations-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0mpy3y76n1jw2prhad9rqyn48miqlmqg3581jgzr4s1iwhpqpx2l";
-      name = "qttranslations-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttranslations-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0xsnxhiqc3ybwvyn1jbhdf1sjmcf7v4mma6w9sxwg535420jrh1p";
+      name = "qttranslations-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtvirtualkeyboard-everywhere-src-6.11.0.tar.xz";
-      sha256 = "11p6m1s7r7q2y6a2ak5lyzfd2907s2skfa630snf64x32cblp2nq";
-      name = "qtvirtualkeyboard-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
+      sha256 = "073y02qmpwxxdqc4pkm6k9frghsjg1zppg2hip5b4hv269xrdim1";
+      name = "qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwayland-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0dsdv1d4p1wf0sqd26cmj486bvwlprmqzmjddsw24agrc3kyc477";
-      name = "qtwayland-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwayland-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1cyr5frhglp2krxvpnqk9q426rgp6nr34ngnxpa42m7p0ajqly4m";
+      name = "qtwayland-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebchannel-everywhere-src-6.11.0.tar.xz";
-      sha256 = "097vm6pxh18bil9ld9cxg50v861nyhaha4f6bjfjqph1icx18ip9";
-      name = "qtwebchannel-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebchannel-everywhere-src-6.11.1.tar.xz";
+      sha256 = "10ld2nh6gd1v2ssbgqlf6w0lsjlqkjdfwqv85mn5krnnf45vbyv9";
+      name = "qtwebchannel-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebengine-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0dk72k92zp19jkph1vl88l2dyrh105v6cycsxln1anfxnb423fb3";
-      name = "qtwebengine-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebengine-everywhere-src-6.11.1.tar.xz";
+      sha256 = "10vhcvw8j60n0mf38bi3fjcx5v1i0cbfyn4wbqhzqn61qv66d737";
+      name = "qtwebengine-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebsockets-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0cnh67ncfh0gvpqfiqhr0cpmswq9zysza130axlmh69mzg8i17sn";
-      name = "qtwebsockets-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebsockets-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1gvgci383dfm4sljqlapdiva7jhks1i2z2ayck0wbj1436hklgi4";
+      name = "qtwebsockets-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebview-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1cy4x331h0f4d5l8c18xrvdq6hwz7r16qd1xhr8gdm8j9bcsw3nb";
-      name = "qtwebview-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebview-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0g8k4xs7b0s474x00ds4i8q9b164icdgrdg8ngln10nmf3pwhqld";
+      name = "qtwebview-everywhere-src-6.11.1.tar.xz";
     };
   };
 }

From 6f40c4f10c3e1166f2e9ee552f5b8f28c967b763 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 23 May 2026 12:22:11 +0000
Subject: [PATCH 0222/1209] tree-sitter: 0.26.8 -> 0.26.9

---
 pkgs/by-name/tr/tree-sitter/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index 1ae410255fc0..69b45f6cc250 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -112,17 +112,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tree-sitter";
-  version = "0.26.8";
+  version = "0.26.9";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fcFEfoALrbpBD6rWogxJ7FNVlvDQgswoX9ylRgko+8Q=";
+    hash = "sha256-ohVhW4AEKX5VspqBePtfxbJGkjmJnNkf5ntU3RUxF+0=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-9FeWnWWPUWmMF15Psmul8GxGv2JceHWc2WZPmOr81gw=";
+  cargoHash = "sha256-3egxdusYHQs8PadxGZ44+VWtlTcGBrcqlWMUyUzpWnY=";
 
   buildInputs = [
     installShellFiles

From 9d229c780ed441cda7dcf943718cc8aa3aa53492 Mon Sep 17 00:00:00 2001
From: Lisanna Dettwyler <lisanna.dettwyler@gmail.com>
Date: Fri, 6 Mar 2026 11:06:41 -0500
Subject: [PATCH 0223/1209] rsync: skip chgrp test

This test fails when built in a chroot store.

Signed-off-by: Lisanna Dettwyler <lisanna.dettwyler@gmail.com>
---
 pkgs/applications/networking/sync/rsync/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index ddfb056d101c..ab771e3c5057 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -80,6 +80,11 @@ stdenv.mkDerivation rec {
 
   passthru.tests = { inherit (nixosTests) rsyncd; };
 
+  # Test fails when built in a chroot store
+  preCheck = ''
+    rm testsuite/chgrp.test
+  '';
+
   doCheck = true;
 
   __darwinAllowLocalNetworking = true;

From 11aa871c2290aa6407227e255da0820a575d2109 Mon Sep 17 00:00:00 2001
From: FlashOnFire_ <flashonfire.dev@gmail.com>
Date: Sun, 12 Apr 2026 19:25:20 +0200
Subject: [PATCH 0224/1209] python3Packages.mypy: fix cross compilation

---
 pkgs/development/python-modules/mypy/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index bbbbb99d5e96..9040eab9ebf8 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -13,8 +13,10 @@
   types-psutil,
   types-setuptools,
 
-  # propagates
+  # nativeBuildInputs + propagates
   librt,
+
+  # propagates
   mypy-extensions,
   tomli,
   typing-extensions,
@@ -50,6 +52,10 @@ buildPythonPackage rec {
     rev-prefix = "v";
   };
 
+  nativeBuildInputs = [
+    librt
+  ];
+
   build-system = [
     mypy-extensions
     pathspec

From 39d6b815825efe757e1616fb80190a4e66c85bdd Mon Sep 17 00:00:00 2001
From: Alex James <git@alextjam.es>
Date: Sat, 23 May 2026 16:24:39 -0700
Subject: [PATCH 0225/1209] bmake: restore missing bsd.*.mk symlinks on Darwin

bmake's installPhase was updated in #462500 to manually install the
binaries and share Makefiles for bmake as the boot-strap script invokes
bmake (breaking cross builds). This caused the darwin.locale build to
regress as bmake could no longer find bsd.prog.mk [1]. The install-sh
script (which is invoked by the install-mk target used by the boot-strap
script) creates bsd.-prefixed symlinks to the Makefiles under share on
BSD systems, including Darwin. Update bmake's installPhase to invoke
install-mk to ensure that the symlinks are created. install-mk does not
invoke bmake so this should not break cross builds.

[1]: https://github.com/apple-oss-distributions/adv_cmds/blob/2bdd0b49a2d51a3249eecdb04277da034f54eca6/locale/BSDmakefile#L9
---
 pkgs/by-name/bm/bmake/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bm/bmake/package.nix b/pkgs/by-name/bm/bmake/package.nix
index 3a1185122339..148beb122af7 100644
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -96,8 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
     # `boot-strap op=install` runs the built bmake, which breaks cross builds.
     install -Dm755 bmake $out/bin/bmake
     install -Dm644 bmake.1 $man/share/man/man1/bmake.1
-    mkdir -p $out/share
-    cp -r mk $out/share
+    install -Dm755 -d $out/share/mk
+    sh mk/install-mk -v -m 444 $out/share/mk
 
     runHook postInstall
   '';

From bb9fb0a2eb6b9481c8d48597f9da1c9fc2022459 Mon Sep 17 00:00:00 2001
From: Alex James <git@alextjam.es>
Date: Sat, 23 May 2026 21:57:42 -0700
Subject: [PATCH 0226/1209] bmake: enable __structuredAttrs

---
 pkgs/by-name/bm/bmake/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/bm/bmake/package.nix b/pkgs/by-name/bm/bmake/package.nix
index 148beb122af7..5d8675628527 100644
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -67,6 +67,8 @@ stdenv.mkDerivation (finalAttrs: {
     ) "export"
   );
 
+  __structuredAttrs = true;
+
   strictDeps = true;
 
   doCheck = true;

From 5f3abe53c32f4bf6aa20e4bfa582566d21d5e085 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 08:46:17 -0700
Subject: [PATCH 0227/1209] python3Packages.urllib3: 2.6.3 -> 2.7.0

Diff: https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0

Changelog: https://github.com/urllib3/urllib3/blob/2.7.0/CHANGES.rst
---
 .../python-modules/urllib3/default.nix          | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 047c47c2dcbe..e9e5ce9eab21 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   isPyPy,
 
   # build-system
@@ -31,12 +31,14 @@
 let
   self = buildPythonPackage rec {
     pname = "urllib3";
-    version = "2.6.3";
+    version = "2.7.0";
     pyproject = true;
 
-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-G2K2iElEpX2+MhUJq5T9TTswcHXgwurpkaxx7hWtOO0=";
+    src = fetchFromGitHub {
+      owner = "urllib3";
+      repo = "urllib3";
+      tag = version;
+      hash = "sha256-iN59MS5gKgDxe2v4ILrZ/1y7wV4yB1tFs4ATKppYAAk=";
     };
 
     build-system = [
@@ -44,11 +46,6 @@ let
       hatch-vcs
     ];
 
-    postPatch = ''
-      substituteInPlace pyproject.toml \
-        --replace-fail ', "setuptools-scm>=8,<10"' ""
-    '';
-
     optional-dependencies = {
       brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
       h2 = [ h2 ];

From b353c0a0f82604f8d0ae661c268594011039606c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 08:52:37 -0700
Subject: [PATCH 0228/1209] python3Packages.urllib3: use finalAttrs

---
 .../python-modules/urllib3/default.nix        | 145 +++++++++---------
 1 file changed, 71 insertions(+), 74 deletions(-)

diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index e9e5ce9eab21..3ff4ea706250 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -28,79 +28,76 @@
   trustme,
 }:
 
-let
-  self = buildPythonPackage rec {
-    pname = "urllib3";
-    version = "2.7.0";
-    pyproject = true;
+buildPythonPackage (finalAttrs: {
+  pname = "urllib3";
+  version = "2.7.0";
+  pyproject = true;
 
-    src = fetchFromGitHub {
-      owner = "urllib3";
-      repo = "urllib3";
-      tag = version;
-      hash = "sha256-iN59MS5gKgDxe2v4ILrZ/1y7wV4yB1tFs4ATKppYAAk=";
-    };
-
-    build-system = [
-      hatchling
-      hatch-vcs
-    ];
-
-    optional-dependencies = {
-      brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
-      h2 = [ h2 ];
-      socks = [ pysocks ];
-      zstd = [ backports-zstd ];
-    };
-
-    nativeCheckInputs = [
-      httpx
-      pyopenssl
-      pytest-socket
-      pytest-timeout
-      pytestCheckHook
-      quart
-      quart-trio
-      tornado
-      trio
-      trustme
-    ]
-    ++ lib.concatAttrValues optional-dependencies;
-
-    disabledTestMarks = [
-      "requires_network"
-    ];
-
-    # Tests in urllib3 are mostly timeout-based instead of event-based and
-    # are therefore inherently flaky. On your own machine, the tests will
-    # typically build fine, but on a loaded cluster such as Hydra random
-    # timeouts will occur.
-    #
-    # The urllib3 test suite has two different timeouts in their test suite
-    # (see `test/__init__.py`):
-    # - SHORT_TIMEOUT
-    # - LONG_TIMEOUT
-    # When CI is in the env, LONG_TIMEOUT will be significantly increased.
-    # Still, failures can occur and for that reason tests are disabled.
-    doCheck = false;
-
-    passthru.tests.pytest = self.overridePythonAttrs (_: {
-      doCheck = true;
-    });
-
-    preCheck = ''
-      export CI # Increases LONG_TIMEOUT
-    '';
-
-    pythonImportsCheck = [ "urllib3" ];
-
-    meta = {
-      description = "Powerful, user-friendly HTTP client for Python";
-      homepage = "https://github.com/urllib3/urllib3";
-      changelog = "https://github.com/urllib3/urllib3/blob/${version}/CHANGES.rst";
-      license = lib.licenses.mit;
-      maintainers = with lib.maintainers; [ fab ];
-    };
+  src = fetchFromGitHub {
+    owner = "urllib3";
+    repo = "urllib3";
+    tag = finalAttrs.version;
+    hash = "sha256-iN59MS5gKgDxe2v4ILrZ/1y7wV4yB1tFs4ATKppYAAk=";
   };
-in
-self
+
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  optional-dependencies = {
+    brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
+    h2 = [ h2 ];
+    socks = [ pysocks ];
+    zstd = [ backports-zstd ];
+  };
+
+  nativeCheckInputs = [
+    httpx
+    pyopenssl
+    pytest-socket
+    pytest-timeout
+    pytestCheckHook
+    quart
+    quart-trio
+    tornado
+    trio
+    trustme
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
+
+  disabledTestMarks = [
+    "requires_network"
+  ];
+
+  # Tests in urllib3 are mostly timeout-based instead of event-based and
+  # are therefore inherently flaky. On your own machine, the tests will
+  # typically build fine, but on a loaded cluster such as Hydra random
+  # timeouts will occur.
+  #
+  # The urllib3 test suite has two different timeouts in their test suite
+  # (see `test/__init__.py`):
+  # - SHORT_TIMEOUT
+  # - LONG_TIMEOUT
+  # When CI is in the env, LONG_TIMEOUT will be significantly increased.
+  # Still, failures can occur and for that reason tests are disabled.
+  doCheck = false;
+
+  passthru.tests.pytest = finalAttrs.finalPackage.overrideAttrs (_: {
+    doInstallCheck = true;
+  });
+
+  preCheck = ''
+    export CI # Increases LONG_TIMEOUT
+  '';
+
+  pythonImportsCheck = [ "urllib3" ];
+
+  meta = {
+    description = "Powerful, user-friendly HTTP client for Python";
+    homepage = "https://github.com/urllib3/urllib3";
+    changelog = "https://github.com/urllib3/urllib3/blob/${finalAttrs.src.tag}/CHANGES.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})

From c146bd0855981393886d773bf056bc0039bcd64b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 09:58:22 -0700
Subject: [PATCH 0229/1209] tunnelgraf: mark insecure

---
 pkgs/by-name/tu/tunnelgraf/package.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/tu/tunnelgraf/package.nix b/pkgs/by-name/tu/tunnelgraf/package.nix
index 3f08a1565e1f..82b297401714 100644
--- a/pkgs/by-name/tu/tunnelgraf/package.nix
+++ b/pkgs/by-name/tu/tunnelgraf/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchPypi,
   python3,
 }:
 
@@ -12,12 +11,18 @@ let
       # Doesn't work with latest paramiko
       paramiko = super.paramiko.overridePythonAttrs (oldAttrs: rec {
         version = "3.4.0";
-        src = fetchPypi {
-          pname = "paramiko";
-          inherit version;
-          hash = "sha256-qsCPJqMdxN/9koIVJ9FoLZnVL572hRloEUqHKPPCdNM=";
+        src = fetchFromGitHub {
+          owner = "paramiko";
+          repo = "paramiko";
+          tag = version;
+          hash = "sha256-V0s9IoRmqXvzYQzzBsWmovYWwXnNC0x1phyiyjbejGA=";
         };
         doCheck = false;
+        meta = oldAttrs.meta // {
+          knownVulnerabilities = [
+            "CVE-2026-44405"
+          ];
+        };
       });
     };
   };

From 30a78f292564a1d67ba2eff1701bc268d21bbb1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 09:18:56 -0700
Subject: [PATCH 0230/1209] python3Packages.paramiko: 4.0.0 -> 5.0.0

Diff: https://github.com/paramiko/paramiko/compare/4.0.0...5.0.0

Changelog: https://github.com/paramiko/paramiko/blob/5.0.0/sites/www/changelog.rst
---
 .../python-modules/paramiko/default.nix       | 29 ++++++-------------
 1 file changed, 9 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index 6350ba2e5a8a..cf24d7e6240f 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -3,12 +3,9 @@
   bcrypt,
   buildPythonPackage,
   cryptography,
-  fetchPypi,
-  gssapi,
+  fetchFromGitHub,
   icecream,
   invoke,
-  mock,
-  pyasn1,
   pynacl,
   pytest-relaxed,
   pytestCheckHook,
@@ -17,12 +14,14 @@
 
 buildPythonPackage rec {
   pname = "paramiko";
-  version = "4.0.0";
+  version = "5.0.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-aiXwezgMycmojSuSCtNxZ6xGZ/jZiGzOvY+Q9lS11p8=";
+  src = fetchFromGitHub {
+    owner = "paramiko";
+    repo = "paramiko";
+    tag = version;
+    hash = "sha256-zzbM2oGaZ5jkIN7LyDGuMAKSpSmUwpBbup6MBVdTaXA=";
   };
 
   build-system = [ setuptools ];
@@ -34,21 +33,11 @@ buildPythonPackage rec {
     pynacl
   ];
 
-  optional-dependencies = {
-    gssapi = [
-      pyasn1
-      gssapi
-    ];
-    ed25519 = [ ];
-  };
-
   nativeCheckInputs = [
     icecream
-    mock
     pytestCheckHook
     pytest-relaxed
-  ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ];
 
   pythonImportsCheck = [ "paramiko" ];
 
@@ -56,7 +45,7 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/paramiko/paramiko/";
-    changelog = "https://github.com/paramiko/paramiko/blob/${version}/sites/www/changelog.rst";
+    changelog = "https://github.com/paramiko/paramiko/blob/${src.tag}/sites/www/changelog.rst";
     description = "Native Python SSHv2 protocol library";
     license = lib.licenses.lgpl21Plus;
     longDescription = ''

From a8643c627799de71d9f10605370b8ed3a478a8b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 09:38:36 -0700
Subject: [PATCH 0231/1209] python3Packages.paramiko: use finalAttrs

---
 pkgs/development/python-modules/paramiko/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index cf24d7e6240f..5e99e2ce79d5 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -12,7 +12,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "paramiko";
   version = "5.0.0";
   pyproject = true;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "paramiko";
     repo = "paramiko";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-zzbM2oGaZ5jkIN7LyDGuMAKSpSmUwpBbup6MBVdTaXA=";
   };
 
@@ -45,7 +45,7 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/paramiko/paramiko/";
-    changelog = "https://github.com/paramiko/paramiko/blob/${src.tag}/sites/www/changelog.rst";
+    changelog = "https://github.com/paramiko/paramiko/blob/${finalAttrs.src.tag}/sites/www/changelog.rst";
     description = "Native Python SSHv2 protocol library";
     license = lib.licenses.lgpl21Plus;
     longDescription = ''
@@ -55,4 +55,4 @@ buildPythonPackage rec {
       supported. SFTP client and server mode are both supported too.
     '';
   };
-}
+})

From 9305bbec01cdd5c5b08f076b0fe136b267596786 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 11:14:01 -0700
Subject: [PATCH 0232/1209] python3Packages.twisted: 25.5.0 -> 26.4.0

Changelog: https://github.com/twisted/twisted/blob/twisted-26.4.0/NEWS.rst
---
 .../python-modules/twisted/default.nix        | 29 +++++--------------
 1 file changed, 7 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index a886c3576a41..f96bed372e06 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -4,8 +4,7 @@
   buildPythonPackage,
   pythonAtLeast,
   pythonOlder,
-  fetchPypi,
-  fetchpatch,
+  fetchFromGitHub,
   python,
 
   # build-system
@@ -56,30 +55,16 @@
 
 buildPythonPackage rec {
   pname = "twisted";
-  version = "25.5.0";
+  version = "26.4.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    extension = "tar.gz";
-    hash = "sha256-HesnI1jLa+Hj6PxvnIs2946w+nwiM9Lb4R7G/uBOoxY=";
+  src = fetchFromGitHub {
+    owner = "twisted";
+    repo = "twisted";
+    tag = "twisted-${version}";
+    hash = "sha256-D6vDa+8qwjryKnElPBZgXCNokMX2l3i2bMdtk4FhEp4=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/twisted/twisted/pull/12508
-      url = "https://github.com/twisted/twisted/commit/ef6160aa2595adfba0c71da6db65b7a7252f23e9.patch";
-      hash = "sha256-zHkEWT0lvWf86RlkzU5Wx6R5ear04cfpxB7wjgdpw5c=";
-    })
-    # https://github.com/twisted/twisted/pull/12511
-    ./python314-urljoin-compat.patch
-    (fetchpatch {
-      # https://github.com/twisted/twisted/pull/12551
-      url = "https://github.com/twisted/twisted/commit/b1173fa307a9752eedd63890113eb610c3cca4a0.patch";
-      hash = "sha256-DWEygdo1b8uQOeFLy0/zcRNuuKJdSsF7cQM7RH04Puw=";
-    })
-  ];
-
   __darwinAllowLocalNetworking = true;
 
   build-system = [

From 3c5b8bbdbaea8e109f0194917257d9cfbc75aff3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 11:44:55 -0700
Subject: [PATCH 0233/1209] python3Packages.scrapy: 2.14.1 -> 2.16.0

Diff: https://github.com/scrapy/scrapy/compare/2.14.1...2.16.0

Changelog: https://github.com/scrapy/scrapy/raw/2.16.0/docs/news.rst
---
 pkgs/development/python-modules/scrapy/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index 0cacbda728d8..cceb55ded458 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -9,6 +9,7 @@
   fetchFromGitHub,
   glibcLocales,
   hatchling,
+  httpx,
   installShellFiles,
   itemadapter,
   itemloaders,
@@ -40,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "scrapy";
-  version = "2.14.1";
+  version = "2.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scrapy";
     repo = "scrapy";
     tag = version;
-    hash = "sha256-KDci1Z5TZ+3svotYXkEG1s+bPWtxzIfQQwOgvI0k8w0=";
+    hash = "sha256-s72COXzDuTtRNGenZEZG8QCeq+9LBu6fuT5NOjpVYaY=";
   };
 
   pythonRelaxDeps = [
@@ -86,6 +87,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     botocore
     glibcLocales
+    httpx
     jmespath
     pexpect
     pytest-asyncio
@@ -106,7 +108,6 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    "tests/test_proxy_connect.py"
     "tests/test_utils_display.py"
     "tests/test_command_check.py"
 
@@ -133,9 +134,12 @@ buildPythonPackage rec {
     "AnonymousFTPTestCase"
     "FTPFeedStorageTest"
     "FeedExportTest"
+    "TestRealWebsite"
     "test_custom_asyncio_loop_enabled_true"
     "test_custom_loop_asyncio"
     "test_custom_loop_asyncio_deferred_signal"
+    "test_pos_string"
+    "test_key_resp_or_url"
     # "FileFeedStoragePreFeedOptionsTest" # https://github.com/scrapy/scrapy/issues/5157
     "test_persist"
     "test_timeout_download_from_spider_nodata_rcvd"

From 948ae444f28653e219f6be6a01a1f376e7dc20a8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 20 May 2026 02:59:50 +0000
Subject: [PATCH 0234/1209] mdbook: 0.5.2 -> 0.5.3

---
 pkgs/by-name/md/mdbook/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/md/mdbook/package.nix b/pkgs/by-name/md/mdbook/package.nix
index 66c14abfb130..fa23ac200d96 100644
--- a/pkgs/by-name/md/mdbook/package.nix
+++ b/pkgs/by-name/md/mdbook/package.nix
@@ -8,7 +8,7 @@
   installShellFiles,
 }:
 let
-  version = "0.5.2";
+  version = "0.5.3";
 in
 rustPlatform.buildRustPackage rec {
   inherit version;
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
     owner = "rust-lang";
     repo = "mdBook";
     tag = "v${version}";
-    hash = "sha256-gyjD47ZR9o2lIxipzesyJ6mxb9J9W+WS77TNWhKHP6U=";
+    hash = "sha256-RMJQn58hshBGQSpu30NdUOb3Prywn6NfhauSzFZ35xQ=";
   };
 
-  cargoHash = "sha256-230KljOUSrDy8QCQki7jvJvdAsjVlUEjKDNVyTF4tWs=";
+  cargoHash = "sha256-LlImOjTQjMQURQ81Gn73v+DEHXqyyiz39K9T+MrE7S0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From a17a97fe7e53c20617fbec8112db78bf75badb2b Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Sun, 8 Mar 2026 21:43:08 +0100
Subject: [PATCH 0235/1209] python3Packages.opentelemetry-api: 1.34.0 -> 1.40.0

---
 pkgs/development/python-modules/opentelemetry-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-api/default.nix b/pkgs/development/python-modules/opentelemetry-api/default.nix
index eb4afad2436f..f5a482ee5155 100644
--- a/pkgs/development/python-modules/opentelemetry-api/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-api/default.nix
@@ -14,7 +14,7 @@
 let
   self = buildPythonPackage rec {
     pname = "opentelemetry-api";
-    version = "1.34.0";
+    version = "1.40.0";
     pyproject = true;
 
     # to avoid breakage, every package in opentelemetry-python must inherit this version, src, and meta
@@ -22,7 +22,7 @@ let
       owner = "open-telemetry";
       repo = "opentelemetry-python";
       tag = "v${version}";
-      hash = "sha256-fAXcS2VyDMk+UDW3ru5ZvwzXjydsY1uFcT2GvZuiGWw=";
+      hash = "sha256-1KVy9s+zjlB4w7E45PMCWRxPus24bgBmmM3k2R9d+Jg=";
     };
 
     sourceRoot = "${src.name}/opentelemetry-api";

From d40d2aaddf1821f005e4faf984400115563670fd Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Sun, 8 Mar 2026 21:43:35 +0100
Subject: [PATCH 0236/1209] python3Packages.opentelemetry-instrumentation:
 0.55b0 -> 0.61b0

---
 .../python-modules/opentelemetry-instrumentation/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
index 80c5e8536de1..5bceaef09814 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "opentelemetry-instrumentation";
-  version = "0.55b0";
+  version = "0.61b0";
   pyproject = true;
 
   # To avoid breakage, every package in opentelemetry-python-contrib must inherit this version, src, and meta
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "open-telemetry";
     repo = "opentelemetry-python-contrib";
     tag = "v${version}";
-    hash = "sha256-UM9ezCh3TVwyj257O0rvTCIgfrddobWcVIgJmBUj/Vo=";
+    hash = "sha256-DT13gcYPNYXBPnf622WsA16C+7sabJfOshDquHn06Ok=";
   };
 
   sourceRoot = "${src.name}/opentelemetry-instrumentation";

From a84547aa748905969c54c0b5a5a154f552d1eb09 Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Wed, 11 Mar 2026 20:57:00 +0100
Subject: [PATCH 0237/1209] 
 python3Packages.opentelemetry-instrumentation-requests: fix test fixtures

---
 .../default.nix                                       | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix
index e64aa913d50b..5adf35cc516f 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix
@@ -1,5 +1,6 @@
 {
   buildPythonPackage,
+  fetchpatch,
   requests,
   hatchling,
   opentelemetry-api,
@@ -18,6 +19,16 @@ buildPythonPackage {
 
   sourceRoot = "${opentelemetry-instrumentation.src.name}/instrumentation/opentelemetry-instrumentation-requests";
 
+  patches = [
+    # remove hardcoded requests version from fixtures
+    (fetchpatch {
+      url = "https://github.com/open-telemetry/opentelemetry-python-contrib/commit/69a94e0c3b25edfdc4abeb18a4d26f5b7532e7ba.patch";
+      stripLen = 2;
+      includes = [ "tests/test_requests_integration.py" ];
+      hash = "sha256-JGWJVHR6lAg8bG1fpfJ4BJbqipnVFRLV7i/bKwOmtPk=";
+    })
+  ];
+
   build-system = [ hatchling ];
 
   dependencies = [

From e708eaa2be3978abc319c810b2ed10cf09da028b Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Sun, 8 Mar 2026 21:16:08 +0100
Subject: [PATCH 0238/1209] 
 python3Packages.opentelemetry-semantic-conventions-ai: init at 0.4.15

---
 .../default.nix                               | 38 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix

diff --git a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
new file mode 100644
index 000000000000..623e6501660a
--- /dev/null
+++ b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  hatchling,
+  opentelemetry-sdk,
+  opentelemetry-semantic-conventions,
+}:
+let
+  version = "0.4.15";
+in
+buildPythonPackage {
+  pname = "opentelemetry-semantic-conventions-ai";
+  inherit version;
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "opentelemetry_semantic_conventions_ai";
+    inherit version;
+    hash = "sha256-Et4XLR4R0hxugrv1eMfopxNYmn/adq+e14VjJWSii4E=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    opentelemetry-sdk
+    opentelemetry-semantic-conventions
+  ];
+
+  pythonImportsCheck = [ "opentelemetry.semconv_ai" ];
+
+  meta = {
+    description = "Open-source observability for your GenAI or LLM application, based on OpenTelemetry";
+    homepage = "https://github.com/traceloop/openllmetry";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ lach ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1a18f0a5c195..311153d6940b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11949,6 +11949,10 @@ self: super: with self; {
     callPackage ../development/python-modules/opentelemetry-semantic-conventions
       { };
 
+  opentelemetry-semantic-conventions-ai =
+    callPackage ../development/python-modules/opentelemetry-semantic-conventions-ai
+      { };
+
   opentelemetry-test-utils = callPackage ../development/python-modules/opentelemetry-test-utils { };
 
   opentelemetry-util-http = callPackage ../development/python-modules/opentelemetry-util-http { };

From d2a5f7f0cafe93df429883d62a6365ec7f4db78c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 19:24:27 -0700
Subject: [PATCH 0239/1209] libadwaita: 1.9.0 -> 1.9.1

Diff: https://gitlab.gnome.org/GNOME/libadwaita/-/compare/1.9.0...1.9.1

Changelog: https://gitlab.gnome.org/GNOME/libadwaita/-/blob/1.9.1/NEWS
---
 pkgs/by-name/li/libadwaita/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libadwaita/package.nix b/pkgs/by-name/li/libadwaita/package.nix
index 0d1ed0da7e85..8f289c6e4977 100644
--- a/pkgs/by-name/li/libadwaita/package.nix
+++ b/pkgs/by-name/li/libadwaita/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.9.0";
+  version = "1.9.1";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-JAKP8CjLCKGZvHoB26ih/J3xAru4wiVf/ObG0L8r4pY=";
+    hash = "sha256-Oy3WcsymNbbmAacm5hEOrorI1wKXjSp063mh4jCJRAE=";
   };
 
   depsBuildBuild = [

From eb99a699438577d486d66e3d860c3ba67facbb1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 21:34:13 -0700
Subject: [PATCH 0240/1209] at-spi2-core: 2.60.1 -> 2.60.4

---
 pkgs/by-name/at/at-spi2-core/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/at/at-spi2-core/package.nix b/pkgs/by-name/at/at-spi2-core/package.nix
index dd5e8f9e4ce1..c20443184374 100644
--- a/pkgs/by-name/at/at-spi2-core/package.nix
+++ b/pkgs/by-name/at/at-spi2-core/package.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "at-spi2-core";
-  version = "2.60.1";
+  version = "2.60.4";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+ZuH48FnT1+8QXzJwdniYcDymqsFUK1jaYBQMdEvaFI=";
+    hash = "sha256-Gh9bqYBZF/QfxqpoI9z4h6KR1gekJ+LVr7a136ZQcMc=";
   };
 
   nativeBuildInputs = [

From 4bb8e4bdb522b174b3ce139cc5dd8f16a4f325c2 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 25 May 2026 13:20:03 +0200
Subject: [PATCH 0241/1209] valgrind.meta.mainProgram: init

---
 pkgs/by-name/va/valgrind/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index 8c3a2ca3db1e..bdef19531e54 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -111,6 +111,7 @@ stdenv.mkDerivation rec {
     '';
 
     license = lib.licenses.gpl3Plus;
+    mainProgram = "valgrind";
 
     platforms =
       with lib.platforms;

From 6e3f57e4db27a98f0d9e7de6f91f3040722333b7 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 25 May 2026 16:06:28 +0200
Subject: [PATCH 0242/1209] pgcopydb: 0.17 -> 0.17-unstable-2026-05-21

Update to latest commit from main, where a build failure with PostgreSQL
18 was recently fixed.

The last release is from 2024, so it's time.
---
 pkgs/by-name/pg/pgcopydb/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pg/pgcopydb/package.nix b/pkgs/by-name/pg/pgcopydb/package.nix
index 906bab8156dc..d55a72b2a7d3 100644
--- a/pkgs/by-name/pg/pgcopydb/package.nix
+++ b/pkgs/by-name/pg/pgcopydb/package.nix
@@ -17,13 +17,13 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "pgcopydb";
-  version = "0.17";
+  version = "0.17-unstable-2026-05-21";
 
   src = fetchFromGitHub {
     owner = "dimitri";
     repo = "pgcopydb";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-g5MC4F0BYgTimpJZDX+PepFLXv1QuH7XGlzV66xM11M=";
+    rev = "984269274ccdaf0d297ed82db635e6746be55b75";
+    hash = "sha256-qTtziRdsge4YtQTTfWQ5KD8SQn2HYnj3rDMcrbI56SY=";
   };
 
   nativeBuildInputs = [

From 6afef1c80a05389c7e96bc78c4341fd70fe18179 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 25 May 2026 16:09:58 +0200
Subject: [PATCH 0243/1209] pgcopydb: propagate postgresql's buildInputs

Some of the build inputs required here are required because this links
against internals of PostgreSQL. The latter might be configured with
different dependencies on different platforms and such, so it's easier
to just depend on postgresql's build inputs.

This fixes the build with PostgreSQL 18, which added libnuma as a new
dependency.
---
 pkgs/by-name/pg/pgcopydb/package.nix | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/pkgs/by-name/pg/pgcopydb/package.nix b/pkgs/by-name/pg/pgcopydb/package.nix
index d55a72b2a7d3..f9ba308e0b30 100644
--- a/pkgs/by-name/pg/pgcopydb/package.nix
+++ b/pkgs/by-name/pg/pgcopydb/package.nix
@@ -31,18 +31,11 @@ clangStdenv.mkDerivation (finalAttrs: {
     postgresql.pg_config
   ];
 
-  buildInputs = [
+  buildInputs = postgresql.buildInputs ++ [
     boehmgc
-    libkrb5
-    openssl
     postgresql
-    readline
     sqlite
-    zlib
     python3Packages.sphinxHook
-  ]
-  ++ lib.optionals clangStdenv.hostPlatform.isLinux [
-    pam
   ];
 
   hardeningDisable = [ "format" ];

From 9c5e58d0798fb7d328e984eafc0d819e46ad68b1 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 24 May 2026 23:38:29 +0200
Subject: [PATCH 0244/1209] postgresql: 17 -> 18

Now that 26.05 is branched off, we should bump PostgreSQL's default
version to v18.
---
 nixos/doc/manual/release-notes/rl-2611.section.md | 2 +-
 nixos/modules/services/databases/postgresql.nix   | 8 ++++++--
 pkgs/top-level/all-packages.nix                   | 4 ++--
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 05a52258d54e..23e99e6e2a97 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -4,7 +4,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 26.11`) is v18.
 
 ## New Modules {#sec-release-26.11-new-modules}
 
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 2040d2be5bb1..982aa566f47c 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -204,7 +204,9 @@ in
         type = types.package;
         example = literalExpression "pkgs.postgresql_15";
         defaultText = literalExpression ''
-          if versionAtLeast config.system.stateVersion "25.11" then
+          if versionAtLeast config.system.stateVersion "26.11" then
+            pkgs.postgresql_18
+          else if versionAtLeast config.system.stateVersion "25.11" then
             pkgs.postgresql_17
           else if versionAtLeast config.system.stateVersion "24.11" then
             pkgs.postgresql_16
@@ -657,7 +659,9 @@ in
           '';
         base =
           # XXX Don't forget to keep `defaultText` of `services.postgresql.package` up to date!
-          if versionAtLeast config.system.stateVersion "25.11" then
+          if versionAtLeast config.system.stateVersion "26.11" then
+            pkgs.postgresql_18
+          else if versionAtLeast config.system.stateVersion "25.11" then
             pkgs.postgresql_17
           else if versionAtLeast config.system.stateVersion "24.11" then
             pkgs.postgresql_16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bcb43e25305c..d4da6b8296f4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8096,8 +8096,8 @@ with pkgs;
     postgresql_17_jit
     postgresql_18_jit
     ;
-  postgresql = postgresql_17;
-  postgresql_jit = postgresql_17_jit;
+  postgresql = postgresql_18;
+  postgresql_jit = postgresql_18_jit;
   postgresqlPackages = recurseIntoAttrs postgresql.pkgs;
   postgresql14Packages = recurseIntoAttrs postgresql_14.pkgs;
   postgresql15Packages = recurseIntoAttrs postgresql_15.pkgs;

From 59a147780b55787b12d8436ce67b8d5b8e467a42 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Mon, 25 May 2026 16:49:30 +0200
Subject: [PATCH 0245/1209] tree-sitter-grammars: move env variable into env
 for structuredAttrs

---
 .../tr/tree-sitter/grammars/build-grammar.nix  | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
index 4694916fbc6f..881b78756850 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
@@ -30,14 +30,16 @@ stdenv.mkDerivation (
       tree-sitter
     ];
 
-    CFLAGS = [
-      "-Isrc"
-      "-O2"
-    ];
-    CXXFLAGS = [
-      "-Isrc"
-      "-O2"
-    ];
+    env = {
+      CFLAGS = toString [
+        "-Isrc"
+        "-O2"
+      ];
+      CXXFLAGS = toString [
+        "-Isrc"
+        "-O2"
+      ];
+    };
 
     stripDebugList = [ "parser" ];
 

From 8ee15adfece7d34ce1de614e6a40bb469da01d54 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Mon, 25 May 2026 18:55:17 +0200
Subject: [PATCH 0246/1209] tree-sitter-grammars: set __structuredAttrs

---
 pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
index 881b78756850..478a0893b72b 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation (
 
     inherit version src;
 
+    __structuredAttrs = true;
+
     nativeBuildInputs = [
       jq
     ]

From 51f6d0a44cbf2051f267b101abd331b4fd372915 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Mon, 25 May 2026 16:48:01 +0200
Subject: [PATCH 0247/1209] valkey: 9.0.4 -> 9.1.0

changelog: https://github.com/valkey-io/valkey/releases/tag/9.1.0

diff: https://github.com/valkey-io/valkey/compare/9.0.4...9.1.0
---
 pkgs/by-name/va/valkey/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/va/valkey/package.nix b/pkgs/by-name/va/valkey/package.nix
index 5898430b732d..b0b0c1065f4e 100644
--- a/pkgs/by-name/va/valkey/package.nix
+++ b/pkgs/by-name/va/valkey/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   lua,
   jemalloc,
   pkg-config,
@@ -25,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "valkey";
-  version = "9.0.4";
+  version = "9.1.0";
 
   src = fetchFromGitHub {
     owner = "valkey-io";
     repo = "valkey";
     rev = finalAttrs.version;
-    hash = "sha256-FDm6i6G6h9WapMTj7ke4YtOjZ4rwIJZGONunQi0v7CE=";
+    hash = "sha256-RMZz83fycpOTPWB1dIXU0/hdh4ZGC+6JhCws8htAQ5E=";
   };
 
   patches = lib.optional useSystemJemalloc ./use_system_jemalloc.patch;
@@ -94,13 +93,14 @@ stdenv.mkDerivation (finalAttrs: {
     fi
 
     # Skip some more flaky tests.
-    # Skip test requiring custom jemalloc (unit/memefficiency).
+    # Skip test requiring custom jemalloc (unit/memefficiency, unit/type/string).
     ./runtest \
       --no-latency \
       --timeout 2000 \
       --clients "$CLIENTS" \
       --tags -leaks \
       --skipunit unit/memefficiency \
+      --skipunit unit/type/string \
       --skipunit integration/failover \
       --skipunit integration/aof-multi-part
 

From e456e5c07f724241d7a02932aec97cba63f8d011 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 25 May 2026 12:46:29 -0700
Subject: [PATCH 0248/1209] cargo-c: 0.10.19 -> 0.10.22

Diff: https://diff.rs/cargo-c/0.10.19/0.10.22

Changelog: https://github.com/lu-zero/cargo-c/releases/tag/v0.10.22
---
 pkgs/by-name/ca/cargo-c/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-c/package.nix b/pkgs/by-name/ca/cargo-c/package.nix
index effa2325438f..159334080752 100644
--- a/pkgs/by-name/ca/cargo-c/package.nix
+++ b/pkgs/by-name/ca/cargo-c/package.nix
@@ -12,19 +12,19 @@
 
 let
   # this version may need to be updated along with package version
-  cargoVersion = "0.93.0";
+  cargoVersion = "0.96.0";
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-c";
-  version = "0.10.19";
+  version = "0.10.22";
 
   src = fetchCrate {
     inherit (finalAttrs) pname;
     version = "${finalAttrs.version}+cargo-${cargoVersion}";
-    hash = "sha256-PrBmB+0tmU2MAUnRr+wx4g9hu0Y9i6WfR8U89bwiLVY=";
+    hash = "sha256-yqSrpBZUa0NmsPawYKKgywmbbG4zgguwfDF667s7zdo=";
   };
 
-  cargoHash = "sha256-EM/vAfW/ucOfK/XmAQn9Zk75eFb7pp8uZoByKbALCyo=";
+  cargoHash = "sha256-yeJWZtkgCRB0ipyTslsGcJi9Fi/XoWziuv74exRhAIk=";
 
   nativeBuildInputs = [
     pkg-config

From 99c958682d291c05ae2a0a044f16aa1cdb997e9e Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Mon, 25 May 2026 17:40:37 -0400
Subject: [PATCH 0249/1209] less: 692 -> 702

Changelog: https://www.greenwoodsoftware.com/less/news.702.html
---
 pkgs/by-name/le/less/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/le/less/package.nix b/pkgs/by-name/le/less/package.nix
index fa2f854f4d80..bc017a199195 100644
--- a/pkgs/by-name/le/less/package.nix
+++ b/pkgs/by-name/le/less/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "less";
-  version = "692";
+  version = "702";
 
   # `less` is provided by the following sources:
   # - meta.homepage
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   # homepage, and only those not marked as beta.
   src = fetchurl {
     url = "https://www.greenwoodsoftware.com/less/less-${finalAttrs.version}.tar.gz";
-    hash = "sha256-YTAPYDeY7PHXeGVweJ8P8/WhrPB1pvufdWg30WbjfRQ=";
+    hash = "sha256-JCpkwA8C2W+O4gjPY4rhcotyfH9f34Kn1PTK4y+whOI=";
   };
 
   buildInputs = [

From 3d799a0c8fb4bb552fc6d18f89c9b122a6b4185f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 25 May 2026 15:48:19 -0700
Subject: [PATCH 0250/1209] double-conversion: 3.3.1 -> 3.4.0

Diff: https://github.com/google/double-conversion/compare/v3.3.1...v3.4.0

Changelog: https://github.com/google/double-conversion/releases/tag/v3.4.0
---
 pkgs/by-name/do/double-conversion/package.nix | 27 +++----------------
 1 file changed, 4 insertions(+), 23 deletions(-)

diff --git a/pkgs/by-name/do/double-conversion/package.nix b/pkgs/by-name/do/double-conversion/package.nix
index 7b31908b1d37..25df8ddcb8fa 100644
--- a/pkgs/by-name/do/double-conversion/package.nix
+++ b/pkgs/by-name/do/double-conversion/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   ninja,
   ctestCheckHook,
@@ -11,34 +10,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "double-conversion";
-  version = "3.3.1";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "double-conversion";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-M80H+azCzQYa4/gBLWv5GNNhEuHsH7LbJ/ajwmACnrM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gxaPqQ51RyXZaTHkvh4RBpedPopcRiuWDoT+PPbI1uw=";
   };
 
-  patches = [
-    # Fix the build with CMake 4.
-    (fetchpatch {
-      name = "double-conversion-fix-cmake-4-1.patch";
-      url = "https://github.com/google/double-conversion/commit/101e1ba89dc41ceb75090831da97c43a76cd2906.patch";
-      hash = "sha256-VRmuNXdzt/I+gWbz5mwWkx5IGn8Vsl9WkdwRsuwZdkU=";
-    })
-    (fetchpatch {
-      name = "double-conversion-fix-cmake-4-2.patch";
-      url = "https://github.com/google/double-conversion/commit/0604b4c18815aadcf7f4b78dfa6bfcb91a634ed7.patch";
-      hash = "sha256-cJBp1ou1O/bMQ/7kvcX52dWbUdhmPfQ9aWmEhQdyhis=";
-    })
-    (fetchpatch {
-      name = "double-conversion-add-pkg-config.patch";
-      url = "https://github.com/google/double-conversion/commit/ddfd18c58ecc32fc74afc1083bb8774240b54efb.patch";
-      hash = "sha256-/pKCL19vS8fNwCm27yTNP+32ApHTH5dEGpnsMI11Lf4=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -68,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     pkgConfigModules = [ "double-conversion" ];
+    changelog = "https://github.com/google/double-conversion/blob/${finalAttrs.src.tag}/Changelog";
     description = "Binary-decimal and decimal-binary routines for IEEE doubles";
     homepage = "https://github.com/google/double-conversion";
     license = lib.licenses.bsd3;

From ec681ffc8f0d1277b5f5a19ad844c5a7d3fda2b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 25 May 2026 15:59:29 -0700
Subject: [PATCH 0251/1209] e2fsprogs: 1.47.3 -> 1.47.4

Changelog: https://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.47.4
---
 pkgs/by-name/e2/e2fsprogs/package.nix | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/e2/e2fsprogs/package.nix b/pkgs/by-name/e2/e2fsprogs/package.nix
index ceb394b1c433..970ea64682c5 100644
--- a/pkgs/by-name/e2/e2fsprogs/package.nix
+++ b/pkgs/by-name/e2/e2fsprogs/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPackages,
   fetchurl,
-  fetchpatch,
   pkg-config,
   libuuid,
   gettext,
@@ -20,25 +19,15 @@
 
 stdenv.mkDerivation rec {
   pname = "e2fsprogs";
-  version = "1.47.3";
+  version = "1.47.4";
 
   __structuredAttrs = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/tytso/e2fsprogs/v${version}/e2fsprogs-${version}.tar.xz";
-    hash = "sha256-hX5u+AD+qiu0V4+8gQIUvl08iLBy6lPFOEczqWVzcyk=";
+    hash = "sha256-/VvziMvb4Aaj07MY2YOylIOCRArMhah/Hn0QhlPo2ws=";
   };
 
-  patches = [
-    # Upstream patch that fixes musl build (and probably others).
-    # Should be included in next release after 1.47.3.
-    (fetchpatch {
-      name = "stdio-portability.patch";
-      url = "https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/patch/?id=f79abd8554e600eacc2a7c864a8332b670c9e262";
-      hash = "sha256-zZ7zmSMTwGyS3X3b/D/mVG0bV2ul5xtY5DJx9YUvQO8=";
-    })
-  ];
-
   # fuse2fs adds 14mb of dependencies
   outputs = [
     "bin"

From b5ea1ced768bb4cfcfee96d1ca792f057bdbb2a4 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Tue, 19 May 2026 15:10:45 +0200
Subject: [PATCH 0252/1209] swtpm: 0.10.1 -> 0.10.1-unstable-05-06-2026

---
 pkgs/by-name/sw/swtpm/package.nix | 63 ++++++++++++-------------------
 1 file changed, 25 insertions(+), 38 deletions(-)

diff --git a/pkgs/by-name/sw/swtpm/package.nix b/pkgs/by-name/sw/swtpm/package.nix
index 8f75456b72e7..f1ec3ef1db55 100644
--- a/pkgs/by-name/sw/swtpm/package.nix
+++ b/pkgs/by-name/sw/swtpm/package.nix
@@ -7,7 +7,7 @@
   pkg-config,
   libtasn1,
   openssl,
-  fuse,
+  fuse3,
   glib,
   libseccomp,
   json-glib,
@@ -15,6 +15,7 @@
   unixtools,
   expect,
   socat,
+  gmp,
   gnutls,
   perl,
   makeWrapper,
@@ -27,20 +28,28 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "swtpm";
-  version = "0.10.1";
+  version = "0.10.1-unstable-2026-05-06"; # fuse3 support, switch to openssl, but does not yet require libtpms >= 0.11
 
   src = fetchFromGitHub {
     owner = "stefanberger";
     repo = "swtpm";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-N79vuI0FhawLyQtwVF6ABIvCmEaYefq/YkyrafUfUHE=";
+    rev = "74f272e337da2c2aa209140df85ddd43a285a2d9";
+    hash = "sha256-cviADrmSTagba9KmlfiQFS6x4W/C8vI2/HuPRqZFh2U=";
   };
 
   patches = [
     (fetchpatch {
-      name = "retry-nwwrite.patch";
-      url = "https://github.com/stefanberger/swtpm/commit/4da66c66f92438443e66b67555673c9cb898b0ae.patch";
-      hash = "sha256-TTS+ViN4g6EfNLrhvGPobcSQEbr/mEl9ZLZTWdxbifs=";
+      # some miscellaneous fixes
+      # - darwin support for socket open
+      # - fix a typoed format string
+      # - fix initializer lists to be compatible with clang
+      url = "https://github.com/stefanberger/swtpm/pull/1127.patch";
+      hash = "sha256-0DFf6LLdjv/wKcsjib1+AOJ3WWu83n5jA0Bx5/chlvc=";
+    })
+    (fetchpatch {
+      # better detection of `stat` util
+      url = "https://github.com/stefanberger/swtpm/pull/1128.patch";
+      hash = "sha256-Cgt8No15NA/eCBLuKsYLDwVWO89XohnTQ3znd4Ky6NM=";
     })
   ];
 
@@ -65,15 +74,17 @@ stdenv.mkDerivation (finalAttrs: {
     libtasn1
     glib
     json-glib
+    gmp
     gnutls
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
-    fuse
+    fuse3
     libseccomp
   ];
 
   configureFlags = [
     "--localstatedir=/var"
+    "--with-gnutls"
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     "--with-cuse"
@@ -87,39 +98,14 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Makefile tries to create the directory /var/lib/swtpm-localca, which fails
     substituteInPlace samples/Makefile.am \
-        --replace 'install-data-local:' 'do-not-execute:'
+        --replace-fail 'install-data-local:' 'do-not-execute:'
 
-    # Use the correct path to the certtool binary
+    # Use the correct path to the openssl binary
     # instead of relying on it being in the environment
     substituteInPlace src/swtpm_localca/swtpm_localca.c \
-      --replace \
-        '# define CERTTOOL_NAME "gnutls-certtool"' \
-        '# define CERTTOOL_NAME "${gnutls}/bin/certtool"' \
-      --replace \
-        '# define CERTTOOL_NAME "certtool"' \
-        '# define CERTTOOL_NAME "${gnutls}/bin/certtool"'
-
-    substituteInPlace tests/common --replace \
-        'CERTTOOL=gnutls-certtool;;' \
-        'CERTTOOL=certtool;;'
-
-    # Fix error on macOS:
-    # stat: invalid option -- '%'
-    # This is caused by the stat program not being the BSD version,
-    # as is expected by the test
-    substituteInPlace tests/common tests/sed-inplace --replace \
-        'if [[ "$(uname -s)" =~ (Linux|CYGWIN_NT-) ]]; then' \
-        'if [[ "$(uname -s)" =~ (Linux|Darwin|CYGWIN_NT-) ]]; then'
-
-    # Otherwise certtool seems to pick up the system language on macOS,
-    # which might cause a test to fail
-    substituteInPlace tests/test_swtpm_setup_create_cert --replace \
-        '$CERTTOOL' \
-        'LC_ALL=C.UTF-8 $CERTTOOL'
-
-    substituteInPlace tests/test_tpm2_swtpm_cert --replace \
-        'certtool' \
-        'LC_ALL=C.UTF-8 certtool'
+      --replace-fail \
+        '#define OPENSSL_TOOL  "openssl"' \
+        '#define OPENSSL_TOOL  "${lib.getExe openssl}"'
   '';
 
   # Workaround for https://github.com/stefanberger/swtpm/issues/795
@@ -129,6 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   doCheck = true;
+  __darwinAllowLocalNetworking = true; # tests do socket things, requires local networking to pass
   enableParallelBuilding = true;
 
   outputs = [

From 83ece5c3a1e6340a1d9b9b40db3d5c50e9e05672 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 13:01:50 +0200
Subject: [PATCH 0253/1209] python3Packages.starlette: 0.52.1 -> 1.1.0

https://www.starlette.io/release-notes/#110
https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr

Fixes: CVE-2026-48710
---
 pkgs/development/python-modules/starlette/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 219ce1e8b7a7..e66a5cf7a80d 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.52.1";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "encode";
     repo = "starlette";
     tag = version;
-    hash = "sha256-XPAeRnh9a0A1/5VGZzzGQBhlBsih1VR8QmFdkxG5cQE=";
+    hash = "sha256-9iQXlpA1VDGw1c7X1zJPmJ3Dub46PwqrVIX1+fWOZ7M=";
   };
 
   build-system = [ hatchling ];

From b481729faf5004e2da0fa3b932a6f2696b4cc98c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 13:06:41 +0200
Subject: [PATCH 0254/1209] python3Packages.fastapi: 0.135.3 -> 0.136.3

https://github.com/fastapi/fastapi/releases/tag/0.136.0
https://github.com/fastapi/fastapi/releases/tag/0.136.1
https://github.com/fastapi/fastapi/releases/tag/0.136.2
https://github.com/fastapi/fastapi/releases/tag/0.136.3
---
 pkgs/development/python-modules/fastapi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 9d5aea8559e5..3e29f81a9da2 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -45,14 +45,14 @@
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.135.3";
+  version = "0.136.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tiangolo";
     repo = "fastapi";
     tag = version;
-    hash = "sha256-sE5d+MgmP9L+MUosRBsR+KSJkcC9i2EOOtKHq0sXjRM=";
+    hash = "sha256-lfmk8ZveKPukEEfwWq2mKtWmOHAtVzGuE5BsOskDzh0=";
   };
 
   build-system = [ pdm-backend ];

From 81d174f747c20e3283d967915d8e990700bbb26f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 26 May 2026 14:16:33 +0300
Subject: [PATCH 0255/1209] pipewire: 1.6.5 -> 1.6.6

Diff: https://gitlab.freedesktop.org/pipewire/pipewire/-/compare/1.6.5...1.6.6

Changelog: https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/1.6.6
---
 pkgs/by-name/pi/pipewire/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index 7a9de59f709d..3929f392ee6a 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -90,7 +90,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pipewire";
-  version = "1.6.5";
+  version = "1.6.6";
 
   outputs = [
     "out"
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     tag = finalAttrs.version;
-    hash = "sha256-ui5VTbSiobHmPUHW4jLguoeMWaKT4f2eTqdo3ZGgvNI=";
+    hash = "sha256-pyZozhJomFT4QkJv/NKkXpbknmVxjv8hCxZV6RcIHmE=";
   };
 
   patches = [

From 8d2dbc322b1436ad3941738b428103423f9463da Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 9 Apr 2026 12:50:27 +0700
Subject: [PATCH 0256/1209] python3Packages.certbot: 5.4.0 -> 5.6.0

---
 pkgs/development/python-modules/certbot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index b7d31f76d771..17c7566b6db2 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "certbot";
-  version = "5.4.0";
+  version = "5.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "certbot";
     repo = "certbot";
     tag = "v${version}";
-    hash = "sha256-Tu46Wybod89TiwsVccNuQcweWoeQE1wbH+pDWNC9+kE=";
+    hash = "sha256-knaEk4bjC0cdnMiO4ENvaDm/i/3tn6ZOJPdyqJxLKOs=";
   };
 
   sourceRoot = "${src.name}/certbot";

From c0495d494a91369cbbca91616a74a94baaad1479 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 9 Apr 2026 12:51:07 +0700
Subject: [PATCH 0257/1209] python3Packages.certbot: add miniharinn as a
 maintainer

---
 pkgs/development/python-modules/certbot/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index 17c7566b6db2..e0244147707f 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -103,7 +103,7 @@ buildPythonPackage rec {
     description = "ACME client that can obtain certs and extensibly update server configurations";
     platforms = lib.platforms.unix;
     mainProgram = "certbot";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ miniharinn ];
     license = with lib.licenses; [ asl20 ];
   };
 }

From be1f6a337333de4cf993cf8f54c6736ef1244d5f Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 9 Apr 2026 12:52:36 +0700
Subject: [PATCH 0258/1209] python3Packages.certbot: use finalAttrs

---
 .../development/python-modules/certbot/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index e0244147707f..797667c6d296 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -22,7 +22,7 @@
   writeShellScriptBin,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "certbot";
   version = "5.6.0";
   pyproject = true;
@@ -30,11 +30,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "certbot";
     repo = "certbot";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-knaEk4bjC0cdnMiO4ENvaDm/i/3tn6ZOJPdyqJxLKOs=";
   };
 
-  sourceRoot = "${src.name}/certbot";
+  sourceRoot = "${finalAttrs.src.name}/certbot";
 
   build-system = [ setuptools ];
 
@@ -87,9 +87,9 @@ buildPythonPackage rec {
     let
       pythonEnv = python.withPackages f;
     in
-    runCommand "certbot-with-plugins-${version}"
+    runCommand "certbot-with-plugins-${finalAttrs.version}"
       {
-        inherit pname version;
+        inherit (finalAttrs) pname version;
       }
       ''
         mkdir -p $out/bin
@@ -99,11 +99,11 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/certbot/certbot";
-    changelog = "https://github.com/certbot/certbot/blob/${src.tag}/certbot/CHANGELOG.md";
+    changelog = "https://github.com/certbot/certbot/blob/${finalAttrs.src.tag}/certbot/CHANGELOG.md";
     description = "ACME client that can obtain certs and extensibly update server configurations";
     platforms = lib.platforms.unix;
     mainProgram = "certbot";
     maintainers = with lib.maintainers; [ miniharinn ];
     license = with lib.licenses; [ asl20 ];
   };
-}
+})

From 02d0ef1ce000de8f47e56363fb80bbf3ea1a6cf9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 09:06:58 -0700
Subject: [PATCH 0259/1209] python3Packages.hass-nabucasa: unpin acme

---
 pkgs/development/python-modules/hass-nabucasa/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index 07485d536e1d..b31a4b1ea581 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -50,6 +50,10 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [
+    "acme"
+  ];
+
   dependencies = [
     acme
     aiohttp

From 4a101f0ce85487c821f8cd07e0a9715e4a1389d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 09:46:24 -0700
Subject: [PATCH 0260/1209] imagemagick: 7.1.2-23 -> 7.1.2-24

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-23...7.1.2-24

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
---
 pkgs/by-name/im/imagemagick/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/imagemagick/package.nix b/pkgs/by-name/im/imagemagick/package.nix
index bbf070eaac05..27f0acd0d16f 100644
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -88,13 +88,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-23";
+  version = "7.1.2-24";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-zYk75q+EyWq5g/AHFU6v8a7gye0aDAEe/ZZvjqR9ZTc=";
+    hash = "sha256-oSH0dsQ3cuFNYJIIr6LHbv82FbFxxcmkjQ5csTNsYCA=";
   };
 
   outputs = [

From 160ca6558e44577004c7660a41e6cf50557d7661 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 26 May 2026 20:58:30 +0300
Subject: [PATCH 0261/1209] curl: set structuredAttrs

---
 pkgs/by-name/cu/curlMinimal/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 3bc05f122f6e..37ebfe7398bf 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -115,6 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   strictDeps = true;
+  __structuredAttrs = true;
 
   env = {
     CXX = "${stdenv.cc.targetPrefix}c++";

From d28f57cdff13598302f9cbebf024a02530893d03 Mon Sep 17 00:00:00 2001
From: Paul Grandperrin <paul.grandperrin@gmail.com>
Date: Tue, 26 May 2026 21:21:06 +0200
Subject: [PATCH 0262/1209] systemd: fix tmpfiles errors when mount is noatime

fixes #520485
---
 pkgs/os-specific/linux/systemd/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index e589188a6099..a6dd663aef3c 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,6 +5,7 @@
   pkgsCross,
   testers,
   fetchFromGitHub,
+  fetchpatch,
   buildPackages,
   makeBinaryWrapper,
   ninja,
@@ -237,6 +238,13 @@ stdenv.mkDerivation (finalAttrs: {
     ./0003-add-rootprefix-to-lookup-dir-paths.patch
     ./0004-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
     ./0005-core-don-t-taint-on-unmerged-usr.patch
+
+    # TODO: remove the following patch when systemd v261 is released.
+    # see upstream PR: https://github.com/systemd/systemd/pull/41232
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/df45055942330fcd2b77389e449905e7f6ca34ec.patch";
+      hash = "sha256-PDh4mP9rYGCglp25346nExU2v6P0WYPfLZgu+YwzZ9c=";
+    })
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch

From 27470b5f24b8a1eb6c543d8dd9e590ddcc75d3a2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 May 2026 20:01:11 +0000
Subject: [PATCH 0263/1209] libxmlb: 0.3.25 -> 0.3.27

---
 pkgs/by-name/li/libxmlb/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libxmlb/package.nix b/pkgs/by-name/li/libxmlb/package.nix
index 1d480f08f1e0..9218433fbe62 100644
--- a/pkgs/by-name/li/libxmlb/package.nix
+++ b/pkgs/by-name/li/libxmlb/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxmlb";
-  version = "0.3.25";
+  version = "0.3.27";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "hughsie";
     repo = "libxmlb";
     rev = finalAttrs.version;
-    hash = "sha256-GBsaVJpnB6m1oItwD7t59BmoZcVQBU/sPz5fGGVzBG0=";
+    hash = "sha256-5RP794gBA67DcrjzqvguDYu/Sf+1X5kfRi9yvLx9b+c=";
   };
 
   patches = [

From 91518f18f5de0f58d3cd532a8eeb227d78b5159f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 13:41:00 -0700
Subject: [PATCH 0264/1209] ffmpeg_8: 8.1 -> 8.1.1

Changelog: https://github.com/FFmpeg/FFmpeg/blob/n8.1.1/Changelog
---
 pkgs/development/libraries/ffmpeg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index cd003aecd13e..ca123f87b955 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -30,8 +30,8 @@ let
     hash = "sha256-1w4OSlz88D2pnZVXQcI4uyX+triNK0NXzlsyt7GGSLU=";
   };
   v8 = {
-    version = "8.1";
-    hash = "sha256-FdKhhCveEo5UodEoyUh3aBHABv3OT2VXmwBXE1ce3p0=";
+    version = "8.1.1";
+    hash = "sha256-WPGfjTZjsgpR5QiANRWF4g6LF2ejGzFQUrLjhzw9cfQ=";
   };
 in
 

From 07e44fb25f474a24adf65c976ff72677ad637a4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 14:10:04 -0700
Subject: [PATCH 0265/1209] fftw: 3.3.10 -> 3.3.11

Changelog: https://github.com/FFTW/fftw3/blob/fftw-3.3.11/NEWS
---
 pkgs/by-name/ff/fftw/package.nix | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/ff/fftw/package.nix b/pkgs/by-name/ff/fftw/package.nix
index 0d9736335f68..a706799bf693 100644
--- a/pkgs/by-name/ff/fftw/package.nix
+++ b/pkgs/by-name/ff/fftw/package.nix
@@ -1,6 +1,5 @@
 {
   fetchurl,
-  fetchpatch,
   stdenv,
   lib,
   gfortran,
@@ -22,24 +21,16 @@ assert lib.elem precision [
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fftw-${precision}";
-  version = "3.3.10";
+  version = "3.3.11";
 
   src = fetchurl {
     urls = [
       "https://fftw.org/fftw-${finalAttrs.version}.tar.gz"
       "ftp://ftp.fftw.org/pub/fftw/fftw-${finalAttrs.version}.tar.gz"
     ];
-    hash = "sha256-VskyVJhSzdz6/as4ILAgDHdCZ1vpIXnlnmIVs0DiZGc=";
+    hash = "sha256-VjDCTN6zOxMWEvfrSxqZNCNHVPnziP+GF0WNC+byOaE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "remove_missing_FFTW3LibraryDepends.patch";
-      url = "https://github.com/FFTW/fftw3/pull/338/commits/f69fef7aa546d4477a2a3fd7f13fa8b2f6c54af7.patch";
-      hash = "sha256-lzX9kAHDMY4A3Td8necXwYLcN6j8Wcegi3A7OIECKeU=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -107,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
+    changelog = "https://github.com/FFTW/fftw3/blob/fftw-${finalAttrs.version}/NEWS";
     description = "Fastest Fourier Transform in the West library";
     homepage = "https://www.fftw.org/";
     license = lib.licenses.gpl2Plus;

From 0b780db8ebf8df374e506dbc70ca31d2da42ffa3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 09:50:57 -0700
Subject: [PATCH 0266/1209] python3Packages.chardet: 5.2.0 -> 6.0.0.post1

Diff: https://github.com/chardet/chardet/compare/5.2.0...6.0.0.post1

Changelog: https://github.com/chardet/chardet/releases/tag/6.0.0.post1
---
 .../python-modules/chardet/default.nix        | 26 +++++++++++++------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/chardet/default.nix b/pkgs/development/python-modules/chardet/default.nix
index 87f4b526b9b4..7e0b2344d250 100644
--- a/pkgs/development/python-modules/chardet/default.nix
+++ b/pkgs/development/python-modules/chardet/default.nix
@@ -1,26 +1,36 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
   hypothesis,
+  pytest-timeout,
+  pytest-xdist,
   pytestCheckHook,
-  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "chardet";
-  version = "5.2.0";
+  version = "6.0.0.post1";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Gztv9HmoxBS8P6LAhSmVaVxKAm3NbQYzst0JLKOcHPc=";
+  src = fetchFromGitHub {
+    owner = "chardet";
+    repo = "chardet";
+    tag = version;
+    hash = "sha256-7G998L4VRvNiGBBNAxPJB27lI2DtL1lTteowUH2NBDk=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
 
   nativeCheckInputs = [
     hypothesis
+    pytest-timeout
+    pytest-xdist
     pytestCheckHook
   ];
 
@@ -32,7 +42,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "chardet" ];
 
   meta = {
-    changelog = "https://github.com/chardet/chardet/releases/tag/${version}";
+    changelog = "https://github.com/chardet/chardet/releases/tag/${src.tag}";
     description = "Universal encoding detector";
     mainProgram = "chardetect";
     homepage = "https://github.com/chardet/chardet";

From 9dfc99b8d876daacfb34786a0af0ebcd3097e2c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 11:06:01 -0700
Subject: [PATCH 0267/1209] python3Packages.chardet: use finalAttrs

---
 pkgs/development/python-modules/chardet/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/chardet/default.nix b/pkgs/development/python-modules/chardet/default.nix
index 7e0b2344d250..1e6bf432037e 100644
--- a/pkgs/development/python-modules/chardet/default.nix
+++ b/pkgs/development/python-modules/chardet/default.nix
@@ -10,7 +10,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "chardet";
   version = "6.0.0.post1";
   pyproject = true;
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "chardet";
     repo = "chardet";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-7G998L4VRvNiGBBNAxPJB27lI2DtL1lTteowUH2NBDk=";
   };
 
@@ -42,11 +42,11 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "chardet" ];
 
   meta = {
-    changelog = "https://github.com/chardet/chardet/releases/tag/${src.tag}";
+    changelog = "https://github.com/chardet/chardet/releases/tag/${finalAttrs.src.tag}";
     description = "Universal encoding detector";
     mainProgram = "chardetect";
     homepage = "https://github.com/chardet/chardet";
     license = lib.licenses.lgpl21Plus;
     maintainers = [ ];
   };
-}
+})

From 1e0590976310901b97d40324705d71746d9b63bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 21 May 2026 08:45:07 -0700
Subject: [PATCH 0268/1209] python3Packages.httpx: skip tests broken by chardet
 v6

---
 pkgs/development/python-modules/httpx/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/httpx/default.nix b/pkgs/development/python-modules/httpx/default.nix
index 2b146d05b658..a5e66abfcd68 100644
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@@ -96,6 +96,10 @@ buildPythonPackage rec {
     "test_sync_proxy_close"
     # ResourceWarning: Async generator 'httpx._content.ByteStream.__aiter__' was garbage collected before it had been exhausted. Surround its use in 'async with aclosing(...):' to ensure that it gets cleaned up as soon as you're done using it.
     "test_write_timeout" # trio variant
+    # chardet v6 recognizes the wrong encoding
+    "test_client_decode_text_using_autodetect"
+    "test_client_decode_text_using_explicit_encoding"
+    "test_response_decode_text_using_autodetect"
   ];
 
   disabledTestPaths = [ "tests/test_main.py" ];

From f21fec3871a704863b2e32afc818cf35337fd7ff Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Wed, 27 May 2026 09:20:26 -0400
Subject: [PATCH 0269/1209] tinysparql: include upstream patch for sqlite
 float-related test fixes

Issue: https://gitlab.gnome.org/GNOME/tinysparql/-/work_items/496
Merge request: https://gitlab.gnome.org/GNOME/tinysparql/-/merge_requests/811
---
 pkgs/by-name/ti/tinysparql/package.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/by-name/ti/tinysparql/package.nix b/pkgs/by-name/ti/tinysparql/package.nix
index 25e5d9aaa0f0..aeeae95159df 100644
--- a/pkgs/by-name/ti/tinysparql/package.nix
+++ b/pkgs/by-name/ti/tinysparql/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchurl,
+  fetchpatch,
   gettext,
   meson,
   mesonEmulatorHook,
@@ -49,6 +50,18 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-z9RgIe4VFK1DXnFPeqHsenh8f1FqlPTHQ4iX7j1uyh4=";
   };
 
+  patches = [
+    # sqlite changed the precision of float <-> text conversions, causing
+    # failures in the test suite. patch here until this appears in a release.
+    # https://gitlab.gnome.org/GNOME/tinysparql/-/work_items/496
+    # https://gitlab.gnome.org/GNOME/tinysparql/-/merge_requests/811
+    (fetchpatch {
+      name = "tinysparql-sqlite-double-value-precision.patch";
+      url = "https://gitlab.gnome.org/GNOME/tinysparql/-/commit/47d5bf9313d0ccb1feb7169eed9047d0e1597a39.patch";
+      hash = "sha256-k6eELZCEEtD8s7GiMckjTlf6QcAiUNY1Mraw7GROsm4=";
+    })
+  ];
+
   strictDeps = true;
 
   depsBuildBuild = [

From e38a2c417533158c391897e6e8d229e752f931e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 May 2026 07:11:43 -0700
Subject: [PATCH 0270/1209] opencv4: use ffmpeg-headless

---
 pkgs/by-name/ml/mlt/package.nix           | 2 +-
 pkgs/development/libraries/opencv/4.x.nix | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ml/mlt/package.nix b/pkgs/by-name/ml/mlt/package.nix
index aba7a2d56717..735a503a011c 100644
--- a/pkgs/by-name/ml/mlt/package.nix
+++ b/pkgs/by-name/ml/mlt/package.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     gdk-pixbuf
-    (opencv4.override { inherit ffmpeg; })
+    (opencv4.override { ffmpeg-headless = ffmpeg; })
     ffmpeg
     fftw
     frei0r
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 3e81c8a5b008..3fcdb07c7607 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -58,7 +58,7 @@
   enableVtk ? false,
   vtk,
   enableFfmpeg ? true,
-  ffmpeg,
+  ffmpeg-headless,
   enableGStreamer ? true,
   elfutils,
   gst_all_1,
@@ -373,7 +373,7 @@ effectiveStdenv.mkDerivation {
     openjpeg
   ]
   ++ optionals enableFfmpeg [
-    ffmpeg
+    ffmpeg-headless
   ]
   ++ optionals (enableGStreamer && effectiveStdenv.hostPlatform.isLinux) [
     elfutils

From 057bd4a56cea3d910100441ab47ade8135efaf56 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Wed, 27 May 2026 17:17:49 +0200
Subject: [PATCH 0271/1209] 
 python314Packages.opentelemetry-semantic-conventions-ai: update meta.homepage

---
 .../opentelemetry-semantic-conventions-ai/default.nix           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
index 623e6501660a..14c16f870d03 100644
--- a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage {
 
   meta = {
     description = "Open-source observability for your GenAI or LLM application, based on OpenTelemetry";
-    homepage = "https://github.com/traceloop/openllmetry";
+    homepage = "https://github.com/traceloop/openllmetry/tree/main/packages/opentelemetry-semantic-conventions-ai";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ lach ];
   };

From 1daeb43ea555600ccc024e6a1a4e12fbd209cbe9 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 24 May 2026 14:52:17 +0200
Subject: [PATCH 0272/1209] mate-panel-with-applets: re-enable man output

This reverts commit 72a37f984c0417d8a741e50decd9f44aeca58c74.
Requires https://github.com/NixOS/nixpkgs/pull/511330 .
---
 .../ma/mate-panel-with-applets/package.nix        | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/ma/mate-panel-with-applets/package.nix b/pkgs/by-name/ma/mate-panel-with-applets/package.nix
index a3a52ced0d43..e5d5031ff9c9 100644
--- a/pkgs/by-name/ma/mate-panel-with-applets/package.nix
+++ b/pkgs/by-name/ma/mate-panel-with-applets/package.nix
@@ -34,12 +34,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "${mate-panel.pname}-with-applets";
-  inherit (mate-panel) version;
+  inherit (mate-panel) version outputs;
 
   src = null;
 
   paths = [
-    mate-panel
+    mate-panel.out
+    mate-panel.man
   ]
   ++ selectedApplets;
 
@@ -84,13 +85,5 @@ stdenv.mkDerivation {
 
   __structuredAttrs = true;
 
-  meta = {
-    inherit (mate-panel.meta)
-      description
-      homepage
-      license
-      teams
-      platforms
-      ;
-  };
+  inherit (mate-panel) meta;
 }

From 6f04e4e7027cb6ecb7d696cacc31ef785a142021 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Wed, 20 May 2026 09:46:01 -0400
Subject: [PATCH 0273/1209] rsync: 3.4.1 -> 3.4.3

https://download.samba.org/pub/rsync/NEWS.html#3.4.2
https://download.samba.org/pub/rsync/NEWS.html#3.4.3
---
 .../networking/sync/rsync/default.nix         | 22 ++++----
 .../rsync/fix-tests-in-darwin-sandbox.patch   | 56 -------------------
 2 files changed, 10 insertions(+), 68 deletions(-)
 delete mode 100644 pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch

diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index ab771e3c5057..e6f2fba8748d 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -1,10 +1,10 @@
 {
   lib,
   stdenv,
-  fetchpatch,
   fetchurl,
   updateAutotoolsGnuConfigScriptsHook,
   perl,
+  python3,
   libiconv,
   zlib,
   popt,
@@ -23,23 +23,17 @@
 
 stdenv.mkDerivation rec {
   pname = "rsync";
-  version = "3.4.1";
+  version = "3.4.3";
 
   src = fetchurl {
     # signed with key 9FEF 112D CE19 A0DC 7E88  2CB8 1BB2 4997 A853 5F6F
     url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
-    hash = "sha256-KSS8s6Hti1UfwQH3QLnw/gogKxFQJ2R89phQ1l/YjFI=";
+    hash = "sha256-xy5jyjAhy8gLqG7DAQJ3P0xWMfvEkrUudzs5WPgqU9M=";
   };
 
-  patches = [
-    # See: <https://github.com/RsyncProject/rsync/pull/790>
-    ./fix-tests-in-darwin-sandbox.patch
-    # fix compilation with gcc15
-    (fetchpatch {
-      url = "https://github.com/RsyncProject/rsync/commit/a4b926dcdce96b0f2cc0dc7744e95747b233500a.patch";
-      hash = "sha256-UiEQJ+p2gtIDYNJqnxx4qKgItKIZzCpkHnvsgoxBmSE=";
-    })
-  ];
+  preBuild = ''
+    patchShebangs ./runtests.py
+  '';
 
   nativeBuildInputs = [
     updateAutotoolsGnuConfigScriptsHook
@@ -80,6 +74,10 @@ stdenv.mkDerivation rec {
 
   passthru.tests = { inherit (nixosTests) rsyncd; };
 
+  nativeCheckInputs = [
+    python3
+  ];
+
   # Test fails when built in a chroot store
   preCheck = ''
     rm testsuite/chgrp.test
diff --git a/pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch b/pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch
deleted file mode 100644
index d9209a97c1ed..000000000000
--- a/pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 9b104ed9859f17b6ed4c4ad01806c75a0c197dd7 Mon Sep 17 00:00:00 2001
-From: Emily <hello@emily.moe>
-Date: Tue, 5 Aug 2025 15:55:24 +0100
-Subject: [PATCH] Allow `ls(1)` to fail in test setup
-
-This can happen when the tests are unable to `stat(2)` some files in
-`/etc`, `/bin`, or `/`, due to Unix permissions or other sandboxing. We
-still guard against serious errors, which use exit code 2.
----
- testsuite/longdir.test | 4 ++--
- testsuite/rsync.fns    | 8 ++++----
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/testsuite/longdir.test b/testsuite/longdir.test
-index 8d66bb5f..26747292 100644
---- a/testsuite/longdir.test
-+++ b/testsuite/longdir.test
-@@ -16,9 +16,9 @@ makepath "$longdir" || test_skipped "unable to create long directory"
- touch "$longdir/1" || test_skipped "unable to create files in long directory"
- date > "$longdir/1"
- if [ -r /etc ]; then
--    ls -la /etc >"$longdir/2"
-+    ls -la /etc >"$longdir/2" || [ $? -eq 1 ]
- else
--    ls -la / >"$longdir/2"
-+    ls -la / >"$longdir/2" || [ $? -eq 1 ]
- fi
- checkit "$RSYNC --delete -avH '$fromdir/' '$todir'" "$fromdir/" "$todir"
- 
-diff --git a/testsuite/rsync.fns b/testsuite/rsync.fns
-index 2ab97b69..f7da363f 100644
---- a/testsuite/rsync.fns
-+++ b/testsuite/rsync.fns
-@@ -195,15 +195,15 @@ hands_setup() {
-     echo some data > "$fromdir/dir/subdir/foobar.baz"
-     mkdir "$fromdir/dir/subdir/subsubdir"
-     if [ -r /etc ]; then
--	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
-+	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
-     else
--	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
-+	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
-     fi
-     mkdir "$fromdir/dir/subdir/subsubdir2"
-     if [ -r /bin ]; then
--	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
-+	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
-     else
--	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
-+	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
-     fi
- 
- #      echo testing head:
--- 
-2.50.1
-

From 481208bdff2dc2f61d4f4fde51e6bd2a939f7d68 Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Wed, 27 May 2026 17:47:18 +0100
Subject: [PATCH 0274/1209] cc-wrapper, gcc, gnat, gnat-bootstrap: fix GCC 13
 and GNAT 13/14/15 builds on darwin

---
 pkgs/build-support/cc-wrapper/default.nix     |   8 +-
 .../compilers/gcc/common/configure-flags.nix  |  19 +-
 .../compilers/gcc/common/dependencies.nix     |   3 +-
 pkgs/development/compilers/gcc/default.nix    |  14 +-
 .../13/gnat13-aarch64-darwin-trampoline.patch | 202 ++++++++++++++++++
 .../compilers/gcc/patches/default.nix         |  24 ++-
 .../gnat-darwin-dylib-install-name-13.patch   |  18 --
 .../compilers/gnat-bootstrap/default.nix      |  19 +-
 pkgs/top-level/all-packages.nix               |  37 ++--
 9 files changed, 278 insertions(+), 66 deletions(-)
 create mode 100644 pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch
 delete mode 100644 pkgs/development/compilers/gcc/patches/gnat-darwin-dylib-install-name-13.patch

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 3c30f5cd308e..d14dea8b7f60 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -27,6 +27,7 @@
   isGNU ? false,
   isClang ? cc.isClang or false,
   isFlang ? cc.isFlang or false,
+  isAlireGNAT ? false,
   isZig ? cc.isZig or false,
   isArocc ? cc.isArocc or false,
   isCcache ? cc.isCcache or false,
@@ -721,7 +722,7 @@ stdenvNoCC.mkDerivation {
         touch "$out/nix-support/libc-cflags"
         touch "$out/nix-support/libc-ldflags"
       ''
-      + optionalString (!isArocc) ''
+      + optionalString (!isArocc && !(isAlireGNAT && targetPlatform.isDarwin)) ''
         echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
       ''
       + ''
@@ -796,7 +797,9 @@ stdenvNoCC.mkDerivation {
     # ${cc_solib}/lib64 (even though it does actually search there...)..
     # This confuses libtool.  So add it to the compiler tool search
     # path explicitly.
-    + optionalString (!nativeTools && !isArocc) ''
+    # Injecting CFlags and LDFlags causes duplicate rpath at linking
+    # stage for Alire GNAT. Skip adding flags here.
+    + optionalString (!nativeTools && !isArocc && !isAlireGNAT) ''
       ccLDFlags=()
       ccCFlags=()
       if [ -e "${cc_solib}/lib64" -a ! -L "${cc_solib}/lib64" ]; then
@@ -811,7 +814,6 @@ stdenvNoCC.mkDerivation {
       touch "$out/nix-support/gnat-cflags"
       touch "$out/nix-support/gnat-ldflags"
       basePath=$(echo $cc/lib/*/*/*)
-      ccCFlags+=("-B$basePath" "-I$basePath/adainclude")
       gnatCFlags="-I$basePath/adainclude -I$basePath/adalib"
 
       echo "$gnatCFlags" >> $out/nix-support/gnat-cflags
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 66099c229743..d7b9344574f1 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -8,7 +8,9 @@
   threadsCross,
   version,
 
-  apple-sdk,
+  is13,
+  apple-sdk_14,
+  apple-sdk_15,
   binutils,
   gmp,
   mpfr,
@@ -53,6 +55,8 @@ let
     targetPlatform
     ;
 
+  appleSdk = if langAda && !is13 then apple-sdk_15 else apple-sdk_14;
+
   # See https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903
   disableBootstrap' = disableBootstrap && !langFortran && !langGo;
 
@@ -159,12 +163,11 @@ let
       # gcc builds for cross-compilers (build != host) or cross-built
       # gcc (host != target) always apply the offset prefix to disentangle
       # target headers from build or host headers:
-      #     ${with_build_sysroot}${native_system_header_dir}
-      #  or ${test_exec_prefix}/${target_noncanonical}/sys-include
-      #  or ${with_sysroot}${native_system_header_dir}
+      #        ${with_sysroot}${native_system_header_dir}
+      #    and ${with_build_sysroot}${native_system_header_dir}
       # While native build (build == host == target) uses passed headers
       # path as is:
-      #    ${with_build_sysroot}${native_system_header_dir}
+      #    ${with_sysroot}${native_system_header_dir}
       #
       # Nixpkgs uses flat directory structure for both native and cross
       # cases. As a result libc headers don't get found for cross case
@@ -175,10 +178,14 @@ let
       # We pick "/" path to effectively avoid sysroot offset and make it work
       # as a native case.
       # Darwin requires using the SDK as the sysroot for `SDKROOT` to work correctly.
-      "--with-build-sysroot=${if targetPlatform.isDarwin then apple-sdk.sdkroot else "/"}"
+      "--with-build-sysroot=${if targetPlatform.isDarwin then appleSdk.sdkroot else "/"}"
       # Same with the stdlibc++ headers embedded in the gcc output
       "--with-gxx-include-dir=${placeholder "out"}/include/c++/${version}/"
     ]
+    ++ lib.optionals (!withoutTargetLibc && targetPlatform.isDarwin && !crossDarwin) [
+      # Building on Darwin often requires --with-sysroot.
+      "--with-sysroot=${appleSdk.sdkroot}"
+    ]
 
     # Basic configuration
     ++ [
diff --git a/pkgs/development/compilers/gcc/common/dependencies.nix b/pkgs/development/compilers/gcc/common/dependencies.nix
index 9d8feadde99e..105fac5fe094 100644
--- a/pkgs/development/compilers/gcc/common/dependencies.nix
+++ b/pkgs/development/compilers/gcc/common/dependencies.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   version,
+  is13,
   buildPackages,
   targetPackages,
   texinfo,
@@ -43,9 +44,9 @@ in
   nativeBuildInputs = [
     texinfo
     which
-    gettext
     autoconf269
   ]
+  ++ optionals (!is13) [ gettext ]
   ++ optionals (perl != null) [ perl ]
   ++ optionals (with stdenv.targetPlatform; isVc4 || isRedox || isSnapshot && flex != null) [ flex ]
   ++ optionals langAda [ gnat-bootstrap ]
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index 615cd2b3b19a..3012bccba8d7 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -58,7 +58,8 @@
   nukeReferences,
   callPackage,
   majorMinorVersion,
-  apple-sdk,
+  apple-sdk_14,
+  apple-sdk_15,
   darwin,
 }:
 
@@ -84,6 +85,8 @@ let
   majorVersion = versions.major version;
   is13 = majorVersion == "13";
 
+  appleSdk = if langAda && !is13 then apple-sdk_15 else apple-sdk_14;
+
   # releases have a form: MAJOR.MINOR.MICRO, like 14.2.1
   # snapshots have a form like MAJOR.MINOR.MICRO.DATE, like 14.2.1.20250322
   isSnapshot = lib.length (lib.splitVersion version) == 4;
@@ -127,7 +130,8 @@ let
       ;
     # inherit generated with 'nix eval --json --impure --expr "with import ./. {}; lib.attrNames (lib.functionArgs gcc${majorVersion}.cc.override)" | jq '.[]' --raw-output'
     inherit
-      apple-sdk
+      apple-sdk_14
+      apple-sdk_15
       autoconf269
       binutils
       buildPackages
@@ -149,6 +153,7 @@ let
       gnat-bootstrap
       gnused
       isl
+      is13
       langAda
       langC
       langCC
@@ -375,6 +380,11 @@ pipe
 
         NIX_LDFLAGS = optionalString hostPlatform.isSunOS "-lm";
 
+        # Override isysroot for GNAT on Darwin due to SDK version sensitivity; GNAT 14+ requires Apple SDK 15 or later.
+        NIX_CFLAGS_COMPILE = optionalString (
+          hostPlatform.isDarwin && langAda
+        ) "-isysroot ${appleSdk.sdkroot}";
+
         inherit (callFile ./common/extra-target-flags.nix { })
           EXTRA_FLAGS_FOR_TARGET
           EXTRA_LDFLAGS_FOR_TARGET
diff --git a/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch b/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch
new file mode 100644
index 000000000000..2065a90d136a
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch
@@ -0,0 +1,202 @@
+From a41f0707bdcc9fb6dab39eb8ce7e392138d16dc0 Mon Sep 17 00:00:00 2001
+From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
+Date: Wed, 27 May 2026 18:25:14 +0100
+Subject: [PATCH] Allow GNAT 13 bootstrap on aarch64-darwin with nested
+ trampoline symbol mismatch
+
+This patch renames nested function trampoline helper symbols from the
+__gcc_* namespace to __builtin_* across GCC and libgcc in order to allow
+GNAT 13 to build on aarch64-darwin under bootstrap constraints where the
+prebuilt stage1 compiler does not provide the newer symbol set.
+
+The change updates builtin definitions, Darwin export lists,
+documentation,
+and libgcc implementations of the heap trampoline hooks used by
+-ftrampoline-impl=heap.
+
+This is a bootstrap compatibility workaround to bridge the ABI mismatch
+between the Alire/GNAT-FSF-build GNAT 13.2.0-2 compiler and the
+IainS/gcc-13-branch 13.4-darwin-r0 source tree.
+---
+ gcc/builtins.def                        | 4 ++--
+ gcc/config/darwin.h                     | 8 ++++----
+ gcc/doc/invoke.texi                     | 4 ++--
+ gcc/tree.cc                             | 8 ++++----
+ libgcc/config/aarch64/heap-trampoline.c | 8 ++++----
+ libgcc/config/i386/heap-trampoline.c    | 8 ++++----
+ libgcc/libgcc-std.ver.in                | 4 ++--
+ libgcc/libgcc2.h                        | 4 ++--
+ 8 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/gcc/builtins.def b/gcc/builtins.def
+index 448cf837ec8..5bf4769ae47 100644
+--- a/gcc/builtins.def
++++ b/gcc/builtins.def
+@@ -1067,8 +1067,8 @@ DEF_BUILTIN_STUB (BUILT_IN_ADJUST_TRAMPOLINE, "__builtin_adjust_trampoline")
+ DEF_BUILTIN_STUB (BUILT_IN_INIT_DESCRIPTOR, "__builtin_init_descriptor")
+ DEF_BUILTIN_STUB (BUILT_IN_ADJUST_DESCRIPTOR, "__builtin_adjust_descriptor")
+ DEF_BUILTIN_STUB (BUILT_IN_NONLOCAL_GOTO, "__builtin_nonlocal_goto")
+-DEF_EXT_LIB_BUILTIN (BUILT_IN_GCC_NESTED_PTR_CREATED, "__gcc_nested_func_ptr_created", BT_FN_VOID_PTR_PTR_PTR, ATTR_NOTHROW_LIST)
+-DEF_EXT_LIB_BUILTIN (BUILT_IN_GCC_NESTED_PTR_DELETED, "__gcc_nested_func_ptr_deleted", BT_FN_VOID, ATTR_NOTHROW_LIST)
++DEF_EXT_LIB_BUILTIN (BUILT_IN_GCC_NESTED_PTR_CREATED, "__builtin_nested_func_ptr_created", BT_FN_VOID_PTR_PTR_PTR, ATTR_NOTHROW_LIST)
++DEF_EXT_LIB_BUILTIN (BUILT_IN_GCC_NESTED_PTR_DELETED, "__builtin_nested_func_ptr_deleted", BT_FN_VOID, ATTR_NOTHROW_LIST)
+ 
+ /* Implementing __builtin_setjmp.  */
+ DEF_BUILTIN_STUB (BUILT_IN_SETJMP_SETUP, "__builtin_setjmp_setup")
+diff --git a/gcc/config/darwin.h b/gcc/config/darwin.h
+index 0cc6f021365..47bca6f1db1 100644
+--- a/gcc/config/darwin.h
++++ b/gcc/config/darwin.h
+@@ -433,10 +433,10 @@ extern GTY(()) int darwin_ms_struct;
+ 	   ___emutls_get_address -exported_symbol ___emutls_get_address \
+ 	  -U ___emutls_register_common \
+ 	  -exported_symbol ___emutls_register_common \
+-	  -U ___gcc_nested_func_ptr_created \
+-	  -exported_symbol ___gcc_nested_func_ptr_created \
+-	  -U ___gcc_nested_func_ptr_deleted \
+-	  -exported_symbol ___gcc_nested_func_ptr_deleted \
++	  -U ___builtin_nested_func_ptr_created \
++	  -exported_symbol ___builtin_nested_func_ptr_created \
++	  -U ___builtin_nested_func_ptr_deleted \
++	  -exported_symbol ___builtin_nested_func_ptr_deleted \
+       }} \
+     }}}\
+     %{!r:%{!nostdlib:%{!nostartfiles:%E}}} %{T*} %{F*} "\
+diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
+index 8f82ba0ecfa..4d5bba42fcd 100644
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -18718,8 +18718,8 @@ for nested functions.
+ By default, trampolines are generated on stack.  However, certain platforms
+ (such as the Apple M1) do not permit an executable stack.  Compiling with
+ @option{-ftrampoline-impl=heap} generate calls to
+-@code{__gcc_nested_func_ptr_created} and
+-@code{__gcc_nested_func_ptr_deleted} in order to allocate and
++@code{__builtin_nested_func_ptr_created} and
++@code{__builtin_nested_func_ptr_deleted} in order to allocate and
+ deallocate trampoline space on the executable heap.  These functions are
+ implemented in libgcc, and will only be provided on specific targets:
+ x86_64 Darwin, x86_64 and aarch64 Linux.  @emph{PLEASE NOTE}: Heap
+diff --git a/gcc/tree.cc b/gcc/tree.cc
+index 032b87ee1c8..54abc791c88 100644
+--- a/gcc/tree.cc
++++ b/gcc/tree.cc
+@@ -9874,17 +9874,17 @@ build_common_builtin_nodes (void)
+ 					ptr_type_node, // void *func
+ 					ptr_ptr_type_node, // void **dst
+ 					NULL_TREE);
+-      local_define_builtin ("__builtin___gcc_nested_func_ptr_created", ftype,
++      local_define_builtin ("__builtin___builtin_nested_func_ptr_created", ftype,
+ 			    BUILT_IN_GCC_NESTED_PTR_CREATED,
+-			    "__gcc_nested_func_ptr_created", ECF_NOTHROW);
++			    "__builtin_nested_func_ptr_created", ECF_NOTHROW);
+     }
+ 
+   if (!builtin_decl_explicit_p (BUILT_IN_GCC_NESTED_PTR_DELETED))
+     {
+       ftype = build_function_type_list (void_type_node, NULL_TREE);
+-      local_define_builtin ("__builtin___gcc_nested_func_ptr_deleted", ftype,
++      local_define_builtin ("__builtin___builtin_nested_func_ptr_deleted", ftype,
+ 			    BUILT_IN_GCC_NESTED_PTR_DELETED,
+-			    "__gcc_nested_func_ptr_deleted", ECF_NOTHROW);
++			    "__builtin_nested_func_ptr_deleted", ECF_NOTHROW);
+     }
+ 
+   ftype = build_function_type_list (void_type_node,
+diff --git a/libgcc/config/aarch64/heap-trampoline.c b/libgcc/config/aarch64/heap-trampoline.c
+index b2c69aa5892..2e47cf56dc6 100644
+--- a/libgcc/config/aarch64/heap-trampoline.c
++++ b/libgcc/config/aarch64/heap-trampoline.c
+@@ -26,8 +26,8 @@ int get_trampolines_per_page (void);
+ struct tramp_ctrl_data *allocate_tramp_ctrl (struct tramp_ctrl_data *parent);
+ void *allocate_trampoline_page (void);
+ 
+-void __gcc_nested_func_ptr_created (void *chain, void *func, void **dst);
+-void __gcc_nested_func_ptr_deleted (void);
++void __builtin_nested_func_ptr_created (void *chain, void *func, void **dst);
++void __builtin_nested_func_ptr_deleted (void);
+ 
+ #if defined(__linux__)
+ static const unsigned char aarch64_trampoline_insns[6][4] = {
+@@ -115,7 +115,7 @@ allocate_tramp_ctrl (struct tramp_ctrl_data *parent)
+ 
+ HEAP_T_ATTR
+ void
+-__gcc_nested_func_ptr_created (void *chain, void *func, void **dst)
++__builtin_nested_func_ptr_created (void *chain, void *func, void **dst)
+ {
+   if (tramp_ctrl_curr == NULL)
+     {
+@@ -163,7 +163,7 @@ __gcc_nested_func_ptr_created (void *chain, void *func, void **dst)
+ 
+ HEAP_T_ATTR
+ void
+-__gcc_nested_func_ptr_deleted (void)
++__builtin_nested_func_ptr_deleted (void)
+ {
+   if (tramp_ctrl_curr == NULL)
+     abort ();
+diff --git a/libgcc/config/i386/heap-trampoline.c b/libgcc/config/i386/heap-trampoline.c
+index 2e8df1cfbd2..34aace2b5a6 100644
+--- a/libgcc/config/i386/heap-trampoline.c
++++ b/libgcc/config/i386/heap-trampoline.c
+@@ -26,8 +26,8 @@ int get_trampolines_per_page (void);
+ struct tramp_ctrl_data *allocate_tramp_ctrl (struct tramp_ctrl_data *parent);
+ void *allocate_trampoline_page (void);
+ 
+-void __gcc_nested_func_ptr_created (void *chain, void *func, void **dst);
+-void __gcc_nested_func_ptr_deleted (void);
++void __builtin_nested_func_ptr_created (void *chain, void *func, void **dst);
++void __builtin_nested_func_ptr_deleted (void);
+ 
+ #if __x86_64__
+ 
+@@ -179,7 +179,7 @@ allocate_tramp_ctrl (struct tramp_ctrl_data *parent)
+ 
+ HEAP_T_ATTR
+ void
+-__gcc_nested_func_ptr_created (void *chain, void *func, void **dst)
++__builtin_nested_func_ptr_created (void *chain, void *func, void **dst)
+ {
+   if (tramp_ctrl_curr == NULL)
+     {
+@@ -233,7 +233,7 @@ __gcc_nested_func_ptr_created (void *chain, void *func, void **dst)
+ 
+ HEAP_T_ATTR
+ void
+-__gcc_nested_func_ptr_deleted (void)
++__builtin_nested_func_ptr_deleted (void)
+ {
+   if (tramp_ctrl_curr == NULL)
+     abort ();
+diff --git a/libgcc/libgcc-std.ver.in b/libgcc/libgcc-std.ver.in
+index ad854bf0ded..acc4e6cfab8 100644
+--- a/libgcc/libgcc-std.ver.in
++++ b/libgcc/libgcc-std.ver.in
+@@ -1947,6 +1947,6 @@ GCC_7.0.0 {
+ 
+ %inherit GCC_14.0.0 GCC_7.0.0
+ GCC_14.0.0 {
+-  __gcc_nested_func_ptr_created
+-  __gcc_nested_func_ptr_deleted
++  __builtin_nested_func_ptr_created
++  __builtin_nested_func_ptr_deleted
+ }
+diff --git a/libgcc/libgcc2.h b/libgcc/libgcc2.h
+index a7a5dff0184..ac7eaab4f01 100644
+--- a/libgcc/libgcc2.h
++++ b/libgcc/libgcc2.h
+@@ -29,8 +29,8 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ #pragma GCC visibility push(default)
+ #endif
+ 
+-extern void __gcc_nested_func_ptr_created (void *, void *, void **);
+-extern void __gcc_nested_func_ptr_deleted (void);
++extern void __builtin_nested_func_ptr_created (void *, void *, void **);
++extern void __builtin_nested_func_ptr_deleted (void);
+ 
+ extern int __gcc_bcmp (const unsigned char *, const unsigned char *, size_t);
+ extern void __clear_cache (void *, void *);
+-- 
+2.50.1 (Apple Git-155)
+
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 5be64c16ce84..048cfee9ffde 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  is13,
   langC,
   langAda,
   langObjC,
@@ -139,16 +140,6 @@ optionals noSysDirs (
   atLeast14 && stdenv.hostPlatform.isDarwin && langAda
 ) ../patches/14/gcc-darwin-remove-coreservices.patch
 
-# Use absolute path in GNAT dylib install names on Darwin
-++ optionals (stdenv.hostPlatform.isDarwin && langAda) (
-  {
-    "15" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
-    "14" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
-    "13" = [ ./gnat-darwin-dylib-install-name-13.patch ];
-  }
-  .${majorVersion} or [ ]
-)
-
 # Here we apply patches by Iains (https://github.com/iains)
 # GitHub's "compare" API produces unstable diffs, so we resort to reusing
 # diffs from the Homebrew repo.
@@ -185,6 +176,19 @@ optionals noSysDirs (
   .${majorVersion} or [ ]
 )
 
+# Use absolute path in GNAT dylib install names on Darwin
+++ optionals (stdenv.hostPlatform.isDarwin && langAda) (
+  {
+    "15" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
+    "14" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
+    # After the Iains patch, GCC 13 and 14 share the same patch.
+    "13" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
+  }
+  .${majorVersion} or [ ]
+)
+
+++ optional (langAda && is13) ./13/gnat13-aarch64-darwin-trampoline.patch
+
 ++ optional (targetPlatform.isWindows || targetPlatform.isCygwin) (fetchpatch {
   name = "libstdc-fix-compilation-in-freestanding-win32.patch";
   url = "https://inbox.sourceware.org/gcc-patches/20250922182808.2599390-2-corngood@gmail.com/raw";
diff --git a/pkgs/development/compilers/gcc/patches/gnat-darwin-dylib-install-name-13.patch b/pkgs/development/compilers/gcc/patches/gnat-darwin-dylib-install-name-13.patch
deleted file mode 100644
index 19c405d1226d..000000000000
--- a/pkgs/development/compilers/gcc/patches/gnat-darwin-dylib-install-name-13.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- a/gcc/ada/gcc-interface/Makefile.in
-+++ b/gcc/ada/gcc-interface/Makefile.in
-@@ -788,13 +788,13 @@ gnatlib-shared-darwin:
- 		-o libgnat$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		$(GNATRTL_NONTASKING_OBJS) $(LIBGNAT_OBJS) \
- 		$(SO_OPTS) \
--		-Wl,-install_name,@rpath/libgnat$(hyphen)$(LIBRARY_VERSION)$(soext) \
-+		-Wl,-install_name,$(ADA_RTL_DSO_DIR)/libgnat$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		$(MISCLIB)
- 	cd $(RTSDIR); $(GCC_FOR_ADA_RTS) -dynamiclib $(PICFLAG_FOR_TARGET) \
- 		-o libgnarl$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		$(GNATRTL_TASKING_OBJS) \
- 		$(SO_OPTS) \
--		-Wl,-install_name,@rpath/libgnarl$(hyphen)$(LIBRARY_VERSION)$(soext) \
-+		-Wl,-install_name,$(ADA_RTL_DSO_DIR)/libgnarl$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		$(THREADSLIB) -Wl,libgnat$(hyphen)$(LIBRARY_VERSION)$(soext)
- 	cd $(RTSDIR); $(LN_S) libgnat$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		libgnat$(soext)
diff --git a/pkgs/development/compilers/gnat-bootstrap/default.nix b/pkgs/development/compilers/gnat-bootstrap/default.nix
index ef7ed876e583..fad7f427fbe6 100644
--- a/pkgs/development/compilers/gnat-bootstrap/default.nix
+++ b/pkgs/development/compilers/gnat-bootstrap/default.nix
@@ -65,6 +65,11 @@ stdenv.mkDerivation (
             hash = "sha256-DC95udGSzRDE22ON4UpekxTYWOSBeUdJvILbSFj6MFQ=";
             upstreamTriplet = "x86_64-pc-linux-gnu";
           };
+          aarch64-darwin = {
+            inherit url;
+            hash = "sha256-Bjl6iuM2xLknezR92j/kpDYpxqTcxK1v8rffmivOAVw=";
+            upstreamTriplet = "aarch64-apple-darwin23.2.0";
+          };
         }
         .${stdenv.hostPlatform.system} or throwUnsupportedSystem;
         "14" = {
@@ -87,6 +92,11 @@ stdenv.mkDerivation (
             hash = "sha256-SVW/0yyj6ZH1GAjvD+unII+zSLGd3KGFt1bjjQ3SEFU=";
             upstreamTriplet = "aarch64-linux-gnu";
           };
+          aarch64-darwin = {
+            inherit url;
+            hash = "sha256-/nARwdQzAMd41fslUbrgloxn0hVZp9PokfQ9yPmL1g8=";
+            upstreamTriplet = "aarch64-apple-darwin23.6.0";
+          };
         }
         .${stdenv.hostPlatform.system} or throwUnsupportedSystem;
       };
@@ -194,7 +204,7 @@ stdenv.mkDerivation (
     # [2]: https://gcc.gnu.org/onlinedocs/gcc-12.2.0/gcc/Fixed-Headers.html
 
     + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
-      upstreamBuildPrefix="/Users/runner/work/GNAT-FSF-builds/GNAT-FSF-builds/sbx/x86_64-darwin/gcc/install"
+      upstreamBuildPrefix="/Users/runner/work/GNAT-FSF-builds/GNAT-FSF-builds/sbx/${stdenv.hostPlatform.system}/gcc/install"
       for i in "$out"/lib/*.dylib "$out"/lib/gcc/*/*/adalib/*.dylib; do
         if [[ -f "$i" && ! -h "$i" ]]; then
           install_name_tool -id "$i" "$i" || true
@@ -236,7 +246,12 @@ stdenv.mkDerivation (
         "x86_64-linux"
         "x86_64-darwin"
       ]
-      ++ lib.optionals (lib.versionAtLeast majorVersion "14") [ "aarch64-linux" ];
+      ++ lib.optionals (lib.versionAtLeast majorVersion "13") [
+        "aarch64-darwin"
+      ]
+      ++ lib.optionals (lib.versionAtLeast majorVersion "14") [
+        "aarch64-linux"
+      ];
       sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     };
   }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ece4f96a5030..f43606b32c14 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3849,9 +3849,8 @@ with pkgs;
           stdenv.hostPlatform == stdenv.targetPlatform
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
-          && stdenv.buildPlatform.isx86_64
         then
-          overrideCC stdenv gnat-bootstrap13
+          overrideCC gccStdenv gnat-bootstrap13
         else
           stdenv;
     }
@@ -3877,9 +3876,8 @@ with pkgs;
           stdenv.hostPlatform == stdenv.targetPlatform
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
-          && stdenv.buildPlatform.isx86_64
         then
-          overrideCC stdenv gnat-bootstrap14
+          overrideCC gccStdenv gnat-bootstrap14
         else
           stdenv;
     }
@@ -3905,9 +3903,8 @@ with pkgs;
           stdenv.hostPlatform == stdenv.targetPlatform
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
-          && stdenv.buildPlatform.isx86_64
         then
-          overrideCC stdenv gnat-bootstrap14
+          overrideCC gccStdenv gnat-bootstrap14
         else
           stdenv;
     }
@@ -3933,31 +3930,23 @@ with pkgs;
           stdenv.hostPlatform == stdenv.targetPlatform
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
-          && stdenv.buildPlatform.isx86_64
         then
-          overrideCC stdenv gnat-bootstrap14
+          overrideCC gccStdenv gnat-bootstrap14
         else
           stdenv;
     }
   );
 
   gnat-bootstrap = gnat-bootstrap13;
-  gnat-bootstrap13 = wrapCCWith (
-    {
-      cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "13"; };
-    }
-    // lib.optionalAttrs (stdenv.hostPlatform.isDarwin) {
-      bintools = bintoolsDualAs;
-    }
-  );
-  gnat-bootstrap14 = wrapCCWith (
-    {
-      cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "14"; };
-    }
-    // lib.optionalAttrs (stdenv.hostPlatform.isDarwin) {
-      bintools = bintoolsDualAs;
-    }
-  );
+  gnat-bootstrap13 = wrapCCWith {
+    cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "13"; };
+    isAlireGNAT = true;
+  };
+
+  gnat-bootstrap14 = wrapCCWith {
+    cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "14"; };
+    isAlireGNAT = true;
+  };
 
   gnat13Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat13; });
   gnat14Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat14; });

From 3df63464830fe406d9bdc3fdb209df94c164c370 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 28 May 2026 01:00:26 +0200
Subject: [PATCH 0275/1209] 
 python314Packages.opentelemetry-semantic-conventions-ai: run the test

There is only 1.
---
 .../opentelemetry-semantic-conventions-ai/default.nix        | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
index 14c16f870d03..b282e160d6ea 100644
--- a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
@@ -5,6 +5,7 @@
   hatchling,
   opentelemetry-sdk,
   opentelemetry-semantic-conventions,
+  pytestCheckHook,
 }:
 let
   version = "0.4.15";
@@ -27,6 +28,10 @@ buildPythonPackage {
     opentelemetry-semantic-conventions
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   pythonImportsCheck = [ "opentelemetry.semconv_ai" ];
 
   meta = {

From fea17e2a81c81a3a8141d23f4dc306d246db9487 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 May 2026 23:51:26 +0000
Subject: [PATCH 0276/1209] vim: 9.2.0389 -> 9.2.0541

---
 pkgs/applications/editors/vim/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 05ac73b9f13e..71848004202f 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0389";
+  version = "9.2.0541";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-shhdJn1bPJ/68a54UZMn1fla7P4tjVUN4DGLbx3ohOg=";
+    hash = "sha256-M2vdIAM3P2MZdcMvFX/3/fixliTosR06nvPIX7NXFNo=";
   };
 
   enableParallelBuilding = true;

From 6787f46af71ab63b31f0d87110275c9a2d890ffd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 28 May 2026 09:15:22 +0000
Subject: [PATCH 0277/1209] libsodium: 1.0.22-unstable-2026-04-09 ->
 1.0.22-unstable-2026-04-16

---
 pkgs/by-name/li/libsodium/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libsodium/package.nix b/pkgs/by-name/li/libsodium/package.nix
index 7046a0a7d80d..3fc91abaf0ca 100644
--- a/pkgs/by-name/li/libsodium/package.nix
+++ b/pkgs/by-name/li/libsodium/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsodium";
-  version = "1.0.22-unstable-2026-04-09";
+  version = "1.0.22-unstable-2026-04-16";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "libsodium";
-    rev = "77e1ce5d6dee871c49ef211222ba18ef0c486bda";
-    hash = "sha256-k8u7iNqvjLA0PptbneDyE8zCtutJlV2LirrRb41tmBY=";
+    rev = "33cc75ab1565d9dcbe808354191bd572ad6b64d0";
+    hash = "sha256-8kS9FBoaFaJOjH7XZc8IG3GaQaUiYD/awQOhs7j0n1Y=";
   };
 
   outputs = [

From 20c65e561681133532832ed922e5906493dcc06b Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 28 May 2026 20:53:34 +0900
Subject: [PATCH 0278/1209] python3Packages.certbot-nginx: fix build with
 certbot 5.6.0

---
 .../python-modules/certbot-nginx/default.nix          | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/certbot-nginx/default.nix b/pkgs/development/python-modules/certbot-nginx/default.nix
index e832f5e7ac09..ebe6f87ef6e3 100644
--- a/pkgs/development/python-modules/certbot-nginx/default.nix
+++ b/pkgs/development/python-modules/certbot-nginx/default.nix
@@ -1,9 +1,7 @@
 {
   buildPythonPackage,
-  acme,
   certbot,
   pyparsing,
-  pytestCheckHook,
   setuptools,
 }:
 
@@ -18,16 +16,13 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
   dependencies = [
-    acme
     certbot
     pyparsing
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pytestFlags = [
-    "-pno:cacheprovider"
-    "-Wignore::DeprecationWarning"
+  pythonImportsCheck = [
+    "certbot_nginx"
+    "certbot.plugins.nginx"
   ];
 
   meta = certbot.meta // {

From fd4f3737156ff8f2aa524f07771581c3b29ca103 Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Fri, 22 May 2026 01:28:43 +0200
Subject: [PATCH 0279/1209] libheif: 1.21.2 -> 1.22.2

---
 pkgs/by-name/li/libheif/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index 7d4912e77598..a24d7986b884 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libheif";
-  version = "1.21.2";
+  version = "1.22.2";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-odkJ0wZSGoZ7mX9fkaNREDpMvQuQA9HKaf3so1dYrbc=";
+    hash = "sha256-z5vTfZATfwDn8Zwqt3piS7PaOQQ3UG+u20sR6j+dsUg=";
   };
 
   nativeBuildInputs = [

From 117c2f76a71c2185e4430cbe83f86d92ebf7eb8e Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 26 May 2026 13:37:33 -0400
Subject: [PATCH 0280/1209] rust: 1.95.0 -> 1.96.0

blog: https://blog.rust-lang.org/releases/1.96.0
changelog: https://github.com/rust-lang/rust/releases/tag/1.96.0
diff: https://github.com/rust-lang/rust/compare/1.95.0...1.96.0

Fixes: CVE-2026-5222, https://blog.rust-lang.org/2026/05/25/cve-2026-5222/
Fixes: CVE-2026-5223, https://blog.rust-lang.org/2026/05/25/cve-2026-5223/
---
 .../compilers/rust/{1_95.nix => 1_96.nix}     | 42 +++++++++----------
 pkgs/top-level/all-packages.nix               |  8 ++--
 2 files changed, 25 insertions(+), 25 deletions(-)
 rename pkgs/development/compilers/rust/{1_95.nix => 1_96.nix} (56%)

diff --git a/pkgs/development/compilers/rust/1_95.nix b/pkgs/development/compilers/rust/1_96.nix
similarity index 56%
rename from pkgs/development/compilers/rust/1_95.nix
rename to pkgs/development/compilers/rust/1_96.nix
index 0c69095341b4..26d58ab8474a 100644
--- a/pkgs/development/compilers/rust/1_95.nix
+++ b/pkgs/development/compilers/rust/1_96.nix
@@ -50,8 +50,8 @@ let
 in
 import ./default.nix
   {
-    rustcVersion = "1.95.0";
-    rustcSha256 = "sha256-6puCqD5GlnU3w1ac6db6FoEcBDqW5lE3bDSecCQcpRU=";
+    rustcVersion = "1.96.0";
+    rustcSha256 = "sha256-6QqesVOylIr6yEDb6dd7ZON2cG8oZDh+53F/dFAEO0Q=";
 
     llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
     llvmSharedForHost = llvmSharedFor pkgsBuildHost;
@@ -65,30 +65,30 @@ import ./default.nix
     # Note: the version MUST be the same version that we are building. Upstream
     # ensures that each released compiler can compile itself:
     # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
-    bootstrapVersion = "1.95.0";
+    bootstrapVersion = "1.96.0";
 
     # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
     bootstrapHashes = {
-      i686-unknown-linux-gnu = "3ef2320bdfa9b69b19c6ca42f950b6bfb9d2af3b925b0c43a6bfecc4d355a66e";
-      x86_64-unknown-linux-gnu = "a47ac940abd12399d59ad15c877e7113fa35f2b9ec7e6a8a045d4fd8b9741dea";
-      x86_64-unknown-linux-musl = "059086762ac6f4ebe15b5b10e629e4e33e96b372765e65741251f75c4fdfb4e0";
-      arm-unknown-linux-gnueabihf = "7d742098e8bb0d10415775634eed83240ae88c1bae6bc73b470ccf0be4629b4c";
-      armv7-unknown-linux-gnueabihf = "23a201e72c082c285e957a32b40e1c30805b15d344b84b984be3659e9aefadf6";
-      aarch64-unknown-linux-gnu = "3b9385d3144ac57616befa0ccbac524f857ba1b4ab074226e73a24d43568a98e";
-      aarch64-unknown-linux-musl = "ad35bcc6928ccb4fd8a12fe19ce88c8fb6e6e3690578a0cb4e0839008017484f";
-      x86_64-apple-darwin = "3f3d9f29f8eb7aa821bd8531cb9b1c3c74c3976aa558dfabfcc15c2febb3cfb8";
-      aarch64-apple-darwin = "ec23ad2e0e15a7397d2c3c232356149cc871b7df7f47e25c2acb1070157f5398";
-      powerpc64-unknown-linux-gnu = "6d89e3739cfb7b3a05880734513361d5860492385217dcd166d033f3e974e823";
-      powerpc64le-unknown-linux-gnu = "29e3430f38406c926ee24ff911357dba0c46ff1d3ea59e91625b03677bd51b30";
-      powerpc64le-unknown-linux-musl = "b8856b651d64f4f4a2e2ee009366d99ea6135bdf88d15cf2134fc9e166745030";
-      riscv64gc-unknown-linux-gnu = "8b527cb1a09f53f83aa3420b4e763c9ea64a54d89e6d7242da35c8aeaa325593";
-      s390x-unknown-linux-gnu = "e9598bdd3bc1438d965208ef5186f0dd671826cddd4bcbb20e22a3cec14c111d";
-      loongarch64-unknown-linux-gnu = "18038ce7a910930c6742cc76e06fdd4b21b879466a3e67d63a0b6cae955bb4dc";
-      loongarch64-unknown-linux-musl = "eef910858c7e833b13c9cb32e79e59d89434999bc2a7d0b6447ab4046eb40461";
-      x86_64-unknown-freebsd = "0ffb7aa1999ea12363bbfaea500e152565bb4918ad5a73e9713be40510d75e49";
+      i686-unknown-linux-gnu = "1547d452083642c33118cc7fce1697d702ff94fdb4875bf5448fe5b1a6300bbd";
+      x86_64-unknown-linux-gnu = "c1130e4f7976f230766ab062b105b1fb050d6a78177db2246a5878fd6a589680";
+      x86_64-unknown-linux-musl = "545aff63f37dea2fcbd8037b877219fca6fbba97660bdcb8d3a0fc5df5fa9edf";
+      arm-unknown-linux-gnueabihf = "31758cb4175a0b7d2868d149c711ebfbe7b780a9cba5d2f84dce58ddf5a283e4";
+      armv7-unknown-linux-gnueabihf = "737d8ab2ace6107e4a3af4189b0e18f805adcafcc00195d5a377fe33e36577ce";
+      aarch64-unknown-linux-gnu = "20d5ebe3916fe489891fc577574e47fc679cdf62080c1bb1be6b6905ff4e275b";
+      aarch64-unknown-linux-musl = "f55a1f02736d9bcd38969a30f2e6bde8184fd36f13e94f773cac068a56407f16";
+      x86_64-apple-darwin = "ddaf6a98ccc500891a74bcb95807a04c89a0d1ad7b9c58bd7116620ff6f903a8";
+      aarch64-apple-darwin = "d97daf14c5c346c2d5a3271880d5a06d9885ec9af7e1fd2f072986e338526f8c";
+      powerpc64-unknown-linux-gnu = "e49b9fb0671cadef9e5b81871bcfc1dc2c53d7503de7f2d7fa34b7cacc7f62e6";
+      powerpc64le-unknown-linux-gnu = "0a80537d96ea86e6520687fa03841f2dfde2c7154ae4bf517d9664d4f13b0c31";
+      powerpc64le-unknown-linux-musl = "1deb71349f7ba2af27b9f348429fdae1d7841e6ad6c1bfd5fa9e759922fc79c3";
+      riscv64gc-unknown-linux-gnu = "ffdf86a600890771414ada76c711800114501c390631aa7b9c3cbfb94a2f6db3";
+      s390x-unknown-linux-gnu = "d29755bb2292ca25ec35ae1407379132a5d87cd916247e895162b93cb91dc5ae";
+      loongarch64-unknown-linux-gnu = "3a86d71a43f434234d3ac578ef06a5da86fe5c75ac34e9e43f60fe650577bed2";
+      loongarch64-unknown-linux-musl = "6cf0e53ed4678306de34d0f38b934e6dea1b0de56a4f99b725d56be49e1ba8ee";
+      x86_64-unknown-freebsd = "5457c15df17ff963b582b95c55fae3bc3736468e4df765182c75c19b1b6e8e74";
     };
 
-    selectRustPackage = pkgs: pkgs.rust_1_95;
+    selectRustPackage = pkgs: pkgs.rust_1_96;
   }
 
   (
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index af651298aa25..2ca22a36260f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4475,15 +4475,15 @@ with pkgs;
   wrapRustcWith = { rustc-unwrapped, ... }@args: callPackage ../build-support/rust/rustc-wrapper args;
   wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; };
 
-  rust_1_95 = callPackage ../development/compilers/rust/1_95.nix { };
-  rust = rust_1_95;
+  rust_1_96 = callPackage ../development/compilers/rust/1_96.nix { };
+  rust = rust_1_96;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
   mrustc-bootstrap = callPackage ../development/compilers/mrustc/bootstrap.nix { };
 
-  rustPackages_1_95 = rust_1_95.packages.stable;
-  rustPackages = rustPackages_1_95;
+  rustPackages_1_96 = rust_1_96.packages.stable;
+  rustPackages = rustPackages_1_96;
 
   inherit (rustPackages)
     cargo

From aa0e627f6e00f52ca5ca10cf48f71f73fb2f49a9 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 28 May 2026 21:32:04 +0100
Subject: [PATCH 0281/1209] libavif: 1.4.1 -> 1.4.2

Changes: https://github.com/AOMediaCodec/libavif/releases/tag/v1.4.2
---
 pkgs/by-name/li/libavif/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libavif/package.nix b/pkgs/by-name/li/libavif/package.nix
index c778d78d66a7..8ec16503feee 100644
--- a/pkgs/by-name/li/libavif/package.nix
+++ b/pkgs/by-name/li/libavif/package.nix
@@ -31,7 +31,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libavif";
-  version = "1.4.1";
+  version = "1.4.2";
 
   outputs = [
     "out"
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "AOMediaCodec";
     repo = "libavif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-035SoxHfN121mp3LGwGykReCi1WJbl2/nZH8c/VwABU=";
+    hash = "sha256-AMQ1TRPGpuBBW7tJ8xuLEVTAeOsLWTHuE0dFJjI7+W4=";
   };
 
   postPatch = ''

From c87a95cbd3a3b06d829d86bf30c093016a47e2bb Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Sun, 17 May 2026 14:03:02 +0300
Subject: [PATCH 0282/1209] cc-wrapper: enable tlsdesc on i686, x86_64 linux

TLSDESC is a more performant way of doing TLS, since it has a custom
calling convention that does not require the caller (of what's usually
__tls_get_addr) to spill clobbered registers and assumes that the callee
preserves all registers.

This adds corresponding plumbing in the machineFlags in the cc-wrapper
that includes version gates for compilers. TLSDESC needs to be supported
by the bintools and libc, so I've only enabled it for architectures that
our packaged glibc, musl, GNU binutils support (x86, x86_64).
We package a lot of LLVM versions and support for -mtls-dialect in the
Clang driver has only landed in LLVM 19, so a version check is added
there too.

Ideally we'd set the default at GCC build-time, but LLVM lacks such an
option, so we'd have to keep it in the compiler wrapper for now.

Gentoo is already building with it by default [1], as is Fedora [2].

In glibc < 2.40 [3] there existed a bug with not all registers being
preserved, but it has since been resolved. x86 support has existed
since basically forever with LLVM adding support in LLVM >= 19.1.
LoongArch support has been added recently too, but it's only available
since musl 1.2.6 while we are stuck at 1.2.5 for now, so I haven't dug
deeper. Aarch64 uses TLSDESC by default already.

The support status on non-Linux is a bit unclear, so these defaults are
scoped only to linux targets.

Sadly RISC-V support is still cooking apparently [4].

See: https://maskray.me/blog/2021-02-14-all-about-thread-local-storage
See: https://groups.google.com/g/x86-64-abi/c/0tjmaQx6nZ0

[1]: https://github.com/gentoo/gentoo/commit/46191b478ebcb6bc6831627526da44f04dfcd1be
[2]: https://src.fedoraproject.org/rpms/gcc/c/8f8d2ea9c326784bce044ff86547107611dda338?branch=rawhide
[3]: https://sourceware.org/bugzilla/show_bug.cgi?id=31372
[4]: https://github.com/riscv-non-isa/riscv-elf-psabi-doc/issues/494
---
 pkgs/build-support/cc-wrapper/default.nix | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index d95fbddc4e89..617bd299a41d 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -316,6 +316,17 @@ let
   tune =
     if targetPlatform ? gcc.tune then findBestTuneApproximation targetPlatform.gcc.tune else null;
 
+  tlsDialect =
+    if
+      # Support status on non-Linux systems is a bit unclear.
+      targetPlatform.isLinux
+      # Support added in https://github.com/llvm/llvm-project/commit/36b4a9ccd9f7e04010476e6b2a311f2052a4ac20 (19.1.0)
+      && (isClang -> versionAtLeast ccVersion "19.1")
+    then
+      (if targetPlatform.isx86 then "gnu2" else null)
+    else
+      null;
+
   # Machine flags. These are necessary to support
 
   # TODO: We should make a way to support miscellaneous machine
@@ -353,7 +364,13 @@ let
         # TODO: clang on powerpcspe also needs a condition: https://github.com/llvm/llvm-project/issues/71356
         # https://releases.llvm.org/18.1.6/tools/clang/docs/ReleaseNotes.html#loongarch-support
         ((targetPlatform.isLoongArch64 && isClang) -> versionAtLeast ccVersion "18.1")
-    ) "-mcmodel=${targetPlatform.gcc.cmodel}";
+    ) "-mcmodel=${targetPlatform.gcc.cmodel}"
+    # Enable TLSDESC. This needs to be supported by the libc and bintools.
+    # See: https://maskray.me/blog/2021-02-14-all-about-thread-local-storage
+    # Aarch64 uses TLSDESC by default and the option is completely ignored (at least on LLVM).
+    # TODO: Enable by default in GCC via --with-tls since https://gcc.gnu.org/cgit/gcc/commit/?id=96a291c4bb0b8a00b0a125e6a60f60072ffe53a7 (GCC 16).
+    # No equivalent build-time option for LLVM yet.
+    ++ optional (tlsDialect != null) "-mtls-dialect=${tlsDialect}";
 
   defaultHardeningFlags = bintools.defaultHardeningFlags or [ ];
 

From 851fd9401f8f79454d1e3e0b786ba4afcaecd134 Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Wed, 13 May 2026 02:00:12 +0300
Subject: [PATCH 0283/1209] elfutils: apply patch allowing R_386_TLS_DESC in
 shared libraries with elflint

Submitted a patch upstream that already got merged to main, so grab it now.
Tests fail without it on i686-linux.

[1]: https://patchwork.sourceware.org/project/elfutils/patch/20260512211127.4157383-1-sergei@zimmerman.foo/
---
 pkgs/by-name/el/elfutils/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix
index 4a73d364c75c..fe3de1161954 100644
--- a/pkgs/by-name/el/elfutils/package.nix
+++ b/pkgs/by-name/el/elfutils/package.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-strndupa.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "sha256-7daehJj1t0wPtQzTv+/Rpuqqs5Ng/EYnZzrcf2o/Lb0=";
     })
+    (fetchpatch {
+      name = "fix-i386_tlsdesc_relocation.patch";
+      url = "https://sourceware.org/git/?p=elfutils.git;a=patch;h=bfd519cc58e190544a6785d3f0a27fcfaf7d8da3";
+      hash = "sha256-N7DL2FG1AWLc+hcnxGMbUl5TuieoAc9OD6gc0sbsiGI=";
+    })
   ]
   ++ lib.optionals stdenv.hostPlatform.isMusl [ ./musl-error_h.patch ];
 

From 817b0e1338faca6deebeb9fca8beeef8409dbeea Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Wed, 13 May 2026 23:00:47 +0300
Subject: [PATCH 0284/1209] ffmpeg: use unwrapped clang for cuda-llvm support

The build system retargets clang for the appropriate nvidia arch
and doesn't depend on anything from the wrappers. Since the wrappped
compiler sets the flags for the original arch, it now includes
`-mtls-dialect=gnu2` on x86_64, which is not a supported flag for the
retargeted clang.
---
 pkgs/development/libraries/ffmpeg/generic.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index b1f682050f21..26b365ad17de 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -841,7 +841,7 @@ stdenv.mkDerivation (
     ++ optionals stdenv.hostPlatform.isx86 [ nasm ]
     # Texinfo version 7.1 introduced breaking changes, which older versions of ffmpeg do not handle.
     ++ optionals (lib.versionAtLeast version "6") [ texinfo ]
-    ++ optionals withCudaLLVM [ clang ]
+    ++ optionals withCudaLLVM [ clang.cc ]
     ++ optionals withCudaNVCC [ cuda_nvcc ];
 
     buildInputs =

From 3bef031c681b7c166dfd94aff0054c674a9b83c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 May 2026 11:32:16 -0700
Subject: [PATCH 0285/1209] python3Packages.fonttools: 4.61.1 -> 4.63.0

Diff: https://github.com/fonttools/fonttools/compare/4.61.1...4.63.0

Changelog: https://github.com/fonttools/fonttools/blob/4.63.0/NEWS.rst
---
 .../python-modules/fonttools/default.nix      | 23 +++++++++----------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index f93a7bd2152b..cdeeddf319ef 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -21,19 +21,20 @@
   xattr,
   skia-pathops,
   uharfbuzz,
+  addBinToPathHook,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "fonttools";
-  version = "4.61.1";
+  version = "4.63.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fonttools";
     repo = "fonttools";
     tag = version;
-    hash = "sha256-762bqAhOqqnuNSH8yFLTBnzYuigs716nt+uC1UwUqT4=";
+    hash = "sha256-XTE18TKpIa4MpbJ5tcHwCyLk3Q6CV/ElzMtddG86HJA=";
   };
 
   build-system = [
@@ -50,7 +51,7 @@ buildPythonPackage rec {
           (if isPyPy then brotlicffi else brotli)
           zopfli
         ];
-        unicode = lib.optional (pythonOlder "3.13") unicodedata2;
+        unicode = lib.optional (pythonOlder "3.15") unicodedata2;
         graphite = [ lz4 ];
         interpolatable = [
           pycairo
@@ -59,13 +60,14 @@ buildPythonPackage rec {
         plot = [ matplotlib ];
         symfont = [ sympy ];
         type1 = lib.optional stdenv.hostPlatform.isDarwin xattr;
-        pathops = lib.optional (lib.meta.availableOn stdenv.hostPlatform skia-pathops) skia-pathops;
+        pathops = [ skia-pathops ];
         repacker = [ uharfbuzz ];
       };
     in
     extras // { all = lib.concatLists (lib.attrValues extras); };
 
   nativeCheckInputs = [
+    addBinToPathHook
     pytestCheckHook
   ]
   ++ lib.concatLists (
@@ -75,20 +77,17 @@ buildPythonPackage rec {
         # "interpolatable" is not included because it only contains 2 tests at the time of writing but adds 270 extra dependencies
         "ufo"
       ]
-      ++ lib.optionals (!skia-pathops.meta.broken) [
-        "pathops" # broken
-      ]
+      ++
+        lib.optionals (lib.meta.availableOn stdenv.hostPlatform skia-pathops && !skia-pathops.meta.broken)
+          [
+            "pathops" # broken
+          ]
       ++ [ "repacker" ]
     ) optional-dependencies
   );
 
   pythonImportsCheck = [ "fontTools" ];
 
-  preCheck = ''
-    # tests want to execute the "fonttools" executable from $PATH
-    export PATH="$out/bin:$PATH"
-  '';
-
   # Timestamp tests have timing issues probably related
   # to our file timestamp normalization
   disabledTests = [

From b84bd317d02036f02ad3875e7bf83f1d3e90b165 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 May 2026 11:39:22 -0700
Subject: [PATCH 0286/1209] python3Packages.fonttools: use finalAttrs

---
 pkgs/development/python-modules/fonttools/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index cdeeddf319ef..d854d9126cbc 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -25,7 +25,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fonttools";
   version = "4.63.0";
   pyproject = true;
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fonttools";
     repo = "fonttools";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-XTE18TKpIa4MpbJ5tcHwCyLk3Q6CV/ElzMtddG86HJA=";
   };
 
@@ -83,7 +83,7 @@ buildPythonPackage rec {
             "pathops" # broken
           ]
       ++ [ "repacker" ]
-    ) optional-dependencies
+    ) finalAttrs.passthru.optional-dependencies
   );
 
   pythonImportsCheck = [ "fontTools" ];
@@ -99,8 +99,8 @@ buildPythonPackage rec {
   meta = {
     homepage = "https://github.com/fonttools/fonttools";
     description = "Library to manipulate font files from Python";
-    changelog = "https://github.com/fonttools/fonttools/blob/${src.tag}/NEWS.rst";
+    changelog = "https://github.com/fonttools/fonttools/blob/${finalAttrs.src.tag}/NEWS.rst";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.sternenseemann ];
   };
-}
+})

From ca04963848648973a36563cbe75246df5451361e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 28 May 2026 17:02:39 -0700
Subject: [PATCH 0287/1209] python3Packages.redis: 7.4.0 -> 8.0.0

Diff: https://github.com/redis/redis-py/compare/v7.4.0...v8.0.0

Changelog: https://github.com/redis/redis-py/releases/tag/v8.0.0
---
 .../python-modules/redis/default.nix           | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 66f7a75717a5..0271f7d5c5ed 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -23,18 +23,26 @@
   cryptography,
   pyopenssl,
   requests,
+
+  # extras: otel
+  opentelemetry-api,
+  opentelemetry-exporter-otlp-proto-http,
+  opentelemetry-sdk,
+
+  # extras: xxhash
+  xxhash,
 }:
 
 buildPythonPackage rec {
   pname = "redis";
-  version = "7.4.0";
+  version = "8.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis-py";
     tag = "v${version}";
-    hash = "sha256-alrfAYzjvoYsaA2NYVgI56f3R+5ed4CsA35ZmvXnk6k=";
+    hash = "sha256-ze9Q8IfSWDAEH0sR+ql0tOu7ajeXF78AKYD6SHpZqRU=";
   };
 
   build-system = [ hatchling ];
@@ -52,6 +60,12 @@ buildPythonPackage rec {
       pyopenssl
       requests
     ];
+    otel = [
+      opentelemetry-api
+      opentelemetry-exporter-otlp-proto-http
+      opentelemetry-sdk
+    ];
+    xxhash = [ xxhash ];
   };
 
   pythonImportsCheck = [

From c0bb1a038834705436cc4e266b75e74f7920c26a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 28 May 2026 17:11:55 -0700
Subject: [PATCH 0288/1209] python3Packages.redis: use finalAttrs

---
 pkgs/development/python-modules/redis/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 0271f7d5c5ed..24a401f4e3f6 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -33,7 +33,7 @@
   xxhash,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "redis";
   version = "8.0.0";
   pyproject = true;
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis-py";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ze9Q8IfSWDAEH0sR+ql0tOu7ajeXF78AKYD6SHpZqRU=";
   };
 
@@ -84,8 +84,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python client for Redis key-value store";
     homepage = "https://github.com/redis/redis-py";
-    changelog = "https://github.com/redis/redis-py/releases/tag/${src.tag}";
+    changelog = "https://github.com/redis/redis-py/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.dotlambda ];
   };
-}
+})

From 580c4bea8e9685918e83c71d5dfaa40c0f313ba0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 28 May 2026 17:08:27 -0700
Subject: [PATCH 0289/1209] python3Packages.redis: add passthru.tests

---
 .../python-modules/redis/default.nix          | 48 ++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 24a401f4e3f6..801be1ce99c8 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -31,6 +31,12 @@
 
   # extras: xxhash
   xxhash,
+
+  # tests
+  numpy,
+  pytest-asyncio,
+  pytestCheckHook,
+  redisTestHook,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -78,9 +84,49 @@ buildPythonPackage (finalAttrs: {
     "redis.utils"
   ];
 
-  # Tests require a running redis
+  nativeCheckInputs = [
+    numpy
+    pytest-asyncio
+    pytestCheckHook
+    redisTestHook
+  ]
+  ++ finalAttrs.passthru.optional-dependencies.circuit_breaker
+  ++ finalAttrs.passthru.optional-dependencies.otel;
+
+  enabledTestMarks = [
+    "onlynoncluster"
+  ];
+
+  disabledTestMarks = [
+    "onlycluster"
+    "redismod"
+  ];
+
+  disabledTestPaths = [
+    # requires Redis Sentinel
+    "tests/test_asyncio/test_sentinel.py"
+    "tests/test_sentinel.py"
+    # FIXME package redis-entraid
+    "tests/test_asyncio/test_credentials.py"
+    "tests/test_credentials.py"
+  ];
+
+  disabledTests = [
+    # requires a Redis cluster
+    "test_readonly_invalid_cluster_state"
+    # we run Valkey, not Redis
+    "test_lolwut"
+  ];
+
+  # circular dependency via pybreaker
   doCheck = false;
 
+  passthru.tests = {
+    pytest = finalAttrs.finalPackage.overrideAttrs {
+      doInstallCheck = true;
+    };
+  };
+
   meta = {
     description = "Python client for Redis key-value store";
     homepage = "https://github.com/redis/redis-py";

From a2e41bb76c7f3b1fca68f135e4029254225c5aa9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 28 May 2026 21:59:59 +0200
Subject: [PATCH 0290/1209] rust-cbindgen: 0.29.2 -> 0.29.3

https://github.com/mozilla/cbindgen/blob/v0.29.3/CHANGES
---
 pkgs/by-name/ru/rust-cbindgen/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rust-cbindgen/package.nix b/pkgs/by-name/ru/rust-cbindgen/package.nix
index 14374532ff52..88bb855e800b 100644
--- a/pkgs/by-name/ru/rust-cbindgen/package.nix
+++ b/pkgs/by-name/ru/rust-cbindgen/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-cbindgen";
-  version = "0.29.2";
+  version = "0.29.3";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cbindgen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P2A+XSLrcuYsI48gnZSNNs5qX+EatiuEJSEJbMvMSxg=";
+    hash = "sha256-d0rY7Sk37s8HEZlQq9Sbjj1P+DgygD0Yjx8cXlFKEIA=";
   };
 
-  cargoHash = "sha256-DbmlpjiOraLWPh5RgJqCIGIYzE1h82MH2S6gpLH+CIQ=";
+  cargoHash = "sha256-UeierkQpfCiB5ES9ZW9hO+0AcI9Ip8qSJ/Nd+I1xrmQ=";
 
   nativeCheckInputs = [
     cmake

From bec5224047e5eea5ec52f7ef11c9d7c391f78cb2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 28 May 2026 21:37:07 +0100
Subject: [PATCH 0291/1209] gssdp_1_6: 1.6.4 -> 1.6.5, gupnp_1_6: 1.6.9 ->
 1.6.10

Changes:
- https://gitlab.gnome.org/GNOME/gssdp/-/blob/gssdp-1.6.5/NEWS?ref_type=tags
- https://gitlab.gnome.org/GNOME/gupnp/-/blob/gupnp-1.6.10/NEWS?ref_type=tags
---
 pkgs/by-name/gs/gssdp_1_6/package.nix | 4 ++--
 pkgs/by-name/gu/gupnp_1_6/package.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gs/gssdp_1_6/package.nix b/pkgs/by-name/gs/gssdp_1_6/package.nix
index b4d8daba12c1..a25d7c8f1547 100644
--- a/pkgs/by-name/gs/gssdp_1_6/package.nix
+++ b/pkgs/by-name/gs/gssdp_1_6/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gssdp";
-  version = "1.6.4";
+  version = "1.6.5";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor finalAttrs.version}/gssdp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/5f9+39WHT5oE7T2ohRSWefC7/Q8wOY/P9Ax0LYmYDI=";
+    hash = "sha256-NP2CTDbvn1dVlNVXJyhBLduMUi9ga2yRPvi1qACq/E4=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/gu/gupnp_1_6/package.nix b/pkgs/by-name/gu/gupnp_1_6/package.nix
index f9c9c50a629c..357eff882818 100644
--- a/pkgs/by-name/gu/gupnp_1_6/package.nix
+++ b/pkgs/by-name/gu/gupnp_1_6/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gupnp";
-  version = "1.6.9";
+  version = "1.6.10";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor finalAttrs.version}/gupnp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Lttu42E1WOYvU4c1NoruJxUbfgnU4uLFFgaDPagBhps=";
+    hash = "sha256-oe4Ht7Emc8Mtf8c8oVilDBpNxpqzW2XpTSTTish1NF4=";
   };
 
   depsBuildBuild = [

From ddda3ed831d0d9f26f2fb446f8986b2c2fae4bc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Silva?= <andrerfosilva@gmail.com>
Date: Fri, 29 May 2026 10:01:50 +0100
Subject: [PATCH 0292/1209] rustPlatform.fetchCargoVendor: remove duplicate
 fetcher

---
 .../rust/fetch-cargo-vendor-util-v2.py        | 416 ------------------
 .../rust/fetch-cargo-vendor-util.py           |   5 +-
 .../build-support/rust/fetch-cargo-vendor.nix |  39 +-
 3 files changed, 18 insertions(+), 442 deletions(-)
 delete mode 100644 pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py b/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
deleted file mode 100644
index 5dc789c93ad9..000000000000
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
+++ /dev/null
@@ -1,416 +0,0 @@
-import functools
-import hashlib
-import json
-import multiprocessing as mp
-import re
-import shutil
-import subprocess
-import sys
-import tomllib
-from os.path import islink, realpath
-from pathlib import Path
-from typing import Any, TypedDict, cast
-from urllib.parse import unquote
-
-import requests
-import tomli_w
-from requests.adapters import HTTPAdapter, Retry
-
-eprint = functools.partial(print, file=sys.stderr)
-
-
-def load_toml(path: Path) -> dict[str, Any]:
-    with open(path, "rb") as f:
-        return tomllib.load(f)
-
-
-def get_lockfile_version(cargo_lock_toml: dict[str, Any]) -> int:
-    # lockfile v1 and v2 don't have the `version` key, so assume v2
-    version = cargo_lock_toml.get("version", 2)
-
-    # TODO: add logic for differentiating between v1 and v2
-
-    return version
-
-
-def create_http_session() -> requests.Session:
-    retries = Retry(
-        total=5,
-        backoff_factor=0.5,
-        status_forcelist=[500, 502, 503, 504]
-    )
-    session = requests.Session()
-    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
-    session.mount('http://', HTTPAdapter(max_retries=retries))
-    session.mount('https://', HTTPAdapter(max_retries=retries))
-    return session
-
-
-def download_file_with_checksum(session: requests.Session, url: str, destination_path: Path) -> str:
-    sha256_hash = hashlib.sha256()
-    with session.get(url, stream=True) as response:
-        if not response.ok:
-            raise Exception(f"Failed to fetch file from {url}. Status code: {response.status_code}")
-        with open(destination_path, "wb") as file:
-            for chunk in response.iter_content(1024):  # Download in chunks
-                if chunk:  # Filter out keep-alive chunks
-                    file.write(chunk)
-                    sha256_hash.update(chunk)
-
-    # Compute the final checksum
-    checksum = sha256_hash.hexdigest()
-    return checksum
-
-
-def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
-    # TODO: support other registries
-    #       maybe fetch config.json from the registry root and get the dl key
-    #       See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-    if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
-        raise Exception("Only the default crates.io registry is supported.")
-
-    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
-    # rate limit on the API servers.
-    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
-
-
-def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
-
-    url = get_download_url_for_tarball(pkg)
-    filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-    # TODO: allow legacy checksum specification, see importCargoLock for example
-    #       also, don't forget about the other usage of the checksum
-    expected_checksum = pkg["checksum"]
-
-    tarball_out_dir = out_dir / "tarballs" / filename
-    eprint(f"Fetching {url} -> tarballs/{filename}")
-
-    calculated_checksum = download_file_with_checksum(session, url, tarball_out_dir)
-
-    if calculated_checksum != expected_checksum:
-        raise Exception(f"Hash mismatch! File fetched from {url} had checksum {calculated_checksum}, expected {expected_checksum}.")
-
-
-def download_git_tree(url: str, git_sha_rev: str, out_dir: Path) -> None:
-
-    tree_out_dir = out_dir / "git" / git_sha_rev
-    eprint(f"Fetching {url}#{git_sha_rev} -> git/{git_sha_rev}")
-
-    cmd = ["nix-prefetch-git", "--builder", "--quiet", "--fetch-submodules", "--url", url, "--rev", git_sha_rev, "--out", str(tree_out_dir)]
-    subprocess.check_output(cmd)
-
-
-GIT_SOURCE_REGEX = re.compile("git\\+(?P<url>[^?]+)(\\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
-
-
-class GitSourceInfo(TypedDict):
-    url: str
-    type: str | None
-    value: str | None
-    git_sha_rev: str
-
-
-def parse_git_source(source: str, lockfile_version: int) -> GitSourceInfo:
-    match = GIT_SOURCE_REGEX.match(source)
-    if match is None:
-        raise Exception(f"Unable to process git source: {source}.")
-
-    source_info = cast(GitSourceInfo, match.groupdict(default=None))
-
-    # the source URL is URL-encoded in lockfile_version >=4
-    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
-    if lockfile_version >= 4 and source_info["value"] is not None:
-        source_info["value"] = unquote(source_info["value"])
-
-    return source_info
-
-
-def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    git_packages: list[dict[str, Any]] = []
-    registry_packages: list[dict[str, Any]] = []
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            eprint(f"Skipping local dependency: {pkg["name"]}")
-            continue
-        source = pkg["source"]
-
-        if source.startswith("git+"):
-            git_packages.append(pkg)
-        elif source.startswith("registry+"):
-            registry_packages.append(pkg)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-    git_sha_rev_to_url: dict[str, str] = {}
-    for pkg in git_packages:
-        source_info = parse_git_source(pkg["source"], lockfile_version)
-        git_sha_rev_to_url[source_info["git_sha_rev"]] = source_info["url"]
-
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    # fetch git trees sequentially, since fetching concurrently leads to flaky behaviour
-    if len(git_packages) != 0:
-        (out_dir / "git").mkdir()
-        for git_sha_rev, url in git_sha_rev_to_url.items():
-            download_git_tree(url, git_sha_rev, out_dir)
-
-    # run tarball download jobs in parallel, with at most 5 concurrent download jobs
-    with mp.Pool(min(5, mp.cpu_count())) as pool:
-        if len(registry_packages) != 0:
-            (out_dir / "tarballs").mkdir()
-            session = create_http_session()
-            tarball_args_gen = ((session, pkg, out_dir) for pkg in registry_packages)
-            pool.starmap(download_tarball, tarball_args_gen)
-
-
-def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
-    cmd = ["cargo", "metadata", "--format-version", "1", "--no-deps", "--manifest-path", str(manifest_path)]
-    output = subprocess.check_output(cmd)
-    return json.loads(output)
-
-
-def try_get_crate_manifest_path_from_manifest_path(manifest_path: Path, crate_name: str) -> Path | None:
-    try:
-        metadata = get_manifest_metadata(manifest_path)
-    except subprocess.CalledProcessError:
-        eprint(f"Warning: cargo metadata failed for {manifest_path}, skipping")
-        return None
-
-    for pkg in metadata["packages"]:
-        if pkg["name"] == crate_name:
-            return Path(pkg["manifest_path"])
-
-    return None
-
-
-def find_crate_manifest_in_tree(tree: Path, crate_name: str) -> Path:
-    # Scan all Cargo.toml files; sort by depth/path to make ordering deterministic
-    # and prefer less-nested manifests first.
-    manifest_paths = sorted(
-        tree.glob("**/Cargo.toml"),
-        key=lambda path: (len(path.parts), str(path)),
-    )
-
-    for manifest_path in manifest_paths:
-        res = try_get_crate_manifest_path_from_manifest_path(manifest_path, crate_name)
-        if res is not None:
-            return res
-
-    raise Exception(f"Couldn't find manifest for crate {crate_name} inside {tree}.")
-
-
-def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_dir: Path) -> None:
-
-    # This function will get called by copytree to decide which entries of a directory should be copied
-    # We'll copy everything except symlinks that are invalid
-    def ignore_func(dir_str: str, path_strs: list[str]) -> list[str]:
-        ignorelist: list[str] = []
-
-        dir = Path(realpath(dir_str, strict=True))
-
-        for path_str in path_strs:
-            path = dir / path_str
-            if not islink(path):
-                continue
-
-            # Filter out cyclic symlinks and symlinks pointing at nonexistant files
-            try:
-                target_path = Path(realpath(path, strict=True))
-            except OSError:
-                ignorelist.append(path_str)
-                eprint(f"Failed to resolve symlink, ignoring: {path}")
-                continue
-
-            # Filter out symlinks that point outside of the current crate's base git tree
-            # This can be useful if the nix build sandbox is turned off and there is a symlink to a common absolute path
-            if not target_path.is_relative_to(git_tree):
-                ignorelist.append(path_str)
-                eprint(f"Symlink points outside of the crate's base git tree, ignoring: {path} -> {target_path}")
-                continue
-
-        return ignorelist
-
-    crate_manifest_path = find_crate_manifest_in_tree(git_tree, crate_name)
-    crate_tree = crate_manifest_path.parent
-
-    eprint(f"Copying to {crate_out_dir}")
-    shutil.copytree(crate_tree, crate_out_dir, ignore=ignore_func)
-    crate_out_dir.chmod(0o755)
-
-    with open(crate_manifest_path, "r") as f:
-        manifest_data = f.read()
-
-    if "workspace" in manifest_data:
-        crate_manifest_metadata = get_manifest_metadata(crate_manifest_path)
-        workspace_root = Path(crate_manifest_metadata["workspace_root"])
-
-        root_manifest_path = workspace_root / "Cargo.toml"
-        manifest_path = crate_out_dir / "Cargo.toml"
-
-        manifest_path.chmod(0o644)
-        eprint(f"Patching {manifest_path}")
-
-        cmd = ["replace-workspace-values", str(manifest_path), str(root_manifest_path)]
-        subprocess.check_output(cmd)
-
-
-def extract_crate_tarball_contents(tarball_path: Path, crate_out_dir: Path) -> None:
-    eprint(f"Unpacking to {crate_out_dir}")
-    crate_out_dir.mkdir()
-    cmd = ["tar", "xf", str(tarball_path), "-C", str(crate_out_dir), "--strip-components=1"]
-    subprocess.check_output(cmd)
-
-
-def make_git_source_selector(source_info: GitSourceInfo) -> dict[str, str]:
-    selector = {}
-    selector["git"] = source_info["url"]
-    if source_info["type"] is not None:
-        selector[source_info["type"]] = source_info["value"]
-    return selector
-
-
-def make_registry_source_selector(source: str) -> dict[str, str]:
-    registry = source[9:] if source.startswith("registry+") else source
-    selector = {}
-    selector["registry"] = registry
-    return selector
-
-
-def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
-    lockfile_path = vendor_staging_dir / "Cargo.lock"
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    source_to_ind: dict[str, str] = {}
-    source_config = {}
-    next_registry_ind = 0
-    next_git_ind = 0
-
-    def add_source_replacement(
-        orig_key: str,
-        orig_selector: dict[str, str],
-        vendored_key: str,
-        vendored_dir: str
-    ) -> None:
-        source_config[vendored_key] = {}
-        source_config[vendored_key]["directory"] = vendored_dir
-        source_config[orig_key] = orig_selector
-        source_config[orig_key]["replace-with"] = vendored_key
-
-    # we reserve registry index 0 for crates-io
-    source_to_ind["registry+https://github.com/rust-lang/crates.io-index"] = "registry-0"
-    source_to_ind["sparse+https://index.crates.io/"] = "registry-0"
-    add_source_replacement(
-        orig_key="crates-io",
-        orig_selector={},  # there is an internal selector defined for the `crates-io` source
-        vendored_key="vendored-source-registry-0",
-        vendored_dir="@vendor@/source-registry-0"
-    )
-    next_registry_ind += 1
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependencies
-        if "source" not in pkg.keys():
-            continue
-        source: str = pkg["source"]
-        if source in source_to_ind:
-            continue
-
-        if source.startswith("git+"):
-            ind = f"git-{next_git_ind}"
-            next_git_ind += 1
-            source_info = parse_git_source(source, lockfile_version)
-            selector = make_git_source_selector(source_info)
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            ind = f"registry-{next_registry_ind}"
-            next_registry_ind += 1
-            selector = make_registry_source_selector(source)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-        source_to_ind[source] = ind
-        add_source_replacement(
-            orig_key=f"original-source-{ind}",
-            orig_selector=selector,
-            vendored_key=f"vendored-source-{ind}",
-            vendored_dir=f"@vendor@/source-{ind}"
-        )
-
-    config_path = out_dir / ".cargo" / "config.toml"
-    config_path.parent.mkdir()
-
-    with open(config_path, "wb") as config_file:
-        tomli_w.dump({"source": source_config}, config_file)
-
-    for pkg in cargo_lock_toml["package"]:
-
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            continue
-
-        source: str = pkg["source"]
-        source_ind = source_to_ind[source]
-        crate_dir_name = f"{pkg["name"]}-{pkg["version"]}"
-        source_dir_name = f"source-{source_ind}"
-        crate_out_dir = out_dir / source_dir_name / crate_dir_name
-        crate_out_dir.parent.mkdir(exist_ok=True)
-
-        if source.startswith("git+"):
-
-            source_info = parse_git_source(source, lockfile_version)
-
-            git_sha_rev = source_info["git_sha_rev"]
-            git_tree = vendor_staging_dir / "git" / git_sha_rev
-
-            copy_and_patch_git_crate_subtree(git_tree, pkg["name"], crate_out_dir)
-
-            # git based crates allow having no checksum information
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}}, f)
-
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-            # TODO: change this when non-crates-io registries are supported
-            dir_name = "tarballs"
-
-            tarball_path = vendor_staging_dir / dir_name / filename
-
-            extract_crate_tarball_contents(tarball_path, crate_out_dir)
-
-            # non-git based crates need the package checksum at minimum
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}, "package": pkg["checksum"]}, f)
-
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-
-def main() -> None:
-    subcommand = sys.argv[1]
-
-    subcommand_func_dict = {
-        "create-vendor-staging": lambda: create_vendor_staging(lockfile_path=Path(sys.argv[2]), out_dir=Path(sys.argv[3])),
-        "create-vendor": lambda: create_vendor(vendor_staging_dir=Path(sys.argv[2]), out_dir=Path(sys.argv[3]))
-    }
-
-    subcommand_func = subcommand_func_dict.get(subcommand)
-
-    if subcommand_func is None:
-        raise Exception(f"Unknown subcommand: '{subcommand}'. Must be one of {list(subcommand_func_dict.keys())}")
-
-    subcommand_func()
-
-
-if __name__ == "__main__":
-    main()
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util.py b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
index 3bee7e150c8e..5dc789c93ad9 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util.py
+++ b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
@@ -40,6 +40,7 @@ def create_http_session() -> requests.Session:
         status_forcelist=[500, 502, 503, 504]
     )
     session = requests.Session()
+    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
     session.mount('http://', HTTPAdapter(max_retries=retries))
     session.mount('https://', HTTPAdapter(max_retries=retries))
     return session
@@ -68,7 +69,9 @@ def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
     if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
         raise Exception("Only the default crates.io registry is supported.")
 
-    return f"https://crates.io/api/v1/crates/{pkg["name"]}/{pkg["version"]}/download"
+    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
+    # rate limit on the API servers.
+    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
 
 
 def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index 2802bf9e73f1..8d554a8dc3e2 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -37,29 +37,18 @@ let
     "hash"
   ];
 
-  mkFetchCargoVendorUtil =
-    name: src:
-    writers.writePython3Bin name {
-      libraries =
-        with python3Packages;
-        [
-          requests
-          tomli-w
-        ]
-        ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
-      flakeIgnore = [
-        "E501"
-      ];
-    } (builtins.readFile src);
-
-  # Separate util used only by the FOD `vendorStaging` stage below. Kept
-  # distinct from fetchCargoVendorUtil so that changes to the network-facing
-  # bits (User-Agent, download URL) don't invalidate the input-addressed
-  # `-vendor` stage and force a mass rebuild of every Rust package in nixpkgs.
-  # vendorStaging is an FOD, so swapping its util is free for consumers.
-  # TODO: unify with fetchCargoVendorUtil on the next `staging` cycle.
-  fetchCargoVendorUtilV2 = mkFetchCargoVendorUtil "fetch-cargo-vendor-util-v2" ./fetch-cargo-vendor-util-v2.py;
-  fetchCargoVendorUtil = mkFetchCargoVendorUtil "fetch-cargo-vendor-util" ./fetch-cargo-vendor-util.py;
+  fetchCargoVendorUtil = writers.writePython3Bin "fetch-cargo-vendor-util" {
+    libraries =
+      with python3Packages;
+      [
+        requests
+        tomli-w
+      ]
+      ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
+    flakeIgnore = [
+      "E501"
+    ];
+  } (builtins.readFile ./fetch-cargo-vendor-util.py);
 in
 
 {
@@ -79,7 +68,7 @@ let
       impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
       nativeBuildInputs = [
-        fetchCargoVendorUtilV2
+        fetchCargoVendorUtil
         cacert
         nix-prefetch-git'
       ]
@@ -92,7 +81,7 @@ let
           cd "$cargoRoot"
         fi
 
-        fetch-cargo-vendor-util-v2 create-vendor-staging ./Cargo.lock "$out"
+        fetch-cargo-vendor-util create-vendor-staging ./Cargo.lock "$out"
 
         runHook postBuild
       '';

From 37ff020c2fefcccc4a354c0f8a193da9b700aea0 Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Thu, 28 May 2026 10:48:35 +0200
Subject: [PATCH 0293/1209] python3Packages.pillow-heif: disable tests that
 abuse spec and break in libheif 1.22.0, disable version check for libheif

---
 .../python-modules/pillow-heif/default.nix            | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/python-modules/pillow-heif/default.nix b/pkgs/development/python-modules/pillow-heif/default.nix
index eea442596817..cc00832bb662 100644
--- a/pkgs/development/python-modules/pillow-heif/default.nix
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@@ -77,6 +77,17 @@ buildPythonPackage rec {
   disabledTests = [
     # Time sensitive speed test, not reproducible
     "test_decode_threads"
+    # Tests failing with libheif 1.22.0. To be removed in the next release
+    # https://github.com/bigcat88/pillow_heif/issues/424
+    # these check what happens when the ispe is not valid
+    "test_numpy_array_invalid_ispe"
+    "test_allow_incorrect_headers"
+    "test_invalid_ispe_ok"
+    "test_invalid_ispe_allow"
+    "test_invalid_ispe_stride"
+    "test_invalid_ispe_stride_pillow"
+    # disable version check for libheif
+    "test_libheif_info"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # https://github.com/bigcat88/pillow_heif/issues/89

From 341ec4198d06f7312d63b970d92292be38ca2b7a Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 26 May 2026 20:57:21 +0300
Subject: [PATCH 0294/1209] curl{,Minimal}: patch shebang of wcurl script with
 host runtimeShell

---
 pkgs/by-name/cu/curlMinimal/package.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 6edda92e8609..a1b1e8210ba2 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -6,6 +6,8 @@
   perl,
   nixosTests,
   autoreconfHook,
+  buildPackages,
+  runtimeShellPackage,
   brotliSupport ? false,
   brotli,
   c-aresSupport ? false,
@@ -82,6 +84,9 @@ assert
     ]) > 1
   );
 
+let
+  isCross = !lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
   version = "8.20.0";
@@ -241,7 +246,19 @@ stdenv.mkDerivation (finalAttrs: {
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4.4.0
+  ''
+  # The wcurl shell script found in `''${!outputBin}/bin`, is located in the
+  # source along with all the scripts patched in `postPatch` above.
+  # `patchShebangs` at that stage causes the host intended wcurl script to get
+  # the buildPlatform's runtimeShell shebang, instead of the hostPlatform's. To
+  # make sure this doesn't happen we disallow it, and fix it above in the
+  # postInstall, and also with the conditional hostPlatform's
+  # runtimeShellPackage added in buildInputs.
+  + lib.optionalString isCross ''
+    patchShebangs --update --host "''${!outputBin}/bin"
   '';
+  disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
+  buildInputs = lib.optional isCross runtimeShellPackage;
 
   passthru =
     let

From 1a817546620f1988b2330765f94db19f96b76210 Mon Sep 17 00:00:00 2001
From: Gavin John <gavinnjohn@gmail.com>
Date: Fri, 29 May 2026 01:45:05 -0700
Subject: [PATCH 0295/1209] nixos/pcscd: expose package as option

---
 nixos/modules/services/hardware/pcscd.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/hardware/pcscd.nix b/nixos/modules/services/hardware/pcscd.nix
index f7e23df84f01..0b9aae8e2bbd 100644
--- a/nixos/modules/services/hardware/pcscd.nix
+++ b/nixos/modules/services/hardware/pcscd.nix
@@ -10,8 +10,6 @@ let
     builtins.concatStringsSep "\n\n" config.services.pcscd.readerConfigs
   );
 
-  package = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
-
   pluginEnv = pkgs.buildEnv {
     name = "pcscd-plugins";
     paths = map (p: "${p}/pcsc/drivers") config.services.pcscd.plugins;
@@ -36,6 +34,11 @@ in
   options.services.pcscd = {
     enable = lib.mkEnableOption "PCSC-Lite daemon, to access smart cards using SCard API (PC/SC)";
 
+    package = (lib.mkPackageOption pkgs "pcsclite" { }) // {
+      default = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
+      defaultText = lib.literalExpression "if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite";
+    };
+
     plugins = lib.mkOption {
       type = lib.types.listOf lib.types.package;
       defaultText = lib.literalExpression "[ pkgs.ccid ]";
@@ -101,8 +104,8 @@ in
   config = lib.mkIf config.services.pcscd.enable {
     environment.etc."reader.conf".source = cfgFile;
 
-    environment.systemPackages = [ package ];
-    systemd.packages = [ package ];
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
 
     services.pcscd.plugins = [ pkgs.ccid ];
 
@@ -133,7 +136,7 @@ in
       # https://github.com/NixOS/nixpkgs/issues/121088
       serviceConfig.ExecStart = [
         ""
-        "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
+        "${lib.getExe cfg.package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
       ];
     };
 

From 1468d638d9872ddb999cfc3053cc66a0089eb59b Mon Sep 17 00:00:00 2001
From: Gavin John <gavinnjohn@gmail.com>
Date: Fri, 29 May 2026 01:48:27 -0700
Subject: [PATCH 0296/1209] pcsclite: enable structuredAttrs,
 separateDebugInfo, strictDeps

__structuredAttrs and strictDeps being enabled are obvious. separateDebugInfo is enabled as it helps with troubleshooting broken plugins.
---
 pkgs/by-name/pc/pcsclite/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/pc/pcsclite/package.nix b/pkgs/by-name/pc/pcsclite/package.nix
index c4d14fe7a137..271bf0fdd121 100644
--- a/pkgs/by-name/pc/pcsclite/package.nix
+++ b/pkgs/by-name/pc/pcsclite/package.nix
@@ -88,6 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
     moveToOutput bin/pcsc-spy "$dev"
   '';
 
+  __structuredAttrs = true;
+  separateDebugInfo = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja

From 629e94d9f8a60ac5d9ebf634722c0422371996f6 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Fri, 29 May 2026 19:17:22 +0200
Subject: [PATCH 0297/1209] libbacktrace: 0-unstable-2024-03-02 ->
 0-unstable-2026-05-03

---
 ...cktrace-avoid-libtool-wrapping-tests.patch | 201 ------------------
 ...acktrace-Allow-configuring-debug-dir.patch |  37 ++--
 pkgs/by-name/li/libbacktrace/package.nix      |  10 +-
 3 files changed, 26 insertions(+), 222 deletions(-)
 delete mode 100644 pkgs/by-name/li/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch

diff --git a/pkgs/by-name/li/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch b/pkgs/by-name/li/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch
deleted file mode 100644
index 61fd56ee0880..000000000000
--- a/pkgs/by-name/li/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch
+++ /dev/null
@@ -1,201 +0,0 @@
-From eadfee17e7d3a1c1bb2a0ff8585772b40331ebd7 Mon Sep 17 00:00:00 2001
-From: Jan Tojnar <jtojnar@gmail.com>
-Date: Sat, 24 Dec 2022 15:31:51 +0100
-Subject: [PATCH 1/4] libbacktrace: avoid libtool wrapping tests
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When `--enable-shared` is used, libtool will produce shell scripts
-instead of programs, preventing separate debug info from being generated:
-
-    objcopy --only-keep-debug btest btest_gnudebuglink.debug
-    objcopy: btest: file format not recognized
-    make[2]: *** [Makefile:2615: btest_gnudebuglink] Error 1
-
-Let’s make it properly set rpath with `-no-install` flag,
-so that wrappers are not needed, as mentioned on
-https://autotools.info/libtool/wrappers.html
----
- Makefile.am | 28 +++++++++++++++++++++++-----
- 1 file changed, 23 insertions(+), 5 deletions(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index 3d67909..06ccf3f 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -107,6 +107,8 @@ check_DATA =
- # Flags to use when compiling test programs.
- libbacktrace_TEST_CFLAGS = $(EXTRA_FLAGS) $(WARN_FLAGS) -g
- 
-+libbacktrace_TEST_LDFLAGS = -no-install
-+
- if USE_DSYMUTIL
- 
- %.dSYM: %
-@@ -171,48 +173,56 @@ xcoff_%.c: xcoff.c
- 
- test_elf_32_SOURCES = test_format.c testlib.c
- test_elf_32_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_elf_32_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_elf_32_LDADD = libbacktrace_noformat.la elf_32.lo
- 
- BUILDTESTS += test_elf_32
- 
- test_elf_64_SOURCES = test_format.c testlib.c
- test_elf_64_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_elf_64_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_elf_64_LDADD = libbacktrace_noformat.la elf_64.lo
- 
- BUILDTESTS += test_elf_64
- 
- test_macho_SOURCES = test_format.c testlib.c
- test_macho_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_macho_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_macho_LDADD = libbacktrace_noformat.la macho.lo
- 
- BUILDTESTS += test_macho
- 
- test_xcoff_32_SOURCES = test_format.c testlib.c
- test_xcoff_32_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_xcoff_32_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_xcoff_32_LDADD = libbacktrace_noformat.la xcoff_32.lo
- 
- BUILDTESTS += test_xcoff_32
- 
- test_xcoff_64_SOURCES = test_format.c testlib.c
- test_xcoff_64_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_xcoff_64_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_xcoff_64_LDADD = libbacktrace_noformat.la xcoff_64.lo
- 
- BUILDTESTS += test_xcoff_64
- 
- test_pecoff_SOURCES = test_format.c testlib.c
- test_pecoff_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_pecoff_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_pecoff_LDADD = libbacktrace_noformat.la pecoff.lo
- 
- BUILDTESTS += test_pecoff
- 
- test_unknown_SOURCES = test_format.c testlib.c
- test_unknown_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_unknown_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_unknown_LDADD = libbacktrace_noformat.la unknown.lo
- 
- BUILDTESTS += test_unknown
- 
- unittest_SOURCES = unittest.c testlib.c
- unittest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+unittest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- unittest_LDADD = libbacktrace.la
- 
- BUILDTESTS += unittest
-@@ -254,7 +264,7 @@ if HAVE_OBJCOPY_DEBUGLINK
- 
- b2test_SOURCES = $(btest_SOURCES)
- b2test_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--b2test_LDFLAGS = -Wl,--build-id
-+b2test_LDFLAGS = -Wl,--build-id $(libbacktrace_TEST_LDFLAGS)
- b2test_LDADD = libbacktrace_elf_for_test.la
- 
- check_PROGRAMS += b2test
-@@ -264,7 +274,7 @@ if HAVE_DWZ
- 
- b3test_SOURCES = $(btest_SOURCES)
- b3test_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--b3test_LDFLAGS = -Wl,--build-id
-+b3test_LDFLAGS = -Wl,--build-id $(libbacktrace_TEST_LDFLAGS)
- b3test_LDADD = libbacktrace_elf_for_test.la
- 
- check_PROGRAMS += b3test
-@@ -278,6 +288,7 @@ endif HAVE_ELF
- 
- btest_SOURCES = btest.c testlib.c
- btest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -O
-+btest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- btest_LDADD = libbacktrace.la
- 
- BUILDTESTS += btest
-@@ -332,6 +343,7 @@ endif HAVE_DWZ
- 
- stest_SOURCES = stest.c
- stest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+stest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- stest_LDADD = libbacktrace.la
- 
- BUILDTESTS += stest
-@@ -354,6 +366,7 @@ if HAVE_ELF
- 
- ztest_SOURCES = ztest.c testlib.c
- ztest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
-+ztest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- ztest_LDADD = libbacktrace.la
- ztest_alloc_LDADD = libbacktrace_alloc.la
- 
-@@ -373,6 +386,7 @@ BUILDTESTS += ztest_alloc
- 
- zstdtest_SOURCES = zstdtest.c testlib.c
- zstdtest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
-+zstdtest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- zstdtest_LDADD = libbacktrace.la
- zstdtest_alloc_LDADD = libbacktrace_alloc.la
- 
-@@ -394,6 +408,7 @@ endif HAVE_ELF
- 
- edtest_SOURCES = edtest.c edtest2_build.c testlib.c
- edtest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+edtest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- edtest_LDADD = libbacktrace.la
- 
- BUILDTESTS += edtest
-@@ -424,6 +439,7 @@ BUILDTESTS += ttest
- 
- ttest_SOURCES = ttest.c testlib.c
- ttest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -pthread
-+ttest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- ttest_LDADD = libbacktrace.la
- 
- if USE_DSYMUTIL
-@@ -472,12 +488,12 @@ if HAVE_COMPRESSED_DEBUG
- 
- ctestg_SOURCES = btest.c testlib.c
- ctestg_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--ctestg_LDFLAGS = -Wl,--compress-debug-sections=zlib-gnu
-+ctestg_LDFLAGS = -Wl,--compress-debug-sections=zlib-gnu $(libbacktrace_TEST_LDFLAGS)
- ctestg_LDADD = libbacktrace.la
- 
- ctesta_SOURCES = btest.c testlib.c
- ctesta_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--ctesta_LDFLAGS = -Wl,--compress-debug-sections=zlib-gabi
-+ctesta_LDFLAGS = -Wl,--compress-debug-sections=zlib-gabi $(libbacktrace_TEST_LDFLAGS)
- ctesta_LDADD = libbacktrace.la
- 
- BUILDTESTS += ctestg ctesta
-@@ -486,7 +502,7 @@ if HAVE_COMPRESSED_DEBUG_ZSTD
- 
- ctestzstd_SOURCES = btest.c testlib.c
- ctestzstd_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--ctestzstd_LDFLAGS = -Wl,--compress-debug-sections=zstd
-+ctestzstd_LDFLAGS = -Wl,--compress-debug-sections=zstd $(libbacktrace_TEST_LDFLAGS)
- ctestzstd_LDADD = libbacktrace.la
- 
- BUILDTESTS += ctestzstd
-@@ -533,6 +549,7 @@ endif
- 
- mtest_SOURCES = mtest.c testlib.c
- mtest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -O
-+mtest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- mtest_LDADD = libbacktrace.la
- 
- BUILDTESTS += mtest
-@@ -565,6 +582,7 @@ if HAVE_ELF
- 
- xztest_SOURCES = xztest.c testlib.c
- xztest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
-+xztest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- xztest_LDADD = libbacktrace.la
- 
- xztest_alloc_SOURCES = $(xztest_SOURCES)
--- 
-2.43.1
-
diff --git a/pkgs/by-name/li/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch b/pkgs/by-name/li/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch
index ee6063875091..da1efae66365 100644
--- a/pkgs/by-name/li/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch
+++ b/pkgs/by-name/li/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch
@@ -1,7 +1,7 @@
-From 2ceaa9bc8a9a0c8a02806a92e19bd21b3fccf3a0 Mon Sep 17 00:00:00 2001
+From f69f2a995d0c5c6bc44fd485a7f5d3b390f26fc4 Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
-Date: Sat, 24 Dec 2022 16:46:18 +0100
-Subject: [PATCH 2/4] libbacktrace: Allow configuring debug dir
+Date: Sat, 25 Apr 2026 23:01:23 +0200
+Subject: [PATCH] libbacktrace: Allow configuring debug dir
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -14,13 +14,13 @@ the path can be changed. The same flag is supported by gdb:
 
 https://github.com/bminor/binutils-gdb/blob/095f84c7e3cf85cd68c657c46b80be078f336bc9/gdb/configure.ac#L113-L115
 ---
- Makefile.am  | 13 +++++++------
+ Makefile.am  | 15 ++++++++-------
  configure.ac |  8 ++++++++
  elf.c        |  4 ++--
- 3 files changed, 17 insertions(+), 8 deletions(-)
+ 3 files changed, 18 insertions(+), 9 deletions(-)
 
 diff --git a/Makefile.am b/Makefile.am
-index 06ccf3f..6304faa 100644
+index 7b32e23..51431b9 100644
 --- a/Makefile.am
 +++ b/Makefile.am
 @@ -33,7 +33,8 @@ ACLOCAL_AMFLAGS = -I config
@@ -33,7 +33,7 @@ index 06ccf3f..6304faa 100644
  
  include_HEADERS = backtrace.h backtrace-supported.h
  
-@@ -134,7 +135,7 @@ libbacktrace_noformat_la_DEPENDENCIES = $(libbacktrace_noformat_la_LIBADD)
+@@ -136,7 +137,7 @@ libbacktrace_noformat_la_DEPENDENCIES = $(libbacktrace_noformat_la_LIBADD)
  if HAVE_ELF
  if HAVE_OBJCOPY_DEBUGLINK
  
@@ -42,7 +42,7 @@ index 06ccf3f..6304faa 100644
  
  check_LTLIBRARIES += libbacktrace_elf_for_test.la
  
-@@ -143,8 +144,8 @@ libbacktrace_elf_for_test_la_LIBADD = $(BACKTRACE_FILE) elf_for_test.lo \
+@@ -145,8 +146,8 @@ libbacktrace_elf_for_test_la_LIBADD = $(BACKTRACE_FILE) elf_for_test.lo \
  	$(VIEW_FILE) $(ALLOC_FILE)
  
  elf_for_test.c: elf.c
@@ -53,7 +53,7 @@ index 06ccf3f..6304faa 100644
  	$(SED) "s%$$SEARCH%$$REPLACE%" \
  		$< \
  		> $@.tmp
-@@ -474,13 +475,13 @@ endif HAVE_OBJCOPY_DEBUGLINK
+@@ -484,13 +485,13 @@ endif HAVE_OBJCOPY_DEBUGLINK
  
  %_buildid: %
  	./install-debuginfo-for-buildid.sh \
@@ -69,8 +69,17 @@ index 06ccf3f..6304faa 100644
  	  $<
  	$(OBJCOPY) --strip-all $< $@
  
+@@ -621,7 +622,7 @@ MAKETESTS += m2test_minidebug2
+ 	$(XZ) $<.mdbg2
+ 	$(OBJCOPY) --add-section .gnu_debugdata=$<.mdbg2.xz $<.dbg2
+ 	$(OBJCOPY) --add-section .gnu_debugdata=$<.mdbg2.xz $<.strip2
+-	$(SHELL) ./install-debuginfo-for-buildid.sh $(TEST_BUILD_ID_DIR) $<.dbg2
++	$(SHELL) ./install-debuginfo-for-buildid.sh "$(TEST_DEBUG_DIR)/.build-id" $<.dbg2
+ 	mv $<.strip2 $@
+ 
+ endif HAVE_OBJCOPY_DEBUGLINK
 diff --git a/configure.ac b/configure.ac
-index 69304ea..aeb2ee9 100644
+index 2267cc5..15cdc6e 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -67,6 +67,14 @@ AM_MAINTAINER_MODE
@@ -89,10 +98,10 @@ index 69304ea..aeb2ee9 100644
  # the wrong, non-multilib-adjusted value will be used in multilibs.
  # As a side effect, we have to subst CFLAGS ourselves.
 diff --git a/elf.c b/elf.c
-index 3ef07bb..21fbe4f 100644
+index e93729d..4765fae 100644
 --- a/elf.c
 +++ b/elf.c
-@@ -856,7 +856,7 @@ elf_readlink (struct backtrace_state *state, const char *filename,
+@@ -857,7 +857,7 @@ elf_readlink (struct backtrace_state *state, const char *filename,
      }
  }
  
@@ -101,7 +110,7 @@ index 3ef07bb..21fbe4f 100644
  
  /* Open a separate debug info file, using the build ID to find it.
     Returns an open file descriptor, or -1.
-@@ -870,7 +870,7 @@ elf_open_debugfile_by_buildid (struct backtrace_state *state,
+@@ -871,7 +871,7 @@ elf_open_debugfile_by_buildid (struct backtrace_state *state,
  			       backtrace_error_callback error_callback,
  			       void *data)
  {
@@ -111,5 +120,5 @@ index 3ef07bb..21fbe4f 100644
    const char * const suffix = ".debug";
    const size_t suffix_len = strlen (suffix);
 -- 
-2.43.1
+2.51.2
 
diff --git a/pkgs/by-name/li/libbacktrace/package.nix b/pkgs/by-name/li/libbacktrace/package.nix
index 0f3abdba1ab9..d91ff3888190 100644
--- a/pkgs/by-name/li/libbacktrace/package.nix
+++ b/pkgs/by-name/li/libbacktrace/package.nix
@@ -10,20 +10,16 @@
 
 stdenv.mkDerivation {
   pname = "libbacktrace";
-  version = "0-unstable-2024-03-02";
+  version = "0-unstable-2026-05-03";
 
   src = fetchFromGitHub {
     owner = "ianlancetaylor";
     repo = "libbacktrace";
-    rev = "28824f2cc9069e3fdc39d3702acdf753e35c41b4";
-    sha256 = "1k1O1GT22hZAWPF8NYP0y4qe+e3pGfzT9Mz2TH+H/v4=";
+    rev = "96664e69b1ecdb76e824be1d9e8f475b76dd08cf";
+    hash = "sha256-+tV6W8SnFWKweAASvFfb+i6bz73ssVGikNhVpq3YbT4=";
   };
 
   patches = [
-    # Fix tests with shared library.
-    # https://github.com/ianlancetaylor/libbacktrace/pull/99
-    ./0001-libbacktrace-avoid-libtool-wrapping-tests.patch
-
     # Support multiple debug dirs.
     # https://github.com/ianlancetaylor/libbacktrace/pull/100
     ./0002-libbacktrace-Allow-configuring-debug-dir.patch

From 783dea20a27c7e49ab239583288166c2fdf3cac6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 25 Mar 2026 22:56:21 +0000
Subject: [PATCH 0298/1209] svt-av1: 3.1.2 -> 4.1.0

---
 pkgs/by-name/sv/svt-av1/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sv/svt-av1/package.nix b/pkgs/by-name/sv/svt-av1/package.nix
index 23c007f26a50..4ad68f820e08 100644
--- a/pkgs/by-name/sv/svt-av1/package.nix
+++ b/pkgs/by-name/sv/svt-av1/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "svt-av1";
-  version = "3.1.2";
+  version = "4.1.0";
 
   src = fetchFromGitLab {
     owner = "AOMediaCodec";
     repo = "SVT-AV1";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/CpcxdyC4qf9wdzzySMYw17FbjYpasT+QVykXSlx28U=";
+    hash = "sha256-NPJG1SsRlG9kGtUwdJa/uP6DAtF09nCctzeorrvjAhQ=";
   };
 
   nativeBuildInputs = [

From 8cd7c741b06e03540da23de65cfd0868cb716bf4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 29 May 2026 11:14:40 -0700
Subject: [PATCH 0299/1209] ffmpeg_7: add patch for svt-av1 4.0

Co-authored-by: Alex James <git@alextjam.es>
---
 pkgs/development/libraries/ffmpeg/generic.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 3b799a0cf9e7..b37b1fced907 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -511,6 +511,13 @@ stdenv.mkDerivation (
           url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/d1ed5c06e3edc5f2b5f3664c80121fa55b0baa95";
           hash = "sha256-2NVkIhQVS1UQJVYuDdeH+ZvWYKVbtwW9Myu5gx7JnbA=";
         })
+      ]
+      ++ optionals (lib.versionAtLeast version "6" && lib.versionOlder version "7.1.4") [
+        (fetchpatch2 {
+          name = "svt-av1-4.0.0-compat.patch";
+          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/a5d4c398b411a00ac09d8fe3b66117222323844c";
+          hash = "sha256-peIXXU5+5DRQc3Xdpz5V+xIN7Vohs0Dlal6mHiMryXc=";
+        })
       ];
 
     configurePlatforms = [ ];

From e64abb9c87f7cb0758d29d84f630bc88802c56a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 29 May 2026 08:55:26 -0700
Subject: [PATCH 0300/1209] handbrake: drop unused patches

---
 pkgs/development/libraries/ffmpeg/generic.nix | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 06cf679cd2cd..22432b5c85ae 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -482,9 +482,6 @@ stdenv.mkDerivation (
           hash = "sha256-OLiQHKBNp2p63ZmzBBI4GEGz3WSSP+rMd8ITfZSVRgY=";
         })
       ]
-      ++ optionals (lib.versionAtLeast version "7.1" && lib.versionOlder version "7.1.1") [
-        ./fix-fate-ffmpeg-spec-disposition-7.1.patch
-      ]
       ++ optionals (lib.versionAtLeast version "7.1.1") [
         # Expose a private API for Chromium / Qt WebEngine.
         (fetchpatch2 {
@@ -492,19 +489,6 @@ stdenv.mkDerivation (
           hash = "sha256-DbH6ieJwDwTjKOdQ04xvRcSLeeLP2Z2qEmqeo8HsPr4=";
         })
       ]
-      ++ optionals (lib.versionAtLeast version "7.1" && lib.versionOlder version "7.1.4") [
-        (fetchpatch2 {
-          name = "lcevcdec-4.0.0-compat.patch";
-          url = "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fa23202cc7baab899894e8d22d82851a84967848.patch";
-          hash = "sha256-Ixkf1xzuDGk5t8J/apXKtghY0X9cfqSj/q987zrUuLQ=";
-        })
-      ]
-      ++ optionals (lib.versionAtLeast version "7.1.1" && lib.versionOlder version "7.1.3") [
-        (fetchpatch2 {
-          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/d8ffec5bf9a2803f55cc0822a97b7815f24bee83";
-          hash = "sha256-lmSI5arShb2/W84FMnSNs3lb6rd5vWdUSzfU8oza0Ic=";
-        })
-      ]
       ++ optionals (lib.versionOlder version "7.1.2") [
         (fetchpatch2 {
           name = "unbreak-svt-av1-3.0.0.patch";

From 1c2d1b16049b36ebec45c8cc17f16e5a702b3e0f Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 29 May 2026 21:58:09 +0100
Subject: [PATCH 0301/1209] libdrm: 2.4.133 -> 2.4.134

Changes: https://lists.x.org/archives/xorg-announce/2026-May/003701.html
---
 pkgs/by-name/li/libdrm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libdrm/package.nix b/pkgs/by-name/li/libdrm/package.nix
index caa0e573221a..7e0b8d177df9 100644
--- a/pkgs/by-name/li/libdrm/package.nix
+++ b/pkgs/by-name/li/libdrm/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdrm";
-  version = "2.4.133";
+  version = "2.4.134";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/libdrm/libdrm-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/Gj50LoupjyUMqKZ4U/qCfrXqKZugDn814AspZ93tPU=";
+    hash = "sha256-rF500VeDDri+5Exqa/OtSXdO8N0qcr2tdKjyAwi1KpU=";
   };
 
   outputs = [

From 4f574aac567ca60ec3bd37a2a670b99491cad5e6 Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Sat, 30 May 2026 00:07:32 +0300
Subject: [PATCH 0302/1209] 
 {khronos-ocl-icd-loader,opencl-clhpp,opencl-headers}: 2025.07.22 ->
 2026.05.29

Syncs with OpenCL 3.1. ocl-icd doesn't have a release yet.
---
 pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix | 4 ++--
 pkgs/by-name/op/opencl-clhpp/package.nix           | 4 ++--
 pkgs/by-name/op/opencl-headers/package.nix         | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix b/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix
index ebd9e4b077f3..f36cfa1fa910 100644
--- a/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix
+++ b/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencl-icd-loader";
-  version = "2025.07.22";
+  version = "2026.05.29";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-ICD-Loader";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jwviNwX7C7b9lqIS4oZ4YLEFBfBdmQfXHxW3FPPYxYs=";
+    hash = "sha256-PUfYCf2+0i+SatQerehPv97LOTDlBsQAmtHFX97UGzo=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/op/opencl-clhpp/package.nix b/pkgs/by-name/op/opencl-clhpp/package.nix
index b3b728561ade..0ef6776ff350 100644
--- a/pkgs/by-name/op/opencl-clhpp/package.nix
+++ b/pkgs/by-name/op/opencl-clhpp/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencl-clhpp";
-  version = "2025.07.22";
+  version = "2026.05.29";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-CLHPP";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    sha256 = "sha256-afiHjAhdhjtNkGggCO69MwHiQuJZb028lfpQl3HIvXw=";
+    sha256 = "sha256-VrI6cufrIXUizV2exKnQ5B1zjKzWsX5imp3ON39BkSw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opencl-headers/package.nix b/pkgs/by-name/op/opencl-headers/package.nix
index 86ab51dc5e33..52082350a991 100644
--- a/pkgs/by-name/op/opencl-headers/package.nix
+++ b/pkgs/by-name/op/opencl-headers/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencl-headers";
-  version = "2025.07.22";
+  version = "2026.05.29";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-Headers";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-XcDzBt4EAsip+5/lbZwPBO7/nDGAognUkJO/2Jg4OeY=";
+    sha256 = "sha256-qL8lFtjj+rYTsNz9RALx3pIlugAkcwclbGW7VIiijXk=";
   };
 
   nativeBuildInputs = [ cmake ];

From 64ae7d0e374a774bb78520e6b0f320e804317d70 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Fri, 29 May 2026 21:35:29 -0400
Subject: [PATCH 0303/1209] gnupatch: disable flaky test

Fixes #525260
---
 pkgs/tools/text/gnupatch/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index 99a801c4cc8e..188ac323543f 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -15,8 +15,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+Hzuae7CtPy/YKOWsDCtaqNBXxkqpffuhMrV4R9/WuM=";
   };
 
-  # This test is filesystem-dependent - observed failing on ZFS
-  postPatch = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+  # This test is filesystem-dependent - observed failing on ZFS.
+  # It is also just plain flaky: it has been observed failing about 10%
+  # of the time on btrfs and ext4 too.
+  postPatch = ''
     sed -E -i -e '/bad-filenames/d' tests/Makefile.am
   '';
 

From adb4fccdc759cc12b4791e486df9412190a308d9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 11 May 2026 22:18:34 +0200
Subject: [PATCH 0304/1209] python3: 3.13 -> 3.14

For 26.11 Python 3.14 will be the default Python release while 3.13 is
mostly provided for legacy compat.
---
 .../interpreters/python/default.nix           | 36 +++++++++----------
 pkgs/top-level/all-packages.nix               |  4 +--
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 1e70883b03a2..b2d04d79b56f 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -16,14 +16,14 @@
     passthruFun = import ./passthrufun.nix args;
 
     sources = {
-      python313 = {
+      python314 = {
         sourceVersion = {
           major = "3";
-          minor = "13";
-          patch = "13";
+          minor = "14";
+          patch = "5";
           suffix = "";
         };
-        hash = "sha256-Krkf9AF4PMymT3XRDIgulXvf1g4r9acvhCF5Nym3inE=";
+        hash = "sha256-fjJZe5nl2aOavtNd5Gk/oWnfPlhQ1MM0M3/9ahmjbbY=";
       };
     };
 
@@ -66,26 +66,26 @@
       inherit passthruFun;
     };
 
-    python313 = callPackage ./cpython (
-      {
-        self = __splicedPackages.python313;
-        inherit passthruFun;
-      }
-      // sources.python313
-    );
-
-    python314 = callPackage ./cpython {
-      self = __splicedPackages.python314;
+    python313 = callPackage ./cpython {
+      self = __splicedPackages.python313;
       sourceVersion = {
         major = "3";
-        minor = "14";
-        patch = "5";
+        minor = "13";
+        patch = "13";
         suffix = "";
       };
-      hash = "sha256-fjJZe5nl2aOavtNd5Gk/oWnfPlhQ1MM0M3/9ahmjbbY=";
+      hash = "sha256-Krkf9AF4PMymT3XRDIgulXvf1g4r9acvhCF5Nym3inE=";
       inherit passthruFun;
     };
 
+    python314 = callPackage ./cpython (
+      {
+        self = __splicedPackages.python314;
+        inherit passthruFun;
+      }
+      // sources.python314
+    );
+
     python315 = callPackage ./cpython {
       self = __splicedPackages.python315;
       sourceVersion = {
@@ -108,7 +108,7 @@
           # strip down that python version as much as possible
           withMinimalDeps = true;
         }
-        // sources.python313
+        // sources.python314
       )).overrideAttrs
         (old: {
           # TODO(@Artturin): Add this to the main cpython expr
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 304bce45d634..5d305e9d5258 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4899,11 +4899,11 @@ with pkgs;
   # available as `pythonPackages.tkinter` and can be used as any other Python package.
   # When switching these sets, please update docs at ../../doc/languages-frameworks/python.md
   python2 = python27;
-  python3 = python313;
+  python3 = python314;
 
   # pythonPackages further below, but assigned here because they need to be in sync
   python2Packages = dontRecurseIntoAttrs python27Packages;
-  python3Packages = dontRecurseIntoAttrs python313Packages;
+  python3Packages = dontRecurseIntoAttrs python314Packages;
 
   pypy = pypy2;
   pypy2 = pypy27;

From 2fb194308fdf9d22879c9bfc46228e2e991121e1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 11 May 2026 22:52:34 +0200
Subject: [PATCH 0305/1209] zstd: remove fetchpatch usage

Welcome to the fetchpatch bootstrap chain due to the Python 3.14 reverse
dependency.
---
 pkgs/tools/compression/zstd/default.nix   |  12 +-
 pkgs/tools/compression/zstd/man-fix.patch | 805 ++++++++++++++++++++++
 2 files changed, 811 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/tools/compression/zstd/man-fix.patch

diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index a014b652d313..03c614cb66e9 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   bashNonInteractive,
   gnugrep,
@@ -27,6 +26,11 @@
   testers,
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "zstd";
   version = "1.5.7";
@@ -49,11 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Pull missing manpages update:
     #   https://github.com/facebook/zstd/pull/4302
     # TODO: remove with 1.5.8 release
-    (fetchpatch {
-      name = "man-fix.patch";
-      url = "https://github.com/facebook/zstd/commit/6af3842118ea5325480b403213b2a9fbed3d3d74.patch";
-      hash = "sha256-i+iv+owUXbKU3UtZBsjfj86kFB3TDlpcVDNsDX8dyZE=";
-    })
+    ./man-fix.patch
   ];
 
   postPatch = lib.optionalString (!static) ''
diff --git a/pkgs/tools/compression/zstd/man-fix.patch b/pkgs/tools/compression/zstd/man-fix.patch
new file mode 100644
index 000000000000..7ef0a5a08d37
--- /dev/null
+++ b/pkgs/tools/compression/zstd/man-fix.patch
@@ -0,0 +1,805 @@
+From 6af3842118ea5325480b403213b2a9fbed3d3d74 Mon Sep 17 00:00:00 2001
+From: Yann Collet <cyan@fb.com>
+Date: Wed, 19 Feb 2025 16:25:00 -0800
+Subject: [PATCH] updated man pages and manual
+
+fixes #4301
+---
+ doc/zstd_manual.html |  55 +++++----
+ programs/zstd.1      | 260 +++++++++++++++++++++++++++++++++++++------
+ programs/zstdgrep.1  |   2 +-
+ programs/zstdless.1  |   2 +-
+ 4 files changed, 257 insertions(+), 62 deletions(-)
+
+diff --git a/doc/zstd_manual.html b/doc/zstd_manual.html
+index 485d5eafbe9..89f0761f492 100644
+--- a/doc/zstd_manual.html
++++ b/doc/zstd_manual.html
+@@ -110,6 +110,7 @@ <h3>Decompression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+            - ZSTD_CONTENTSIZE_UNKNOWN if the size cannot be determined
+            - ZSTD_CONTENTSIZE_ERROR if an error occurred (e.g. invalid magic number, srcSize too small)
+   note 1 : a 0 return value means the frame is valid but "empty".
++           When invoking this method on a skippable frame, it will return 0.
+   note 2 : decompressed size is an optional field, it may not be present (typically in streaming mode).
+            When `return==ZSTD_CONTENTSIZE_UNKNOWN`, data to decompress could be any size.
+            In which case, it's necessary to use streaming mode to decompress data.
+@@ -128,9 +129,8 @@ <h3>Decompression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+ </p></pre><BR>
+ 
+ <pre><b>ZSTD_DEPRECATED("Replaced by ZSTD_getFrameContentSize")
+-ZSTDLIB_API
+ unsigned long long ZSTD_getDecompressedSize(const void* src, size_t srcSize);
+-</b><p>  NOTE: This function is now obsolete, in favor of ZSTD_getFrameContentSize().
++</b><p>  This function is now obsolete, in favor of ZSTD_getFrameContentSize().
+   Both functions work the same way, but ZSTD_getDecompressedSize() blends
+   "empty", "unknown" and "error" results to the same return value (0),
+   while ZSTD_getFrameContentSize() gives them separate return values.
+@@ -142,7 +142,12 @@ <h3>Decompression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+  `srcSize` must be >= first frame size
+  @return : the compressed size of the first frame starting at `src`,
+            suitable to pass as `srcSize` to `ZSTD_decompress` or similar,
+-        or an error code if input is invalid 
++           or an error code if input is invalid
++  Note 1: this method is called _find*() because it's not enough to read the header,
++          it may have to scan through the frame's content, to reach its end.
++  Note 2: this method also works with Skippable Frames. In which case,
++          it returns the size of the complete skippable frame,
++          which is always equal to its content size + 8 bytes for headers. 
+ </p></pre><BR>
+ 
+ <h3>Compression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+@@ -166,8 +171,7 @@ <h3>Compression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+  
+ </p></pre><BR>
+ 
+-<h3>Error helper functions</h3><pre></pre><b><pre>#include "zstd_errors.h" </b>/* list of errors */<b>
+-</b>/* ZSTD_isError() :<b>
++<h3>Error helper functions</h3><pre></pre><b><pre></b>/* ZSTD_isError() :<b>
+  * Most ZSTD_* functions returning a size_t value can be tested for error,
+  * using ZSTD_isError().
+  * @return 1 if error, 0 otherwise
+@@ -1239,7 +1243,7 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+ </p></pre><BR>
+ 
+ <pre><b>ZSTDLIB_STATIC_API size_t ZSTD_frameHeaderSize(const void* src, size_t srcSize);
+-</b><p>  srcSize must be >= ZSTD_FRAMEHEADERSIZE_PREFIX.
++</b><p>  srcSize must be large enough, aka >= ZSTD_FRAMEHEADERSIZE_PREFIX.
+  @return : size of the Frame Header,
+            or an error code (if srcSize is too small) 
+ </p></pre><BR>
+@@ -1252,20 +1256,20 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+     unsigned blockSizeMax;
+     ZSTD_FrameType_e frameType;          </b>/* if == ZSTD_skippableFrame, frameContentSize is the size of skippable content */<b>
+     unsigned headerSize;
+-    unsigned dictID;
++    unsigned dictID;                     </b>/* for ZSTD_skippableFrame, contains the skippable magic variant [0-15] */<b>
+     unsigned checksumFlag;
+     unsigned _reserved1;
+     unsigned _reserved2;
+-} ZSTD_frameHeader;
++} ZSTD_FrameHeader;
+ </b></pre><BR>
+-<pre><b>ZSTDLIB_STATIC_API size_t ZSTD_getFrameHeader(ZSTD_FrameHeader* zfhPtr, const void* src, size_t srcSize);   </b>/**< doesn't consume input */<b>
++<pre><b>ZSTDLIB_STATIC_API size_t ZSTD_getFrameHeader(ZSTD_FrameHeader* zfhPtr, const void* src, size_t srcSize);
+ </b>/*! ZSTD_getFrameHeader_advanced() :<b>
+  *  same as ZSTD_getFrameHeader(),
+  *  with added capability to select a format (like ZSTD_f_zstd1_magicless) */
+ ZSTDLIB_STATIC_API size_t ZSTD_getFrameHeader_advanced(ZSTD_FrameHeader* zfhPtr, const void* src, size_t srcSize, ZSTD_format_e format);
+-</b><p>  decode Frame Header, or requires larger `srcSize`.
+- @return : 0, `zfhPtr` is correctly filled,
+-          >0, `srcSize` is too small, value is wanted `srcSize` amount,
++</b><p>  decode Frame Header into `zfhPtr`, or requires larger `srcSize`.
++ @return : 0 => header is complete, `zfhPtr` is correctly filled,
++          >0 => `srcSize` is too small, @return value is the wanted `srcSize` amount, `zfhPtr` is not filled,
+            or an error code, which can be tested using ZSTD_isError() 
+ </p></pre><BR>
+ 
+@@ -1421,7 +1425,7 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+ ZSTD_compressSequencesAndLiterals(ZSTD_CCtx* cctx,
+                       void* dst, size_t dstCapacity,
+                 const ZSTD_Sequence* inSeqs, size_t nbSequences,
+-                const void* literals, size_t litSize, size_t litCapacity,
++                const void* literals, size_t litSize, size_t litBufCapacity,
+                 size_t decompressedSize);
+ </b><p> This is a variant of ZSTD_compressSequences() which,
+  instead of receiving (src,srcSize) as input parameter, receives (literals,litSize),
+@@ -1435,20 +1439,22 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+  - Not compatible with frame checksum, which must be disabled
+  - If any block is incompressible, will fail and return an error
+  - @litSize must be == sum of all @.litLength fields in @inSeqs. Any discrepancy will generate an error.
+- - the buffer @literals must have a size @litCapacity which is larger than @litSize by at least 8 bytes.
++ - @litBufCapacity is the size of the underlying buffer into which literals are written, starting at address @literals.
++   @litBufCapacity must be at least 8 bytes larger than @litSize.
+  - @decompressedSize must be correct, and correspond to the sum of all Sequences. Any discrepancy will generate an error.
+  @return : final compressed size, or a ZSTD error code.
+  
+ </p></pre><BR>
+ 
+ <pre><b>ZSTDLIB_STATIC_API size_t ZSTD_writeSkippableFrame(void* dst, size_t dstCapacity,
+-                                const void* src, size_t srcSize, unsigned magicVariant);
++                                 const void* src, size_t srcSize,
++                                       unsigned magicVariant);
+ </b><p> Generates a zstd skippable frame containing data given by src, and writes it to dst buffer.
+ 
+  Skippable frames begin with a 4-byte magic number. There are 16 possible choices of magic number,
+  ranging from ZSTD_MAGIC_SKIPPABLE_START to ZSTD_MAGIC_SKIPPABLE_START+15.
+- As such, the parameter magicVariant controls the exact skippable frame magic number variant used, so
+- the magic number used will be ZSTD_MAGIC_SKIPPABLE_START + magicVariant.
++ As such, the parameter magicVariant controls the exact skippable frame magic number variant used,
++ so the magic number used will be ZSTD_MAGIC_SKIPPABLE_START + magicVariant.
+ 
+  Returns an error if destination buffer is not large enough, if the source size is not representable
+  with a 4-byte unsigned int, or if the parameter magicVariant is greater than 15 (and therefore invalid).
+@@ -1457,13 +1463,14 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+  
+ </p></pre><BR>
+ 
+-<pre><b>size_t ZSTD_readSkippableFrame(void* dst, size_t dstCapacity, unsigned* magicVariant,
+-                                const void* src, size_t srcSize);
+-</b><p> Retrieves a zstd skippable frame containing data given by src, and writes it to dst buffer.
++<pre><b>ZSTDLIB_STATIC_API size_t ZSTD_readSkippableFrame(void* dst, size_t dstCapacity,
++                                      unsigned* magicVariant,
++                                      const void* src, size_t srcSize);
++</b><p> Retrieves the content of a zstd skippable frame starting at @src, and writes it to @dst buffer.
+ 
+- The parameter magicVariant will receive the magicVariant that was supplied when the frame was written,
+- i.e. magicNumber - ZSTD_MAGIC_SKIPPABLE_START.  This can be NULL if the caller is not interested
+- in the magicVariant.
++ The parameter @magicVariant will receive the magicVariant that was supplied when the frame was written,
++ i.e. magicNumber - ZSTD_MAGIC_SKIPPABLE_START.
++ This can be NULL if the caller is not interested in the magicVariant.
+ 
+  Returns an error if destination buffer is not large enough, or if the frame is not skippable.
+ 
+@@ -1471,7 +1478,7 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+  
+ </p></pre><BR>
+ 
+-<pre><b>unsigned ZSTD_isSkippableFrame(const void* buffer, size_t size);
++<pre><b>ZSTDLIB_STATIC_API unsigned ZSTD_isSkippableFrame(const void* buffer, size_t size);
+ </b><p>  Tells if the content of `buffer` starts with a valid Frame Identifier for a skippable frame.
+  
+ </p></pre><BR>
+diff --git a/programs/zstd.1 b/programs/zstd.1
+index 5f1519f3323..5503a5b86f4 100644
+--- a/programs/zstd.1
++++ b/programs/zstd.1
+@@ -1,392 +1,580 @@
+-.TH "ZSTD" "1" "October 2024" "zstd 1.5.6" "User Commands"
++.
++.TH "ZSTD" "1" "February 2025" "zstd 1.5.7" "User Commands"
++.
+ .SH "NAME"
+ \fBzstd\fR \- zstd, zstdmt, unzstd, zstdcat \- Compress or decompress \.zst files
++.
+ .SH "SYNOPSIS"
+-.TS
+-allbox;
+-\fBzstd\fR [\fIOPTIONS\fR] [\-	\fIINPUT\-FILE\fR] [\-o \fIOUTPUT\-FILE\fR]
+-.TE
++\fBzstd\fR [\fIOPTIONS\fR] [\-|\fIINPUT\-FILE\fR] [\-o \fIOUTPUT\-FILE\fR]
++.
+ .P
+ \fBzstdmt\fR is equivalent to \fBzstd \-T0\fR
++.
+ .P
+ \fBunzstd\fR is equivalent to \fBzstd \-d\fR
++.
+ .P
+ \fBzstdcat\fR is equivalent to \fBzstd \-dcf\fR
++.
+ .SH "DESCRIPTION"
+ \fBzstd\fR is a fast lossless compression algorithm and data compression tool, with command line syntax similar to \fBgzip\fR(1) and \fBxz\fR(1)\. It is based on the \fBLZ77\fR family, with further FSE & huff0 entropy stages\. \fBzstd\fR offers highly configurable compression speed, from fast modes at > 200 MB/s per core, to strong modes with excellent compression ratios\. It also features a very fast decoder, with speeds > 500 MB/s per core, which remains roughly stable at all compression settings\.
++.
+ .P
+ \fBzstd\fR command line syntax is generally similar to gzip, but features the following few differences:
++.
+ .IP "\(bu" 4
+-Source files are preserved by default\. It's possible to remove them automatically by using the \fB\-\-rm\fR command\.
++Source files are preserved by default\. It\'s possible to remove them automatically by using the \fB\-\-rm\fR command\.
++.
+ .IP "\(bu" 4
+ When compressing a single file, \fBzstd\fR displays progress notifications and result summary by default\. Use \fB\-q\fR to turn them off\.
++.
+ .IP "\(bu" 4
+ \fBzstd\fR displays a short help page when command line is an error\. Use \fB\-q\fR to turn it off\.
++.
+ .IP "\(bu" 4
+-\fBzstd\fR does not accept input from console, though it does accept \fBstdin\fR when it's not the console\.
++\fBzstd\fR does not accept input from console, though it does accept \fBstdin\fR when it\'s not the console\.
++.
+ .IP "\(bu" 4
+-\fBzstd\fR does not store the input's filename or attributes, only its contents\.
++\fBzstd\fR does not store the input\'s filename or attributes, only its contents\.
++.
+ .IP "" 0
++.
+ .P
+ \fBzstd\fR processes each \fIfile\fR according to the selected operation mode\. If no \fIfiles\fR are given or \fIfile\fR is \fB\-\fR, \fBzstd\fR reads from standard input and writes the processed data to standard output\. \fBzstd\fR will refuse to write compressed data to standard output if it is a terminal: it will display an error message and skip the file\. Similarly, \fBzstd\fR will refuse to read compressed data from standard input if it is a terminal\.
++.
+ .P
+ Unless \fB\-\-stdout\fR or \fB\-o\fR is specified, \fIfiles\fR are written to a new file whose name is derived from the source \fIfile\fR name:
++.
+ .IP "\(bu" 4
+ When compressing, the suffix \fB\.zst\fR is appended to the source filename to get the target filename\.
++.
+ .IP "\(bu" 4
+ When decompressing, the \fB\.zst\fR suffix is removed from the source filename to get the target filename
++.
+ .IP "" 0
++.
+ .SS "Concatenation with \.zst Files"
+ It is possible to concatenate multiple \fB\.zst\fR files\. \fBzstd\fR will decompress such agglomerated file as if it was a single \fB\.zst\fR file\.
++.
+ .SH "OPTIONS"
++.
+ .SS "Integer Suffixes and Special Values"
+ In most places where an integer argument is expected, an optional suffix is supported to easily indicate large integers\. There must be no space between the integer and the suffix\.
++.
+ .TP
+ \fBKiB\fR
+-Multiply the integer by 1,024 (2\e^10)\. \fBKi\fR, \fBK\fR, and \fBKB\fR are accepted as synonyms for \fBKiB\fR\.
++Multiply the integer by 1,024 (2^10)\. \fBKi\fR, \fBK\fR, and \fBKB\fR are accepted as synonyms for \fBKiB\fR\.
++.
+ .TP
+ \fBMiB\fR
+-Multiply the integer by 1,048,576 (2\e^20)\. \fBMi\fR, \fBM\fR, and \fBMB\fR are accepted as synonyms for \fBMiB\fR\.
++Multiply the integer by 1,048,576 (2^20)\. \fBMi\fR, \fBM\fR, and \fBMB\fR are accepted as synonyms for \fBMiB\fR\.
++.
+ .SS "Operation Mode"
+ If multiple operation mode options are given, the last one takes effect\.
++.
+ .TP
+ \fB\-z\fR, \fB\-\-compress\fR
+ Compress\. This is the default operation mode when no operation mode option is specified and no other operation mode is implied from the command name (for example, \fBunzstd\fR implies \fB\-\-decompress\fR)\.
++.
+ .TP
+ \fB\-d\fR, \fB\-\-decompress\fR, \fB\-\-uncompress\fR
+ Decompress\.
++.
+ .TP
+ \fB\-t\fR, \fB\-\-test\fR
+ Test the integrity of compressed \fIfiles\fR\. This option is equivalent to \fB\-\-decompress \-\-stdout > /dev/null\fR, decompressed data is discarded and checksummed for errors\. No files are created or removed\.
++.
+ .TP
+ \fB\-b#\fR
+ Benchmark file(s) using compression level \fI#\fR\. See \fIBENCHMARK\fR below for a description of this operation\.
++.
+ .TP
+ \fB\-\-train FILES\fR
+ Use \fIFILES\fR as a training set to create a dictionary\. The training set should contain a lot of small files (> 100)\. See \fIDICTIONARY BUILDER\fR below for a description of this operation\.
++.
+ .TP
+ \fB\-l\fR, \fB\-\-list\fR
+-Display information related to a zstd compressed file, such as size, ratio, and checksum\. Some of these fields may not be available\. This command's output can be augmented with the \fB\-v\fR modifier\.
++Display information related to a zstd compressed file, such as size, ratio, and checksum\. Some of these fields may not be available\. This command\'s output can be augmented with the \fB\-v\fR modifier\.
++.
+ .SS "Operation Modifiers"
++.
+ .IP "\(bu" 4
+-\fB\-#\fR: selects \fB#\fR compression level [1\-19] (default: 3)\. Higher compression levels \fIgenerally\fR produce higher compression ratio at the expense of speed and memory\. A rough rule of thumb is that compression speed is expected to be divided by 2 every 2 levels\. Technically, each level is mapped to a set of advanced parameters (that can also be modified individually, see below)\. Because the compressor's behavior highly depends on the content to compress, there's no guarantee of a smooth progression from one level to another\.
++\fB\-#\fR: selects \fB#\fR compression level [1\-19] (default: 3)\. Higher compression levels \fIgenerally\fR produce higher compression ratio at the expense of speed and memory\. A rough rule of thumb is that compression speed is expected to be divided by 2 every 2 levels\. Technically, each level is mapped to a set of advanced parameters (that can also be modified individually, see below)\. Because the compressor\'s behavior highly depends on the content to compress, there\'s no guarantee of a smooth progression from one level to another\.
++.
+ .IP "\(bu" 4
+ \fB\-\-ultra\fR: unlocks high compression levels 20+ (maximum 22), using a lot more memory\. Note that decompression will also require more memory when using these levels\.
++.
+ .IP "\(bu" 4
+ \fB\-\-fast[=#]\fR: switch to ultra\-fast compression levels\. If \fB=#\fR is not present, it defaults to \fB1\fR\. The higher the value, the faster the compression speed, at the cost of some compression ratio\. This setting overwrites compression level if one was set previously\. Similarly, if a compression level is set after \fB\-\-fast\fR, it overrides it\.
++.
+ .IP "\(bu" 4
+ \fB\-T#\fR, \fB\-\-threads=#\fR: Compress using \fB#\fR working threads (default: 1)\. If \fB#\fR is 0, attempt to detect and use the number of physical CPU cores\. In all cases, the nb of threads is capped to \fBZSTDMT_NBWORKERS_MAX\fR, which is either 64 in 32\-bit mode, or 256 for 64\-bit environments\. This modifier does nothing if \fBzstd\fR is compiled without multithread support\.
++.
+ .IP "\(bu" 4
+ \fB\-\-single\-thread\fR: Use a single thread for both I/O and compression\. As compression is serialized with I/O, this can be slightly slower\. Single\-thread mode features significantly lower memory usage, which can be useful for systems with limited amount of memory, such as 32\-bit systems\.
++.
+ .IP
+ Note 1: this mode is the only available one when multithread support is disabled\.
++.
+ .IP
+ Note 2: this mode is different from \fB\-T1\fR, which spawns 1 compression thread in parallel with I/O\. Final compressed result is also slightly different from \fB\-T1\fR\.
++.
+ .IP "\(bu" 4
+ \fB\-\-auto\-threads={physical,logical} (default: physical)\fR: When using a default amount of threads via \fB\-T0\fR, choose the default based on the number of detected physical or logical cores\.
++.
+ .IP "\(bu" 4
+ \fB\-\-adapt[=min=#,max=#]\fR: \fBzstd\fR will dynamically adapt compression level to perceived I/O conditions\. Compression level adaptation can be observed live by using command \fB\-v\fR\. Adaptation can be constrained between supplied \fBmin\fR and \fBmax\fR levels\. The feature works when combined with multi\-threading and \fB\-\-long\fR mode\. It does not work with \fB\-\-single\-thread\fR\. It sets window size to 8 MiB by default (can be changed manually, see \fBwlog\fR)\. Due to the chaotic nature of dynamic adaptation, compressed result is not reproducible\.
++.
+ .IP
+ \fINote\fR: at the time of this writing, \fB\-\-adapt\fR can remain stuck at low speed when combined with multiple worker threads (>=2)\.
++.
+ .IP "\(bu" 4
+ \fB\-\-long[=#]\fR: enables long distance matching with \fB#\fR \fBwindowLog\fR, if \fB#\fR is not present it defaults to \fB27\fR\. This increases the window size (\fBwindowLog\fR) and memory usage for both the compressor and decompressor\. This setting is designed to improve the compression ratio for files with long matches at a large distance\.
++.
+ .IP
+ Note: If \fBwindowLog\fR is set to larger than 27, \fB\-\-long=windowLog\fR or \fB\-\-memory=windowSize\fR needs to be passed to the decompressor\.
++.
++.IP "\(bu" 4
++\fB\-\-max\fR: set advanced parameters to maximum compression\. warning: this setting is very slow and uses a lot of resources\. It\'s inappropriate for 32\-bit mode and therefore disabled in this mode\.
++.
+ .IP "\(bu" 4
+ \fB\-D DICT\fR: use \fBDICT\fR as Dictionary to compress or decompress FILE(s)
++.
+ .IP "\(bu" 4
+-\fB\-\-patch\-from FILE\fR: Specify the file to be used as a reference point for zstd's diff engine\. This is effectively dictionary compression with some convenient parameter selection, namely that \fIwindowSize\fR > \fIsrcSize\fR\.
++\fB\-\-patch\-from FILE\fR: Specify the file to be used as a reference point for zstd\'s diff engine\. This is effectively dictionary compression with some convenient parameter selection, namely that \fIwindowSize\fR > \fIsrcSize\fR\.
++.
+ .IP
+ Note: cannot use both this and \fB\-D\fR together\.
++.
+ .IP
+ Note: \fB\-\-long\fR mode will be automatically activated if \fIchainLog\fR < \fIfileLog\fR (\fIfileLog\fR being the \fIwindowLog\fR required to cover the whole file)\. You can also manually force it\.
++.
+ .IP
+-Note: up to level 15, you can use \fB\-\-patch\-from\fR in \fB\-\-single\-thread\fR mode to improve compression ratio marginally at the cost of speed\. Using '\-\-single\-thread' above level 15 will lead to lower compression ratios\.
++Note: up to level 15, you can use \fB\-\-patch\-from\fR in \fB\-\-single\-thread\fR mode to improve compression ratio marginally at the cost of speed\. Using \'\-\-single\-thread\' above level 15 will lead to lower compression ratios\.
++.
+ .IP
+ Note: for level 19, you can get increased compression ratio at the cost of speed by specifying \fB\-\-zstd=targetLength=\fR to be something large (i\.e\. 4096), and by setting a large \fB\-\-zstd=chainLog=\fR\.
++.
+ .IP "\(bu" 4
+-\fB\-\-rsyncable\fR: \fBzstd\fR will periodically synchronize the compression state to make the compressed file more rsync\-friendly\. There is a negligible impact to compression ratio, and a potential impact to compression speed, perceptible at higher speeds, for example when combining \fB\-\-rsyncable\fR with many parallel worker threads\. This feature does not work with \fB\-\-single\-thread\fR\. You probably don't want to use it with long range mode, since it will decrease the effectiveness of the synchronization points, but your mileage may vary\.
++\fB\-\-rsyncable\fR: \fBzstd\fR will periodically synchronize the compression state to make the compressed file more rsync\-friendly\. There is a negligible impact to compression ratio, and a potential impact to compression speed, perceptible at higher speeds, for example when combining \fB\-\-rsyncable\fR with many parallel worker threads\. This feature does not work with \fB\-\-single\-thread\fR\. You probably don\'t want to use it with long range mode, since it will decrease the effectiveness of the synchronization points, but your mileage may vary\.
++.
+ .IP "\(bu" 4
+ \fB\-C\fR, \fB\-\-[no\-]check\fR: add integrity check computed from uncompressed data (default: enabled)
++.
+ .IP "\(bu" 4
+ \fB\-\-[no\-]content\-size\fR: enable / disable whether or not the original size of the file is placed in the header of the compressed file\. The default option is \fB\-\-content\-size\fR (meaning that the original size will be placed in the header)\.
++.
+ .IP "\(bu" 4
+-\fB\-\-no\-dictID\fR: do not store dictionary ID within frame header (dictionary compression)\. The decoder will have to rely on implicit knowledge about which dictionary to use, it won't be able to check if it's correct\.
++\fB\-\-no\-dictID\fR: do not store dictionary ID within frame header (dictionary compression)\. The decoder will have to rely on implicit knowledge about which dictionary to use, it won\'t be able to check if it\'s correct\.
++.
+ .IP "\(bu" 4
+ \fB\-M#\fR, \fB\-\-memory=#\fR: Set a memory usage limit\. By default, \fBzstd\fR uses 128 MiB for decompression as the maximum amount of memory the decompressor is allowed to use, but you can override this manually if need be in either direction (i\.e\. you can increase or decrease it)\.
++.
+ .IP
+ This is also used during compression when using with \fB\-\-patch\-from=\fR\. In this case, this parameter overrides that maximum size allowed for a dictionary\. (128 MiB)\.
++.
+ .IP
+ Additionally, this can be used to limit memory for dictionary training\. This parameter overrides the default limit of 2 GiB\. zstd will load training samples up to the memory limit and ignore the rest\.
++.
+ .IP "\(bu" 4
+ \fB\-\-stream\-size=#\fR: Sets the pledged source size of input coming from a stream\. This value must be exact, as it will be included in the produced frame header\. Incorrect stream sizes will cause an error\. This information will be used to better optimize compression parameters, resulting in better and potentially faster compression, especially for smaller source sizes\.
++.
+ .IP "\(bu" 4
+ \fB\-\-size\-hint=#\fR: When handling input from a stream, \fBzstd\fR must guess how large the source size will be when optimizing compression parameters\. If the stream size is relatively small, this guess may be a poor one, resulting in a higher compression ratio than expected\. This feature allows for controlling the guess when needed\. Exact guesses result in better compression ratios\. Overestimates result in slightly degraded compression ratios, while underestimates may result in significant degradation\.
++.
+ .IP "\(bu" 4
+ \fB\-\-target\-compressed\-block\-size=#\fR: Attempt to produce compressed blocks of approximately this size\. This will split larger blocks in order to approach this target\. This feature is notably useful for improved latency, when the receiver can leverage receiving early incomplete data\. This parameter defines a loose target: compressed blocks will target this size "on average", but individual blocks can still be larger or smaller\. Enabling this feature can decrease compression speed by up to ~10% at level 1\. Higher levels will see smaller relative speed regression, becoming invisible at higher settings\.
++.
+ .IP "\(bu" 4
+ \fB\-f\fR, \fB\-\-force\fR: disable input and output checks\. Allows overwriting existing files, input from console, output to stdout, operating on links, block devices, etc\. During decompression and when the output destination is stdout, pass\-through unrecognized formats as\-is\.
++.
+ .IP "\(bu" 4
+ \fB\-c\fR, \fB\-\-stdout\fR: write to standard output (even if it is the console); keep original files (disable \fB\-\-rm\fR)\.
++.
+ .IP "\(bu" 4
+ \fB\-o FILE\fR: save result into \fBFILE\fR\. Note that this operation is in conflict with \fB\-c\fR\. If both operations are present on the command line, the last expressed one wins\.
++.
+ .IP "\(bu" 4
+ \fB\-\-[no\-]sparse\fR: enable / disable sparse FS support, to make files with many zeroes smaller on disk\. Creating sparse files may save disk space and speed up decompression by reducing the amount of disk I/O\. default: enabled when output is into a file, and disabled when output is stdout\. This setting overrides default and can force sparse mode over stdout\.
++.
+ .IP "\(bu" 4
+ \fB\-\-[no\-]pass\-through\fR enable / disable passing through uncompressed files as\-is\. During decompression when pass\-through is enabled, unrecognized formats will be copied as\-is from the input to the output\. By default, pass\-through will occur when the output destination is stdout and the force (\fB\-f\fR) option is set\.
++.
+ .IP "\(bu" 4
+ \fB\-\-rm\fR: remove source file(s) after successful compression or decompression\. This command is silently ignored if output is \fBstdout\fR\. If used in combination with \fB\-o\fR, triggers a confirmation prompt (which can be silenced with \fB\-f\fR), as this is a destructive operation\.
++.
+ .IP "\(bu" 4
+ \fB\-k\fR, \fB\-\-keep\fR: keep source file(s) after successful compression or decompression\. This is the default behavior\.
++.
+ .IP "\(bu" 4
+ \fB\-r\fR: operate recursively on directories\. It selects all files in the named directory and all its subdirectories\. This can be useful both to reduce command line typing, and to circumvent shell expansion limitations, when there are a lot of files and naming breaks the maximum size of a command line\.
++.
+ .IP "\(bu" 4
+ \fB\-\-filelist FILE\fR read a list of files to process as content from \fBFILE\fR\. Format is compatible with \fBls\fR output, with one file per line\.
++.
+ .IP "\(bu" 4
+ \fB\-\-output\-dir\-flat DIR\fR: resulting files are stored into target \fBDIR\fR directory, instead of same directory as origin file\. Be aware that this command can introduce name collision issues, if multiple files, from different directories, end up having the same name\. Collision resolution ensures first file with a given name will be present in \fBDIR\fR, while in combination with \fB\-f\fR, the last file will be present instead\.
++.
+ .IP "\(bu" 4
+ \fB\-\-output\-dir\-mirror DIR\fR: similar to \fB\-\-output\-dir\-flat\fR, the output files are stored underneath target \fBDIR\fR directory, but this option will replicate input directory hierarchy into output \fBDIR\fR\.
++.
+ .IP
+ If input directory contains "\.\.", the files in this directory will be ignored\. If input directory is an absolute directory (i\.e\. "/var/tmp/abc"), it will be stored into the "output\-dir/var/tmp/abc"\. If there are multiple input files or directories, name collision resolution will follow the same rules as \fB\-\-output\-dir\-flat\fR\.
++.
+ .IP "\(bu" 4
+ \fB\-\-format=FORMAT\fR: compress and decompress in other formats\. If compiled with support, zstd can compress to or decompress from other compression algorithm formats\. Possibly available options are \fBzstd\fR, \fBgzip\fR, \fBxz\fR, \fBlzma\fR, and \fBlz4\fR\. If no such format is provided, \fBzstd\fR is the default\.
++.
+ .IP "\(bu" 4
+ \fB\-h\fR/\fB\-H\fR, \fB\-\-help\fR: display help/long help and exit
++.
+ .IP "\(bu" 4
+ \fB\-V\fR, \fB\-\-version\fR: display version number and immediately exit\. note that, since it exits, flags specified after \fB\-V\fR are effectively ignored\. Advanced: \fB\-vV\fR also displays supported formats\. \fB\-vvV\fR also displays POSIX support\. \fB\-qV\fR will only display the version number, suitable for machine reading\.
++.
+ .IP "\(bu" 4
+ \fB\-v\fR, \fB\-\-verbose\fR: verbose mode, display more information
++.
+ .IP "\(bu" 4
+ \fB\-q\fR, \fB\-\-quiet\fR: suppress warnings, interactivity, and notifications\. specify twice to suppress errors too\.
++.
+ .IP "\(bu" 4
+ \fB\-\-no\-progress\fR: do not display the progress bar, but keep all other messages\.
++.
+ .IP "\(bu" 4
+ \fB\-\-show\-default\-cparams\fR: shows the default compression parameters that will be used for a particular input file, based on the provided compression level and the input size\. If the provided file is not a regular file (e\.g\. a pipe), this flag will output the parameters used for inputs of unknown size\.
++.
+ .IP "\(bu" 4
+ \fB\-\-exclude\-compressed\fR: only compress files that are not already compressed\.
++.
+ .IP "\(bu" 4
+ \fB\-\-\fR: All arguments after \fB\-\-\fR are treated as files
++.
+ .IP "" 0
++.
+ .SS "gzip Operation Modifiers"
+ When invoked via a \fBgzip\fR symlink, \fBzstd\fR will support further options that intend to mimic the \fBgzip\fR behavior:
++.
+ .TP
+ \fB\-n\fR, \fB\-\-no\-name\fR
+ do not store the original filename and timestamps when compressing a file\. This is the default behavior and hence a no\-op\.
++.
+ .TP
+ \fB\-\-best\fR
+ alias to the option \fB\-9\fR\.
++.
+ .SS "Environment Variables"
+ Employing environment variables to set parameters has security implications\. Therefore, this avenue is intentionally limited\. Only \fBZSTD_CLEVEL\fR and \fBZSTD_NBTHREADS\fR are currently supported\. They set the default compression level and number of threads to use during compression, respectively\.
++.
+ .P
+ \fBZSTD_CLEVEL\fR can be used to set the level between 1 and 19 (the "normal" range)\. If the value of \fBZSTD_CLEVEL\fR is not a valid integer, it will be ignored with a warning message\. \fBZSTD_CLEVEL\fR just replaces the default compression level (\fB3\fR)\.
++.
+ .P
+-\fBZSTD_NBTHREADS\fR can be used to set the number of threads \fBzstd\fR will attempt to use during compression\. If the value of \fBZSTD_NBTHREADS\fR is not a valid unsigned integer, it will be ignored with a warning message\. \fBZSTD_NBTHREADS\fR has a default value of (\fB1\fR), and is capped at ZSTDMT_NBWORKERS_MAX==200\. \fBzstd\fR must be compiled with multithread support for this variable to have any effect\.
++\fBZSTD_NBTHREADS\fR can be used to set the number of threads \fBzstd\fR will attempt to use during compression\. If the value of \fBZSTD_NBTHREADS\fR is not a valid unsigned integer, it will be ignored with a warning message\. \fBZSTD_NBTHREADS\fR has a default value of \fBmax(1, min(4, nbCores/4))\fR, and is capped at ZSTDMT_NBWORKERS_MAX==200\. \fBzstd\fR must be compiled with multithread support for this variable to have any effect\.
++.
+ .P
+ They can both be overridden by corresponding command line arguments: \fB\-#\fR for compression level and \fB\-T#\fR for number of compression threads\.
++.
+ .SH "ADVANCED COMPRESSION OPTIONS"
+ \fBzstd\fR provides 22 predefined regular compression levels plus the fast levels\. A compression level is translated internally into multiple advanced parameters that control the behavior of the compressor (one can observe the result of this translation with \fB\-\-show\-default\-cparams\fR)\. These advanced parameters can be overridden using advanced compression options\.
++.
+ .SS "\-\-zstd[=options]:"
+ The \fIoptions\fR are provided as a comma\-separated list\. You may specify only the options you want to change and the rest will be taken from the selected or default compression level\. The list of available \fIoptions\fR:
++.
+ .TP
+ \fBstrategy\fR=\fIstrat\fR, \fBstrat\fR=\fIstrat\fR
+ Specify a strategy used by a match finder\.
++.
+ .IP
+ There are 9 strategies numbered from 1 to 9, from fastest to strongest: 1=\fBZSTD_fast\fR, 2=\fBZSTD_dfast\fR, 3=\fBZSTD_greedy\fR, 4=\fBZSTD_lazy\fR, 5=\fBZSTD_lazy2\fR, 6=\fBZSTD_btlazy2\fR, 7=\fBZSTD_btopt\fR, 8=\fBZSTD_btultra\fR, 9=\fBZSTD_btultra2\fR\.
++.
+ .TP
+ \fBwindowLog\fR=\fIwlog\fR, \fBwlog\fR=\fIwlog\fR
+ Specify the maximum number of bits for a match distance\.
++.
+ .IP
+ The higher number of increases the chance to find a match which usually improves compression ratio\. It also increases memory requirements for the compressor and decompressor\. The minimum \fIwlog\fR is 10 (1 KiB) and the maximum is 30 (1 GiB) on 32\-bit platforms and 31 (2 GiB) on 64\-bit platforms\.
++.
+ .IP
+ Note: If \fBwindowLog\fR is set to larger than 27, \fB\-\-long=windowLog\fR or \fB\-\-memory=windowSize\fR needs to be passed to the decompressor\.
++.
+ .TP
+ \fBhashLog\fR=\fIhlog\fR, \fBhlog\fR=\fIhlog\fR
+ Specify the maximum number of bits for a hash table\.
++.
+ .IP
+ Bigger hash tables cause fewer collisions which usually makes compression faster, but requires more memory during compression\.
++.
+ .IP
+ The minimum \fIhlog\fR is 6 (64 entries / 256 B) and the maximum is 30 (1B entries / 4 GiB)\.
++.
+ .TP
+ \fBchainLog\fR=\fIclog\fR, \fBclog\fR=\fIclog\fR
+ Specify the maximum number of bits for the secondary search structure, whose form depends on the selected \fBstrategy\fR\.
++.
+ .IP
+ Higher numbers of bits increases the chance to find a match which usually improves compression ratio\. It also slows down compression speed and increases memory requirements for compression\. This option is ignored for the \fBZSTD_fast\fR \fBstrategy\fR, which only has the primary hash table\.
++.
+ .IP
+ The minimum \fIclog\fR is 6 (64 entries / 256 B) and the maximum is 29 (512M entries / 2 GiB) on 32\-bit platforms and 30 (1B entries / 4 GiB) on 64\-bit platforms\.
++.
+ .TP
+ \fBsearchLog\fR=\fIslog\fR, \fBslog\fR=\fIslog\fR
+ Specify the maximum number of searches in a hash chain or a binary tree using logarithmic scale\.
++.
+ .IP
+ More searches increases the chance to find a match which usually increases compression ratio but decreases compression speed\.
++.
+ .IP
+-The minimum \fIslog\fR is 1 and the maximum is 'windowLog' \- 1\.
++The minimum \fIslog\fR is 1 and the maximum is \'windowLog\' \- 1\.
++.
+ .TP
+ \fBminMatch\fR=\fImml\fR, \fBmml\fR=\fImml\fR
+ Specify the minimum searched length of a match in a hash table\.
++.
+ .IP
+ Larger search lengths usually decrease compression ratio but improve decompression speed\.
++.
+ .IP
+ The minimum \fImml\fR is 3 and the maximum is 7\.
++.
+ .TP
+ \fBtargetLength\fR=\fItlen\fR, \fBtlen\fR=\fItlen\fR
+ The impact of this field vary depending on selected strategy\.
++.
+ .IP
+ For \fBZSTD_btopt\fR, \fBZSTD_btultra\fR and \fBZSTD_btultra2\fR, it specifies the minimum match length that causes match finder to stop searching\. A larger \fBtargetLength\fR usually improves compression ratio but decreases compression speed\.
++.
+ .IP
+ For \fBZSTD_fast\fR, it triggers ultra\-fast mode when > 0\. The value represents the amount of data skipped between match sampling\. Impact is reversed: a larger \fBtargetLength\fR increases compression speed but decreases compression ratio\.
++.
+ .IP
+ For all other strategies, this field has no impact\.
++.
+ .IP
+ The minimum \fItlen\fR is 0 and the maximum is 128 KiB\.
++.
+ .TP
+ \fBoverlapLog\fR=\fIovlog\fR, \fBovlog\fR=\fIovlog\fR
+ Determine \fBoverlapSize\fR, amount of data reloaded from previous job\. This parameter is only available when multithreading is enabled\. Reloading more data improves compression ratio, but decreases speed\.
++.
+ .IP
+ The minimum \fIovlog\fR is 0, and the maximum is 9\. 1 means "no overlap", hence completely independent jobs\. 9 means "full overlap", meaning up to \fBwindowSize\fR is reloaded from previous job\. Reducing \fIovlog\fR by 1 reduces the reloaded amount by a factor 2\. For example, 8 means "windowSize/2", and 6 means "windowSize/8"\. Value 0 is special and means "default": \fIovlog\fR is automatically determined by \fBzstd\fR\. In which case, \fIovlog\fR will range from 6 to 9, depending on selected \fIstrat\fR\.
++.
++.TP
++\fBldmHashRateLog\fR=\fIlhrlog\fR, \fBlhrlog\fR=\fIlhrlog\fR
++Specify the frequency of inserting entries into the long distance matching hash table\.
++.
++.IP
++This option is ignored unless long distance matching is enabled\.
++.
++.IP
++Larger values will improve compression speed\. Deviating far from the default value will likely result in a decrease in compression ratio\.
++.
++.IP
++The default value varies between 4 and 7, depending on \fBstrategy\fR\.
++.
+ .TP
+ \fBldmHashLog\fR=\fIlhlog\fR, \fBlhlog\fR=\fIlhlog\fR
+ Specify the maximum size for a hash table used for long distance matching\.
++.
+ .IP
+ This option is ignored unless long distance matching is enabled\.
++.
+ .IP
+ Bigger hash tables usually improve compression ratio at the expense of more memory during compression and a decrease in compression speed\.
++.
+ .IP
+-The minimum \fIlhlog\fR is 6 and the maximum is 30 (default: 20)\.
++The minimum \fIlhlog\fR is 6 and the maximum is 30 (default: \fBwindowLog \- ldmHashRateLog\fR)\.
++.
+ .TP
+ \fBldmMinMatch\fR=\fIlmml\fR, \fBlmml\fR=\fIlmml\fR
+ Specify the minimum searched length of a match for long distance matching\.
++.
+ .IP
+ This option is ignored unless long distance matching is enabled\.
++.
+ .IP
+ Larger/very small values usually decrease compression ratio\.
++.
+ .IP
+-The minimum \fIlmml\fR is 4 and the maximum is 4096 (default: 64)\.
++The minimum \fIlmml\fR is 4 and the maximum is 4096 (default: 32 to 64, depending on \fBstrategy\fR)\.
++.
+ .TP
+ \fBldmBucketSizeLog\fR=\fIlblog\fR, \fBlblog\fR=\fIlblog\fR
+ Specify the size of each bucket for the hash table used for long distance matching\.
++.
+ .IP
+ This option is ignored unless long distance matching is enabled\.
++.
+ .IP
+ Larger bucket sizes improve collision resolution but decrease compression speed\.
++.
+ .IP
+-The minimum \fIlblog\fR is 1 and the maximum is 8 (default: 3)\.
+-.TP
+-\fBldmHashRateLog\fR=\fIlhrlog\fR, \fBlhrlog\fR=\fIlhrlog\fR
+-Specify the frequency of inserting entries into the long distance matching hash table\.
+-.IP
+-This option is ignored unless long distance matching is enabled\.
+-.IP
+-Larger values will improve compression speed\. Deviating far from the default value will likely result in a decrease in compression ratio\.
+-.IP
+-The default value is \fBwlog \- lhlog\fR\.
++The minimum \fIlblog\fR is 1 and the maximum is 8 (default: 4 to 8, depending on \fBstrategy\fR)\.
++.
+ .SS "Example"
+ The following parameters sets advanced compression options to something similar to predefined level 19 for files bigger than 256 KB:
++.
+ .P
+ \fB\-\-zstd\fR=wlog=23,clog=23,hlog=22,slog=6,mml=3,tlen=48,strat=6
++.
+ .SS "\-B#:"
+ Specify the size of each compression job\. This parameter is only available when multi\-threading is enabled\. Each compression job is run in parallel, so this value indirectly impacts the nb of active threads\. Default job size varies depending on compression level (generally \fB4 * windowSize\fR)\. \fB\-B#\fR makes it possible to manually select a custom size\. Note that job size must respect a minimum value which is enforced transparently\. This minimum is either 512 KB, or \fBoverlapSize\fR, whichever is largest\. Different job sizes will lead to non\-identical compressed frames\.
++.
+ .SH "DICTIONARY BUILDER"
+-\fBzstd\fR offers \fIdictionary\fR compression, which greatly improves efficiency on small files and messages\. It's possible to train \fBzstd\fR with a set of samples, the result of which is saved into a file called a \fBdictionary\fR\. Then, during compression and decompression, reference the same dictionary, using command \fB\-D dictionaryFileName\fR\. Compression of small files similar to the sample set will be greatly improved\.
++\fBzstd\fR offers \fIdictionary\fR compression, which greatly improves efficiency on small files and messages\. It\'s possible to train \fBzstd\fR with a set of samples, the result of which is saved into a file called a \fBdictionary\fR\. Then, during compression and decompression, reference the same dictionary, using command \fB\-D dictionaryFileName\fR\. Compression of small files similar to the sample set will be greatly improved\.
++.
+ .TP
+ \fB\-\-train FILEs\fR
+ Use FILEs as training set to create a dictionary\. The training set should ideally contain a lot of samples (> 100), and weight typically 100x the target dictionary size (for example, ~10 MB for a 100 KB dictionary)\. \fB\-\-train\fR can be combined with \fB\-r\fR to indicate a directory rather than listing all the files, which can be useful to circumvent shell expansion limits\.
++.
+ .IP
+ Since dictionary compression is mostly effective for small files, the expectation is that the training set will only contain small files\. In the case where some samples happen to be large, only the first 128 KiB of these samples will be used for training\.
++.
+ .IP
+ \fB\-\-train\fR supports multithreading if \fBzstd\fR is compiled with threading support (default)\. Additional advanced parameters can be specified with \fB\-\-train\-fastcover\fR\. The legacy dictionary builder can be accessed with \fB\-\-train\-legacy\fR\. The slower cover dictionary builder can be accessed with \fB\-\-train\-cover\fR\. Default \fB\-\-train\fR is equivalent to \fB\-\-train\-fastcover=d=8,steps=4\fR\.
++.
+ .TP
+ \fB\-o FILE\fR
+ Dictionary saved into \fBFILE\fR (default name: dictionary)\.
++.
+ .TP
+ \fB\-\-maxdict=#\fR
+-Limit dictionary to specified size (default: 112640 bytes)\. As usual, quantities are expressed in bytes by default, and it's possible to employ suffixes (like \fBKB\fR or \fBMB\fR) to specify larger values\.
++Limit dictionary to specified size (default: 112640 bytes)\. As usual, quantities are expressed in bytes by default, and it\'s possible to employ suffixes (like \fBKB\fR or \fBMB\fR) to specify larger values\.
++.
+ .TP
+ \fB\-#\fR
+ Use \fB#\fR compression level during training (optional)\. Will generate statistics more tuned for selected compression level, resulting in a \fIsmall\fR compression ratio improvement for this level\.
++.
+ .TP
+ \fB\-B#\fR
+ Split input files into blocks of size # (default: no split)
++.
+ .TP
+ \fB\-M#\fR, \fB\-\-memory=#\fR
+ Limit the amount of sample data loaded for training (default: 2 GB)\. Note that the default (2 GB) is also the maximum\. This parameter can be useful in situations where the training set size is not well controlled and could be potentially very large\. Since speed of the training process is directly correlated to the size of the training sample set, a smaller sample set leads to faster training\.
++.
+ .IP
+ In situations where the training set is larger than maximum memory, the CLI will randomly select samples among the available ones, up to the maximum allowed memory budget\. This is meant to improve dictionary relevance by mitigating the potential impact of clustering, such as selecting only files from the beginning of a list sorted by modification date, or sorted by alphabetical order\. The randomization process is deterministic, so training of the same list of files with the same parameters will lead to the creation of the same dictionary\.
++.
+ .TP
+ \fB\-\-dictID=#\fR
+-A dictionary ID is a locally unique ID\. The decoder will use this value to verify it is using the right dictionary\. By default, zstd will create a 4\-bytes random number ID\. It's possible to provide an explicit number ID instead\. It's up to the dictionary manager to not assign twice the same ID to 2 different dictionaries\. Note that short numbers have an advantage: an ID < 256 will only need 1 byte in the compressed frame header, and an ID < 65536 will only need 2 bytes\. This compares favorably to 4 bytes default\.
++A dictionary ID is a locally unique ID\. The decoder will use this value to verify it is using the right dictionary\. By default, zstd will create a 4\-bytes random number ID\. It\'s possible to provide an explicit number ID instead\. It\'s up to the dictionary manager to not assign twice the same ID to 2 different dictionaries\. Note that short numbers have an advantage: an ID < 256 will only need 1 byte in the compressed frame header, and an ID < 65536 will only need 2 bytes\. This compares favorably to 4 bytes default\.
++.
+ .IP
+-Note that RFC8878 reserves IDs less than 32768 and greater than or equal to 2\e^31, so they should not be used in public\.
++Note that RFC8878 reserves IDs less than 32768 and greater than or equal to 2^31, so they should not be used in public\.
++.
+ .TP
+ \fB\-\-train\-cover[=k#,d=#,steps=#,split=#,shrink[=#]]\fR
+ Select parameters for the default dictionary builder algorithm named cover\. If \fId\fR is not specified, then it tries \fId\fR = 6 and \fId\fR = 8\. If \fIk\fR is not specified, then it tries \fIsteps\fR values in the range [50, 2000]\. If \fIsteps\fR is not specified, then the default value of 40 is used\. If \fIsplit\fR is not specified or split <= 0, then the default value of 100 is used\. Requires that \fId\fR <= \fIk\fR\. If \fIshrink\fR flag is not used, then the default value for \fIshrinkDict\fR of 0 is used\. If \fIshrink\fR is not specified, then the default value for \fIshrinkDictMaxRegression\fR of 1 is used\.
++.
+ .IP
+ Selects segments of size \fIk\fR with highest score to put in the dictionary\. The score of a segment is computed by the sum of the frequencies of all the subsegments of size \fId\fR\. Generally \fId\fR should be in the range [6, 8], occasionally up to 16, but the algorithm will run faster with d <= \fI8\fR\. Good values for \fIk\fR vary widely based on the input data, but a safe range is [2 * \fId\fR, 2000]\. If \fIsplit\fR is 100, all input samples are used for both training and testing to find optimal \fId\fR and \fIk\fR to build dictionary\. Supports multithreading if \fBzstd\fR is compiled with threading support\. Having \fIshrink\fR enabled takes a truncated dictionary of minimum size and doubles in size until compression ratio of the truncated dictionary is at most \fIshrinkDictMaxRegression%\fR worse than the compression ratio of the largest dictionary\.
++.
+ .IP
+ Examples:
++.
+ .IP
+ \fBzstd \-\-train\-cover FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=k=50,d=8 FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=d=8,steps=500 FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=k=50 FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=k=50,split=60 FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=shrink FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=shrink=2 FILEs\fR
++.
+ .TP
+ \fB\-\-train\-fastcover[=k#,d=#,f=#,steps=#,split=#,accel=#]\fR
+ Same as cover but with extra parameters \fIf\fR and \fIaccel\fR and different default value of split If \fIsplit\fR is not specified, then it tries \fIsplit\fR = 75\. If \fIf\fR is not specified, then it tries \fIf\fR = 20\. Requires that 0 < \fIf\fR < 32\. If \fIaccel\fR is not specified, then it tries \fIaccel\fR = 1\. Requires that 0 < \fIaccel\fR <= 10\. Requires that \fId\fR = 6 or \fId\fR = 8\.
++.
+ .IP
+ \fIf\fR is log of size of array that keeps track of frequency of subsegments of size \fId\fR\. The subsegment is hashed to an index in the range [0,2^\fIf\fR \- 1]\. It is possible that 2 different subsegments are hashed to the same index, and they are considered as the same subsegment when computing frequency\. Using a higher \fIf\fR reduces collision but takes longer\.
++.
+ .IP
+ Examples:
++.
+ .IP
+ \fBzstd \-\-train\-fastcover FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-fastcover=d=8,f=15,accel=2 FILEs\fR
++.
+ .TP
+ \fB\-\-train\-legacy[=selectivity=#]\fR
+ Use legacy dictionary builder algorithm with the given dictionary \fIselectivity\fR (default: 9)\. The smaller the \fIselectivity\fR value, the denser the dictionary, improving its efficiency but reducing its achievable maximum size\. \fB\-\-train\-legacy=s=#\fR is also accepted\.
++.
+ .IP
+ Examples:
++.
+ .IP
+ \fBzstd \-\-train\-legacy FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-legacy=selectivity=8 FILEs\fR
++.
+ .SH "BENCHMARK"
+-The \fBzstd\fR CLI provides a benchmarking mode that can be used to easily find suitable compression parameters, or alternatively to benchmark a computer's performance\. \fBzstd \-b [FILE(s)]\fR will benchmark \fBzstd\fR for both compression and decompression using default compression level\. Note that results are very dependent on the content being compressed\. It's possible to pass multiple files to the benchmark, and even a directory with \fB\-r DIRECTORY\fR\. When no \fBFILE\fR is provided, the benchmark will use a procedurally generated \fBlorem ipsum\fR text\.
++The \fBzstd\fR CLI provides a benchmarking mode that can be used to easily find suitable compression parameters, or alternatively to benchmark a computer\'s performance\. \fBzstd \-b [FILE(s)]\fR will benchmark \fBzstd\fR for both compression and decompression using default compression level\. Note that results are very dependent on the content being compressed\.
++.
++.P
++It\'s possible to pass multiple files to the benchmark, and even a directory with \fB\-r DIRECTORY\fR\. When no \fBFILE\fR is provided, the benchmark will use a procedurally generated \fBlorem ipsum\fR text\.
++.
++.P
++Benchmarking will employ \fBmax(1, min(4, nbCores/4))\fR worker threads by default in order to match the behavior of the normal CLI I/O\.
++.
+ .IP "\(bu" 4
+ \fB\-b#\fR: benchmark file(s) using compression level #
++.
+ .IP "\(bu" 4
+ \fB\-e#\fR: benchmark file(s) using multiple compression levels, from \fB\-b#\fR to \fB\-e#\fR (inclusive)
++.
+ .IP "\(bu" 4
+ \fB\-d\fR: benchmark decompression speed only (requires providing a zstd\-compressed content)
++.
+ .IP "\(bu" 4
+ \fB\-i#\fR: minimum evaluation time, in seconds (default: 3s), benchmark mode only
++.
+ .IP "\(bu" 4
+ \fB\-B#\fR, \fB\-\-block\-size=#\fR: cut file(s) into independent chunks of size # (default: no chunking)
++.
+ .IP "\(bu" 4
+ \fB\-S\fR: output one benchmark result per input file (default: consolidated result)
++.
+ .IP "\(bu" 4
+ \fB\-D dictionary\fR benchmark using dictionary
++.
+ .IP "\(bu" 4
+ \fB\-\-priority=rt\fR: set process priority to real\-time (Windows)
++.
+ .IP "" 0
++.
+ .P
+ Beyond compression levels, benchmarking is also compatible with other parameters, such as number of threads (\fB\-T#\fR), advanced compression parameters (\fB\-\-zstd=###\fR), dictionary compression (\fB\-D dictionary\fR), or even disabling checksum verification for example\.
++.
+ .P
+ \fBOutput Format:\fR CompressionLevel#Filename: InputSize \-> OutputSize (CompressionRatio), CompressionSpeed, DecompressionSpeed
++.
+ .P
+ \fBMethodology:\fR For speed measurement, the entire input is compressed/decompressed in\-memory to measure speed\. A run lasts at least 1 sec, so when files are small, they are compressed/decompressed several times per run, in order to improve measurement accuracy\.
++.
+ .SH "SEE ALSO"
+ \fBzstdgrep\fR(1), \fBzstdless\fR(1), \fBgzip\fR(1), \fBxz\fR(1)
++.
+ .P
+-The \fIzstandard\fR format is specified in Y\. Collet, "Zstandard Compression and the 'application/zstd' Media Type", https://www\.ietf\.org/rfc/rfc8878\.txt, Internet RFC 8878 (February 2021)\.
++The \fIzstandard\fR format is specified in Y\. Collet, "Zstandard Compression and the \'application/zstd\' Media Type", https://www\.ietf\.org/rfc/rfc8878\.txt, Internet RFC 8878 (February 2021)\.
++.
+ .SH "BUGS"
+ Report bugs at: https://github\.com/facebook/zstd/issues
++.
+ .SH "AUTHOR"
+ Yann Collet
+diff --git a/programs/zstdgrep.1 b/programs/zstdgrep.1
+index d7fda583398..fc79e82e326 100644
+--- a/programs/zstdgrep.1
++++ b/programs/zstdgrep.1
+@@ -1,5 +1,5 @@
+ .
+-.TH "ZSTDGREP" "1" "March 2024" "zstd 1.5.6" "User Commands"
++.TH "ZSTDGREP" "1" "February 2025" "zstd 1.5.7" "User Commands"
+ .
+ .SH "NAME"
+ \fBzstdgrep\fR \- print lines matching a pattern in zstandard\-compressed files
+diff --git a/programs/zstdless.1 b/programs/zstdless.1
+index 7dd65f8fc44..ad5048a02c7 100644
+--- a/programs/zstdless.1
++++ b/programs/zstdless.1
+@@ -1,5 +1,5 @@
+ .
+-.TH "ZSTDLESS" "1" "March 2024" "zstd 1.5.6" "User Commands"
++.TH "ZSTDLESS" "1" "February 2025" "zstd 1.5.7" "User Commands"
+ .
+ .SH "NAME"
+ \fBzstdless\fR \- view zstandard\-compressed files

From 6c1d92dac9ae370ea4c8780d02ee23d1fbe28a2e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 11 May 2026 22:54:37 +0200
Subject: [PATCH 0306/1209] python3Minimal: exclude zstd on minimal

Evade eval errors during bootstrap.
---
 pkgs/development/interpreters/python/cpython/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 849ed85648e0..1df3ba77044a 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -31,6 +31,7 @@
   sqlite,
   xz,
   zlib,
+  withZstd ? !withMinimalDeps,
   zstd,
 
   # platform-specific dependencies
@@ -289,7 +290,7 @@ let
     ++ optionals withExpat [
       expat
     ]
-    ++ optionals (passthru.pythonAtLeast "3.14") [
+    ++ optionals (withZstd && passthru.pythonAtLeast "3.14") [
       zstd
     ]
     ++ optionals bluezSupport [

From 7385b5369eb87464fc2a2ad05ad97699664beb90 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:03:48 +0200
Subject: [PATCH 0307/1209] python3Packages.installer: 1.0.0 -> 1.0.1

https://github.com/pypa/installer/blob/1.0.1/docs/changelog.md
---
 pkgs/development/python-modules/installer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/installer/default.nix b/pkgs/development/python-modules/installer/default.nix
index b0fcdf21f463..677be93995a5 100644
--- a/pkgs/development/python-modules/installer/default.nix
+++ b/pkgs/development/python-modules/installer/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "installer";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "installer";
     rev = version;
-    hash = "sha256-zOnDOaH+9h78Z1667n1Cr8HIm8+OPn2Vc1Zl4XksiCM=";
+    hash = "sha256-GkHLZfzHfTcBL8wQmIGlNkVodEw9Pih4i1SS36mSfBo=";
   };
 
   patches = [

From 202edcd58283cd0fa5e1a2a0770d6504c2de898a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:04:42 +0200
Subject: [PATCH 0308/1209] python3Packages.build: 1.4.4 -> 1.5.0

https://github.com/pypa/build/blob/1.5.0/CHANGELOG.rst
---
 pkgs/development/python-modules/build/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 5764651403a0..194e56dd34f9 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "build";
-  version = "1.4.4";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "build";
     tag = version;
-    hash = "sha256-QprU0sXL6FL0rSVJwu8cYpcPlnYKzKAbkyDaTV778js=";
+    hash = "sha256-Kxqqh9HfNC28CxFHzVkNVzqNM8MVkLgkaCU2jxpjceA=";
   };
 
   build-system = [ flit-core ];

From a76a96a0855da3a5c98444d4fc283e33adcca017 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:12:30 +0200
Subject: [PATCH 0309/1209] python3Packages.wheel: 0.46.1 -> 0.47.0

https://github.com/pypa/wheel/compare/0.46.1...0.47.0
---
 pkgs/development/python-modules/wheel/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 50696d7c0cf5..4aca9e5d587d 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "wheel";
-  version = "0.46.1";
+  version = "0.47.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "wheel";
     tag = version;
-    hash = "sha256-iyGfGr3pLVZSEIHetjsPbIIXkuXrmIPiSqqOw31l9Qw=";
+    hash = "sha256-/5OxFySesdsFsuUbhdhcgFPsry8RSy5ZshG0TWGncVY=";
   };
 
   nativeBuildInputs = [ flit-core ];

From 5aba6aebb6996044bc15a3bb11a3855fa486845e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 01:08:40 +0200
Subject: [PATCH 0310/1209] python3Packages.distutils_80: init at 80.10.2

---
 .../python-modules/distutils/80.nix           | 91 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  3 +
 2 files changed, 94 insertions(+)
 create mode 100644 pkgs/development/python-modules/distutils/80.nix

diff --git a/pkgs/development/python-modules/distutils/80.nix b/pkgs/development/python-modules/distutils/80.nix
new file mode 100644
index 000000000000..8d9c304afded
--- /dev/null
+++ b/pkgs/development/python-modules/distutils/80.nix
@@ -0,0 +1,91 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonAtLeast,
+  setuptools-scm,
+  setuptools_80,
+  python,
+  docutils,
+  jaraco-collections,
+  jaraco-functools,
+  jaraco-envs,
+  jaraco-path,
+  jaraco-text,
+  libz,
+  more-itertools,
+  packaging,
+  path,
+  pyfakefs,
+  pytestCheckHook,
+  stdenv,
+}:
+
+buildPythonPackage {
+  pname = "distutils";
+  inherit (setuptools_80) version;
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = "distutils";
+    rev = "5ad8291ff2ad3e43583bc72a4c09299ca6134f09"; # correlate commit from setuptools version
+    hash = "sha256-3Mqpe/Goj3lQ6GEbX3DHWjdoh7XsFIg9WkOCK138OAo=";
+  };
+
+  postPatch = ''
+    sed -i '/coherent\.licensed/d' pyproject.toml
+  '';
+
+  build-system = [ setuptools-scm ];
+
+  dependencies = [
+    jaraco-collections
+    jaraco-functools
+    more-itertools
+    packaging
+  ];
+
+  postInstall = ''
+    rm -r $out/${python.sitePackages}/distutils
+    ln -s ${setuptools_80}/${python.sitePackages}/setuptools/_distutils $out/${python.sitePackages}/distutils
+  '';
+
+  pythonImportsCheck = [ "distutils" ];
+
+  nativeCheckInputs = [
+    docutils
+    jaraco-envs
+    jaraco-path
+    jaraco-text
+    more-itertools
+    path
+    pyfakefs
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    # https://github.com/pypa/distutils/blob/5ad8291ff2ad3e43583bc72a4c09299ca6134f09/distutils/tests/test_build_ext.py#L107
+    libz
+  ];
+
+  # jaraco-path depends ob pyobjc
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  disabledTests = [
+    #  TypeError: byte_compile() got an unexpected keyword argument 'dry_run'
+    "test_byte_compile"
+    "test_byte_compile_optimized"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    #  AssertionError: assert '(?s:foo[^/]*)\\z' == '(?s:foo[^/]*)\\Z'
+    "test_glob_to_re"
+  ];
+
+  meta = {
+    description = "Distutils as found in cpython";
+    homepage = "https://github.com/pypa/distutils";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0927c751981e..bf307ade35ac 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4091,6 +4091,9 @@ self: super: with self; {
 
   distutils-extra = callPackage ../development/python-modules/distutils-extra { };
 
+  distutils_80 =
+    if pythonOlder "3.12" then null else callPackage ../development/python-modules/distutils/80.nix { };
+
   dj-database-url = callPackage ../development/python-modules/dj-database-url { };
 
   dj-email-url = callPackage ../development/python-modules/dj-email-url { };

From a0d82aa87667d55a44560f9f8e5e20d0660bf32e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:15:49 +0200
Subject: [PATCH 0311/1209] python3Packages.setuptools: 80.10.1 -> 82.0.1

https://setuptools.pypa.io/en/stable/history.html#v82-0-1
---
 .../python-modules/setuptools/default.nix          | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 657d23f35073..7daa5062fbb8 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -7,16 +7,16 @@
   python,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "setuptools";
-  version = "80.10.1";
+  version = "82.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "setuptools";
-    tag = "v${version}";
-    hash = "sha256-s/gfJc3yxvCE6cjP03vtIZqNFmoZKR3d7+4gTPk1hQg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-M4fB+R4UNla2VlcWNhfDLvExQMpjLkPkgVsU4vg6ImU=";
   };
 
   patches = [
@@ -29,7 +29,7 @@ buildPythonPackage rec {
 
     # Substitute version for reproducible builds
     substituteInPlace setuptools/version.py \
-      --replace-fail '@version@' '${version}'
+      --replace-fail '@version@' '${finalAttrs.version}'
   '';
 
   preBuild = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
@@ -47,10 +47,10 @@ buildPythonPackage rec {
     description = "Utilities to facilitate the installation of Python packages";
     homepage = "https://github.com/pypa/setuptools";
     changelog = "https://setuptools.pypa.io/en/stable/history.html#v${
-      lib.replaceStrings [ "." ] [ "-" ] version
+      lib.replaceString "." "-" finalAttrs.version
     }";
     license = with lib.licenses; [ mit ];
     platforms = python.meta.platforms;
     teams = [ lib.teams.python ];
   };
-}
+})

From 388458978c392b723a844df7b5f906684a96f974 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 17 May 2026 22:52:46 +0200
Subject: [PATCH 0312/1209] python3Packages.distutils: 80.10.1 -> 82.0.1

---
 pkgs/development/python-modules/distutils/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/distutils/default.nix b/pkgs/development/python-modules/distutils/default.nix
index 727b109d64bc..1039dea6e13f 100644
--- a/pkgs/development/python-modules/distutils/default.nix
+++ b/pkgs/development/python-modules/distutils/default.nix
@@ -29,10 +29,14 @@ buildPythonPackage {
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "distutils";
-    rev = "5ad8291ff2ad3e43583bc72a4c09299ca6134f09"; # correlate commit from setuptools version
-    hash = "sha256-3Mqpe/Goj3lQ6GEbX3DHWjdoh7XsFIg9WkOCK138OAo=";
+    rev = "f10ac6219960991c98b821cf2544bf9c2864ebc2"; # correlate commit from setuptools version
+    hash = "sha256-KzC7zvrC7fsAQhLFZvep/F+yDRzsBDYtir1EA7gdpGM=";
   };
 
+  postPatch = ''
+    sed -i '/coherent\.licensed/d' pyproject.toml
+  '';
+
   build-system = [ setuptools-scm ];
 
   dependencies = [

From a03725a6c6bdaa098a6e48a70c447a102385ff7a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:27:01 +0200
Subject: [PATCH 0313/1209] python3Packages.setuptools_80: init at 80.10.2

81 is the last version with pkg_resources module.
80 is the last version with dry_run arg in copy_file function.
---
 .../python-modules/setuptools/80.nix          | 56 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 58 insertions(+)
 create mode 100644 pkgs/development/python-modules/setuptools/80.nix

diff --git a/pkgs/development/python-modules/setuptools/80.nix b/pkgs/development/python-modules/setuptools/80.nix
new file mode 100644
index 000000000000..a051cb776fa3
--- /dev/null
+++ b/pkgs/development/python-modules/setuptools/80.nix
@@ -0,0 +1,56 @@
+{
+  stdenv,
+  lib,
+  buildPythonPackage,
+  distutils_80,
+  fetchFromGitHub,
+  python,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "setuptools";
+  version = "80.10.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = "setuptools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-kf2c4auQrZDGW8bM0SxOPFsR8IE4b0coevTxKWGtHp8=";
+  };
+
+  patches = [
+    ./reproducible-wheel.patch
+  ];
+
+  # Drop dependency on coherent.license, which in turn requires coherent.build
+  postPatch = ''
+    sed -i "/coherent.licensed/d" pyproject.toml
+
+    # Substitute version for reproducible builds
+    substituteInPlace setuptools/version.py \
+      --replace-fail '@version@' '${finalAttrs.version}'
+  '';
+
+  preBuild = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
+    export SETUPTOOLS_INSTALL_WINDOWS_SPECIFIC_FILES=0
+  '';
+
+  # Requires pytest, causing infinite recursion.
+  doCheck = false;
+
+  passthru.tests = {
+    inherit distutils_80;
+  };
+
+  meta = {
+    description = "Utilities to facilitate the installation of Python packages";
+    homepage = "https://github.com/pypa/setuptools";
+    changelog = "https://setuptools.pypa.io/en/stable/history.html#v${
+      lib.replaceString "." "-" finalAttrs.version
+    }";
+    license = with lib.licenses; [ mit ];
+    platforms = python.meta.platforms;
+    teams = [ lib.teams.python ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bf307ade35ac..126941497f48 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -27,6 +27,8 @@ self: super: with self; {
 
   setuptools = callPackage ../development/python-modules/setuptools { };
 
+  setuptools_80 = callPackage ../development/python-modules/setuptools/80.nix { };
+
   # by_regex ensures inherit statements are sorted after the (first) attribute name that is inherited.
   # keep-sorted start block=yes newline_separated=yes by_regex=["(?:inherit\\s+\\([^)]+\\)\\n?\\s*)?(.+)"]
   a2a-sdk = callPackage ../development/python-modules/a2a-sdk { };

From d00eb26967dfa68e63cd0d901e6a50e9ce0ea8b6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:53:38 +0200
Subject: [PATCH 0314/1209] python3Packages.vcs-versioning: init at 1.1.1

---
 .../python-modules/vcs-versioning/default.nix | 60 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/development/python-modules/vcs-versioning/default.nix

diff --git a/pkgs/development/python-modules/vcs-versioning/default.nix b/pkgs/development/python-modules/vcs-versioning/default.nix
new file mode 100644
index 000000000000..096da5eac421
--- /dev/null
+++ b/pkgs/development/python-modules/vcs-versioning/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  packaging,
+  setuptools,
+  git,
+  pytestCheckHook,
+  vcs-versioning,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "vcs-versioning";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = "setuptools-scm";
+    tag = "vcs-versioning-v${finalAttrs.version}";
+    hash = "sha256-CfRzupWFtvmQLbubyr+eXRnLi4auZc2PA/Zz0aFNgaU=";
+  };
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
+
+  postPatch = ''
+    pushd vcs-versioning
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    packaging
+  ];
+
+  pythonImportsCheck = [
+    "vcs_versioning"
+  ];
+
+  doCheck = false; # infinite recursion with pytest
+
+  nativeCheckInputs = [
+    git
+    pytestCheckHook
+  ];
+
+  pytestFlags = [ "-vvv" ];
+
+  passthru.tests.pytest = vcs-versioning.overridePythonAttrs { doCheck = true; };
+
+  meta = {
+    changelog = "https://github.com/pypa/setuptools-scm/releases/tag/${finalAttrs.src.tag}";
+    description = "The blessed package to manage your versions by scm tags";
+    homepage = "https://github.com/pypa/setuptools-scm/tree/main/vcs-versioning";
+    license = lib.licenses.mit;
+    teams = [ lib.teams.python ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 126941497f48..0affe265a11a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -21069,6 +21069,8 @@ self: super: with self; {
 
   vcrpy = callPackage ../development/python-modules/vcrpy { };
 
+  vcs-versioning = callPackage ../development/python-modules/vcs-versioning { };
+
   vcversioner = callPackage ../development/python-modules/vcversioner { };
 
   vdf = callPackage ../development/python-modules/vdf { };

From 729d33e350be215e02394760f6caa6cea36766ad Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:54:00 +0200
Subject: [PATCH 0315/1209] python3Packages.setuptools-scm: 9.2.2 -> 10.0.5

https://github.com/pypa/setuptools_scm/blob/10.0.5/CHANGELOG.md
---
 .../python-modules/setuptools-scm/default.nix          | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/setuptools-scm/default.nix b/pkgs/development/python-modules/setuptools-scm/default.nix
index 876eb1e9cbd8..3b855063ad5e 100644
--- a/pkgs/development/python-modules/setuptools-scm/default.nix
+++ b/pkgs/development/python-modules/setuptools-scm/default.nix
@@ -8,8 +8,7 @@
   setuptools,
 
   # dependencies
-  packaging,
-  typing-extensions,
+  vcs-versioning,
 
   # optional-dependencies
   rich,
@@ -17,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "setuptools-scm";
-  version = "9.2.2";
+  version = "10.0.5";
   pyproject = true;
 
   src = fetchPypi {
     pname = "setuptools_scm";
     inherit version;
-    hash = "sha256-HGdKtGZWhqCIfX4kwDqyXyQgHCE+guponS8+Fp7371c=";
+    hash = "sha256-u7qP51RRbN79AX9EVnIXdebvlmK9eIf7Uq4mgT1IOMM=";
   };
 
   postPatch = null;
@@ -31,9 +30,8 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
   dependencies = [
-    packaging
     setuptools
-    typing-extensions
+    vcs-versioning
   ];
 
   optional-dependencies = {

From 2372f065add76dcb494b003989827c862231c461 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:29:07 +0200
Subject: [PATCH 0316/1209] python3Packages.zope-event: 6.1 -> 6.2

https://github.com/zopefoundation/zope.event/blob/6.2/CHANGES.rst
---
 .../python-modules/zope-event/default.nix        | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/zope-event/default.nix b/pkgs/development/python-modules/zope-event/default.nix
index 0c33629346d7..5d8ff0a4d2a9 100644
--- a/pkgs/development/python-modules/zope-event/default.nix
+++ b/pkgs/development/python-modules/zope-event/default.nix
@@ -2,23 +2,23 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "zope-event";
-  version = "6.1";
+  version = "6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zopefoundation";
     repo = "zope.event";
-    tag = version;
-    hash = "sha256-ugyHPqqFcObgldThkkUQgZnl1fVEcXYFnXyAxNwUFIE=";
+    tag = finalAttrs.version;
+    hash = "sha256-FoE9bdr/JcOaB8/OQTUmxGrNgIDc1vPDlmZq0v+bjmQ=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   pythonImportsCheck = [ "zope.event" ];
 
@@ -31,8 +31,8 @@ buildPythonPackage rec {
   meta = {
     description = "Event publishing system";
     homepage = "https://github.com/zopefoundation/zope.event";
-    changelog = "https://github.com/zopefoundation/zope.event/blob/${src.tag}/CHANGES.rst";
+    changelog = "https://github.com/zopefoundation/zope.event/blob/${finalAttrs.src.tag}/CHANGES.rst";
     license = lib.licenses.zpl21;
     maintainers = [ ];
   };
-}
+})

From 73b7906d92df92fad0ca571aa6d52df7bc2e9aa7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 3 May 2026 11:02:59 -0700
Subject: [PATCH 0317/1209] python3Packages.poetry-core: 2.3.2 -> 2.4.0

Diff: https://github.com/python-poetry/poetry-core/compare/2.3.2...2.4.0

Changelog: https://github.com/python-poetry/poetry-core/blob/2.4.0/CHANGELOG.md
---
 pkgs/development/python-modules/poetry-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index be7b67a21b50..d158236eff78 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "2.3.2";
+  version = "2.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = "poetry-core";
     tag = version;
-    hash = "sha256-Rv6JCHsqu5rRvihGaUFcRk/NUT90bnIUM01QxUUkxh4=";
+    hash = "sha256-i9EucMsoX8Z0iyhNDVYaczv1CSY/KaZpMjn/FGzIJU4=";
   };
 
   nativeCheckInputs = [

From ed3453c6941da21956553959ece02f42bd119d09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 27 Apr 2026 07:29:39 -0700
Subject: [PATCH 0318/1209] python3Packages.uv-build: 0.10.0 -> 0.11.8

Diff: https://github.com/astral-sh/uv/compare/0.10.0...0.11.8

Changelog: https://github.com/astral-sh/uv/blob/0.11.8/CHANGELOG.md
---
 pkgs/development/python-modules/uv-build/default.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/uv-build/default.nix b/pkgs/development/python-modules/uv-build/default.nix
index c37b17d316c7..bf45da4ab785 100644
--- a/pkgs/development/python-modules/uv-build/default.nix
+++ b/pkgs/development/python-modules/uv-build/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "uv-build";
-  version = "0.10.0";
+  version = "0.11.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-nD26zqKMK5LNkeYdqVYteeYL4mYaQQ/QlyjbMDDhLAY=";
+    hash = "sha256-wu9EA3z/qj29lfSj8wKE4p8XEAJQakQTg2AK8I/64us=";
   };
 
   nativeBuildInputs = [
@@ -26,7 +26,7 @@ buildPythonPackage (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-lEynVemQHCI7ZKD2+1n4K/AtEYRld2+aRLkDMSX8ejM=";
+    hash = "sha256-ygGRoZgD88Q2EkN0U4SDTwya96Ds3Pqy3Llj8cjGwnY=";
   };
 
   buildAndTestSubdir = "crates/uv-build";
@@ -47,9 +47,10 @@ buildPythonPackage (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://github.com/astral-sh/uv/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Minimal build backend for uv";
     homepage = "https://docs.astral.sh/uv/reference/settings/#build-backend";
-    inherit (pkgs.uv.meta) changelog license;
+    inherit (pkgs.uv.meta) license;
     maintainers = with lib.maintainers; [ bengsparks ];
   };
 })

From ddb28fa0cb827873e6c51e86909433ed4312e627 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 26 Apr 2026 10:58:55 -0700
Subject: [PATCH 0319/1209] python3Packages.filelock: 3.20.3 -> 3.29.0

Diff: https://github.com/tox-dev/filelock/compare/3.20.3...3.29.0

Changelog: https://github.com/tox-dev/py-filelock/releases/tag/3.29.0
---
 .../python-modules/filelock/default.nix            | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index 54fc63da2f08..1ef40a71fc1f 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   hatch-vcs,
   hatchling,
   pytest-asyncio,
@@ -12,12 +12,14 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "3.20.3";
+  version = "3.29.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-GMV+6RXH7GHP8Oz38Phpk2x8MBkbsM9AbxNBd40INOE=";
+  src = fetchFromGitHub {
+    owner = "tox-dev";
+    repo = "filelock";
+    tag = version;
+    hash = "sha256-efBEyjuCcLkHsfpG61eKN6ALk4QW4UMdNmD56rSgFLc=";
   };
 
   build-system = [
@@ -43,7 +45,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/tox-dev/py-filelock/releases/tag/${version}";
     description = "Platform independent file lock for Python";
     homepage = "https://github.com/benediktschmitt/py-filelock";
-    license = lib.licenses.unlicense;
+    license = lib.licenses.mit;
     maintainers = [ ];
   };
 }

From 53b29af49e5ba0b41134cefdc725b4c1f16af357 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 26 Apr 2026 10:52:55 -0700
Subject: [PATCH 0320/1209] python3Packages.virtualenv: 20.36.1 -> 21.2.4

Diff: https://github.com/pypa/virtualenv/compare/20.36.1...21.2.4

Changelog: https://github.com/pypa/virtualenv/blob/21.2.4/docs/changelog.rst
---
 pkgs/development/python-modules/virtualenv/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index a51ae2bbd75e..dbdb04131e0d 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -12,19 +12,20 @@
   pytest-freezer,
   pytest-mock,
   pytestCheckHook,
+  python-discovery,
   time-machine,
 }:
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.36.1";
+  version = "21.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "virtualenv";
     tag = version;
-    hash = "sha256-8fiC7+9FzQnmoI+N4cA5kKBLH9tpU7LXZ7pVj8Bz8Wc=";
+    hash = "sha256-3Ed2h5zzjpm+D1fQW2urWYcO/6sFGuZtueQxUnIu3MY=";
   };
 
   build-system = [
@@ -36,6 +37,7 @@ buildPythonPackage rec {
     distlib
     filelock
     platformdirs
+    python-discovery
   ];
 
   nativeCheckInputs = [

From 01204a518c1c5d7cde86e36259f5fb3eb4e1c95e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 28 Apr 2026 20:56:42 -0700
Subject: [PATCH 0321/1209] python3Packages.starlette: cleanup

---
 .../development/python-modules/starlette/default.nix | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index e66a5cf7a80d..98974519d575 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "encode";
+    owner = "Kludex";
     repo = "starlette";
     tag = version;
     hash = "sha256-9iQXlpA1VDGw1c7X1zJPmJ3Dub46PwqrVIX1+fWOZ7M=";
@@ -56,12 +56,6 @@ buildPythonPackage rec {
   ]
   ++ lib.concatAttrValues optional-dependencies;
 
-  pytestFlags = [
-    "-Wignore::DeprecationWarning"
-    "-Wignore::trio.TrioDeprecationWarning"
-    "-Wignore::ResourceWarning" # FIXME remove once test suite is fully compatible with anyio 4.4.0
-  ];
-
   pythonImportsCheck = [ "starlette" ];
 
   passthru.tests = {
@@ -69,8 +63,8 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://www.starlette.io/release-notes/#${lib.replaceStrings [ "." ] [ "" ] version}";
-    downloadPage = "https://github.com/encode/starlette";
+    changelog = "https://github.com/Kludex/starlette/blob/${src.tag}/docs/release-notes.md";
+    downloadPage = "https://github.com/Kludex/starlette";
     homepage = "https://www.starlette.io/";
     description = "Little ASGI framework that shines";
     license = lib.licenses.bsd3;

From c04487ac166ea634cd2a2ab70604d2321dd48019 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 28 Apr 2026 21:19:06 -0700
Subject: [PATCH 0322/1209] python3Packages.fastapi-cli: 0.0.20 -> 0.0.24

Diff: https://github.com/fastapi/fastapi-cli/compare/0.0.20...0.0.24

Changelog: https://github.com/fastapi/fastapi-cli/releases/tag/0.0.24
---
 pkgs/development/python-modules/fastapi-cli/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fastapi-cli/default.nix b/pkgs/development/python-modules/fastapi-cli/default.nix
index b13bcff26a20..9a314d21ca1b 100644
--- a/pkgs/development/python-modules/fastapi-cli/default.nix
+++ b/pkgs/development/python-modules/fastapi-cli/default.nix
@@ -15,14 +15,14 @@
 let
   self = buildPythonPackage rec {
     pname = "fastapi-cli";
-    version = "0.0.20";
+    version = "0.0.24";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "fastapi";
       repo = "fastapi-cli";
       tag = version;
-      hash = "sha256-RTxu6WmKmGMVsQ2izd8j8P+gGbXV91gVjb95JC52e8Q=";
+      hash = "sha256-LEo8to1mspauTMCQ5Zf6znG0ALqF5XtauPar5bqN6/Q=";
     };
 
     build-system = [ pdm-backend ];
@@ -37,6 +37,11 @@ let
     optional-dependencies = {
       standard = [
         uvicorn
+        # FIXME package fastapi-cloud-cli
+      ]
+      ++ uvicorn.optional-dependencies.standard;
+      standard-no-fastapi-cloud-cli = [
+        uvicorn
       ]
       ++ uvicorn.optional-dependencies.standard;
     };

From ec7194a37a87948f0e3de2411fed623a30d5775d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 28 Apr 2026 21:12:32 -0700
Subject: [PATCH 0323/1209] python3Packages.fastapi: update dependencies

---
 .../python-modules/fastapi/default.nix        | 49 +++++++------------
 1 file changed, 18 insertions(+), 31 deletions(-)

diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 3e29f81a9da2..886b6ecccd7c 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -11,6 +11,7 @@
   starlette,
   pydantic,
   typing-extensions,
+  typing-inspection,
 
   # tests
   anyio,
@@ -18,15 +19,11 @@
   dirty-equals,
   flask,
   inline-snapshot,
-  passlib,
   pwdlib,
   pyjwt,
-  pytest-asyncio,
   pytest-xdist,
   pytest-timeout,
   pytestCheckHook,
-  sqlalchemy,
-  trio,
 
   # optional-dependencies
   fastapi-cli,
@@ -35,8 +32,6 @@
   itsdangerous,
   python-multipart,
   pyyaml,
-  ujson,
-  orjson,
   email-validator,
   uvicorn,
   pydantic-settings,
@@ -57,16 +52,12 @@ buildPythonPackage rec {
 
   build-system = [ pdm-backend ];
 
-  pythonRelaxDeps = [
-    "anyio"
-    "starlette"
-  ];
-
   dependencies = [
     annotated-doc
     starlette
     pydantic
     typing-extensions
+    typing-inspection
   ];
 
   optional-dependencies = {
@@ -77,12 +68,8 @@ buildPythonPackage rec {
       python-multipart
       itsdangerous
       pyyaml
-      ujson
-      orjson
       email-validator
       uvicorn
-    ]
-    ++ lib.optionals (lib.versionAtLeast pydantic.version "2") [
       pydantic-settings
       pydantic-extra-types
     ]
@@ -90,56 +77,56 @@ buildPythonPackage rec {
     ++ uvicorn.optional-dependencies.standard;
     standard = [
       fastapi-cli
+      # FIXME package fastar
       httpx
       jinja2
       python-multipart
       email-validator
       uvicorn
+      pydantic-settings
+      pydantic-extra-types
     ]
     ++ fastapi-cli.optional-dependencies.standard
     ++ uvicorn.optional-dependencies.standard;
+    standard-no-fastapi-cloud-cli = [
+      fastapi-cli
+      httpx
+      jinja2
+      python-multipart
+      email-validator
+      uvicorn
+      pydantic-settings
+      pydantic-extra-types
+    ]
+    ++ fastapi-cli.optional-dependencies.standard-no-fastapi-cloud-cli
+    ++ uvicorn.optional-dependencies.standard;
   };
 
   nativeCheckInputs = [
+    a2wsgi
     anyio
     a2wsgi
     dirty-equals
     flask
     inline-snapshot
-    passlib
     pwdlib
     pyjwt
     pytestCheckHook
-    pytest-asyncio
     pytest-xdist
     pytest-timeout
-    trio
-    sqlalchemy
   ]
   ++ anyio.optional-dependencies.trio
-  ++ passlib.optional-dependencies.bcrypt
   ++ optional-dependencies.all;
 
-  pytestFlags = [
-    # ignoring deprecation warnings to avoid test failure from
-    # tests/test_tutorial/test_testing/test_tutorial001.py
-    "-Wignore::DeprecationWarning"
-    "-Wignore::pytest.PytestUnraisableExceptionWarning"
-  ];
-
   disabledTests = [
     # Coverage test
     "test_fastapi_cli"
-    # Likely pydantic compat issue
-    "test_exception_handler_body_access"
   ];
 
   disabledTestPaths = [
     # Don't test docs and examples
     "docs_src"
     "tests/test_tutorial/test_sql_databases"
-    "tests/test_tutorial/test_static_files"
-    "tests/test_tutorial/test_custom_docs_ui"
     # Infinite recursion with strawberry-graphql
     "tests/test_tutorial/test_graphql/test_tutorial001.py"
   ];

From b35c7a165927f2f25a9c9831670f8ecb37de0017 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:54:50 +0200
Subject: [PATCH 0324/1209] python3Packages.html5lib: pin to setuptools_80

Requires pkg_resources.
---
 pkgs/development/python-modules/html5lib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/html5lib/default.nix b/pkgs/development/python-modules/html5lib/default.nix
index dc252d84b8a1..63ccf4c8f2a5 100644
--- a/pkgs/development/python-modules/html5lib/default.nix
+++ b/pkgs/development/python-modules/html5lib/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
   six,
   webencodings,
   pytest-expect,
@@ -29,7 +29,7 @@ buildPythonPackage {
     ./pytest9-compat.patch
   ];
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     six

From bffbd23fea6a2f260b60204fdd13e450641459b1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:56:52 +0200
Subject: [PATCH 0325/1209] python3Packages.packaging: 26.1 -> 26.2

https://github.com/pypa/packaging/blob/26.2/CHANGELOG.rst
---
 .../python-modules/packaging/default.nix      | 92 +++++++++----------
 1 file changed, 45 insertions(+), 47 deletions(-)

diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
index ebf39f5d92cd..25e98c490a21 100644
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -7,56 +7,54 @@
   flit-core,
 
   # tests
+  packaging,
   pretend,
   pytestCheckHook,
 }:
 
-let
-  packaging = buildPythonPackage rec {
-    pname = "packaging";
-    version = "26.1";
-    pyproject = true;
+buildPythonPackage (finalAttrs: {
+  pname = "packaging";
+  version = "26.2";
+  pyproject = true;
 
-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-8EIVK2gcS/rFyuJ0KlXhA9J6suwPPYgDcTa2v+fJxd4=";
-    };
-
-    nativeBuildInputs = [ flit-core ];
-
-    nativeCheckInputs = [
-      pytestCheckHook
-      pretend
-    ];
-
-    pythonImportsCheck = [
-      "packaging"
-      "packaging.metadata"
-      "packaging.requirements"
-      "packaging.specifiers"
-      "packaging.tags"
-      "packaging.version"
-    ];
-
-    # Prevent circular dependency with pytest
-    doCheck = false;
-
-    passthru.tests = packaging.overridePythonAttrs (_: {
-      doCheck = true;
-    });
-
-    meta = {
-      changelog = "https://github.com/pypa/packaging/blob/${version}/CHANGELOG.rst";
-      description = "Core utilities for Python packages";
-      downloadPage = "https://github.com/pypa/packaging";
-      homepage = "https://packaging.pypa.io/";
-      license = with lib.licenses; [
-        bsd2
-        asl20
-      ];
-      maintainers = with lib.maintainers; [ bennofs ];
-      teams = [ lib.teams.python ];
-    };
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-/0Uv9aPoKM4RAZD+/xF4ux8uoigfogdarbmHwvsiFmE=";
   };
-in
-packaging
+
+  nativeBuildInputs = [ flit-core ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pretend
+  ];
+
+  pythonImportsCheck = [
+    "packaging"
+    "packaging.metadata"
+    "packaging.requirements"
+    "packaging.specifiers"
+    "packaging.tags"
+    "packaging.version"
+  ];
+
+  # Prevent circular dependency with pytest
+  doCheck = false;
+
+  passthru.tests = packaging.overridePythonAttrs (_: {
+    doCheck = true;
+  });
+
+  meta = {
+    changelog = "https://github.com/pypa/packaging/blob/${finalAttrs.version}/CHANGELOG.rst";
+    description = "Core utilities for Python packages";
+    downloadPage = "https://github.com/pypa/packaging";
+    homepage = "https://packaging.pypa.io/";
+    license = with lib.licenses; [
+      bsd2
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ bennofs ];
+    teams = [ lib.teams.python ];
+  };
+})

From d937cb6e2d2d3f9e47dc7ae82bb54a27a64f2e99 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:59:54 +0200
Subject: [PATCH 0326/1209] python3Packages.certifi: 2026.01.04 -> 2026.04.22

https://github.com/certifi/python-certifi/compare/2026.01.04...2026.04.22
---
 pkgs/development/python-modules/certifi/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index 94ef983a6a8e..2f1d3be1e64d 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -7,16 +7,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "certifi";
-  version = "2026.01.04";
+  version = "2026.04.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "certifi";
     repo = "python-certifi";
-    rev = version;
-    hash = "sha256-JXv12im46xKabIRVZ4FMSZUbpw2k8WCcaZZLX2pFteY=";
+    tag = finalAttrs.version;
+    hash = "sha256-bGeOrYd7ZUG0VIbgRiYIBK3JDRC5wpST5IrFHyWO/cg=";
   };
 
   patches = [
@@ -47,4 +47,4 @@ buildPythonPackage rec {
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ koral ];
   };
-}
+})

From 11c393f1bd8e6177d463d051c3cb132e6148bfe2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:10:10 +0200
Subject: [PATCH 0327/1209] python3Packages.click: 8.3.1 -> 8.3.3

https://github.com/pallets/click/blob/8.3.3/CHANGES.rst
---
 pkgs/development/python-modules/click/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index 47f53fb6580b..13e65aa099c8 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "click";
-  version = "8.3.1";
+  version = "8.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pallets";
     repo = "click";
     tag = version;
-    hash = "sha256-MbaIQJr6GbM8JwdbUkbeC8TqWN5dH82pFOqHwJE2PBA=";
+    hash = "sha256-LcnAI4hyiuaJ4qnFnbAR5Cft/yvW5tAIjY6qc6K/Nrw=";
   };
 
   build-system = [ flit-core ];

From ff97264d4555e412ed674c38e24973eecdaf4127 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:01:13 +0200
Subject: [PATCH 0328/1209] python3Packages.idna: 3.13 -> 3.14

https://github.com/kjd/idna/releases/tag/v3.14
---
 pkgs/development/python-modules/idna/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index 9d4cbee7e5a1..08f1f6a1d6cf 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "3.13";
+  version = "3.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kjd";
     repo = "idna";
     tag = "v${version}";
-    hash = "sha256-D72KUEwiFA/LdU/xE3sN+Abc6NpAsIlGSdB07V1nk68=";
+    hash = "sha256-cCyJsZc7+DpYQjS3nOfahrUcyFX2WtmmBKw8trZlELU=";
   };
 
   build-system = [ flit-core ];

From 39e8a44dd31601b1ffd5a913aa1889de329ac845 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:13:19 +0200
Subject: [PATCH 0329/1209] python3Packages.wcwidth: 0.6.0 -> 0.7.0

https://github.com/jquast/wcwidth/releases/tag/0.7.0
---
 pkgs/development/python-modules/wcwidth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/wcwidth/default.nix b/pkgs/development/python-modules/wcwidth/default.nix
index 39e7931da584..d8c9b9cea8c5 100644
--- a/pkgs/development/python-modules/wcwidth/default.nix
+++ b/pkgs/development/python-modules/wcwidth/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "wcwidth";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jquast";
     repo = "wcwidth";
     tag = version;
-    hash = "sha256-J1uVqHMbOr9OZK6W7O3ilSgzB4i6R9jLN8RzwOxZZnA=";
+    hash = "sha256-XIOgDCoAP/shepasR41NbNW3cFlbemmdC0Xbd+9OOts=";
   };
 
   build-system = [ hatchling ];

From e80b4d990b1ef0abd8f988622856c056228059c7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:03:53 +0200
Subject: [PATCH 0330/1209] python3Packages.babel: 2.17.0 -> 2.18.0

https://github.com/python-babel/babel/releases/tag/v2.18.0
---
 pkgs/development/python-modules/babel/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/babel/default.nix b/pkgs/development/python-modules/babel/default.nix
index 85466baf4573..5f51421c82e5 100644
--- a/pkgs/development/python-modules/babel/default.nix
+++ b/pkgs/development/python-modules/babel/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "babel";
-  version = "2.17.0";
+  version = "2.18.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DFTP+xn2kM3MUqO1C8v3HgeoCNHIDVSfJFm50s8K+50=";
+    hash = "sha256-uAuZoUvQhfys+hXJFl9lH7s0BuZsxgOr8RxXUJN8mS0=";
   };
 
   build-system = [ setuptools ];

From a0709bc85f0e6d181639caad91ea50aa871cc837 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:13:59 +0200
Subject: [PATCH 0331/1209] python3Packages.click-repl: 0.3.0 ->
 0.3.0-unstable-2026-03-26

---
 .../python-modules/click-repl/default.nix     | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/click-repl/default.nix b/pkgs/development/python-modules/click-repl/default.nix
index 7b57b60938b2..5dffa0168649 100644
--- a/pkgs/development/python-modules/click-repl/default.nix
+++ b/pkgs/development/python-modules/click-repl/default.nix
@@ -9,31 +9,31 @@
   # dependencies
   click,
   prompt-toolkit,
-  six,
+  typing-extensions,
 
   # tests
   pytest-cov-stub,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "click-repl";
-  version = "0.3.0";
+  version = "0.3.0-unstable-2026-03-26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "click-contrib";
     repo = "click-repl";
-    tag = version;
-    hash = "sha256-xCT3w0DDY73dtDL5jbssXM05Zlr44OOcy4vexgHyWiE=";
+    rev = "b84191aec21b407b3cb3374ff1ab000887d38f29";
+    hash = "sha256-5Xv6oeV6sIRE3K3sZq8DyAXOcY8fYobcJtW/ZN7C4U0=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     click
     prompt-toolkit
-    six
+    typing-extensions
   ];
 
   nativeCheckInputs = [
@@ -42,11 +42,9 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    # https://github.com/click-contrib/click-repl/issues/128
-    broken = lib.versionAtLeast click.version "8.2.0";
     homepage = "https://github.com/click-contrib/click-repl";
     description = "Subcommand REPL for click apps";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ twey ];
   };
-}
+})

From b4b0de8c2515e014a0509241522bb5152525f022 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:08:36 +0200
Subject: [PATCH 0332/1209] python3Packages.lxml: 6.0.2 -> 6.1.0

https://github.com/lxml/lxml/blob/lxml-6.1.0/CHANGES.txt
---
 pkgs/development/python-modules/lxml/default.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index 2892a70dd7c4..d3dd5022478f 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -18,21 +18,16 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "6.0.2";
+  version = "6.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lxml";
     repo = "lxml";
     tag = "lxml-${version}";
-    hash = "sha256-Ri5SzfQJFghRcMAKHS5QKD365OZlio895fSlumq83vs=";
+    hash = "sha256-crFUn1TmxdHXr3ULDKsRy4Y4PR/itaycsWiSDb+pbeg=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail 'Cython>=3.1.4' 'Cython'
-  '';
-
   build-system = [
     cython
     setuptools

From d7aa737a85346c2dc8c1bc80501949dc2174dcc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 8 May 2026 12:46:06 -0700
Subject: [PATCH 0333/1209] python3Packages.backports-zstd: 1.3.0 -> 1.4.0

Diff: https://github.com/rogdham/backports.zstd/compare/v1.3.0...v1.4.0

Changelog: https://github.com/rogdham/backports.zstd/blob/v1.4.0/CHANGELOG.md
---
 pkgs/development/python-modules/backports-zstd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/backports-zstd/default.nix b/pkgs/development/python-modules/backports-zstd/default.nix
index e8567cb41465..13c28638361f 100644
--- a/pkgs/development/python-modules/backports-zstd/default.nix
+++ b/pkgs/development/python-modules/backports-zstd/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "backports-zstd";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm -r "$out/src/c/zstd"
     '';
-    hash = "sha256-AF2Id4U2++RMCFICxz0E3DrgEVgGNsph4sIZ9YC87fE=";
+    hash = "sha256-dOzaenKu3sf1qaTWZfJ6W1l3KV4BYklUardpiPnSQWU=";
   };
 
   postPatch = ''

From 65a18839e72199f2a6ad332565b8a94e7776648d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 05:22:56 +0200
Subject: [PATCH 0334/1209] python3Packages.typeguard: 4.4.4 -> 4.5.1

https://github.com/agronholm/typeguard/releases/tag/4.5.1
---
 pkgs/development/python-modules/typeguard/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index 81a5310ec78b..b1c969e2d398 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "typeguard";
-  version = "4.4.4";
+  version = "4.5.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-On/S3/twXU0O+u1DBqcEyJud7oULaI8GCosWFaeeX3Q=";
+    hash = "sha256-9vjsu8gZybx0mYPMZ8AjkeFqm0O4sn8V3HDtfEoAcnQ=";
   };
 
   outputs = [

From e59adf722657f3305cf80855365362c2c2281633 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:11:31 +0200
Subject: [PATCH 0335/1209] python3Packages.requests: 2.33.1 -> 2.34.0

https://github.com/psf/requests/blob/v2.34.0/HISTORY.md
---
 .../python-modules/requests/default.nix        | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 633658bec1ec..17fca3669c1e 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -15,18 +15,16 @@
   urllib3,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "requests";
-  version = "2.33.1";
+  version = "2.34.0";
   pyproject = true;
 
-  __darwinAllowLocalNetworking = true;
-
   src = fetchFromGitHub {
     owner = "psf";
     repo = "requests";
-    tag = "v${version}";
-    hash = "sha256-cQnCTMmpdkvWwt7RFAIhAfmhVwGVn0Y8Z5Tr6lzDmS8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DDx+UV3OuCLUXM7ESbURCGeZ7t2acFEfMTOMcJdfUbI=";
   };
 
   build-system = [ setuptools ];
@@ -49,7 +47,7 @@ buildPythonPackage rec {
     pytest-xdist
     pytestCheckHook
   ]
-  ++ optional-dependencies.socks;
+  ++ finalAttrs.passthru.optional-dependencies.socks;
 
   disabledTests = [
     # Disable tests that require network access and use httpbin
@@ -79,11 +77,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "requests" ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "HTTP library for Python";
     homepage = "http://docs.python-requests.org/";
-    changelog = "https://github.com/psf/requests/blob/v${version}/HISTORY.md";
+    changelog = "https://github.com/psf/requests/blob/${finalAttrs.src.tag}/HISTORY.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From a9b867c25b3f7c5419547102286cee3e2dd89792 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:14:39 +0200
Subject: [PATCH 0336/1209] python3Packages.importlib-resources: 6.5.2 -> 7.1.0

---
 .../python-modules/importlib-resources/default.nix        | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index f5451a8e95ee..85dfcc8a7038 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -21,15 +21,19 @@
 
 buildPythonPackage rec {
   pname = "importlib-resources";
-  version = "6.5.2";
+  version = "7.1.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "importlib_resources";
     inherit version;
-    hash = "sha256-GF+Hre9bzCiESdmPtPugfOp4vANkVd1ExfxKL+eP7Sw=";
+    hash = "sha256-ByLUxiEkicUw8qFFo0wKejtHIbyWoV+tpZMOKgt2Bwg=";
   };
 
+  postPatch = ''
+    sed -i '/coherent.licensed/d' pyproject.toml
+  '';
+
   build-system = [
     setuptools
     setuptools-scm

From b8e8ef279380136c1ceccb4c442afec26d7ef41f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:33:47 +0200
Subject: [PATCH 0337/1209] python3Packages.cryptography: disable problematic
 test

Depending on the overcommit setting of the host system this test tries
to allocate up to 1 TiB of virtual memory.
---
 pkgs/development/python-modules/cryptography/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 729c1801daa7..56fb295e6dd9 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -71,6 +71,12 @@ buildPythonPackage rec {
 
   pytestFlags = [ "--disable-pytest-warnings" ];
 
+  disabledTests = [
+    # Tries to allocate 1 TiB with vm.overcommit_memory=1
+    # https://github.com/pyca/cryptography/pull/14782
+    "test_argon2_malloc_failure"
+  ];
+
   disabledTestPaths = [
     # save compute time by not running benchmarks
     "tests/bench"

From 5d71cbbabe6aa159eaa35d0de1d95979cfbd2fff Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:44:21 +0200
Subject: [PATCH 0338/1209] python3Packages.pandas: 2.3.3 -> 3.0.3

https://pandas.pydata.org/docs/whatsnew/index.html
---
 pkgs/development/python-modules/pandas/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 947122608e8c..88c164c5a93f 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -63,14 +63,14 @@
 let
   pandas = buildPythonPackage rec {
     pname = "pandas";
-    version = "2.3.3";
+    version = "3.0.3";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "pandas-dev";
       repo = "pandas";
       tag = "v${version}";
-      hash = "sha256-jY1uM9HmJzoFk26ilbtzJnxAsQhmXS19r73JcFeFWRQ=";
+      hash = "sha256-G+pWdmft/kcxv97ySa+0ZFEgvMKuNaK33DseZQ8R1z8=";
     };
 
     # A NOTE regarding the Numpy version relaxing: Both Numpy versions 1.x &
@@ -86,7 +86,7 @@ let
     # that override globally the `numpy` attribute to point to `numpy_1`.
     postPatch = ''
       substituteInPlace pyproject.toml \
-        --replace-fail "numpy>=2.0" numpy
+        --replace-fail "numpy>=2.0.0" numpy
     '';
 
     build-system = [

From 527b10263179b75f9ad1f71aa2e74ad3a2641651 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:47:08 +0200
Subject: [PATCH 0339/1209] python3Packages.pycurl: 7.45.6 -> 7.46.0

https://github.com/pycurl/pycurl/blob/REL_7_46_0/ChangeLog
---
 .../python-modules/pycurl/default.nix         | 37 ++++---------------
 1 file changed, 7 insertions(+), 30 deletions(-)

diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 49be840bf8f9..e37e001a3419 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -4,19 +4,19 @@
   buildPythonPackage,
   isPyPy,
   fetchFromGitHub,
-  fetchpatch,
   curl,
   openssl,
   bottle,
   pytestCheckHook,
   flaky,
   flask,
+  numpy,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pycurl";
-  version = "7.45.6";
+  version = "7.46.0";
   pyproject = true;
 
   disabled = isPyPy; # https://github.com/pycurl/pycurl/issues/208
@@ -25,24 +25,9 @@ buildPythonPackage rec {
     owner = "pycurl";
     repo = "pycurl";
     tag = "REL_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-M4rO0CaI2SmjdJVS7hWnJZrL72WvayB4aKn707KoNiQ=";
+    hash = "sha256-F40bJ7TYFK2dVkDJGGxl7XV46fKmjwvUYYulcwGL6hk=";
   };
 
-  patches = [
-    # curl 8.16 compatibility
-    (fetchpatch {
-      url = "https://github.com/pycurl/pycurl/commit/eb7f52eeef85feb6c117678d52803050bbdd7bc8.patch";
-      hash = "sha256-hdwazS7R9duuMd/7S3SNAxVcToo3GhtyWu/1Q6qTMYc=";
-    })
-    # curl 8.17+ compatibility
-    # https://github.com/pycurl/pycurl/pull/909
-    (fetchpatch {
-      name = "pycurl-8.17.0-compat.patch";
-      url = "https://github.com/pycurl/pycurl/commit/ea92e3ca230a3ff3d464cb6816102fa157177aca.patch";
-      hash = "sha256-kmlsG0SFfS9FdRNp8pPgudcWK6hSyD9x5oAedZLgBcY=";
-    })
-  ];
-
   preConfigure = ''
     substituteInPlace setup.py \
       --replace-fail '--static-libs' '--libs'
@@ -64,6 +49,7 @@ buildPythonPackage rec {
     bottle
     flaky
     flask
+    numpy
     pytestCheckHook
   ];
 
@@ -90,24 +76,15 @@ buildPythonPackage rec {
     "test_libcurl_ssl_gnutls"
     # AssertionError: assert 'crypto' in ['curl']
     "test_ssl_in_static_libs"
-    # https://github.com/pycurl/pycurl/issues/819
-    "test_multi_socket_select"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # https://github.com/pycurl/pycurl/issues/729
-    "test_easy_pause_unpause"
-    "test_multi_socket_action"
+    # expected socketp to be None again after unassign()
+    "test_clear_via_assign_none_inside_callback_resets_socketp"
+    "test_multi_unassign_inside_socket_callback"
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     # Fatal Python error: Segmentation fault
     "cadata_test"
   ];
 
-  disabledTestPaths = [
-    # https://github.com/pycurl/pycurl/issues/856
-    "tests/multi_test.py"
-  ];
-
   meta = {
     description = "Python Interface To The cURL library";
     homepage = "http://pycurl.io/";

From 81d9d52bf7a580609f6885fda75f085617be2d9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 02:31:36 -0700
Subject: [PATCH 0340/1209] python3Packages.pydantic-core: 2.41.5 -> 2.46.4

---
 .../python-modules/pydantic-core/default.nix  | 26 ++++++++++---------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/pydantic-core/default.nix b/pkgs/development/python-modules/pydantic-core/default.nix
index c59679649a88..6f580895976f 100644
--- a/pkgs/development/python-modules/pydantic-core/default.nix
+++ b/pkgs/development/python-modules/pydantic-core/default.nix
@@ -2,9 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  cargo,
   rustPlatform,
-  rustc,
   typing-extensions,
   pytestCheckHook,
   hypothesis,
@@ -21,26 +19,31 @@
 let
   pydantic-core = buildPythonPackage rec {
     pname = "pydantic-core";
-    version = "2.41.5";
+    version = "2.46.4";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "pydantic";
-      repo = "pydantic-core";
-      tag = "v${version}";
-      hash = "sha256-oIYHLSep8tWOXEaUybXG8Gv9WBoPGQ1Aj7QyqYksvMw=";
+      repo = "pydantic";
+      tag = "core-v${version}";
+      hash = "sha256-G4Xo6BF6tOn4g/qG3RNDP3/+lYnCOuw3AB1OrVOGcSA=";
     };
 
+    sourceRoot = "${src.name}/pydantic-core";
+
     cargoDeps = rustPlatform.fetchCargoVendor {
-      inherit pname version src;
-      hash = "sha256-Kvc0a34C6oGc9oS/iaPaazoVUWn5ABUgrmPa/YocV+Y=";
+      inherit
+        pname
+        version
+        src
+        sourceRoot
+        ;
+      hash = "sha256-5L317YTV7/Bc/YJLLzc745oJntiYkcZupdeUxiQwcOU=";
     };
 
     nativeBuildInputs = [
-      cargo
       rustPlatform.cargoSetupHook
       rustPlatform.maturinBuildHook
-      rustc
     ];
 
     dependencies = [ typing-extensions ];
@@ -64,9 +67,8 @@ let
     ];
 
     meta = {
-      changelog = "https://github.com/pydantic/pydantic-core/releases/tag/${src.tag}";
       description = "Core validation logic for pydantic written in rust";
-      homepage = "https://github.com/pydantic/pydantic-core";
+      homepage = "https://github.com/pydantic/pydantic/tree/main/pydantic-core";
       license = lib.licenses.mit;
       inherit (pydantic.meta) maintainers;
     };

From a03c2ddc0f4f4e7727d46d0f1f7f3cde79074b33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 02:29:43 -0700
Subject: [PATCH 0341/1209] python3Packages.pydantic: 2.12.5 -> 2.13.4

Diff: https://github.com/pydantic/pydantic/compare/v2.12.5...v2.13.4

Changelog: https://github.com/pydantic/pydantic/blob/v2.13.4/HISTORY.md
---
 .../python-modules/pydantic/default.nix       | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index a34ffbb95b29..b84ef6f5aace 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -3,7 +3,6 @@
   python,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   # build-system
   hatchling,
@@ -19,32 +18,27 @@
   cloudpickle,
   email-validator,
   dirty-equals,
+  hypothesis,
+  inline-snapshot,
   jsonschema,
   pytestCheckHook,
   pytest-mock,
   pytest-run-parallel,
+  pytest-timeout,
 }:
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "2.12.5";
+  version = "2.13.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic";
     tag = "v${version}";
-    hash = "sha256-9TRLtVNBw2WHQnS0XFHg16Q7FdpTf3e2nb5qE5rlLUA=";
+    hash = "sha256-G4Xo6BF6tOn4g/qG3RNDP3/+lYnCOuw3AB1OrVOGcSA=";
   };
 
-  patches = lib.optionals (lib.versionAtLeast python.version "3.14.1") [
-    # Fix build with python 3.14.1
-    (fetchpatch {
-      url = "https://github.com/pydantic/pydantic/commit/53cb5f830207dd417d20e0e55aab2e6764f0d6fc.patch";
-      hash = "sha256-Y1Ob1Ei0rrw0ua+0F5L2iE2r2RdpI9DI2xuiu9pLr5Y=";
-    })
-  ];
-
   postPatch = ''
     sed -i "/--benchmark/d" pyproject.toml
   '';
@@ -68,15 +62,19 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     cloudpickle
     dirty-equals
+    hypothesis
+    (inline-snapshot.overridePythonAttrs { doCheck = false; })
     jsonschema
     pytest-mock
     pytest-run-parallel
+    pytest-timeout
     pytestCheckHook
   ]
   ++ lib.concatAttrValues optional-dependencies;
 
   disabledTestPaths = [
     "tests/benchmarks"
+    "tests/pydantic_core/benchmarks"
 
     # avoid cyclic dependency
     "tests/test_docs.py"

From ff4c4962d28ba2140f8b0bb8d2705d2c1903584d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 06:05:04 -0700
Subject: [PATCH 0342/1209] python3Packages.mashumaro: 3.17 -> 3.21

Diff: https://github.com/Fatal1ty/mashumaro/compare/v3.17...v3.21

Changelog: https://github.com/Fatal1ty/mashumaro/releases/tag/v3.21
---
 pkgs/development/python-modules/mashumaro/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mashumaro/default.nix b/pkgs/development/python-modules/mashumaro/default.nix
index 2a490f7d6e2c..88e4f1ad479e 100644
--- a/pkgs/development/python-modules/mashumaro/default.nix
+++ b/pkgs/development/python-modules/mashumaro/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "mashumaro";
-  version = "3.17";
+  version = "3.21";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Fatal1ty";
     repo = "mashumaro";
     tag = "v${version}";
-    hash = "sha256-oQKSIDrIPlY1m63uP9Jxpgf7ruaZpt9uZF4hTso503U=";
+    hash = "sha256-SWmZA/yoiElQ299+BkjwTdcPukKfgw/UgUwiesFRkqo=";
   };
 
   build-system = [ setuptools ];

From 5addde923dd9b990d839992a20ea379eab46333a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 06:05:08 -0700
Subject: [PATCH 0343/1209] python3Packages.platformdirs: 4.5.1 -> 4.9.6

Diff: https://github.com/tox-dev/platformdirs/compare/4.5.1...4.9.6

Changelog: https://github.com/tox-dev/platformdirs/releases/tag/4.9.6
---
 pkgs/development/python-modules/platformdirs/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index fd0cc9667c0d..3c81d609b50f 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "4.5.1";
+  version = "4.9.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "platformdirs";
     tag = version;
-    hash = "sha256-wDhhfS8r0fCYOUJUu2kwH+fyTPmS+aPUiqWN21Fedoc=";
+    hash = "sha256-/aoJquWRn1UQZa96uZba15tDO+IGEHN9/duu9JYXmd4=";
   };
 
   build-system = [
@@ -34,6 +34,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "platformdirs" ];
 
+  preCheck = ''
+    unset XDG_DATA_DIRS
+  '';
+
   meta = {
     description = "Module for determining appropriate platform-specific directories";
     homepage = "https://platformdirs.readthedocs.io/";

From 7bd04c0097c8e274f1090eb2d3c6f390217c7605 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 14:23:11 +0200
Subject: [PATCH 0344/1209] python3Packages.pathspec: 1.0.4 -> 1.1.1

https://github.com/cpburnz/python-pathspec/blob/v1.1.1/CHANGES.rst
---
 pkgs/development/python-modules/pathspec/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pathspec/default.nix b/pkgs/development/python-modules/pathspec/default.nix
index 925f2896c54b..a0f0b47f599f 100644
--- a/pkgs/development/python-modules/pathspec/default.nix
+++ b/pkgs/development/python-modules/pathspec/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "pathspec";
-  version = "1.0.4";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AhDiroohqRN8DUcFeMsOWVr4ftqm6/Ev8XbxSgLg5kU=";
+    hash = "sha256-F9tezVJBBKEg4XOBTJA2epapjQfEWy4QwvORn/+Rv1o=";
   };
 
   nativeBuildInputs = [ flit-core ];

From 2d6cb39369369a3ba4d77291e1b2acb628427f2d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 14:55:21 +0200
Subject: [PATCH 0345/1209] python3Packages.zipp: 3.23.1 -> 4.0.0

https://github.com/jaraco/zipp/compare/v3.23.1...v4.0.0
---
 pkgs/development/python-modules/zipp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index 9981e18a166e..bd2c8c65ad88 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -11,14 +11,14 @@
 let
   zipp = buildPythonPackage rec {
     pname = "zipp";
-    version = "3.23.1";
+    version = "4.0.0";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "jaraco";
       repo = "zipp";
       tag = "v${version}";
-      hash = "sha256-SC5aMiQsAPLNjCdOHDAMYX2iDSwZltjXxAJJgZnPlJ0=";
+      hash = "sha256-JkU35S+BpDvWca1+BP61z3W5oyxf/RI21WXZ9fZ65SQ=";
     };
 
     postPatch = ''

From 83fbf8ebee98139688e59d538b3c0e89191a80c4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 14:58:33 +0200
Subject: [PATCH 0346/1209] python3Packages.skia-pathops: 0.9.1 -> 0.9.2

---
 pkgs/development/python-modules/skia-pathops/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/skia-pathops/default.nix b/pkgs/development/python-modules/skia-pathops/default.nix
index 275f8814a9cb..8db6aca481ec 100644
--- a/pkgs/development/python-modules/skia-pathops/default.nix
+++ b/pkgs/development/python-modules/skia-pathops/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "skia-pathops";
-  version = "0.9.1";
+  version = "0.9.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "skia_pathops";
     inherit version;
-    hash = "sha256-8Sc+9NojVw8z5253U5CEhOWkokaPexCJ+REMzuYpP5k=";
+    hash = "sha256-S22EWfb0ppKCyyb8oMK7CzIcxYqb+cxleaUqOR7cAxk=";
   };
 
   postPatch = ''

From 95dd19e324a1bf808b8518b7c12836927ec4b266 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 15:02:44 +0200
Subject: [PATCH 0347/1209] python3Packages.mako: 1.3.10 -> 1.3.12

https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12
---
 .../python-modules/mako/default.nix            | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/mako/default.nix b/pkgs/development/python-modules/mako/default.nix
index ab4137e548bc..a317e542fc80 100644
--- a/pkgs/development/python-modules/mako/default.nix
+++ b/pkgs/development/python-modules/mako/default.nix
@@ -5,7 +5,7 @@
   isPyPy,
 
   # build-system
-  setuptools,
+  setuptools_80,
 
   # propagates
   markupsafe,
@@ -20,19 +20,19 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "mako";
-  version = "1.3.10";
+  version = "1.3.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlalchemy";
     repo = "mako";
-    tag = "rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-lxGlYyKbrDpr2LHcsqTow+s2l8+g+63M5j8xJt++tGo=";
+    tag = "rel_${lib.replaceString "." "_" finalAttrs.version}";
+    hash = "sha256-YIMmP8CIGUlgnB8/96lR9yDvEZTES766dSN0vT0JfbM=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [ markupsafe ];
 
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     mock
     pytestCheckHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   disabledTests = lib.optionals isPyPy [
     # https://github.com/sqlalchemy/mako/issues/315
@@ -59,12 +59,12 @@ buildPythonPackage rec {
   ];
 
   meta = {
+    changelog = "https://github.com/sqlalchemy/mako/releases/tag/${finalAttrs.src.tag}";
     description = "Super-fast templating language";
     mainProgram = "mako-render";
     homepage = "https://www.makotemplates.org/";
-    changelog = "https://docs.makotemplates.org/en/latest/changelog.html";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = [ ];
   };
-}
+})

From d59d282564af6ac82e99ca5915a4e95e27c7760c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 16:23:25 +0200
Subject: [PATCH 0348/1209] python3Packages.ast-serialize: init at 0.3.0

---
 .../python-modules/ast-serialize/default.nix  | 44 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/development/python-modules/ast-serialize/default.nix

diff --git a/pkgs/development/python-modules/ast-serialize/default.nix b/pkgs/development/python-modules/ast-serialize/default.nix
new file mode 100644
index 000000000000..71ee99cb9e62
--- /dev/null
+++ b/pkgs/development/python-modules/ast-serialize/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cargo,
+  rustPlatform,
+  rustc,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "ast-serialize";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "mypyc";
+    repo = "ast_serialize";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-R5hNpbJjKKZDOKQCdGZQ+0iW5vdh5CzSgzORESh4bDU=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-uhUMaUkaL57X8CVy6T9pCQa62IsOeKN/dhZTPVXSn14=";
+  };
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  pythonImportsCheck = [
+    "ast_serialize"
+  ];
+
+  meta = {
+    description = "Fast Python parser that generates a serialized AST";
+    homepage = "https://github.com/mypyc/ast_serialize";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0affe265a11a..815153af375a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1094,6 +1094,8 @@ self: super: with self; {
 
   ast-grep-py = callPackage ../development/python-modules/ast-grep-py { };
 
+  ast-serialize = callPackage ../development/python-modules/ast-serialize { };
+
   asterisk-mbox = callPackage ../development/python-modules/asterisk-mbox { };
 
   asteroid-filterbanks = callPackage ../development/python-modules/asteroid-filterbanks { };

From c5d5b72238ae3cb8764a30d85691139a8d61e49a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 16:23:48 +0200
Subject: [PATCH 0349/1209] python3Packages.mypy: 1.20.1 -> 2.1.0

---
 pkgs/development/python-modules/mypy/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index add7605c4a9b..b758998c6dbc 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -12,6 +12,7 @@
   setuptools,
   types-psutil,
   types-setuptools,
+  ast-serialize,
 
   # propagates
   librt,
@@ -33,7 +34,7 @@
 
 buildPythonPackage rec {
   pname = "mypy";
-  version = "1.20.1";
+  version = "2.1.0";
   pyproject = true;
 
   # relies on several CPython internals
@@ -43,7 +44,7 @@ buildPythonPackage rec {
     owner = "python";
     repo = "mypy";
     tag = "v${version}";
-    hash = "sha256-MQZZyGu6xFh3wO+0lWED+mingjK92v/onljtp9gylmM=";
+    hash = "sha256-sm/pxQGxH5XuPH7B8i3fpp30KaFU9aSp6BT67UcDPvU=";
   };
 
   passthru.updateScript = gitUpdater {
@@ -57,6 +58,7 @@ buildPythonPackage rec {
     types-psutil
     types-setuptools
     typing-extensions
+    ast-serialize
   ];
 
   dependencies = [

From a9349934d2f581c60de5018b20bdaa33a9f65788 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 17:33:58 +0200
Subject: [PATCH 0350/1209] python3Packages.charset-normaler: expose withMypyc
 flag

This is necessary to break the

     fetch-cargo-vendor
  -> ast-serialize
  -> mypy
  -> charset-normalizer
  -> requests
  -> fetch-cargo-vendor

infinite recursion
---
 .../python-modules/charset-normalizer/default.nix            | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index 5137ceb0e83f..da6efe28e397 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -8,6 +8,7 @@
   pytestCheckHook,
   requests,
   setuptools,
+  withMypyc ? !isPyPy,
 }:
 
 buildPythonPackage rec {
@@ -30,9 +31,9 @@ buildPythonPackage rec {
   build-system = [
     setuptools
   ]
-  ++ lib.optional (!isPyPy) mypy;
+  ++ lib.optional (withMypyc) mypy;
 
-  env.CHARSET_NORMALIZER_USE_MYPYC = lib.optionalString (!isPyPy) "1";
+  env.CHARSET_NORMALIZER_USE_MYPYC = lib.optionalString withMypyc "1";
 
   nativeCheckInputs = [ pytestCheckHook ];
 

From 3ca34d25fce6a6cf70a3284446ee2d96c6dbc558 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 17:35:11 +0200
Subject: [PATCH 0351/1209] fetchCargoVendor: break infinite recursion with
 ast-serialize

The ast-serialize package depends on fetchCargoVendor and is part of the
bootstrap chain for requests.
---
 pkgs/build-support/rust/fetch-cargo-vendor.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index 2802bf9e73f1..23c746921c57 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -3,7 +3,7 @@
   stdenvNoCC,
   runCommand,
   writers,
-  python3Packages,
+  python3,
   cargo,
   gitMinimal,
   nix-prefetch-git,
@@ -11,6 +11,16 @@
 }:
 
 let
+  python = python3.override {
+    self = python;
+    packageOverrides = final: prev: {
+      # The ast-serialize package, a dependency for mypy, depends on
+      # fetchCargoVendor and is part of the bootstrap chain for requests.
+      charset-normalizer = prev.charset-normalizer.override { withMypyc = false; };
+    };
+  };
+  python3Packages = python.pkgs;
+
   replaceWorkspaceValues = writers.writePython3Bin "replace-workspace-values" {
     libraries = with python3Packages; [
       tomli

From ca8d5fbb3d8512fc85ef938839e6682d69e1df67 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 18:05:42 +0200
Subject: [PATCH 0352/1209] python3Packages.librt: 0.9.0 -> 0.11.0

https://github.com/mypyc/librt/compare/v0.9.0...v0.11.0
---
 pkgs/development/python-modules/librt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/librt/default.nix b/pkgs/development/python-modules/librt/default.nix
index c1531eed6054..628f0e68b0ab 100644
--- a/pkgs/development/python-modules/librt/default.nix
+++ b/pkgs/development/python-modules/librt/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "librt";
-  version = "0.9.0";
+  version = "0.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mypyc";
     repo = "librt";
     tag = "v${version}";
-    hash = "sha256-RZGaOq8hmkwekCs1fKshDrx3vmHdJl/wI3IO9ZLH5rc=";
+    hash = "sha256-y9z1EdrZRiDtT8cxz/Ex/f6B/RfjnAXdGf7tM+77HGg=";
   };
 
   # https://github.com/mypyc/librt/blob/v0.7.8/.github/workflows/buildwheels.yml#L90-L93

From 0bb3a590b3da000f848a777f1b30d287b3761a71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 11:59:49 -0700
Subject: [PATCH 0353/1209] python3Packages.pytz: 2026.1.post1 -> 2026.2

Changelog: https://launchpad.net/pytz/+announcements
---
 pkgs/development/python-modules/pytz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index a6f0018e3fd1..7b8e9ddc2d6b 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pytz";
-  version = "2026.1.post1";
+  version = "2026.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-M3jd5qDD0mcZGCFCxW5gx/mvfpaAdvMarladcqA1juE=";
+    hash = "sha256-DmC0eynyFXQ3byGP4hq8AJiUojIeoWxnVPPK1ut83Wo=";
   };
 
   postPatch = ''

From 04038fded705355bb482068b3abd493c399ebe84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 12:02:32 -0700
Subject: [PATCH 0354/1209] python3Packages.pytest-subprocess: 1.5.4 -> 1.6.0

Diff: https://github.com/aklajnert/pytest-subprocess/compare/1.5.4...1.6.0

Changelog: https://github.com/aklajnert/pytest-subprocess/blob/1.6.0/HISTORY.rst
---
 .../python-modules/pytest-subprocess/default.nix   | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-subprocess/default.nix b/pkgs/development/python-modules/pytest-subprocess/default.nix
index b46373b85b9b..bdb8d2ef8591 100644
--- a/pkgs/development/python-modules/pytest-subprocess/default.nix
+++ b/pkgs/development/python-modules/pytest-subprocess/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   setuptools,
   pytest,
   pytestCheckHook,
@@ -16,25 +15,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-subprocess";
-  version = "1.5.4";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aklajnert";
     repo = "pytest-subprocess";
     tag = version;
-    hash = "sha256-TFTY6enuyzQx0U+qHVde71VHqVa0oEGbSJUwhMAsI7Q=";
+    hash = "sha256-zPKExIrCt8ZwhKGU0l3tyTcDhRIGPSiM8OWy5cpmsuE=";
   };
 
-  patches = [
-    # https://github.com/aklajnert/pytest-subprocess/pull/202
-    (fetchpatch {
-      name = "fix-test_any_matching_program.patch";
-      url = "https://github.com/aklajnert/pytest-subprocess/commit/14c571b9b72a7b7e429189a9455fc715e6f0dbce.patch";
-      hash = "sha256-xDj5KSyv+JXRuMoUKpIr5oDN9y8V14LApRXbzNi9HI8=";
-    })
-  ];
-
   build-system = [ setuptools ];
 
   buildInputs = [ pytest ];

From 404b6579059b783d5dae16cc15662691b7abfd7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 12:07:00 -0700
Subject: [PATCH 0355/1209] python3Packages.trove-classifiers: 2026.4.28.13 ->
 2026.5.7.17

Changelog: https://github.com/pypa/trove-classifiers/releases/tag/2026.5.7.17
---
 pkgs/development/python-modules/trove-classifiers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 5771c7160515..88a82933636b 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -10,13 +10,13 @@
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2026.4.28.13";
+    version = "2026.5.7.17";
     pyproject = true;
 
     src = fetchPypi {
       pname = "trove_classifiers";
       inherit version;
-      hash = "sha256-yFu4pTw95zMNFpm4RO2fuAmmAqCawV3HmtbRpQm+BnY=";
+      hash = "sha256-oEpI+PCnh8uZZRTTlprHYIqjxgyxXQc8HgKAHmBTPoA=";
     };
 
     postPatch = ''

From bc9158e81e11c409651030dc153469b9c336fa9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 11:23:13 -0700
Subject: [PATCH 0356/1209] python3Packages.pendulum: 3.1.0-unstable-2025-10-28
 -> 3.2.0

Diff: https://github.com/sdispater/pendulum/compare/2982f25feaad2e58ad1530d3b53cc30fc1c82bd6...3.2.0

Changelog: https://github.com/sdispater/pendulum/blob/3.2.0/CHANGELOG.md
---
 .../python-modules/pendulum/default.nix       | 23 +++++++------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/pendulum/default.nix b/pkgs/development/python-modules/pendulum/default.nix
index 2a30200bf269..da2332bc0220 100644
--- a/pkgs/development/python-modules/pendulum/default.nix
+++ b/pkgs/development/python-modules/pendulum/default.nix
@@ -3,10 +3,8 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  isPyPy,
 
   # build-system
-  poetry-core,
   rustPlatform,
 
   # native dependencies
@@ -14,54 +12,49 @@
 
   # dependencies
   python-dateutil,
-  time-machine,
   tzdata,
 
   # tests
   pytestCheckHook,
-  pytz,
+  time-machine,
 }:
 
 buildPythonPackage rec {
   pname = "pendulum";
-  version = "3.1.0-unstable-2025-10-28";
+  version = "3.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sdispater";
     repo = "pendulum";
-    rev = "2982f25feaad2e58ad1530d3b53cc30fc1c82bd6";
-    hash = "sha256-1ULvlWLZx3z5eGmWJfrN46x0ohJ+mAxipm6l6rykGPY=";
+    tag = version;
+    hash = "sha256-zpBymeYhCy+yu6RPhOuN5xOVk6928hd3+oRsfiBPPuY=";
   };
 
   cargoRoot = "rust";
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
     sourceRoot = "${src.name}/rust";
-    hash = "sha256-Ozg+TW/woJsqmbmyDsgdMua3Lmnn+KBvBhd9kVik3XY=";
+    hash = "sha256-tC65lxI561ygOhBFujWzGk32XiQH6QB42nqboWSfQrg=";
   };
 
   nativeBuildInputs = [
-    poetry-core
     rustPlatform.maturinBuildHook
     rustPlatform.cargoSetupHook
   ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ iconv ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     python-dateutil
     tzdata
-  ]
-  ++ lib.optionals (!isPyPy) [
-    time-machine
   ];
 
   pythonImportsCheck = [ "pendulum" ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    pytz
+    time-machine
   ];
 
   disabledTestPaths = [
@@ -75,7 +68,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python datetimes made easy";
     homepage = "https://github.com/sdispater/pendulum";
-    changelog = "https://github.com/sdispater/pendulum/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/sdispater/pendulum/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };

From ca7a8d536044be0bdd903da251ff7552c052f543 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 12:10:56 -0700
Subject: [PATCH 0357/1209] python3Packages.pendulum: use finalAttrs

---
 pkgs/development/python-modules/pendulum/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pendulum/default.nix b/pkgs/development/python-modules/pendulum/default.nix
index da2332bc0220..662acb08c292 100644
--- a/pkgs/development/python-modules/pendulum/default.nix
+++ b/pkgs/development/python-modules/pendulum/default.nix
@@ -19,7 +19,7 @@
   time-machine,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pendulum";
   version = "3.2.0";
   pyproject = true;
@@ -27,14 +27,14 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "sdispater";
     repo = "pendulum";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-zpBymeYhCy+yu6RPhOuN5xOVk6928hd3+oRsfiBPPuY=";
   };
 
   cargoRoot = "rust";
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${src.name}/rust";
+    inherit (finalAttrs) pname version src;
+    sourceRoot = "${finalAttrs.src.name}/rust";
     hash = "sha256-tC65lxI561ygOhBFujWzGk32XiQH6QB42nqboWSfQrg=";
   };
 
@@ -68,8 +68,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python datetimes made easy";
     homepage = "https://github.com/sdispater/pendulum";
-    changelog = "https://github.com/sdispater/pendulum/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/sdispater/pendulum/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})

From 6b54753cb103db12dc383131d2e724f4847f91ee Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 13 May 2026 02:38:24 +0200
Subject: [PATCH 0358/1209] python3Packages.uvicorn: 0.40.0 -> 0.46.0

https://github.com/encode/uvicorn/blob/0.46.0/CHANGELOG.md
---
 pkgs/development/python-modules/uvicorn/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/uvicorn/default.nix b/pkgs/development/python-modules/uvicorn/default.nix
index 9bdc07615fe1..d9d4aba3e6e2 100644
--- a/pkgs/development/python-modules/uvicorn/default.nix
+++ b/pkgs/development/python-modules/uvicorn/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "uvicorn";
-  version = "0.40.0";
+  version = "0.46.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "encode";
     repo = "uvicorn";
     tag = version;
-    hash = "sha256-YpmvMZJxxpMdwbhFQSu+0fo7kcM6w3zJ7jI5LVamV1E=";
+    hash = "sha256-+21fEPLnH2nrwPCXNlRw7U1VcXdaUnNCeThTfzepQoY=";
   };
 
   outputs = [

From db883c3f8ea329bb682b750996e97e566a4ba0a0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 14 May 2026 17:20:56 +0200
Subject: [PATCH 0359/1209] python3Packages.filelock: disable flaky locking
 tests

Locally these work fine, on builders these timeout after 20s.
---
 pkgs/development/python-modules/filelock/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index 1ef40a71fc1f..80810b707766 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -39,6 +39,8 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # Circular dependency with virtualenv
     "tests/test_virtualenv.py"
+    # Very prone to timeouts on busy machines
+    "tests/test_filelock.py"
   ];
 
   meta = {

From 73599831a40bdf3e1e777de1721a73d446239d99 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 14 May 2026 19:09:38 +0200
Subject: [PATCH 0360/1209] python3Packages.charset-normalizer: provide
 ast-serialize build dep

Now that mypy requires ast-serialize at build time, charset-normalizer
wants it too.
---
 .../python-modules/charset-normalizer/default.nix           | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index da6efe28e397..7454c0643eb1 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   isPyPy,
+  ast-serialize,
   mypy,
   pytestCheckHook,
   requests,
@@ -31,7 +32,10 @@ buildPythonPackage rec {
   build-system = [
     setuptools
   ]
-  ++ lib.optional (withMypyc) mypy;
+  ++ lib.optionals withMypyc [
+    ast-serialize
+    mypy
+  ];
 
   env.CHARSET_NORMALIZER_USE_MYPYC = lib.optionalString withMypyc "1";
 

From 29184d79fafd851f7f99926042c595eecd39cd48 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 14 May 2026 19:32:55 +0200
Subject: [PATCH 0361/1209] python3Packages.matplotlib: relax setuptools-scm
 constraint

---
 pkgs/development/python-modules/matplotlib/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index ff7fb38852a5..2311afef7a39 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -100,7 +100,8 @@ buildPythonPackage rec {
     ''
     + ''
       substituteInPlace pyproject.toml \
-        --replace-fail "meson-python>=0.13.1,<0.17.0" meson-python
+        --replace-fail "meson-python>=0.13.1,<0.17.0" meson-python \
+        --replace-fail "setuptools_scm>=7,<10" setuptools_scm
 
       patchShebangs tools
     ''

From 5a1cd9cc55dddb9a0ef3babd914f1f7d0cb8907f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 14 May 2026 19:34:07 +0200
Subject: [PATCH 0362/1209] python3Packages.rich: 14.3.3 -> 15.0.0

https://github.com/Textualize/rich/blob/v15.0.0/CHANGELOG.md
---
 pkgs/development/python-modules/rich/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index 78ad8add1fd9..7b055a98e0bb 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -25,16 +25,16 @@
   textual,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "rich";
-  version = "14.3.3";
+  version = "15.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Textualize";
     repo = "rich";
-    tag = "v${version}";
-    hash = "sha256-6udVO7N17ineQozlCG/tI9jJob811gqb4GtY50JZFb0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Uk3r6aYhrjYJ8GrMKfdlv3/muK/uUynd4pd1yWCwSOM=";
   };
 
   build-system = [ poetry-core ];
@@ -68,8 +68,8 @@ buildPythonPackage rec {
   meta = {
     description = "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal";
     homepage = "https://github.com/Textualize/rich";
-    changelog = "https://github.com/Textualize/rich/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Textualize/rich/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ris ];
   };
-}
+})

From 8ea0b4f2556c15e9736c87e5bb9862f161986b4b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 15:24:22 +0200
Subject: [PATCH 0363/1209] python3Packages.pylama: pin to setuptools_80

---
 .../python-modules/pylama/default.nix         |  4 +--
 .../python-ldap/python-3.14.patch             | 29 -------------------
 2 files changed, 2 insertions(+), 31 deletions(-)
 delete mode 100644 pkgs/development/python-modules/python-ldap/python-3.14.patch

diff --git a/pkgs/development/python-modules/pylama/default.nix b/pkgs/development/python-modules/pylama/default.nix
index ed1a787eb7a1..5349ee627470 100644
--- a/pkgs/development/python-modules/pylama/default.nix
+++ b/pkgs/development/python-modules/pylama/default.nix
@@ -11,7 +11,7 @@
   pydocstyle,
   pyflakes,
   vulture,
-  setuptools,
+  setuptools_80,
   pylint,
   pytestCheckHook,
 }:
@@ -43,7 +43,7 @@ let
       pycodestyle
       pydocstyle
       pyflakes
-      setuptools
+      setuptools_80
       vulture
     ];
 
diff --git a/pkgs/development/python-modules/python-ldap/python-3.14.patch b/pkgs/development/python-modules/python-ldap/python-3.14.patch
deleted file mode 100644
index 831296d2607e..000000000000
--- a/pkgs/development/python-modules/python-ldap/python-3.14.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From c6bb3ea9d16f0e088151b87c7ff8184272aa0714 Mon Sep 17 00:00:00 2001
-From: Iwan <iwanb@users.noreply.github.com>
-Date: Sat, 17 Jan 2026 15:26:55 +0100
-Subject: [PATCH] Explicitly close url file to avoid ResourceWarning in Python
- 3.14
-
----
- Lib/ldap/schema/subentry.py | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
-index b83d819b..3f73df71 100644
---- a/Lib/ldap/schema/subentry.py
-+++ b/Lib/ldap/schema/subentry.py
-@@ -476,10 +476,10 @@ def urlfetch(uri,trace_level=0):
-     l.unbind_s()
-     del l
-   else:
--    ldif_file = urlopen(uri)
--    ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
--    ldif_parser.parse()
--    subschemasubentry_dn,s_temp = ldif_parser.all_records[0]
-+    with urlopen(uri) as ldif_file:
-+      ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
-+      ldif_parser.parse()
-+      subschemasubentry_dn,s_temp = ldif_parser.all_records[0]
-   # Work-around for mixed-cased attribute names
-   subschemasubentry_entry = ldap.cidict.cidict()
-   s_temp = s_temp or {}

From 1434d0780e5235485f7ab251f4be595ab2cf34ee Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 16:30:13 +0200
Subject: [PATCH 0364/1209] python3Packages.deprecated: pin to setuptools_80

---
 .../python-modules/deprecated/default.nix           | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/deprecated/default.nix b/pkgs/development/python-modules/deprecated/default.nix
index 195534a8add3..4dce3b873c78 100644
--- a/pkgs/development/python-modules/deprecated/default.nix
+++ b/pkgs/development/python-modules/deprecated/default.nix
@@ -3,13 +3,13 @@
   fetchFromGitHub,
   buildPythonPackage,
   pythonAtLeast,
-  setuptools,
+  setuptools_80,
   wrapt,
   pytestCheckHook,
   sphinxHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "deprecated";
   version = "1.3.1";
   pyproject = true;
@@ -22,15 +22,15 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tantale";
     repo = "deprecated";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-1mB9aRZOsaW7Mqcu1SWIYTusQ7MlMvUucdTyfu++Nx8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   nativeBuildInputs = [ sphinxHook ];
 
-  propagatedBuildInputs = [ wrapt ];
+  dependencies = [ wrapt ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -43,9 +43,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "deprecated" ];
 
   meta = {
+    changelog = "https://github.com/laurent-laporte-pro/deprecated/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/tantale/deprecated";
     description = "Python @deprecated decorator to deprecate old python classes, functions or methods";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ tilpner ];
   };
-}
+})

From fb8cdd0dba95d2d293b648e7156b1419a96725e1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 16:34:18 +0200
Subject: [PATCH 0365/1209] python3Packages.blockdiag: pin to setuptools_80

---
 pkgs/development/python-modules/blockdiag/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/blockdiag/default.nix b/pkgs/development/python-modules/blockdiag/default.nix
index ba1e71eab352..7ca2aece7bfa 100644
--- a/pkgs/development/python-modules/blockdiag/default.nix
+++ b/pkgs/development/python-modules/blockdiag/default.nix
@@ -10,7 +10,7 @@
   pillow,
   pytestCheckHook,
   reportlab,
-  setuptools,
+  setuptools_80,
   webcolors,
 }:
 
@@ -48,14 +48,14 @@ buildPythonPackage rec {
     # note: this is a postPatch as `seqdiag` uses them directly
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     docutils
     funcparserlib
     pillow
     reportlab
-    setuptools
+    setuptools_80
     webcolors
   ];
 

From f3964c18d6dc142d8cfda6bb1ade6f1e3fb0a09f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 16:46:05 +0200
Subject: [PATCH 0366/1209] python3Packages.uvloop: pin to setuptools_80

---
 pkgs/development/python-modules/uvloop/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index 629c2cba2e0d..994eef15ed08 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -3,11 +3,10 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   # build-system
   cython,
-  setuptools,
+  setuptools_80,
 
   # native dependencies
   libuv,
@@ -39,7 +38,7 @@ buildPythonPackage rec {
 
   build-system = [
     cython
-    setuptools
+    setuptools_80
   ];
 
   env.LIBUV_CONFIGURE_HOST = stdenv.hostPlatform.config;

From 604a2a80c0026f8ed880ef5e6d6c05f5e535b57b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 17:03:45 +0200
Subject: [PATCH 0367/1209] python3Packages.distutils: disable failing tests

---
 pkgs/development/python-modules/distutils/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/distutils/default.nix b/pkgs/development/python-modules/distutils/default.nix
index 1039dea6e13f..292cf61b2fb9 100644
--- a/pkgs/development/python-modules/distutils/default.nix
+++ b/pkgs/development/python-modules/distutils/default.nix
@@ -72,7 +72,12 @@ buildPythonPackage {
   # jaraco-path depends ob pyobjc
   doCheck = !stdenv.hostPlatform.isDarwin;
 
-  disabledTests = lib.optionals (pythonAtLeast "3.14") [
+  disabledTests = [
+    #  TypeError: byte_compile() got an unexpected keyword argument 'dry_run'
+    "test_byte_compile"
+    "test_byte_compile_optimized"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
     #  AssertionError: assert '(?s:foo[^/]*)\\z' == '(?s:foo[^/]*)\\Z'
     "test_glob_to_re"
   ];

From b5c57c52c8bf0af4ef51b3f5a5023d07611ac29c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 17:04:06 +0200
Subject: [PATCH 0368/1209] python3Packages.python-ldap: 3.4.5 -> 3.4.6

https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.6
---
 .../python-modules/python-ldap/default.nix    | 22 +++++--------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/python-modules/python-ldap/default.nix b/pkgs/development/python-modules/python-ldap/default.nix
index 26cba5d602e9..3e067291bab6 100644
--- a/pkgs/development/python-modules/python-ldap/default.nix
+++ b/pkgs/development/python-modules/python-ldap/default.nix
@@ -19,28 +19,18 @@
   jaraco-functools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-ldap";
-  version = "3.4.5";
+  version = "3.4.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-ldap";
     repo = "python-ldap";
-    tag = "python-ldap-${version}";
-    hash = "sha256-olRu5HacRKaAcNbQczA+UCbDxhySUOO7qH0KdWlSbT0=";
+    tag = "python-ldap-${finalAttrs.version}";
+    hash = "sha256-j0viogO02O8G53ORq0u1U+B5I0mcpuB+E1Xvl7ZQKQw=";
   };
 
-  patches = [
-    # https://github.com/python-ldap/python-ldap/pull/605
-    ./python-3.14.patch
-  ];
-
-  postPatch = ''
-    # unused in 3.4.5; https://github.com/python-ldap/python-ldap/pull/597
-    sed -i "/setuptools-scm/d" pyproject.toml
-  '';
-
   build-system = [
     distutils
     setuptools
@@ -80,8 +70,8 @@ buildPythonPackage rec {
     description = "Python modules for implementing LDAP clients";
     downloadPage = "https://github.com/python-ldap/python-ldap";
     homepage = "https://www.python-ldap.org/";
-    changelog = "https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-${version}";
+    changelog = "https://github.com/python-ldap/python-ldap/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.psfl;
     maintainers = [ ];
   };
-}
+})

From 16c46466218e025e73e6ad7de125069df62e82c0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 17:14:51 +0200
Subject: [PATCH 0369/1209] python3Packages.tqdm: 4.67.1 -> 4.67.3

https://tqdm.github.io/releases/
---
 pkgs/development/python-modules/tqdm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index 0ca33fd88fe7..82cb311ab284 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "tqdm";
-  version = "4.67.1";
+  version = "4.67.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+K75xSwIwTpl8w6jT05arD/Ro0lZh51+WeYwJyhmJ/I=";
+    hash = "sha256-fYJfA/iSRO9z8dTOGTyxd0qBef2W8x1+Hc3mIJK5YLs=";
   };
 
   nativeBuildInputs = [

From 3f544ddd49d65aadaea5fa53ee65bd1c1c129a6f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 01:18:59 +0200
Subject: [PATCH 0370/1209] python3Packages.scikit-build-core: 0.11.6 -> 0.12.2

https://github.com/scikit-build/scikit-build-core/blob/v0.12.2/docs/about/changelog.md
---
 .../scikit-build-core/default.nix              | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/scikit-build-core/default.nix b/pkgs/development/python-modules/scikit-build-core/default.nix
index c0ee37ecae8e..61cd4585d23c 100644
--- a/pkgs/development/python-modules/scikit-build-core/default.nix
+++ b/pkgs/development/python-modules/scikit-build-core/default.nix
@@ -28,27 +28,24 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "scikit-build-core";
-  version = "0.11.6";
+  version = "0.12.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-build";
     repo = "scikit-build-core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zBTDacTkeclz+/X0SUl1xkxLz4zsfeLOD4Ew0V1Y1iU=";
+    hash = "sha256-JE6z44u1FLfI+Gguhd2rVUvY8tyEoo/WviGJmPRT8kc=";
   };
 
   patches = [
-    # Backport an upstream commit to fix the tests on Darwin.
     (fetchpatch {
-      url = "https://github.com/scikit-build/scikit-build-core/commit/c30f52a3b2bd01dc05f23d3b89332c213006afe0.patch";
-      excludes = [ ".github/workflows/ci.yml" ];
-      hash = "sha256-5E9QfF5UcSNY1wzHzieEEHEPYzPjUTb66CKCodYb9vo=";
+      name = "setuptools-scm-10-compat.patch";
+      url = "https://github.com/scikit-build/scikit-build-core/commit/1b870c538bf7ca679fc4a6e0cbba301c98d9ac35.patch";
+      hash = "sha256-JUxBvKiAHpDlIIFkvU+CflTNA6m/auxW5wd5cVYpvcM=";
     })
   ];
 
-  postPatch = "";
-
   build-system = [
     hatch-vcs
     hatchling
@@ -84,6 +81,11 @@ buildPythonPackage (finalAttrs: {
     "network"
   ];
 
+  disabledTests = [
+    # wheel tags generated with wrong system name/version
+    "test_wheel_tag"
+  ];
+
   disabledTestPaths = [
     # store permissions issue in Nix:
     "tests/test_editable.py"

From e03a9010055c6c3c91c51ee529d29a5cd43dd601 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 15 May 2026 10:17:35 -0700
Subject: [PATCH 0371/1209] python3Packages.pikepdf: 10.5.1 -> 10.6.0

Diff: https://github.com/pikepdf/pikepdf/compare/v10.5.1...v10.6.0

Changelog: https://github.com/pikepdf/pikepdf/blob/v10.6.0/docs/releasenotes/version10.md
---
 .../python-modules/pikepdf/default.nix        | 23 ++++++++++---------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index cb7214e768fb..43e519ca3a96 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -2,6 +2,7 @@
   lib,
   attrs,
   buildPythonPackage,
+  cmake,
   fetchFromGitHub,
   hypothesis,
   jbig2dec,
@@ -9,23 +10,24 @@
   lxml,
   withMupdf ? false,
   mupdf-headless,
+  nanobind,
+  ninja,
   numpy,
   packaging,
   pillow,
   psutil,
-  pybind11,
   pytest-xdist,
   pytestCheckHook,
   python-dateutil,
   python-xmp-toolkit,
   qpdf,
-  setuptools,
   replaceVars,
+  scikit-build-core,
 }:
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "10.5.1";
+  version = "10.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -38,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-x17cRef8rB5UQQws48G/IqeSp4B3CaLzIoUIQ8fJeUg=";
+    hash = "sha256-COEAY9/H9KZ1Tyj89CFMBl9ydTro82qk1XYWbaI9AFY=";
   };
 
   patches = [
@@ -54,18 +56,17 @@ buildPythonPackage rec {
     })
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail "shims_enabled = not cflags_defined" "shims_enabled = False"
-  '';
-
   buildInputs = [ qpdf ];
 
   build-system = [
-    pybind11
-    setuptools
+    cmake
+    nanobind
+    ninja
+    scikit-build-core
   ];
 
+  dontUseCmakeConfigure = true;
+
   nativeCheckInputs = [
     attrs
     hypothesis

From 3043c255b3f63d82df004cc8fa29b6a19013fbf1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 01:40:02 +0200
Subject: [PATCH 0372/1209] spidermonkey: pin to python 3.13

> AttributeError: module 'ast' has no attribute 'Str'
---
 pkgs/development/interpreters/spidermonkey/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/spidermonkey/common.nix b/pkgs/development/interpreters/spidermonkey/common.nix
index dd4bfcb45b7d..29b381e77476 100644
--- a/pkgs/development/interpreters/spidermonkey/common.nix
+++ b/pkgs/development/interpreters/spidermonkey/common.nix
@@ -15,7 +15,7 @@
   m4,
   perl,
   pkg-config,
-  python3,
+  python313,
   rust-cbindgen,
   rustPlatform,
   rustc,
@@ -80,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
     m4
     perl
     pkg-config
-    python3
+    python313
     rustc
     rustc.llvmPackages.llvm # for llvm-objdump
     which

From b7a93ec9e6b5dd233d70b1c9dc1ca2740773d881 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 02:00:36 +0200
Subject: [PATCH 0373/1209] buildMozillaMach: use python3.13 for versions below
 143.0

---
 pkgs/build-support/build-mozilla-mach/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 67312aa0e186..d6fce120abb7 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -58,6 +58,7 @@ in
   pkg-config,
   pkgsCross, # wasm32 rlbox
   python3,
+  python313,
   runCommand,
   rustc,
   rust-cbindgen,
@@ -364,7 +365,7 @@ buildStdenv.mkDerivation {
     makeBinaryWrapper
     nodejs
     perl
-    python3
+    (if lib.versionAtLeast version "143.0" then python3 else python313)
     rust-cbindgen
     rustPlatform.bindgenHook
     rustc

From 3ccd026063e5b6836980dad734554ebdcf59c533 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 02:03:14 +0200
Subject: [PATCH 0374/1209] python3Packages.face-recognition-models: pin
 setuptools_80

---
 .../python-modules/face-recognition/models.nix       | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/face-recognition/models.nix b/pkgs/development/python-modules/face-recognition/models.nix
index 40eb6ad5bbe2..aa2ef447dab8 100644
--- a/pkgs/development/python-modules/face-recognition/models.nix
+++ b/pkgs/development/python-modules/face-recognition/models.nix
@@ -2,21 +2,21 @@
   buildPythonPackage,
   lib,
   fetchPypi,
-  setuptools,
+  setuptools_80,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "face-recognition-models";
   version = "0.3.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "face_recognition_models";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-t5vSAKiMh8mp1EbJkK5xxaYm0fNzAXTm1XAVf/HYls8=";
   };
 
-  propagatedBuildInputs = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   # no tests
   doCheck = false;
@@ -29,4 +29,4 @@ buildPythonPackage rec {
     maintainers = [ ];
     description = "Trained models for the face_recognition python library";
   };
-}
+})

From a04da3fde40e75e24b1f22ab83281303e786602a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 02:03:42 +0200
Subject: [PATCH 0375/1209] python3Packages.apswutils: pin setuptools_80

---
 pkgs/development/python-modules/apswutils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/apswutils/default.nix b/pkgs/development/python-modules/apswutils/default.nix
index 035a74132ab5..707309af83a6 100644
--- a/pkgs/development/python-modules/apswutils/default.nix
+++ b/pkgs/development/python-modules/apswutils/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 
   # build-system
-  setuptools,
+  setuptools_80,
 
   # dependencies
   apsw,
@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   build-system = [
-    setuptools
+    setuptools_80
   ];
 
   dependencies = [

From e4d45548b4aab765d44e0be313d8dbc0eada07eb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 09:57:07 +0200
Subject: [PATCH 0376/1209] python3Packages.zope-testing: relax setuptools
 constraint

---
 pkgs/development/python-modules/zope-testing/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/zope-testing/default.nix b/pkgs/development/python-modules/zope-testing/default.nix
index 79764e7fed27..d0a68e9b7b24 100644
--- a/pkgs/development/python-modules/zope-testing/default.nix
+++ b/pkgs/development/python-modules/zope-testing/default.nix
@@ -19,6 +19,11 @@ buildPythonPackage rec {
     hash = "sha256-dAUiG8DxlhQKMBXh49P0CDC9UjqAYjB+2vVCTI36cgc=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools >= 78.1.1,< 81" setuptools
+  '';
+
   build-system = [ setuptools ];
 
   doCheck = !isPyPy;

From 47cb1d0c8ef0815fdd2c2c5fc7c208c71c55b285 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 09:59:25 +0200
Subject: [PATCH 0377/1209] python3Packages.pytest-mypy-plugins: 4.0.2 -> 4.0.3

https://github.com/typeddjango/pytest-mypy-plugins/releases/tag/4.0.3
---
 .../python-modules/pytest-mypy-plugins/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-mypy-plugins/default.nix b/pkgs/development/python-modules/pytest-mypy-plugins/default.nix
index 4c073d30e042..9ba4e2bef69a 100644
--- a/pkgs/development/python-modules/pytest-mypy-plugins/default.nix
+++ b/pkgs/development/python-modules/pytest-mypy-plugins/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-mypy-plugins";
-  version = "4.0.2";
+  version = "4.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "typeddjango";
     repo = "pytest-mypy-plugins";
     tag = version;
-    hash = "sha256-py6sspmhQ2vjXEEn+X6kx1+fTiS1M0P8z+kbgVItW/k=";
+    hash = "sha256-RyHoZniVLtunqz42tuVeAoiUm/e5JvvwX2MMCAJBhy8=";
   };
 
   build-system = [ setuptools ];

From 116e9f56ccdbf7571273708dd4431896e317a4cd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 10:00:44 +0200
Subject: [PATCH 0378/1209] python3Packages.jupyter-packaging: disable
 FutureWarning

---
 .../python-modules/jupyter-packaging/default.nix       | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/jupyter-packaging/default.nix b/pkgs/development/python-modules/jupyter-packaging/default.nix
index 9c56beb7f3a3..516cf273d441 100644
--- a/pkgs/development/python-modules/jupyter-packaging/default.nix
+++ b/pkgs/development/python-modules/jupyter-packaging/default.nix
@@ -31,9 +31,9 @@ buildPythonPackage rec {
     })
   ];
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     deprecation
     packaging
     setuptools
@@ -45,7 +45,11 @@ buildPythonPackage rec {
     pytest-timeout
   ];
 
-  pytestFlags = [ "-Wignore::DeprecationWarning" ];
+  pytestFlags = [
+    "-Wignore::DeprecationWarning"
+    # The 'wheel' package is no longer the canonical location of the 'bdist_wheel' command, and will be removed in a future release. Please update to setuptools v70.1 or later which contains an integrated version of this command.
+    "-Wignore::FutureWarning"
+  ];
 
   preCheck = ''
     export HOME=$(mktemp -d)

From fc149bad32bfab5e8004960cc053e8b3748cc2df Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 10:17:26 +0200
Subject: [PATCH 0379/1209] python3Packages.aiohasupervisor: drop wheel build
 dep

---
 pkgs/development/python-modules/aiohasupervisor/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/aiohasupervisor/default.nix b/pkgs/development/python-modules/aiohasupervisor/default.nix
index a4a3aaf8d4c1..f9a93a152ce4 100644
--- a/pkgs/development/python-modules/aiohasupervisor/default.nix
+++ b/pkgs/development/python-modules/aiohasupervisor/default.nix
@@ -29,7 +29,8 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail 'version = "0.0.0"' 'version = "${version}"' \
-      --replace-fail "setuptools>=68.0,<82.1" "setuptools"
+      --replace-fail "setuptools>=68.0,<82.1" "setuptools" \
+      --replace-fail ', "wheel>=0.40,<0.47"' ""
   '';
 
   build-system = [ setuptools ];

From 720b51f8029f4a02f0dc010b3f3d9c5693067e26 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 10:24:27 +0200
Subject: [PATCH 0380/1209] python3Packages.xlib: pin setuptools_80

---
 pkgs/development/python-modules/xlib/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/xlib/default.nix b/pkgs/development/python-modules/xlib/default.nix
index 73c1ff3eca83..13c97c7c9bb9 100644
--- a/pkgs/development/python-modules/xlib/default.nix
+++ b/pkgs/development/python-modules/xlib/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   six,
-  setuptools,
+  setuptools_80,
   setuptools-scm,
   libx11,
   xvfb,
@@ -19,8 +19,6 @@ buildPythonPackage rec {
   version = "0.33";
   pyproject = true;
 
-  build-system = [ setuptools ];
-
   src = fetchFromGitHub {
     owner = "python-xlib";
     repo = "python-xlib";
@@ -28,11 +26,13 @@ buildPythonPackage rec {
     hash = "sha256-u06OWlMIOUzHOVS4hvm72jGgTSXWUqMvEQd8bTpFog0=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    (setuptools-scm.override { setuptools = setuptools_80; })
+  ];
 
   buildInputs = [ libx11 ];
 
-  propagatedBuildInputs = [ six ];
+  dependencies = [ six ];
 
   doCheck = !stdenv.hostPlatform.isDarwin;
 

From 3dc26f2e52e702403288e7854101e5ee9e732d34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 16 May 2026 17:41:07 -0700
Subject: [PATCH 0381/1209] python3Packages.syrupy: 5.1.0 -> 5.2.0

Diff: https://github.com/syrupy-project/syrupy/compare/v5.1.0...v5.2.0

Changelog: https://github.com/syrupy-project/syrupy/blob/v5.2.0/CHANGELOG.md
---
 pkgs/development/python-modules/syrupy/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/syrupy/default.nix b/pkgs/development/python-modules/syrupy/default.nix
index 4b2b521e033c..0a04f704a740 100644
--- a/pkgs/development/python-modules/syrupy/default.nix
+++ b/pkgs/development/python-modules/syrupy/default.nix
@@ -1,9 +1,9 @@
 {
   lib,
-  attrs,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  hatchling,
+  hypothesis,
   pydantic,
   pytest,
   pytest-xdist,
@@ -12,22 +12,22 @@
 
 buildPythonPackage rec {
   pname = "syrupy";
-  version = "5.1.0";
+  version = "5.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "syrupy-project";
     repo = "syrupy";
     tag = "v${version}";
-    hash = "sha256-oogH5Q+0leZsfu/7r3tZmB2rxjcUOmGAsn4Z50oSlH8=";
+    hash = "sha256-tivRKADRYyyNmNOOd0w2qTseA3t7TMwkAkQ/Kr6wp6U=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   buildInputs = [ pytest ];
 
   nativeCheckInputs = [
-    attrs
+    hypothesis
     invoke
     pydantic
     pytest

From 065869b1b2d0a6894eba98a8967263c97dca45eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 16 May 2026 17:48:42 -0700
Subject: [PATCH 0382/1209] python3Packages.syrupy: use finalAttrs

---
 pkgs/development/python-modules/syrupy/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/syrupy/default.nix b/pkgs/development/python-modules/syrupy/default.nix
index 0a04f704a740..c4f84e150699 100644
--- a/pkgs/development/python-modules/syrupy/default.nix
+++ b/pkgs/development/python-modules/syrupy/default.nix
@@ -10,7 +10,7 @@
   invoke,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "syrupy";
   version = "5.2.0";
   pyproject = true;
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "syrupy-project";
     repo = "syrupy";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-tivRKADRYyyNmNOOd0w2qTseA3t7TMwkAkQ/Kr6wp6U=";
   };
 
@@ -44,10 +44,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "syrupy" ];
 
   meta = {
-    changelog = "https://github.com/syrupy-project/syrupy/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/syrupy-project/syrupy/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Pytest Snapshot Test Utility";
     homepage = "https://github.com/syrupy-project/syrupy";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

From 0d33bcce4ecd82a7568ff200c6c65dfc3af9357b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 17 May 2026 15:37:14 +0200
Subject: [PATCH 0383/1209] python3Packages.numcodecs: 0.16.3 -> 0.16.5

---
 .../python-modules/numcodecs/default.nix      | 22 ++++++++++++++-----
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/numcodecs/default.nix b/pkgs/development/python-modules/numcodecs/default.nix
index c32b3e679805..ef6f77ba48fe 100644
--- a/pkgs/development/python-modules/numcodecs/default.nix
+++ b/pkgs/development/python-modules/numcodecs/default.nix
@@ -11,15 +11,18 @@
   py-cpuinfo,
 
   # dependencies
-  deprecated,
   numpy,
+  typing-extensions,
 
   # optional-dependencies
   crc32c,
+  google-crc32c,
+  pcodec,
   pyzstd,
 
   # tests
   msgpack,
+  python,
   pytestCheckHook,
   importlib-metadata,
   zstd,
@@ -27,12 +30,12 @@
 
 buildPythonPackage rec {
   pname = "numcodecs";
-  version = "0.16.3";
+  version = "0.16.5";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-U9cFhl+q8KeSfJc683d1MgAcj7tlPeEZwehEYIYU15k=";
+    hash = "sha256-DQ+2CFL4TAvZVDzE0que79N/yO/MQQrNR3fmKh0wAxg=";
   };
 
   build-system = [
@@ -43,14 +46,15 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    deprecated
     numpy
+    typing-extensions
   ];
 
   optional-dependencies = {
     crc32c = [ crc32c ];
+    google_crc32c = [ google-crc32c ];
     msgpack = [ msgpack ];
-    pyzstd = [ pyzstd ];
+    pcodec = [ pcodec ];
     # zfpy = [ zfpy ];
   };
 
@@ -61,12 +65,18 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     importlib-metadata
+    pyzstd
     zstd
   ]
   ++ lib.concatAttrValues optional-dependencies;
 
+  disabledTestPaths = [
+    # https://github.com/zarr-developers/numcodecs/issues/815
+    "numcodecs/tests/test_pcodec.py"
+  ];
+
   # https://github.com/NixOS/nixpkgs/issues/255262
-  preCheck = "pushd $out";
+  preCheck = "pushd $out/${python.sitePackages}";
   postCheck = "popd";
 
   meta = {

From 3c13010a19b2e933f509109ea0ae3b63aef74853 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 17 May 2026 22:59:25 +0200
Subject: [PATCH 0384/1209] python3Packages.llvmlite: 0.46.0 -> 0.47.0

https://github.com/numba/llvmlite/blob/v0.47.0/CHANGE_LOG
---
 pkgs/development/python-modules/llvmlite/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/llvmlite/default.nix b/pkgs/development/python-modules/llvmlite/default.nix
index d932dd3c866d..cb855b02e33c 100644
--- a/pkgs/development/python-modules/llvmlite/default.nix
+++ b/pkgs/development/python-modules/llvmlite/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   buildPythonPackage,
   isPyPy,
-  pythonAtLeast,
 
   setuptools,
 
@@ -26,7 +24,7 @@ in
 
 buildPythonPackage rec {
   pname = "llvmlite";
-  version = "0.46.0";
+  version = "0.47.0";
   pyproject = true;
 
   disabled = isPyPy;
@@ -35,7 +33,7 @@ buildPythonPackage rec {
     owner = "numba";
     repo = "llvmlite";
     tag = "v${version}";
-    hash = "sha256-mQFNfcOLmFYvYQGcgLi7G6iJDoTCm7hJfPh5hH9jPGc=";
+    hash = "sha256-YEIdIdbk19JHYtgL2gWjnAUYu13CH+7ikoyBUkOPpws=";
   };
 
   build-system = [ setuptools ];

From 2b81f14fb44b825dbf2ef44e0da0842b823b3c78 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 17 May 2026 23:02:04 +0200
Subject: [PATCH 0385/1209] python3Packages.numba: 0.63.1 -> 0.65.1

https://numba.readthedocs.io/en/stable/release/0.65.1-notes.html
---
 .../python-modules/numba/default.nix          | 24 +++----------------
 1 file changed, 3 insertions(+), 21 deletions(-)

diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index 506f0e10dfd6..0e38f0392cde 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -37,7 +37,7 @@ let
   cudatoolkit = cudaPackages.cuda_nvcc;
 in
 buildPythonPackage (finalAttrs: {
-  version = "0.63.1";
+  version = "0.65.1";
   pname = "numba";
   pyproject = true;
 
@@ -53,7 +53,7 @@ buildPythonPackage (finalAttrs: {
     postFetch = ''
       sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${finalAttrs.src.tag})"/' $out/numba/_version.py
     '';
-    hash = "sha256-M7Hdc1Qakclz7i/HujBUqVEWFsHj9ZGQDzb8Ze9AztA=";
+    hash = "sha256-DMmUyTElDFyMK4BUQ4EhDNmG43lOWQHurKbnSyhAs5k=";
   };
 
   postPatch = ''
@@ -84,25 +84,7 @@ buildPythonPackage (finalAttrs: {
     llvmlite
   ];
 
-  patches = [
-    # Support Numpy 2.4, see:
-    #
-    # - https://github.com/numba/numba/pull/10393
-    # - https://github.com/numba/numba/issues/10263
-    (fetchpatch {
-      url = "https://github.com/numba/numba/commit/7ec267efb80d87f0652c00535e8843f35d006f20.patch";
-      hash = "sha256-oAOZa2/m2qs8CeX13/0lmRTg/lQj5aDIaaQeDeLAghc=";
-      excludes = [
-        "azure-pipelines.yml"
-        "buildscripts/azure/azure-windows.yml"
-      ];
-    })
-    # The above doesn't fix the source's build and run time checks of Numpy's
-    # version, it only fixes the tests and API. Upstream puts these checks only
-    # in release tarballs, and hence the patch has to be vendored.
-    ./numpy2.4.patch
-  ]
-  ++ lib.optionals cudaSupport [
+  patches = lib.optionals cudaSupport [
     (replaceVars ./cuda_path.patch {
       cuda_toolkit_path = cudatoolkit;
       cuda_toolkit_lib_path = lib.getLib cudatoolkit;

From ea45d1e8606c9b820d85f5c038b215957621406b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 00:51:49 +0200
Subject: [PATCH 0386/1209] python3Packages.torch: relax setuptools

---
 pkgs/development/python-modules/torch/source/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/torch/source/default.nix b/pkgs/development/python-modules/torch/source/default.nix
index d9a475d7512e..f547c1604476 100644
--- a/pkgs/development/python-modules/torch/source/default.nix
+++ b/pkgs/development/python-modules/torch/source/default.nix
@@ -348,7 +348,9 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=70.1.0,<80.0" "setuptools"
+      --replace-fail "setuptools>=70.1.0,<82" "setuptools"
+    substituteInPlace setup.py \
+      --replace-fail "setuptools<82" setuptools
   ''
   # Provide path to openssl binary for inductor code cache hash
   # InductorError: FileNotFoundError: [Errno 2] No such file or directory: 'openssl'

From 4143982e36f38bc219d93fae4069f0b32ab5e1ad Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 01:09:47 +0200
Subject: [PATCH 0387/1209] python3Packages.coreapi: pin to setuptools_80

---
 pkgs/development/python-modules/coreapi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/coreapi/default.nix b/pkgs/development/python-modules/coreapi/default.nix
index 7c810a0fb0c5..90c7c088308c 100644
--- a/pkgs/development/python-modules/coreapi/default.nix
+++ b/pkgs/development/python-modules/coreapi/default.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
-  setuptools,
+  setuptools_80,
   django,
   coreschema,
   itypes,
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     hash = "sha256-nNUzQbBaT7woI3fmvPvIM0SVDnt4iC2rQ9bDgUeFzLA=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     django

From b44ac20dfb04f54187e6a7dd95cdbfe83de341b2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:07:33 +0200
Subject: [PATCH 0388/1209] python3Packages.scales: pin to setuptools_80

---
 pkgs/development/python-modules/scales/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/scales/default.nix b/pkgs/development/python-modules/scales/default.nix
index e258bdf045f2..a0809ee2c5f3 100644
--- a/pkgs/development/python-modules/scales/default.nix
+++ b/pkgs/development/python-modules/scales/default.nix
@@ -5,7 +5,7 @@
   pytestCheckHook,
   fetchpatch2,
   six,
-  setuptools,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     done;
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [ six ];
 

From 9e8a6e9c9bd02489a59ea0a637bbd58ea6866987 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:11:51 +0200
Subject: [PATCH 0389/1209] python3Packages.plaster-pastedeploy: pep517 build,
 setuptools 81 pin

---
 .../python-modules/plaster-pastedeploy/default.nix         | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/plaster-pastedeploy/default.nix b/pkgs/development/python-modules/plaster-pastedeploy/default.nix
index 05e7a02e49b7..ab5a8f6dd902 100644
--- a/pkgs/development/python-modules/plaster-pastedeploy/default.nix
+++ b/pkgs/development/python-modules/plaster-pastedeploy/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools_80,
   plaster,
   pastedeploy,
   pytestCheckHook,
@@ -10,7 +11,7 @@
 buildPythonPackage rec {
   pname = "plaster-pastedeploy";
   version = "1.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "plaster_pastedeploy";
@@ -18,7 +19,9 @@ buildPythonPackage rec {
     hash = "sha256-viYubS5BpyZIddqi/ihQy7BhVyi83JKCj9xyc244FBI=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools_80 ];
+
+  dependencies = [
     plaster
     pastedeploy
   ];

From e4c7627d6ae57a55fc178392aab0a1822eb09da0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:16:47 +0200
Subject: [PATCH 0390/1209] python3Packages.mcp: 1.26.0 -> 1.27.1

https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.1
---
 pkgs/development/python-modules/mcp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mcp/default.nix b/pkgs/development/python-modules/mcp/default.nix
index b8536ececaa5..f351b9ce4313 100644
--- a/pkgs/development/python-modules/mcp/default.nix
+++ b/pkgs/development/python-modules/mcp/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mcp";
-  version = "1.26.0";
+  version = "1.27.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "modelcontextprotocol";
     repo = "python-sdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TGkAyuBcIstL2BCZYBWoi7PhnhoBvap67sLWGe0QUoU=";
+    hash = "sha256-LhoLcFC5+7xOCfud23sbHyTMxKYmdeZh0c+UtGdvzCs=";
   };
 
   # time.sleep(0.1) feels a bit optimistic and it has been flaky whilst

From 7b235832bc2996c42b5b74d9952c41015dff71f4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:18:25 +0200
Subject: [PATCH 0391/1209] afew: pin to setuptools_80

---
 pkgs/by-name/af/afew/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/af/afew/package.nix b/pkgs/by-name/af/afew/package.nix
index 00349a77af67..d5aa04249411 100644
--- a/pkgs/by-name/af/afew/package.nix
+++ b/pkgs/by-name/af/afew/package.nix
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   nativeBuildInputs = with python3Packages; [
     sphinxHook
-    setuptools
+    setuptools_80
     setuptools-scm
   ];
 

From 4b583d748c40e8ddf8c309a710f81027ec9cf981 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:33:36 +0200
Subject: [PATCH 0392/1209] python3Packages.home-assistant-chip-wheels: provide
 ast-serialize

Mypy 2.0 wants ast-serialize in some cases but does not propagate it
itself.
---
 .../python-modules/home-assistant-chip-wheels/default.nix       | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix b/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
index 8ccc67b828a0..0ff3cc2c9dab 100644
--- a/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
@@ -1,6 +1,7 @@
 {
   aiohttp,
   alive-progress,
+  ast-serialize,
   build,
   clang-tools,
   click,
@@ -196,6 +197,7 @@ stdenv.mkDerivation rec {
       dependencies = [
         aiohttp
         alive-progress
+        ast-serialize
         colorama
         coloredlogs
         click

From 9518afa893a183c0154b8597d6f5cd587dc1b5a1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:34:37 +0200
Subject: [PATCH 0393/1209] python3Packages.pycapnp: backport patch for py314
 compat

---
 pkgs/development/python-modules/pycapnp/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/python-modules/pycapnp/default.nix b/pkgs/development/python-modules/pycapnp/default.nix
index 2a60d3958e18..85505ac6c6e5 100644
--- a/pkgs/development/python-modules/pycapnp/default.nix
+++ b/pkgs/development/python-modules/pycapnp/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   replaceVars,
   fetchFromGitHub,
+  fetchpatch,
   setuptools,
   wheel,
   capnproto,
@@ -35,6 +36,12 @@ buildPythonPackage rec {
     # other than the builtin schemas (based on quick GitHub code search), so I don't
     # think it's worthwhile.
     (replaceVars ./include-paths.patch { inherit capnproto; })
+
+    (fetchpatch {
+      url = "https://github.com/capnproto/pycapnp/commit/aa90ab6844df4718f02e2ca4974858d5ab0b079c.patch";
+      name = "python314-compat.patch";
+      hash = "sha256-pscOdgPotLZsW0XWyRTJigIDl3uWOizA1W0gQGZHSyg=";
+    })
   ];
 
   build-system = [

From 654d103b12e185401fdbede9b6d543932fff6dd4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:38:13 +0200
Subject: [PATCH 0394/1209] python3Packages.scikit-build: 0.18.1 -> 0.19.0

https://github.com/scikit-build/scikit-build/blob/0.19.0/CHANGES.rst
---
 .../python-modules/scikit-build/default.nix   | 15 +-----
 .../scikit-build/fix-cmake-4.patch            | 47 -------------------
 2 files changed, 2 insertions(+), 60 deletions(-)
 delete mode 100644 pkgs/development/python-modules/scikit-build/fix-cmake-4.patch

diff --git a/pkgs/development/python-modules/scikit-build/default.nix b/pkgs/development/python-modules/scikit-build/default.nix
index 31f0a1d2b65f..8bf1fbdc5ba7 100644
--- a/pkgs/development/python-modules/scikit-build/default.nix
+++ b/pkgs/development/python-modules/scikit-build/default.nix
@@ -22,26 +22,15 @@
 
 buildPythonPackage rec {
   pname = "scikit-build";
-  version = "0.18.1";
+  version = "0.19.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "scikit_build";
     inherit version;
-    hash = "sha256-pBUqxaCE1JnCineXvgYo2DZsM24vsOGgY+sy5V78uOc=";
+    hash = "sha256-RuGy1xND0U5MB9fmCQLmc8eN77miwoK3CtgPuFAq3i4=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "setuptools-75.0-compat.patch";
-      url = "https://github.com/scikit-build/scikit-build/commit/3992485c67331097553ec8f54233c4c295943f70.patch";
-      hash = "sha256-U34UY+m6RE3c3UN/jGHuR+sRUqTGmG7dT52NWCY7nIE=";
-    })
-
-    # <https://github.com/scikit-build/scikit-build/pull/1160>
-    ./fix-cmake-4.patch
-  ];
-
   # This line in the filterwarnings section of the pytest configuration leads to this error:
   #  E   UserWarning: Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.
   postPatch = ''
diff --git a/pkgs/development/python-modules/scikit-build/fix-cmake-4.patch b/pkgs/development/python-modules/scikit-build/fix-cmake-4.patch
deleted file mode 100644
index 35d1ef5ad931..000000000000
--- a/pkgs/development/python-modules/scikit-build/fix-cmake-4.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 9efbf7f9baa846867a9c5586e4cc82a8a19e2e84 Mon Sep 17 00:00:00 2001
-From: Emily <hello@emily.moe>
-Date: Wed, 17 Sep 2025 19:00:01 +0100
-Subject: [PATCH 1/2] tests: fix `test_issue335_support_cmake_source_dir` with
- CMake 4
-
----
- tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt b/tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt
-index 7e391c46..18bae2bf 100644
---- a/tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt
-+++ b/tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt
-@@ -1,4 +1,4 @@
--cmake_minimum_required(VERSION 3.2)
-+cmake_minimum_required(VERSION 3.2...3.10)
- 
- project(hello NONE)
- 
-
-From 491d7494a3ec6cc181d37d02670c65b74c67cbfe Mon Sep 17 00:00:00 2001
-From: Emily <hello@emily.moe>
-Date: Wed, 17 Sep 2025 19:00:01 +0100
-Subject: [PATCH 2/2] tests: fix `test_make_without_configure_fails` with CMake
- 4
-
----
- tests/test_cmaker.py | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/tests/test_cmaker.py b/tests/test_cmaker.py
-index cf166905..9b6c3758 100644
---- a/tests/test_cmaker.py
-+++ b/tests/test_cmaker.py
-@@ -82,7 +82,10 @@ def test_make_without_configure_fails(capfd):
-         CMaker().make()
-     _, err = capfd.readouterr()
-     assert "An error occurred while building with CMake." in str(excinfo.value)
--    assert "Error: could not load cache" in err
-+    # CMake 4 changed the error message.
-+    err_message_cmake_3 = "Error: could not load cache"
-+    err_message_cmake_4 = "Error: not a CMake build directory (missing CMakeCache.txt)"
-+    assert err_message_cmake_3 in err or err_message_cmake_4 in err
- 
- 
- @pytest.mark.parametrize("configure_with_cmake_source_dir", [True, False])

From 158b6a83f793b2f1ce7acd9c72b89dacd8291e76 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:38:46 +0200
Subject: [PATCH 0395/1209] python3Packages.apscheduler: pin to setuptools_80

---
 pkgs/development/python-modules/apscheduler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/apscheduler/default.nix b/pkgs/development/python-modules/apscheduler/default.nix
index aaa64871ccb7..0d03b1775976 100644
--- a/pkgs/development/python-modules/apscheduler/default.nix
+++ b/pkgs/development/python-modules/apscheduler/default.nix
@@ -9,7 +9,7 @@
   pytest-tornado,
   pytest8_3CheckHook,
   pytz,
-  setuptools,
+  setuptools_80,
   setuptools-scm,
   tornado,
   twisted,
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    setuptools
+    setuptools_80
     setuptools-scm
   ];
 

From b4538c1c7c54dfdee811dd694a4b7d8e0a4223d2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:41:20 +0200
Subject: [PATCH 0396/1209] python3Packages.makefun: pin to setuptools_80

and update pytest pin to 8.3.
---
 pkgs/development/python-modules/makefun/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/makefun/default.nix b/pkgs/development/python-modules/makefun/default.nix
index 2065105ac8b1..3f7c4872e4bc 100644
--- a/pkgs/development/python-modules/makefun/default.nix
+++ b/pkgs/development/python-modules/makefun/default.nix
@@ -4,11 +4,11 @@
   buildPythonPackage,
 
   # build-system
-  setuptools,
+  setuptools_80,
   setuptools-scm,
 
   # tests
-  pytest7CheckHook,
+  pytest8_3CheckHook,
 }:
 
 buildPythonPackage rec {
@@ -27,11 +27,13 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    setuptools
+    setuptools_80
     setuptools-scm
   ];
 
-  nativeCheckInputs = [ pytest7CheckHook ];
+  nativeCheckInputs = [
+    pytest8_3CheckHook
+  ];
 
   pythonImportsCheck = [ "makefun" ];
 

From 6c81b30e2cd1aa5d76191ae549726cfc4cc31ae1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:45:56 +0200
Subject: [PATCH 0397/1209] python313Packages.fs: pin to setuptools_80

---
 pkgs/development/python-modules/fs/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/fs/default.nix b/pkgs/development/python-modules/fs/default.nix
index 44715f97f82d..c579ac186a6e 100644
--- a/pkgs/development/python-modules/fs/default.nix
+++ b/pkgs/development/python-modules/fs/default.nix
@@ -12,7 +12,7 @@
   pytestCheckHook,
   pythonAtLeast,
   pytz,
-  setuptools,
+  setuptools_80,
   six,
 }:
 
@@ -35,10 +35,10 @@ buildPythonPackage rec {
       --replace ThreadedTestFTPd FtpdThreadWrapper
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
-    setuptools
+    setuptools_80
     six
     appdirs
     pytz

From b9c3d1c0ffa85fcaa1b757685771d92f8ba6425e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:47:23 +0200
Subject: [PATCH 0398/1209] python3Packages.cu2qu: pin to setuptools_80

---
 pkgs/development/python-modules/cu2qu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cu2qu/default.nix b/pkgs/development/python-modules/cu2qu/default.nix
index 1e913c4f4aca..aa76138d3e46 100644
--- a/pkgs/development/python-modules/cu2qu/default.nix
+++ b/pkgs/development/python-modules/cu2qu/default.nix
@@ -6,7 +6,7 @@
   # build
   cython,
   setuptools-scm,
-  setuptools,
+  setuptools_80,
 
   # propagates
   defcon,
@@ -32,7 +32,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cython
-    setuptools
+    setuptools_80
     setuptools-scm
   ];
 

From b473e8448f2c8d47bffb9ef1411926c53b889579 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:51:01 +0200
Subject: [PATCH 0399/1209] python3Packages.omegaconf: pin to setuptools_80

---
 pkgs/development/python-modules/omegaconf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/omegaconf/default.nix b/pkgs/development/python-modules/omegaconf/default.nix
index a4542a21913a..e0f6acec894a 100644
--- a/pkgs/development/python-modules/omegaconf/default.nix
+++ b/pkgs/development/python-modules/omegaconf/default.nix
@@ -5,7 +5,7 @@
   attrs,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
   jre_minimal,
   pydevd,
   pytest-mock,
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     sed -i 's/antlr4-python3-runtime==.*/antlr4-python3-runtime/' requirements/base.txt
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   nativeBuildInputs = [ jre_minimal ];
 

From eeaaa9d01b937c3a6760c662b0244d348925a607 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 03:08:43 +0200
Subject: [PATCH 0400/1209] python3Packages.duckdb: propagate typing-extensions

---
 pkgs/development/python-modules/duckdb/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index 9736c5eeae5f..4ce00e36200a 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -18,6 +18,7 @@
   pytz,
   scikit-build-core,
   setuptools-scm,
+  typing-extensions,
   pytest-reraise,
   pytestCheckHook,
 }:
@@ -71,6 +72,10 @@ buildPythonPackage rec {
     openssl
   ];
 
+  dependencies = [
+    typing-extensions
+  ];
+
   optional-dependencies = {
     all = [
       # FIXME package adbc_driver_manager

From 1aaa1baa60ff884f0cd68fa3ca969b6fc9237860 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 14:38:20 +0200
Subject: [PATCH 0401/1209] python3Packages.cmd2: disable failing test

This is due to expecting a rich version lt 15. Upstream yanked the test
after the rich 15 update.
---
 pkgs/development/python-modules/cmd2/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/cmd2/default.nix b/pkgs/development/python-modules/cmd2/default.nix
index 464b1187d40d..1ea710021d18 100644
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@@ -46,6 +46,8 @@ buildPythonPackage rec {
     # Don't require vim for tests, it causes lots of rebuilds
     "test_find_editor_not_specified"
     "test_transcript"
+    # Removed upstream after rich 15 update
+    "test_from_ansi_wrapper"
   ];
 
   pythonImportsCheck = [ "cmd2" ];

From fe760b16bc9d76d483406d5070bf171216d03fbd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 15:52:52 +0200
Subject: [PATCH 0402/1209] python3Packages.pyramid: 2.0.2 -> 2.1

https://github.com/Pylons/pyramid/blob/2.1/CHANGES.rst
---
 .../python-modules/pyramid/default.nix        | 32 +++++++------------
 1 file changed, 12 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/python-modules/pyramid/default.nix b/pkgs/development/python-modules/pyramid/default.nix
index 6b76dad2eb72..c04a3e45faee 100644
--- a/pkgs/development/python-modules/pyramid/default.nix
+++ b/pkgs/development/python-modules/pyramid/default.nix
@@ -1,8 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  fetchpatch2,
+  fetchFromGitHub,
   webtest,
   zope-component,
   hupper,
@@ -10,7 +9,7 @@
   plaster,
   plaster-pastedeploy,
   repoze-lru,
-  setuptools,
+  setuptools_80,
   translationstring,
   venusian,
   webob,
@@ -19,25 +18,19 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyramid";
-  version = "2.0.2";
+  version = "2.1";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-NyE4pzjkIWU1zHbczm7d1aGqypUTDyNU+4NCZMBvGN4=";
+  src = fetchFromGitHub {
+    owner = "Pylons";
+    repo = "pyramid";
+    tag = finalAttrs.version;
+    hash = "sha256-N0zH0BpS9ImSTWeADBOBSgLYI062sdLxTzwBENAawFc=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "python-3.13-compat.patch";
-      url = "https://github.com/Pylons/pyramid/commit/1079613eb07e2a67454378e1fc28815dfd64bb82.patch";
-      hash = "sha256-/jxbA2q0kAeXDvIwhNkO8h4KbKtdquWXAH7/0lV8MXc=";
-    })
-  ];
-
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     hupper
@@ -45,7 +38,6 @@ buildPythonPackage rec {
     plaster
     plaster-pastedeploy
     repoze-lru
-    setuptools # for pkg_resources
     translationstring
     venusian
     webob
@@ -64,8 +56,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python web framework";
     homepage = "https://trypyramid.com/";
-    changelog = "https://github.com/Pylons/pyramid/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/Pylons/pyramid/blob/${finalAttrs.src.tag}/CHANGES.rst";
     license = lib.licenses.bsd0;
     maintainers = [ ];
   };
-}
+})

From d5ff76f1cf5a04039ab8b0f2475aa01f7c6344a6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 16:38:18 +0200
Subject: [PATCH 0403/1209] python3Packages.prawcore: disable failing test

---
 pkgs/development/python-modules/prawcore/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/prawcore/default.nix b/pkgs/development/python-modules/prawcore/default.nix
index 790594cde747..22c34f8302dd 100644
--- a/pkgs/development/python-modules/prawcore/default.nix
+++ b/pkgs/development/python-modules/prawcore/default.nix
@@ -39,6 +39,11 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # fixture out of date
+    "test_request__session_timeout_default"
+  ];
+
   disabledTestPaths = [
     # tests requiring network
     "tests/integration"

From 4f399b1dae36318a2ba050f91fa5c9b0c301f187 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 18:37:01 -0700
Subject: [PATCH 0404/1209] python3Packages.idna: 3.14 -> 3.15

Diff: https://github.com/kjd/idna/compare/v3.14...v3.15

Changelog: https://github.com/kjd/idna/releases/tag/v3.15
---
 pkgs/development/python-modules/idna/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index 08f1f6a1d6cf..c6c917852319 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "3.14";
+  version = "3.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kjd";
     repo = "idna";
     tag = "v${version}";
-    hash = "sha256-cCyJsZc7+DpYQjS3nOfahrUcyFX2WtmmBKw8trZlELU=";
+    hash = "sha256-z3Nd834inihGzquCAmejUQvRcM0Yn/VmMcWQP3oh4ak=";
   };
 
   build-system = [ flit-core ];

From ef431c73be68d3b9a1f968fd517621a7809a21f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 20:35:07 -0700
Subject: [PATCH 0405/1209] python313Packages.backports-zstd: 1.4.0 -> 1.5.0

Diff: https://github.com/rogdham/backports.zstd/compare/v1.4.0...v1.5.0

Changelog: https://github.com/rogdham/backports.zstd/blob/v1.5.0/CHANGELOG.md
---
 pkgs/development/python-modules/backports-zstd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/backports-zstd/default.nix b/pkgs/development/python-modules/backports-zstd/default.nix
index 13c28638361f..db294f3527d7 100644
--- a/pkgs/development/python-modules/backports-zstd/default.nix
+++ b/pkgs/development/python-modules/backports-zstd/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "backports-zstd";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm -r "$out/src/c/zstd"
     '';
-    hash = "sha256-dOzaenKu3sf1qaTWZfJ6W1l3KV4BYklUardpiPnSQWU=";
+    hash = "sha256-0FGYh6o26oeovZ23VYKmmY2nNzDHXIKU8/lBqUxuGQw=";
   };
 
   postPatch = ''

From 8fc19d25f3bc2e6f58094390324a670e99889591 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 17 May 2026 13:19:24 -0400
Subject: [PATCH 0406/1209] darwin.stdenv: fix infinite recursion due to Python
 3.14 upgrade

---
 pkgs/stdenv/darwin/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 3cf47e5a7334..d1658b467c6a 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -603,6 +603,7 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
         python3-bootstrap = super.python3.override {
           self = self.python3-bootstrap;
           pythonAttr = "python3-bootstrap";
+          zstd = null; # Avoid infinite recursion due to zstd depending on libiconv, which depends on Python via Meson.
           enableLTO = false;
         };
 

From e9bb1dd3f36a813e4ce3d819326be3f2d42d4062 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 19 May 2026 11:30:20 -0700
Subject: [PATCH 0407/1209] python3Packages.pandas: make src reproducible

---
 pkgs/development/python-modules/pandas/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 88c164c5a93f..e4b838dba6ba 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -70,6 +70,9 @@ let
       owner = "pandas-dev";
       repo = "pandas";
       tag = "v${version}";
+      postFetch = ''
+        sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pandas/_version.py
+      '';
       hash = "sha256-G+pWdmft/kcxv97ySa+0ZFEgvMKuNaK33DseZQ8R1z8=";
     };
 

From 1d5c2a8b871c5b295897e3f3cf5f974ba6435f05 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 20 May 2026 01:03:29 +0200
Subject: [PATCH 0408/1209] python3Packages.cffsubr: pin to setuptools 80

---
 pkgs/development/python-modules/cffsubr/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/cffsubr/default.nix b/pkgs/development/python-modules/cffsubr/default.nix
index 082c6f493a58..7483086dbd13 100644
--- a/pkgs/development/python-modules/cffsubr/default.nix
+++ b/pkgs/development/python-modules/cffsubr/default.nix
@@ -3,13 +3,13 @@
   afdko,
   buildPythonPackage,
   cmake,
-  distutils,
+  distutils_80,
   fetchPypi,
   fonttools,
   ninja,
   pytestCheckHook,
   scikit-build,
-  setuptools,
+  setuptools_80,
   setuptools-scm,
 }:
 
@@ -31,11 +31,11 @@ buildPythonPackage rec {
   '';
 
   build-system = [
+    distutils_80
+    setuptools_80
     cmake
-    distutils
     ninja
     scikit-build
-    setuptools
     setuptools-scm
   ];
 

From 7676fdd6ad59e7444d0566d591edabdb11d56317 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 19 May 2026 17:03:39 -0700
Subject: [PATCH 0409/1209] python3Packages.yarl: 1.23.0 -> 1.24.2

Diff: https://github.com/aio-libs/yarl/compare/v1.23.0...v1.24.2

Changelog: https://github.com/aio-libs/yarl/blob/v1.24.2/CHANGES.rst
---
 pkgs/development/python-modules/yarl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index 4b517a019959..ba29a36fff8f 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.23.0";
+  version = "1.24.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "yarl";
     tag = "v${version}";
-    hash = "sha256-vjWV9fgBg7Mw54hsXWnO81CxJCe9WzB0okMEUz1KRAc=";
+    hash = "sha256-GEe2GDXmqsQgWB0UxPZVMdSco3j2JYHg9BU9M6oqynw=";
   };
 
   build-system = [

From 4105de0322de93ff1b9d03b18e878d1bee15d6d8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:16:44 +0200
Subject: [PATCH 0410/1209] python3Packages.tabcmd: 2.0.18 -> 2.0.20

https://github.com/tableau/tabcmd/releases/tag/v2.0.20
---
 pkgs/development/python-modules/tabcmd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tabcmd/default.nix b/pkgs/development/python-modules/tabcmd/default.nix
index b2282677ee3b..c07319fbe6c8 100644
--- a/pkgs/development/python-modules/tabcmd/default.nix
+++ b/pkgs/development/python-modules/tabcmd/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "tabcmd";
-  version = "2.0.18";
+  version = "2.0.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tableau";
     repo = "tabcmd";
     tag = "v${version}";
-    hash = "sha256-Eb9ZboYdco6opKW3Tz0+U9VREWdEyt2xuG62n9WIXPk=";
+    hash = "sha256-BviaCIav8rz37ac126KS4p54gbxzd6vs1p5kTy42bv4=";
   };
 
   prePatch = ''

From b56b7a3671f8f56740b171abb779ec16602516e1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:19:26 +0200
Subject: [PATCH 0411/1209] python3Packages.tank-utility: pin to setuptools 80

---
 pkgs/development/python-modules/tank-utility/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/tank-utility/default.nix b/pkgs/development/python-modules/tank-utility/default.nix
index f8eaa1592994..cd3673865689 100644
--- a/pkgs/development/python-modules/tank-utility/default.nix
+++ b/pkgs/development/python-modules/tank-utility/default.nix
@@ -6,7 +6,7 @@
   pytestCheckHook,
   requests,
   responses,
-  setuptools,
+  setuptools_80,
   urllib3,
 }:
 
@@ -22,9 +22,9 @@ buildPythonPackage rec {
     hash = "sha256-h9y3X+FSzSFt+bd/chz+x0nocHaKZ8DvreMxAYMs8/E=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     requests
     urllib3
   ];

From 9c013026b9854fa3c5ea38965ad0b55a94597824 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:26:12 +0200
Subject: [PATCH 0412/1209] python3Packages.typer: 0.24.0 -> 0.25.1

https://github.com/tiangolo/typer/releases/tag/0.25.1
---
 pkgs/development/python-modules/typer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/typer/default.nix b/pkgs/development/python-modules/typer/default.nix
index c9bc634b3549..65a0772135ad 100644
--- a/pkgs/development/python-modules/typer/default.nix
+++ b/pkgs/development/python-modules/typer/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "typer";
-  version = "0.24.0";
+  version = "0.25.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastapi";
     repo = "typer";
     tag = version;
-    hash = "sha256-ha/cT2+I9/WUjb7ZXSKqLSocZ3vq0N1fm4RvRpsXIDc=";
+    hash = "sha256-HIvXseuR7zUXFuTWzntDfHhAp8BcFjxo35gn0i4+03w=";
   };
 
   postPatch = ''

From 292f1bcbd43dae3ba1103ebc1c9041b983c93492 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:29:03 +0200
Subject: [PATCH 0413/1209] python3Packages.pytokens: init at 0.4.1

New dependency for black.
---
 .../python-modules/pytokens/default.nix       | 47 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 49 insertions(+)
 create mode 100644 pkgs/development/python-modules/pytokens/default.nix

diff --git a/pkgs/development/python-modules/pytokens/default.nix b/pkgs/development/python-modules/pytokens/default.nix
new file mode 100644
index 000000000000..cd0346f06223
--- /dev/null
+++ b/pkgs/development/python-modules/pytokens/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  ast-serialize,
+  mypy,
+  setuptools,
+  pytestCheckHook,
+  pytest-cov-stub,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pytokens";
+  version = "0.4.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "tusharsadhwani";
+    repo = "pytokens";
+    tag = finalAttrs.version;
+    hash = "sha256-DOCOoZ3T7qh8me1vn7qYlEMiyc31d77sf1/5RsW5sUg=";
+  };
+
+  build-system = [
+    ast-serialize
+    mypy
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pytokens"
+  ];
+
+  meta = {
+    changelog = "https://github.com/tusharsadhwani/pytokens/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    description = "Fast, spec compliant Python 3.14+ tokenizer that runs on older Pythons";
+    homepage = "https://github.com/tusharsadhwani/pytokens";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 815153af375a..8fb3255bb1da 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16358,6 +16358,8 @@ self: super: with self; {
 
   pytmx = callPackage ../development/python-modules/pytmx { };
 
+  pytokens = callPackage ../development/python-modules/pytokens { };
+
   pytomlpp = callPackage ../development/python-modules/pytomlpp { };
 
   pytomorrowio = callPackage ../development/python-modules/pytomorrowio { };

From cafee09a901be684d083111ff4483cbd93faa507 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:32:44 +0200
Subject: [PATCH 0414/1209] black: 25.1.0 -> 26.5.1

https://github.com/psf/black/blob/26.5.1/CHANGES.md
---
 .../python-modules/black/default.nix          | 48 ++++++-------------
 1 file changed, 15 insertions(+), 33 deletions(-)

diff --git a/pkgs/development/python-modules/black/default.nix b/pkgs/development/python-modules/black/default.nix
index ea56257d981f..ee547c137c06 100644
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@@ -2,8 +2,7 @@
   stdenv,
   lib,
   buildPythonPackage,
-  fetchPypi,
-  fetchpatch,
+  fetchFromGitHub,
   pytestCheckHook,
   aiohttp,
   click,
@@ -17,50 +16,36 @@
   pathspec,
   parameterized,
   platformdirs,
+  pytokens,
   tokenize-rt,
   uvloop,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "black";
-  version = "25.1.0";
+  version = "26.5.1";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-M0ltXNEiKtczkTUrSujaFSU8Xeibk6gLPiyNmhnsJmY=";
+  src = fetchFromGitHub {
+    owner = "psf";
+    repo = "black";
+    tag = finalAttrs.version;
+    hash = "sha256-xALg9ta0U2V6i/b7VYiPKu0oNnHfg9T+XuK3CvqJmjs=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "click-8.2-compat-1.patch";
-      url = "https://github.com/psf/black/commit/14e1de805a5d66744a08742cad32d1660bf7617a.patch";
-      hash = "sha256-fHRlMetE6+09MKkuFNQQr39nIKeNrqwQuBNqfIlP4hc=";
-    })
-    (fetchpatch {
-      name = "click-8.2-compat-2.patch";
-      url = "https://github.com/psf/black/commit/ed64d89faa7c738c4ba0006710f7e387174478af.patch";
-      hash = "sha256-df/J6wiRqtnHk3mAY3ETiRR2G4hWY1rmZMfm2rjP2ZQ=";
-    })
-    (fetchpatch {
-      name = "click-8.2-compat-3.patch";
-      url = "https://github.com/psf/black/commit/b0f36f5b4233ef4cf613daca0adc3896d5424159.patch";
-      hash = "sha256-SGLCxbgrWnAi79IjQOb2H8mD/JDbr2SGfnKyzQsJrOA=";
-    })
-  ];
-
-  nativeBuildInputs = [
+  build-system = [
     hatch-fancy-pypi-readme
     hatch-vcs
     hatchling
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     click
     mypy-extensions
     packaging
     pathspec
     platformdirs
+    pytokens
   ];
 
   optional-dependencies = {
@@ -81,7 +66,7 @@ buildPythonPackage rec {
     pytestCheckHook
     parameterized
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   pytestFlags = [
     "-Wignore::DeprecationWarning"
@@ -102,9 +87,6 @@ buildPythonPackage rec {
   disabledTests = [
     # requires network access
     "test_gen_check_output"
-    # broken on Python 3.13.4
-    # FIXME: remove this when fixed upstream
-    "test_simple_format[pep_701]"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # fails on darwin
@@ -119,7 +101,7 @@ buildPythonPackage rec {
   meta = {
     description = "Uncompromising Python code formatter";
     homepage = "https://github.com/psf/black";
-    changelog = "https://github.com/psf/black/blob/${version}/CHANGES.md";
+    changelog = "https://github.com/psf/black/blob/${finalAttrs.src.tag}/CHANGES.md";
     license = lib.licenses.mit;
     mainProgram = "black";
     maintainers = with lib.maintainers; [
@@ -127,4 +109,4 @@ buildPythonPackage rec {
       autophagy
     ];
   };
-}
+})

From 5bb6e1f605eddcb72957fdc2a2bfa9912cecfb9d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:45:42 +0200
Subject: [PATCH 0415/1209] python3Packages.masky: pep517 build, pin setuptools
 80

---
 pkgs/development/python-modules/masky/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/masky/default.nix b/pkgs/development/python-modules/masky/default.nix
index d8ecee4241ec..8f11f1e2cb30 100644
--- a/pkgs/development/python-modules/masky/default.nix
+++ b/pkgs/development/python-modules/masky/default.nix
@@ -7,12 +7,13 @@
   fetchFromGitHub,
   impacket,
   pyasn1,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
   pname = "masky";
   version = "0.2.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Z4kSec";
@@ -21,7 +22,9 @@ buildPythonPackage rec {
     hash = "sha256-npRuszHkxwjJ+B+q8eQywXPd0OX0zS+AfCro4TM83Uc=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools_80 ];
+
+  dependencies = [
     asn1crypto
     colorama
     cryptography

From 8d493968f57ace53c0f4ee7bc3e3511ce9996c4a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:52:48 +0200
Subject: [PATCH 0416/1209] python3Packages.pytest-logdog: pep517 build, pin
 setuptools 80

---
 .../python-modules/pytest-logdog/default.nix          | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-logdog/default.nix b/pkgs/development/python-modules/pytest-logdog/default.nix
index 4ddb31f54c58..cf479422c759 100644
--- a/pkgs/development/python-modules/pytest-logdog/default.nix
+++ b/pkgs/development/python-modules/pytest-logdog/default.nix
@@ -4,14 +4,14 @@
   fetchFromGitHub,
   pytest,
   pytestCheckHook,
-  setuptools,
+  setuptools_80,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "pytest-logdog";
   version = "0.1.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ods";
@@ -20,12 +20,13 @@ buildPythonPackage rec {
     hash = "sha256-Tmoq+KAGzn0MMj29rukDfAc4LSIwC8DoMTuBAppV32I=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools_80
+    setuptools-scm
+  ];
 
   buildInputs = [ pytest ];
 
-  propagatedBuildInputs = [ setuptools ];
-
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "pytest_logdog" ];

From 16d1c62a28f584d97f28746a04c099ff1a0be837 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:55:29 +0200
Subject: [PATCH 0417/1209] python3Packages.python-ldap: 3.4.6 -> 3.4.7

https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.7
---
 pkgs/development/python-modules/python-ldap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-ldap/default.nix b/pkgs/development/python-modules/python-ldap/default.nix
index 3e067291bab6..23186b37e8db 100644
--- a/pkgs/development/python-modules/python-ldap/default.nix
+++ b/pkgs/development/python-modules/python-ldap/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-ldap";
-  version = "3.4.6";
+  version = "3.4.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-ldap";
     repo = "python-ldap";
     tag = "python-ldap-${finalAttrs.version}";
-    hash = "sha256-j0viogO02O8G53ORq0u1U+B5I0mcpuB+E1Xvl7ZQKQw=";
+    hash = "sha256-uSP8c5gid5TBenBaNVdlteHatkctAafz6yFHuIYKiTY=";
   };
 
   build-system = [

From e936451e5803e96160c892826dd8d236289b4b4e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 02:00:25 +0200
Subject: [PATCH 0418/1209] python3Packages.certomancer: 0.13.0 -> 0.14.0

---
 .../python-modules/certomancer/default.nix           | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/certomancer/default.nix b/pkgs/development/python-modules/certomancer/default.nix
index d54ae914cde0..1a0d61e8f6c2 100644
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@@ -2,9 +2,11 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
   # build-system
   setuptools,
-  wheel,
+  setuptools-scm,
+
   # dependencies
   asn1crypto,
   click,
@@ -12,11 +14,13 @@
   python-dateutil,
   pyyaml,
   tzlocal,
+
   # optional-dependencies
   requests-mock,
   jinja2,
   werkzeug,
   python-pkcs11,
+
   # nativeCheckInputs
   freezegun,
   pyhanko-certvalidator,
@@ -28,19 +32,19 @@
 
 buildPythonPackage rec {
   pname = "certomancer";
-  version = "0.13.0";
+  version = "0.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MatthiasValvekens";
     repo = "certomancer";
     tag = "v${version}";
-    hash = "sha256-2/qTTN/UuSMHjkSsOs/KbfzKLBjJSLHY51XtgQ6x1Wo=";
+    hash = "sha256-rsugn1g8iYESrC+IUSbxCAbwnKXWG+ubbUj9QdZB+Ow=";
   };
 
   build-system = [
     setuptools
-    wheel
+    setuptools-scm
   ];
 
   dependencies = [

From a41d6b2f06659724d1ee7bc7289c0b030341ad3b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 02:01:48 +0200
Subject: [PATCH 0419/1209] python3Packages.launchpadlib: pin setuptools 80

---
 pkgs/development/python-modules/launchpadlib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/launchpadlib/default.nix b/pkgs/development/python-modules/launchpadlib/default.nix
index db6e0c9ab8e0..02769d84b52f 100644
--- a/pkgs/development/python-modules/launchpadlib/default.nix
+++ b/pkgs/development/python-modules/launchpadlib/default.nix
@@ -5,7 +5,7 @@
   httplib2,
   lazr-restfulclient,
   lazr-uri,
-  setuptools,
+  setuptools_80,
   six,
   testresources,
   pytestCheckHook,
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     hash = "sha256-tMJYkLt1BQ1UwIEj0nMxVreKWaJVX1Rh9psORM2RJC8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     httplib2

From 3d53e58aad1a8a32670ad3b5f55a6cbc055a11fb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 02:04:29 +0200
Subject: [PATCH 0420/1209] python3Packages.pyhanko: 0.34.1 -> 0.35.1

https://github.com/MatthiasValvekens/pyHanko/blob/v0.35.1/docs/changelog.rst#pyhanko
---
 pkgs/development/python-modules/pyhanko/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pyhanko/default.nix b/pkgs/development/python-modules/pyhanko/default.nix
index 473a61694bc5..e82fe9b72499 100644
--- a/pkgs/development/python-modules/pyhanko/default.nix
+++ b/pkgs/development/python-modules/pyhanko/default.nix
@@ -63,11 +63,11 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     asn1crypto
     cryptography
+    lxml
     pyhanko-certvalidator
     pyyaml
     requests
     tzlocal
-    lxml
   ];
 
   optional-dependencies = {

From 7add03ebc953e3847fcea47e60a3a491a04a4232 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 22:09:25 -0700
Subject: [PATCH 0421/1209] python3Packages.pathable: 0.5.0 -> 0.6.0

Diff: https://github.com/p1c2u/pathable/compare/0.5.0...0.6.0

Changelog: https://github.com/p1c2u/pathable/releases/tag/0.6.0
---
 pkgs/development/python-modules/pathable/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pathable/default.nix b/pkgs/development/python-modules/pathable/default.nix
index 4921616d1c14..85e7f7593a8c 100644
--- a/pkgs/development/python-modules/pathable/default.nix
+++ b/pkgs/development/python-modules/pathable/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pathable";
-  version = "0.5.0";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "p1c2u";
     repo = "pathable";
     tag = version;
-    hash = "sha256-D3TYVMcKXPA6fmy2JND5o8ja3Rk8Ne17Sxm4+fLw3Dw=";
+    hash = "sha256-DjIn+hXZvx4tKyzQlWPwIxHD8vWy/jEvhdFY6HC+sdo=";
   };
 
   build-system = [ poetry-core ];

From 1010b888452029ebeb25d1e46cd4448cfc2ecba1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 22:08:46 -0700
Subject: [PATCH 0422/1209] python3Packages.jsonschema-path: 0.4.6 -> 0.5.0

Diff: https://github.com/p1c2u/jsonschema-path/compare/0.4.6...0.5.0

Changelog: https://github.com/p1c2u/jsonschema-path/releases/tag/0.5.0
---
 pkgs/development/python-modules/jsonschema-path/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jsonschema-path/default.nix b/pkgs/development/python-modules/jsonschema-path/default.nix
index 85cdc1f45b59..c5da88ac3732 100644
--- a/pkgs/development/python-modules/jsonschema-path/default.nix
+++ b/pkgs/development/python-modules/jsonschema-path/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema-path";
-  version = "0.4.6";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "p1c2u";
     repo = "jsonschema-path";
     tag = version;
-    hash = "sha256-abAhWtBnZUeg1VGphfnvxPzSnPM6VjM/XKLPJVIrIXg=";
+    hash = "sha256-CDDwhIlwytUPVwq/+0T5kVzl8viJfSalSIxC5VrQdgs=";
   };
 
   build-system = [ poetry-core ];

From d8e3c884537f7f94e1a5ffbd42d64570c3435368 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 22:12:28 -0700
Subject: [PATCH 0423/1209] python3Packages.pikepdf: 10.6.0 -> 10.7.0

Diff: https://github.com/pikepdf/pikepdf/compare/v10.6.0...v10.7.0

Changelog: https://github.com/pikepdf/pikepdf/blob/v10.7.0/docs/releasenotes/version10.md
---
 pkgs/development/python-modules/pikepdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 43e519ca3a96..eb8e8090863d 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "10.6.0";
+  version = "10.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-COEAY9/H9KZ1Tyj89CFMBl9ydTro82qk1XYWbaI9AFY=";
+    hash = "sha256-+HnETz4+yS7RRxvFiJXv/LG6mnmwJJrfIsB19ruU9kc=";
   };
 
   patches = [

From cfc4aab3490772bea291b63818f3e077ed98e07d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 22:15:14 -0700
Subject: [PATCH 0424/1209] python3Packages.trove-classifiers: 2026.5.7.17 ->
 2026.5.20.19

Changelog: https://github.com/pypa/trove-classifiers/releases/tag/2026.5.20.19
---
 pkgs/development/python-modules/trove-classifiers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 88a82933636b..898180da3cd0 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -10,13 +10,13 @@
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2026.5.7.17";
+    version = "2026.5.20.19";
     pyproject = true;
 
     src = fetchPypi {
       pname = "trove_classifiers";
       inherit version;
-      hash = "sha256-oEpI+PCnh8uZZRTTlprHYIqjxgyxXQc8HgKAHmBTPoA=";
+      hash = "sha256-bmEZk5h8qTJpaK1wRScz2t0xRxWZ05iWBFsolwqbuB4=";
     };
 
     postPatch = ''

From 3c1a2152d0ed6c1fff4921d2065d0245eb0b4faf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 22 May 2026 12:28:13 -0700
Subject: [PATCH 0425/1209] python3Packages.pikepdf: 10.7.0 -> 10.7.1

Diff: https://github.com/pikepdf/pikepdf/compare/v10.7.0...v10.7.1

Changelog: https://github.com/pikepdf/pikepdf/blob/v10.7.1/docs/releasenotes/version10.md
---
 pkgs/development/python-modules/pikepdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index eb8e8090863d..4173d1cc9eda 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "10.7.0";
+  version = "10.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-+HnETz4+yS7RRxvFiJXv/LG6mnmwJJrfIsB19ruU9kc=";
+    hash = "sha256-qXpGopfiIG9dimJjHZlbHhXrtliSbgj2tWGQhbQwP5Q=";
   };
 
   patches = [

From aaa1dd2051a1e298b8d627a81282d5085d42e576 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 23 May 2026 18:54:00 +0200
Subject: [PATCH 0426/1209] python3Packages.cassandra-driver: 3.29.3 -> 3.30.0

https://github.com/apache/cassandra-python-driver/blob/3.30.0/CHANGELOG.rst
---
 .../python-modules/cassandra-driver/default.nix           | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cassandra-driver/default.nix b/pkgs/development/python-modules/cassandra-driver/default.nix
index da4ab5806aaf..a560f2598d8d 100644
--- a/pkgs/development/python-modules/cassandra-driver/default.nix
+++ b/pkgs/development/python-modules/cassandra-driver/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   cryptography,
   cython,
+  deprecated,
   eventlet,
   fetchFromGitHub,
   geomet,
@@ -17,6 +18,7 @@
   pyyaml,
   scales,
   sure,
+  tomli,
   twisted,
   setuptools,
   distutils,
@@ -24,14 +26,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cassandra-driver";
-  version = "3.29.3";
+  version = "3.30.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "cassandra-python-driver";
     tag = finalAttrs.version;
-    hash = "sha256-VynrUc7gqAi061FU2ln4B1fK4NaSUcjSgH1i1JQpmvk=";
+    hash = "sha256-4ElOiADaldT/TyLqg/5ijFk9Ygb3GEF37P2d8WdAxkw=";
   };
 
   pythonRelaxDeps = [ "geomet" ];
@@ -40,11 +42,13 @@ buildPythonPackage (finalAttrs: {
     distutils
     setuptools
     cython
+    tomli
   ];
 
   buildInputs = [ libev ];
 
   dependencies = [
+    deprecated
     geomet
   ];
 

From f90f7a646ab118ba24ac48c93cc9cc39e4127b93 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 24 May 2026 00:44:42 +0200
Subject: [PATCH 0427/1209] python3Packages.wxpython: 4.2.4 -> 4.2.5

https://github.com/wxWidgets/Phoenix/blob/wxPython-4.2.5/CHANGES.rst
---
 .../python-modules/wxpython/4.2.nix           | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/wxpython/4.2.nix b/pkgs/development/python-modules/wxpython/4.2.nix
index e33e4e871716..1e5cfaea6e75 100644
--- a/pkgs/development/python-modules/wxpython/4.2.nix
+++ b/pkgs/development/python-modules/wxpython/4.2.nix
@@ -48,14 +48,14 @@
   xvfb-run,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "wxpython";
-  version = "4.2.4";
+  version = "4.2.5";
   pyproject = false;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-LrEjl5yHvLMp6KJFImnWD/j59lHpvyXGdXnlPE67rjw=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-ROg20bzNmcOHkLsDS27PcNkGD2c0MgVg98Sw0AYUR5M=";
   };
 
   patches = [
@@ -65,13 +65,6 @@ buildPythonPackage rec {
       libcairo = "${lib.getLib cairo}/lib/libcairo${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
     ./0001-add-missing-bool-c.patch # Add missing bool.c from old source
-    # TODO: drop when updating beyond version 4.2.4
-    # https://github.com/wxWidgets/Phoenix/pull/2822
-    (fetchpatch {
-      name = "Fix-wx.svg-to-work-with-cython-3.1-generated-code.patch";
-      url = "https://github.com/wxWidgets/Phoenix/commit/31303649ab0a0fed0789e0951a7487d172b65bfa.patch";
-      hash = "sha256-OAnAsyqHGPNEAiOxLLpdEGcd92K7TCxqEBYceuIb8so=";
-    })
   ];
 
   # https://github.com/wxWidgets/Phoenix/issues/2575
@@ -178,7 +171,7 @@ buildPythonPackage rec {
     '';
 
   meta = {
-    changelog = "https://github.com/wxWidgets/Phoenix/blob/wxPython-${version}/CHANGES.rst";
+    changelog = "https://github.com/wxWidgets/Phoenix/blob/wxPython-${finalAttrs.version}/CHANGES.rst";
     description = "Cross platform GUI toolkit for Python, Phoenix version";
     homepage = "http://wxpython.org/";
     license = with lib.licenses; [
@@ -186,4 +179,4 @@ buildPythonPackage rec {
       wxWindowsException31
     ];
   };
-}
+})

From 0073ff9cf24341384998b94d3f1bf04f3d921417 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 24 May 2026 01:19:35 +0200
Subject: [PATCH 0428/1209] python3Packages.pysmi: 1.6.3 -> 2.0.2

https://github.com/lextudio/pysmi/blob/v2.0.2/CHANGES.rst
---
 pkgs/development/python-modules/pysmi/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pysmi/default.nix b/pkgs/development/python-modules/pysmi/default.nix
index 2c64e9f2ab8d..39ade30d993e 100644
--- a/pkgs/development/python-modules/pysmi/default.nix
+++ b/pkgs/development/python-modules/pysmi/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   flit-core,
   jinja2,
-  ply,
+  lark,
   pysmi,
   pysnmp,
   pytestCheckHook,
@@ -13,21 +13,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pysmi";
-  version = "1.6.3";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lextudio";
     repo = "pysmi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TpDrsBGym07JPIcnytyWI7Ebx9RR+7Ia36zOzWMWqPM=";
+    hash = "sha256-ft8R73eUgb+pnr35ZVc2Br3BGHhUDHEcQ9k/K6tjYBk=";
   };
 
   build-system = [ flit-core ];
 
   dependencies = [
-    ply
     jinja2
+    lark
     requests
   ];
 

From 9d95ab00dccb89e17616f57c0fb1f74fba95484f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 24 May 2026 02:06:44 +0200
Subject: [PATCH 0429/1209] python3Packages.pysnmp: 7.1.24 -> 7.1.27

https://github.com/lextudio/pysnmp/blob/refs/tags/v7.1.27/CHANGES.rst
---
 pkgs/development/python-modules/pysnmp/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pysnmp/default.nix b/pkgs/development/python-modules/pysnmp/default.nix
index b1fb2450970e..dcdf8d9f5b6a 100644
--- a/pkgs/development/python-modules/pysnmp/default.nix
+++ b/pkgs/development/python-modules/pysnmp/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "pysnmp";
-  version = "7.1.24";
+  version = "7.1.27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lextudio";
     repo = "pysnmp";
     tag = "v${version}";
-    hash = "sha256-jKTU6ivcg13naaKMVmCYtjmi16kh3nAScDN80OR0d+A=";
+    hash = "sha256-BFdPdEa5aZAYa6i7714k33wM36Sq1ExJO/6dmsGLzVg=";
   };
 
   build-system = [ flit-core ];
@@ -64,6 +64,7 @@ buildPythonPackage rec {
     "test_v2c_get_table_bulk_0_5_subtree"
     "test_v2c_get_table_bulk_0_6_subtree"
     # pysnmp.smi.error.MibNotFoundError
+    # mibs are not part of the repo and expensive to pull
     "test_send_v3_trap_notification"
     "test_addAsn1MibSource"
     "test_v1_walk"
@@ -72,6 +73,9 @@ buildPythonPackage rec {
     "test_syntax_unsigned"
     "test_add_asn1_mib_source"
     "test_syntax_fixed_length_octet_string"
+    "test_inet_address_ipv4_resolv"
+    "test_inet_address_ipv6_resolv"
+    "test_inet_address_roundtrip"
   ];
 
   disabledTestPaths = [

From b77987ff5cdd4c90094cea50949428a12587bc23 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 18:45:31 -0700
Subject: [PATCH 0430/1209] python3Packages.db-dtypes: 1.5.0 -> 1.6.0

Diff: https://github.com/googleapis/google-cloud-python/compare/db-dtypes-v1.5.0...db-dtypes-v1.6.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/db-dtypes-v1.6.0/packages/db-dtypes/CHANGELOG.md
---
 .../python-modules/db-dtypes/default.nix      | 25 ++++++++-----------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index 82f7dde2133d..58617f0f9a66 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -6,22 +6,24 @@
   packaging,
   pandas,
   pyarrow,
-  pytest8_3CheckHook,
+  pytestCheckHook,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "db-dtypes";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
-    repo = "python-db-dtypes-pandas";
-    tag = "v${version}";
-    hash = "sha256-cF40Y2J944AojOXKoTzQ/ybTFY4GP5G8KWY6+NWyRT8=";
+    repo = "google-cloud-python";
+    tag = "db-dtypes-v${version}";
+    hash = "sha256-KJviH4dofYSvZu9S7VMBSnGjH66xMUEvhcmZN7GJ4Iw=";
   };
 
+  sourceRoot = "${src.name}/packages/db-dtypes";
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -31,21 +33,14 @@ buildPythonPackage rec {
     pyarrow
   ];
 
-  nativeCheckInputs = [ pytest8_3CheckHook ];
-
-  disabledTests = [
-    # ValueError: Unable to avoid copy while creating an array as requested.
-    "test_array_interface_copy"
-    # Failed: DID NOT RAISE <class 'TypeError'>
-    "test_reduce_series_numeric"
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "db_dtypes" ];
 
   meta = {
     description = "Pandas Data Types for SQL systems (BigQuery, Spanner)";
-    homepage = "https://github.com/googleapis/python-db-dtypes-pandas";
-    changelog = "https://github.com/googleapis/python-db-dtypes-pandas/blob/${src.tag}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/db-dtypes";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${src.tag}/packages/db-dtypes/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };

From e00dc7175e90e5d3cc4cfc6d847a1044102d1744 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 18:48:20 -0700
Subject: [PATCH 0431/1209] python3Packages.db-dtypes: support pandas 3.0

---
 pkgs/development/python-modules/db-dtypes/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index 58617f0f9a66..ef3848830186 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   numpy,
   packaging,
   pandas,
@@ -24,6 +25,15 @@ buildPythonPackage rec {
 
   sourceRoot = "${src.name}/packages/db-dtypes";
 
+  patches = [
+    (fetchpatch {
+      name = "support-pandas-3.0.patch";
+      url = "https://github.com/googleapis/google-cloud-python/commit/2086b34d8b3418462c9bc89b96eac779a25a3afd.patch";
+      relative = "packages/db-dtypes";
+      hash = "sha256-0NvbTCnr95IW7rkQVu3iUDsNXU/LzXhJwwSDdliFZ+Y=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [

From e4599fe4ce68693b49609eeae449851e129a0d57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 18:49:48 -0700
Subject: [PATCH 0432/1209] python3Packages.db-dtypes: use finalAttrs

---
 pkgs/development/python-modules/db-dtypes/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index ef3848830186..c2bb9a49595a 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -11,7 +11,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "db-dtypes";
   version = "1.6.0";
   pyproject = true;
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
-    tag = "db-dtypes-v${version}";
+    tag = "db-dtypes-v${finalAttrs.version}";
     hash = "sha256-KJviH4dofYSvZu9S7VMBSnGjH66xMUEvhcmZN7GJ4Iw=";
   };
 
-  sourceRoot = "${src.name}/packages/db-dtypes";
+  sourceRoot = "${finalAttrs.src.name}/packages/db-dtypes";
 
   patches = [
     (fetchpatch {
@@ -50,8 +50,8 @@ buildPythonPackage rec {
   meta = {
     description = "Pandas Data Types for SQL systems (BigQuery, Spanner)";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/db-dtypes";
-    changelog = "https://github.com/googleapis/google-cloud-python/blob/${src.tag}/packages/db-dtypes/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${finalAttrs.src.tag}/packages/db-dtypes/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})

From 05c1067067263ab0945cd6a68da869fea49160b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:11:56 -0700
Subject: [PATCH 0433/1209] python3Packages.openapi-core: fix build with
 jsonschema-path 0.5.0

---
 pkgs/development/python-modules/openapi-core/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/openapi-core/default.nix b/pkgs/development/python-modules/openapi-core/default.nix
index 3fafd9f25fd4..81fb76e51861 100644
--- a/pkgs/development/python-modules/openapi-core/default.nix
+++ b/pkgs/development/python-modules/openapi-core/default.nix
@@ -42,6 +42,10 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [
+    "jsonschema-path"
+  ];
+
   dependencies = [
     isodate
     more-itertools
@@ -86,6 +90,11 @@ buildPythonPackage rec {
     "tests/integration/contrib/django/"
   ];
 
+  disabledTests = [
+    # https://github.com/p1c2u/jsonschema-path/pull/262 broke comparison of `SchemaPath`s
+    "test_returns_default_server"
+  ];
+
   pythonImportsCheck = [
     "openapi_core"
     "openapi_core.validation.request.validators"

From 3bf49825cb3fdd061450222fee69420aa8cd4f58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:33:32 -0700
Subject: [PATCH 0434/1209] python3Packages.xmlsec: unpin lxml

---
 pkgs/development/python-modules/xmlsec/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/xmlsec/default.nix b/pkgs/development/python-modules/xmlsec/default.nix
index e1178ff3058f..81f4571b32e6 100644
--- a/pkgs/development/python-modules/xmlsec/default.nix
+++ b/pkgs/development/python-modules/xmlsec/default.nix
@@ -40,6 +40,7 @@ buildPythonPackage (finalAttrs: {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace-fail "lxml==" "lxml>=" \
       --replace-fail "setuptools==" "setuptools>="
   '';
 

From e09d96cba6f73c0d31009076f9a16b03a215408a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:43:09 -0700
Subject: [PATCH 0435/1209] python3Packages.google-cloud-bigquery: 3.40.0 ->
 3.41.0

Changelog: https://github.com/googleapis/python-bigquery/blob/v3.41.0/CHANGELOG.md
---
 .../python-modules/google-cloud-bigquery/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 9b9bf37da1f8..7d4b5748ba92 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -37,13 +37,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "3.40.0";
+  version = "3.41.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_bigquery";
     inherit version;
-    hash = "sha256-s8yxHK8AKfFbKVaVGPZnVT/gj28UWblZAgyD+72PLmg=";
+    hash = "sha256-IhfkiLR+1XY2DJsswH1Z2IOlS4MWfA7zf5FcJrAaBv4=";
   };
 
   build-system = [ setuptools ];

From 62a201505988284b8e63ba4a3caf5d457551834f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:53:07 -0700
Subject: [PATCH 0436/1209] python3Packages.ast-serialize: 0.3.0 -> 0.5.0

Diff: https://github.com/mypyc/ast_serialize/compare/v0.3.0...v0.5.0
---
 .../python-modules/ast-serialize/default.nix           | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/ast-serialize/default.nix b/pkgs/development/python-modules/ast-serialize/default.nix
index 71ee99cb9e62..0ce8d6d2a3f4 100644
--- a/pkgs/development/python-modules/ast-serialize/default.nix
+++ b/pkgs/development/python-modules/ast-serialize/default.nix
@@ -2,33 +2,29 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  cargo,
   rustPlatform,
-  rustc,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "ast-serialize";
-  version = "0.3.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mypyc";
     repo = "ast_serialize";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R5hNpbJjKKZDOKQCdGZQ+0iW5vdh5CzSgzORESh4bDU=";
+    hash = "sha256-GmhbMraI16J6ePtn7lXAWaJ+9zDH1GdebKIAzm5w9ok=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-uhUMaUkaL57X8CVy6T9pCQa62IsOeKN/dhZTPVXSn14=";
+    hash = "sha256-h+BklNeoQaRVWczsE9sFXgvFrnHW5vjWOVaOvLghv0U=";
   };
 
   build-system = [
-    cargo
     rustPlatform.cargoSetupHook
     rustPlatform.maturinBuildHook
-    rustc
   ];
 
   pythonImportsCheck = [

From e8a86698fb5a52c2fd64f274ba322f1aa1882110 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:58:10 -0700
Subject: [PATCH 0437/1209] python3Packages.coredis: 5.6.0 -> 6.6.1

Diff: https://github.com/alisaifee/coredis/compare/5.6.0...6.6.1

Changelog: https://github.com/alisaifee/coredis/blob/6.6.1/HISTORY.rst
---
 .../python-modules/coredis/default.nix        | 25 +++++++++----------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/coredis/default.nix b/pkgs/development/python-modules/coredis/default.nix
index d54d4e0a6525..8b1e0cf051ad 100644
--- a/pkgs/development/python-modules/coredis/default.nix
+++ b/pkgs/development/python-modules/coredis/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  async-timeout,
+  anyio,
   beartype,
   buildPythonPackage,
   hatchling,
@@ -8,36 +8,35 @@
   hatch-vcs,
   types-deprecated,
   deprecated,
+  exceptiongroup,
   fetchFromGitHub,
   packaging,
-  pympler,
   pytest-asyncio,
   pytest-lazy-fixtures,
+  pytest-mock,
   pytestCheckHook,
   redis,
   typing-extensions,
-  wrapt,
 }:
 
 buildPythonPackage rec {
   pname = "coredis";
-  version = "5.6.0";
+  version = "6.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alisaifee";
     repo = "coredis";
     tag = version;
-    hash = "sha256-84mFHEPvCv7c1u2giTwTmC+56KCB/3snl8vJ4c+sE2s=";
+    hash = "sha256-Jn6tqMpyk849/hwYM0DHuQnGbMltRpTXAVcN5Kt6lk4=";
   };
 
   postPatch = ''
     sed -i '/mypy==/d' pyproject.toml
-    sed -i '/packaging/d' pyproject.toml
-    sed -i '/pympler/d' pyproject.toml
-    sed -i '/types_deprecated/d' pyproject.toml
-    substituteInPlace pytest.ini \
-      --replace-fail "-K" ""
+    sed -i '/hatch-mypy/d' pyproject.toml
+    sed -i '/opentelemetry-sdk/d' pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace-fail '"-K"' ""
   '';
 
   build-system = [
@@ -48,13 +47,12 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    async-timeout
+    anyio
     beartype
     deprecated
+    exceptiongroup
     packaging
-    pympler
     typing-extensions
-    wrapt
   ];
 
   nativeCheckInputs = [
@@ -62,6 +60,7 @@ buildPythonPackage rec {
     redis
     pytest-asyncio
     pytest-lazy-fixtures
+    pytest-mock
   ];
 
   pythonImportsCheck = [ "coredis" ];

From d3ec3c976fbcf94dc6447ca30aab6fe5c0c87b9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 20:22:25 -0700
Subject: [PATCH 0438/1209] python3Packages.coredis: use finalAttrs

---
 pkgs/development/python-modules/coredis/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/coredis/default.nix b/pkgs/development/python-modules/coredis/default.nix
index 8b1e0cf051ad..7740b0a99efe 100644
--- a/pkgs/development/python-modules/coredis/default.nix
+++ b/pkgs/development/python-modules/coredis/default.nix
@@ -19,7 +19,7 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "coredis";
   version = "6.6.1";
   pyproject = true;
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "alisaifee";
     repo = "coredis";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-Jn6tqMpyk849/hwYM0DHuQnGbMltRpTXAVcN5Kt6lk4=";
   };
 
@@ -76,7 +76,7 @@ buildPythonPackage rec {
   meta = {
     description = "Async redis client with support for redis server, cluster & sentinel";
     homepage = "https://github.com/alisaifee/coredis";
-    changelog = "https://github.com/alisaifee/coredis/blob/${src.tag}/HISTORY.rst";
+    changelog = "https://github.com/alisaifee/coredis/blob/${finalAttrs.src.tag}/HISTORY.rst";
     license = lib.licenses.mit;
   };
-}
+})

From eb3b83f3573b46a7be1c65822df45974ef70de3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 20:07:00 -0700
Subject: [PATCH 0439/1209] python3Packages.litellm: unpin pydantic

---
 pkgs/development/python-modules/litellm/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index e4b8edc8ff16..e16a538321d1 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -162,6 +162,7 @@ buildPythonPackage rec {
     "importlib-metadata"
     "jsonschema"
     "openai"
+    "pydantic"
     "python-dotenv"
   ];
 

From df634ceed92b51d0f6815c4df320e7c338bfb8cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 21:48:10 -0700
Subject: [PATCH 0440/1209] python3Packages.slowapi: skip tests broken by
 starlette 1.0

---
 pkgs/development/python-modules/slowapi/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/slowapi/default.nix b/pkgs/development/python-modules/slowapi/default.nix
index bf4412ff471a..8a987739b28f 100644
--- a/pkgs/development/python-modules/slowapi/default.nix
+++ b/pkgs/development/python-modules/slowapi/default.nix
@@ -45,6 +45,10 @@ buildPythonPackage rec {
     # AssertionError: assert '1740326049.9886339' == '1740326049'
     "test_headers_no_breach"
     "test_headers_breach"
+    # tests use @app.route() removed in Starlette 1.0
+    # https://github.com/laurentS/slowapi/issues/271
+    "test_retry_after"
+    "test_exempt_decorator"
   ];
 
   pythonImportsCheck = [ "slowapi" ];

From d38ef98cdadcf520666a2b34851bcaccc9dc769e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 22:15:38 -0700
Subject: [PATCH 0441/1209] python3Packages.uv-build: 0.11.8 -> 0.11.16

Diff: https://github.com/astral-sh/uv/compare/0.11.8...0.11.16

Changelog: https://github.com/astral-sh/uv/blob/0.11.16/CHANGELOG.md
---
 pkgs/development/python-modules/uv-build/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/uv-build/default.nix b/pkgs/development/python-modules/uv-build/default.nix
index bf45da4ab785..0750166192ce 100644
--- a/pkgs/development/python-modules/uv-build/default.nix
+++ b/pkgs/development/python-modules/uv-build/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "uv-build";
-  version = "0.11.8";
+  version = "0.11.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-wu9EA3z/qj29lfSj8wKE4p8XEAJQakQTg2AK8I/64us=";
+    hash = "sha256-5LJspcHj/RjOMv7eRB7n+tofX4s51M3kqHCPymCg90A=";
   };
 
   nativeBuildInputs = [
@@ -26,7 +26,7 @@ buildPythonPackage (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-ygGRoZgD88Q2EkN0U4SDTwya96Ds3Pqy3Llj8cjGwnY=";
+    hash = "sha256-2lg86WxPGVbJ91zi61lKrSqnzFgmmSrBrl+SfV5SJWU=";
   };
 
   buildAndTestSubdir = "crates/uv-build";

From d8055d7eba08187915876c6a6cbe49e41bf2d0e9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 24 May 2026 22:35:44 +0200
Subject: [PATCH 0442/1209] python3Packages.sqlalchemy: 2.0.49 -> 2.0.50

https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_2_0_50
---
 pkgs/development/python-modules/sqlalchemy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 43176c93edcd..1e57fb444030 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sqlalchemy";
-  version = "2.0.49";
+  version = "2.0.50";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     tag = "rel_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-+6g9TONKwCQWmWXHjpIDPDh96ng4lwLc1C009/l769Q=";
+    hash = "sha256-pZgkQa+qXuXSSlBXba5qByXFqegaIB/XGgp7Q2Bsz9U=";
   };
 
   postPatch = ''

From ccd892abf03a7edf54b3d19d7a50f7f0c11f14cc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 May 2026 14:06:23 +0200
Subject: [PATCH 0443/1209] python3Packages.adax-local: pin to setuptools 80

---
 pkgs/development/python-modules/adax-local/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/adax-local/default.nix b/pkgs/development/python-modules/adax-local/default.nix
index 0dea9d257e5f..8f0f851408ea 100644
--- a/pkgs/development/python-modules/adax-local/default.nix
+++ b/pkgs/development/python-modules/adax-local/default.nix
@@ -6,7 +6,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   async-timeout,
-  setuptools,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     hash = "sha256-8gVpUYQoE4V3ATR6zFAz/sARyEmHu9lYyGchTpS1eX8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     aiohttp

From 61727d1d60cd321d089c72bd41c2a12329071053 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 May 2026 14:23:08 +0200
Subject: [PATCH 0444/1209] alerta-server: pep517, pin to setuptools 80

---
 pkgs/by-name/al/alerta-server/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alerta-server/package.nix b/pkgs/by-name/al/alerta-server/package.nix
index a8109b35fd33..0c83ccd4fbc6 100644
--- a/pkgs/by-name/al/alerta-server/package.nix
+++ b/pkgs/by-name/al/alerta-server/package.nix
@@ -7,14 +7,16 @@
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "alerta-server";
   version = "9.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
     hash = "sha256-v4+0l5Sx9RTxmNFnKCoKrWFl1xu1JIRZ/kiI6zi/y0I=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = [ python3.pkgs.setuptools_80 ];
+
+  dependencies = with python3.pkgs; [
     bcrypt
     blinker
     cryptography

From d8b6fe97fe680427d54c6d3a8f6bdc396bbe5f17 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 00:36:57 +0200
Subject: [PATCH 0445/1209] python3Packages.dropbox: pin to setuptools 80

---
 pkgs/development/python-modules/dropbox/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 6393b3d9fc1d..c4fd3dd51b3b 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
   requests,
   six,
   stone,
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     hash = "sha256-9Fsh06V226vIyJhrlLkh9Xr4UGoEIISnIFCtuKqI218=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     requests

From e3484937e9c5b26634d87d986eea005d3895d7a2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 00:47:10 +0200
Subject: [PATCH 0446/1209] python3Packages.decopatch: pep517 build, pin
 setuptools 80

---
 pkgs/development/python-modules/decopatch/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/decopatch/default.nix b/pkgs/development/python-modules/decopatch/default.nix
index 36dd006225db..c95f9339b39c 100644
--- a/pkgs/development/python-modules/decopatch/default.nix
+++ b/pkgs/development/python-modules/decopatch/default.nix
@@ -3,22 +3,26 @@
   buildPythonPackage,
   fetchPypi,
   makefun,
+  setuptools_80,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "decopatch";
   version = "1.4.10";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-lX9JyT9BUBgsI/j7UdE7syE+DxenngnIzKcFdZi1VyA=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools_80
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [ makefun ];
+  dependencies = [ makefun ];
 
   postPatch = ''
     substituteInPlace setup.cfg \

From 08996ffcc0ab1bc8ef7fe6109452fb4023ec4858 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 01:52:44 +0200
Subject: [PATCH 0447/1209] python3Packages.cohere: relax pydantic-core
 constraint

---
 pkgs/development/python-modules/cohere/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index c1d4d8d169d2..98bf148ea60c 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -47,6 +47,10 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
+  pythonRelaxDeps = [
+    "pydantic-core"
+  ];
+
   optional-dependencies = {
     aiohttp = [
       aiohttp

From 27e7bd612280bdc48e0d84424ee95ecb8d7b8605 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 09:47:42 -0700
Subject: [PATCH 0448/1209] python3Packages.pytest-asyncio: 1.3.0 -> 1.4.0

Diff: https://github.com/pytest-dev/pytest-asyncio/compare/v1.3.0...v1.4.0

Changelog: https://github.com/pytest-dev/pytest-asyncio/blob/v1.4.0/docs/reference/changelog.rst
---
 pkgs/development/python-modules/pytest-asyncio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-asyncio/default.nix b/pkgs/development/python-modules/pytest-asyncio/default.nix
index 87062960a7cb..a166439fdac9 100644
--- a/pkgs/development/python-modules/pytest-asyncio/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-asyncio";
-  version = "1.3.0"; # N.B.: when updating, tests bleak and aioesphomeapi tests
+  version = "1.4.0"; # N.B.: when updating, tests bleak and aioesphomeapi tests
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = "pytest-asyncio";
     tag = "v${version}";
-    hash = "sha256-MWKMJkvxdvuOyxE8rNlf15j7C+MwJibnNsbfS0biKwo=";
+    hash = "sha256-MuTLCRHCuD9TwJkMiFIC5Xv5Xz6NL8j4JZpW8BA45SI=";
   };
 
   outputs = [

From 72e057ef7f328b787071d8e1c3016576f5ebd2ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 May 2026 06:57:43 -0700
Subject: [PATCH 0449/1209] python3Packages.tensorboard: fix build with
 setuptools 82

---
 .../python-modules/tensorboard/default.nix    | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pkgs/development/python-modules/tensorboard/default.nix b/pkgs/development/python-modules/tensorboard/default.nix
index d96daa9ed04e..80df6401b747 100644
--- a/pkgs/development/python-modules/tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorboard/default.nix
@@ -1,7 +1,9 @@
 {
   lib,
+  fetchpatch,
   fetchPypi,
   buildPythonPackage,
+  python,
 
   # dependencies
   absl-py,
@@ -57,6 +59,26 @@ buildPythonPackage rec {
     standard-imghdr
   ];
 
+  postInstall =
+    let
+      patch = fetchpatch {
+        name = "remove-runtime-pkg_resources-dependency.patch";
+        url = "https://github.com/tensorflow/tensorboard/commit/29f809f4737489912612635d9079a61f8e570bb8.patch";
+        excludes = [
+          "tensorboard/BUILD"
+          "tensorboard/data/BUILD"
+          "tensorboard/default_test.py"
+          "tensorboard/version_test.py"
+        ];
+        hash = "sha256-+jaXI4fVQP4mOg6y94KPMMCg3XuHV/gBUDNsp3ogS6c=";
+      };
+    in
+    ''
+      pushd $out/${python.sitePackages}
+      patch -p1 < ${patch}
+      popd
+    '';
+
   pythonImportsCheck = [
     "tensorboard"
     "tensorboard.backend"

From 7b925925a5e1633f0257be7d2aba46224557f653 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 30 May 2026 03:14:07 +0200
Subject: [PATCH 0450/1209] python3Packages.dramatiq: pin to setuptools 80

---
 pkgs/development/python-modules/dramatiq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dramatiq/default.nix b/pkgs/development/python-modules/dramatiq/default.nix
index 3600b0aa51fb..4e0c76774c88 100644
--- a/pkgs/development/python-modules/dramatiq/default.nix
+++ b/pkgs/development/python-modules/dramatiq/default.nix
@@ -11,7 +11,7 @@
   pytest-benchmark,
   pytest-cov-stub,
   redis,
-  setuptools,
+  setuptools_80,
   watchdog,
   watchdog-gevent,
 }:
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     hash = "sha256-VqMHSn2mdkO140t7IpZt32OHoEU0nEXiRWJ0w6Km0o8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [ prometheus-client ];
 

From a916df7c891adfbd522416c38c0131881bd2cacf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 30 May 2026 03:18:04 +0200
Subject: [PATCH 0451/1209] python3Packages.dramatiq: 2.0.1 -> 2.1.0

https://github.com/Bogdanp/dramatiq/compare/v2.0.1...v2.1.0
---
 pkgs/development/python-modules/dramatiq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dramatiq/default.nix b/pkgs/development/python-modules/dramatiq/default.nix
index 4e0c76774c88..af59efd2d91b 100644
--- a/pkgs/development/python-modules/dramatiq/default.nix
+++ b/pkgs/development/python-modules/dramatiq/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "dramatiq";
-  version = "2.0.1";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bogdanp";
     repo = "dramatiq";
     tag = "v${version}";
-    hash = "sha256-VqMHSn2mdkO140t7IpZt32OHoEU0nEXiRWJ0w6Km0o8=";
+    hash = "sha256-wUE3R/lFafP7P9tjKjFC+jwCc3jkvGeXunC8AhkBLbM=";
   };
 
   build-system = [ setuptools_80 ];

From 7d288b00ad501dfbfa0e37f17b3c29a50377173b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 30 May 2026 12:37:07 +0200
Subject: [PATCH 0452/1209] python3Packages.psautohint: fix build

Prunes dependencies, migrates to finalAttrs and a PEP517 build.
---
 .../python-modules/psautohint/default.nix     | 27 ++++++++++---------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/psautohint/default.nix b/pkgs/development/python-modules/psautohint/default.nix
index ae962b95e978..3a00ad840176 100644
--- a/pkgs/development/python-modules/psautohint/default.nix
+++ b/pkgs/development/python-modules/psautohint/default.nix
@@ -2,10 +2,9 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fonttools,
-  lxml,
-  fs, # for fonttools extras
+  setuptools,
   setuptools-scm,
+  fonttools,
   pytestCheckHook,
   pytest-cov-stub,
   pytest-xdist,
@@ -13,31 +12,32 @@
   psautohint, # for passthru.tests
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "psautohint";
   version = "2.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adobe-type-tools";
     repo = "psautohint";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "125nx7accvbk626qlfar90va1995kp9qfrz6a978q4kv2kk37xai";
     fetchSubmodules = true; # data dir for tests
   };
 
   postPatch = ''
-    echo '#define PSAUTOHINT_VERSION "${version}"' > libpsautohint/src/version.h
+    echo '#define PSAUTOHINT_VERSION "${finalAttrs.version}"' > libpsautohint/src/version.h
     sed -i '/use_scm_version/,+3d' setup.py
-    sed -i '/setup(/a \     version="${version}",' setup.py
+    sed -i '/setup(/a \     version="${finalAttrs.version}",' setup.py
   '';
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     fonttools
-    lxml
-    fs
   ];
 
   nativeCheckInputs = [
@@ -45,6 +45,7 @@ buildPythonPackage rec {
     pytest-cov-stub
     pytest-xdist
   ];
+
   disabledTests = lib.optionals (!runAllTests) [
     # Slow tests, reduces test time from ~5 mins to ~30s
     "test_mmufo"
@@ -69,4 +70,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.sternenseemann ];
   };
-}
+})

From 06028a8aa5018ac8e70ae8edaff5c7397143e08c Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Thu, 21 May 2026 10:42:50 +0200
Subject: [PATCH 0453/1209] curl: backport performance patch

https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23

See https://curl.se/mail/distros-2026-05/0000.html

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 .../curlMinimal/fix-wakeup-consumption.patch  | 32 +++++++++++++++++++
 pkgs/by-name/cu/curlMinimal/package.nix       |  7 ++++
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch

diff --git a/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch b/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
new file mode 100644
index 000000000000..0bc04b60bb87
--- /dev/null
+++ b/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
@@ -0,0 +1,32 @@
+From 2a2104f3cff44bb28bb570a093be52bbeeed8f23 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 11 May 2026 14:56:04 +0200
+Subject: [PATCH] event: fix wakeup consumption
+
+The events on a multi wakeup socketpair were only consumed via
+curl_multi_poll()/curl_multi_wait() but not in event based processing on
+a curl_multi_socket() call. That led to busy loops as reported in
+
+Fixes #21547
+Reported-by: Earnestly on github
+Closes #21549
+---
+ lib/multi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/multi.c b/lib/multi.c
+index be32740a7097..5e84133f13fd 100644
+--- a/lib/multi.c
++++ b/lib/multi.c
+@@ -2703,6 +2703,11 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
+   Curl_uint32_bset_remove(&multi->dirty, data->mid);
+ 
+   if(data == multi->admin) {
++#ifdef ENABLE_WAKEUP
++    /* Consume any pending wakeup signals before processing.
++     * This is necessary for event based processing. See #21547 */
++    (void)Curl_wakeup_consume(multi->wakeup_pair, TRUE);
++#endif
+ #ifdef USE_RESOLV_THREADED
+     Curl_async_thrdd_multi_process(multi);
+ #endif
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 3bc05f122f6e..51208baea4b0 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -96,6 +96,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Y/4twUi6DOromSLvg49+XJRicsLni3xZ+rS3nTziuJY=";
   };
 
+  patches = [
+    # https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
+    # According to <https://curl.se/mail/distros-2026-05/0000.html>, this fixes
+    # a performance regression, causing high CPU usage
+    ./fix-wakeup-consumption.patch
+  ];
+
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''

From 42073baefa3d15729563d3a1aca59f0cc2c9b033 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sat, 30 May 2026 13:19:51 +0200
Subject: [PATCH 0454/1209] libbacktrace: Disable mtest_minidebug test on
 powerpc64-linux

---
 pkgs/by-name/li/libbacktrace/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/li/libbacktrace/package.nix b/pkgs/by-name/li/libbacktrace/package.nix
index 0f3abdba1ab9..2568b21be126 100644
--- a/pkgs/by-name/li/libbacktrace/package.nix
+++ b/pkgs/by-name/li/libbacktrace/package.nix
@@ -33,6 +33,15 @@ stdenv.mkDerivation {
     ./0004-libbacktrace-Support-NIX_DEBUG_INFO_DIRS-environment.patch
   ];
 
+  # https://github.com/ianlancetaylor/libbacktrace/issues/163
+  postPatch =
+    lib.optionalString
+      (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian && stdenv.hostPlatform.isAbiElfv1)
+      ''
+        substituteInPlace Makefile.am \
+          --replace-fail 'MAKETESTS += mtest_minidebug' '# MAKETESTS += mtest_minidebug'
+      '';
+
   nativeBuildInputs = [
     autoreconfHook
   ];

From ddf69fce53586a3154ef547ced79fd6a3b705dcc Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sat, 30 May 2026 20:17:03 +0200
Subject: [PATCH 0455/1209] file: Apply patches to fix GUID parsing on
 big-endian

---
 .../tools/misc/file/0003-Add-LE-BE-GUID.patch | 631 ++++++++++++++++++
 ...parsing-guids-in-big-endian-machines.patch |  82 +++
 pkgs/tools/misc/file/default.nix              |  23 +
 3 files changed, 736 insertions(+)
 create mode 100644 pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
 create mode 100644 pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch

diff --git a/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch b/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
new file mode 100644
index 000000000000..69e52586b5f6
--- /dev/null
+++ b/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
@@ -0,0 +1,631 @@
+From 797a275514c80303accbd821df9692b04f6020e6 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Sun, 19 Apr 2026 19:56:49 +0000
+Subject: [PATCH] Add LE/BE GUID
+
+(OPNA2608: removed hunks that change file modification dates, as they
+make it more difficult to apply the patch)
+
+(OPNA2608: merge typo fix 2866af2e51beb40afe35d2ff5e765991ac459237)
+
+---
+ doc/magic.man    |   8 ++--
+ src/Makefile.am  |   3 +-
+ src/apprentice.c | 121 ++++++++++-------------------------------------
+ src/file.h       |  31 ++++++------
+ src/funcs.c      |  30 +++++++++---
+ src/print.c      |  11 +++--
+ src/softmagic.c  |  18 ++++++-
+ src/swap.c       | 101 +++++++++++++++++++++++++++++++++++++++
+ src/swap.h       |  48 +++++++++++++++++++
+ 9 files changed, 247 insertions(+), 124 deletions(-)
+ create mode 100644 src/swap.c
+ create mode 100644 src/swap.h
+
+diff --git a/doc/magic.man b/doc/magic.man
+index aa9f8da247..bad8111b28 100644
+--- a/doc/magic.man
++++ b/doc/magic.man
+@@ -373,7 +373,9 @@ The DER types are:
+ .Dv rel-oid-iri .
+ These types can be followed by an optional numeric size, which indicates
+ the field width in bytes.
+-.It Dv guid
++.It Dv guid ,
++.It Dv leguid ,
++.It Dv beguid 
+ A Globally Unique Identifier, parsed and printed as
+ XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.
+ Its format is a string.
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 64c0414367..10cf6fcb23 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -10,7 +10,8 @@ AM_CFLAGS = $(CFLAG_VISIBILITY) @WARNINGS@
+ libmagic_la_SOURCES = buffer.c magic.c apprentice.c softmagic.c ascmagic.c \
+ 	encoding.c compress.c is_csv.c is_json.c is_simh.c is_tar.c readelf.c \
+ 	print.c fsmagic.c funcs.c file.h readelf.h tar.h apptype.c der.c der.h \
+-	file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h
++	file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h \
++	swap.c swap.h
+ libmagic_la_LDFLAGS = -no-undefined -version-info 1:0:0
+ if MINGW
+ MINGWLIBS = -lgnurx -lshlwapi
+diff --git a/src/apprentice.c b/src/apprentice.c
+index a6ab9e7c30..b67897b45a 100644
+--- a/src/apprentice.c
++++ b/src/apprentice.c
+@@ -32,6 +32,7 @@
+ #endif	/* lint */
+ 
+ #include "magic.h"
++#include "swap.h"
+ #include <stdlib.h>
+ #ifdef HAVE_UNISTD_H
+ #include <unistd.h>
+@@ -50,12 +51,6 @@ FILE_RCSID("@(#)$File: apprentice.c,v 1.373 2026/04/17 14:58:57 christos Exp $")
+ #endif
+ #include <dirent.h>
+ #include <limits.h>
+-#ifdef HAVE_BYTESWAP_H
+-#include <byteswap.h>
+-#endif
+-#ifdef HAVE_SYS_BSWAP_H
+-#include <sys/bswap.h>
+-#endif
+ 
+ 
+ #define	EATAB {while (*l && isascii(CAST(unsigned char, *l)) && \
+@@ -131,20 +126,6 @@ file_private void mlist_free(struct mlist *);
+ file_private void byteswap(struct magic *, uint32_t);
+ file_private void bs1(struct magic *);
+ 
+-#if defined(HAVE_BYTESWAP_H)
+-#define swap2(x)	bswap_16(x)
+-#define swap4(x)	bswap_32(x)
+-#define swap8(x)	bswap_64(x)
+-#elif defined(HAVE_SYS_BSWAP_H)
+-#define swap2(x)	bswap16(x)
+-#define swap4(x)	bswap32(x)
+-#define swap8(x)	bswap64(x)
+-#else
+-file_private uint16_t swap2(uint16_t);
+-file_private uint32_t swap4(uint32_t);
+-file_private uint64_t swap8(uint64_t);
+-#endif
+-
+ file_private char *mkdbname(struct magic_set *, const char *, int);
+ file_private struct magic_map *apprentice_buf(struct magic_set *, struct magic *,
+     size_t);
+@@ -285,6 +266,8 @@ static const struct type_tbl_s type_tbl[] = {
+ 	{ XX("clear"),		FILE_CLEAR,		FILE_FMT_NONE },
+ 	{ XX("der"),		FILE_DER,		FILE_FMT_STR },
+ 	{ XX("guid"),		FILE_GUID,		FILE_FMT_STR },
++	{ XX("leguid"),		FILE_LEGUID,		FILE_FMT_STR },
++	{ XX("beguid"),		FILE_BEGUID,		FILE_FMT_STR },
+ 	{ XX("offset"),		FILE_OFFSET,		FILE_FMT_QUAD },
+ 	{ XX("bevarint"),	FILE_BEVARINT,		FILE_FMT_STR },
+ 	{ XX("levarint"),	FILE_LEVARINT,		FILE_FMT_STR },
+@@ -926,6 +909,8 @@ typesize(int type)
+ 	case FILE_LEVARINT:
+ 		return 8;
+ 
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 	case FILE_GUID:
+ 		return 16;
+ 
+@@ -989,6 +974,8 @@ apprentice_magic_strength_1(const struct magic *m)
+ 	case FILE_BEVARINT:
+ 	case FILE_LEVARINT:
+ 	case FILE_GUID:
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 	case FILE_BEID3:
+ 	case FILE_LEID3:
+ 	case FILE_OFFSET:
+@@ -1251,6 +1238,8 @@ set_test_type(struct magic *mstart, struct magic *m)
+ 	case FILE_LEVARINT:
+ 	case FILE_DER:
+ 	case FILE_GUID:
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 	case FILE_OFFSET:
+ 	case FILE_MSDOSDATE:
+ 	case FILE_BEMSDOSDATE:
+@@ -1733,6 +1722,8 @@ file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
+ 		case FILE_CLEAR:
+ 		case FILE_DER:
+ 		case FILE_GUID:
++		case FILE_LEGUID:
++		case FILE_BEGUID:
+ 		case FILE_OCTAL:
+ 			break;
+ 		default:
+@@ -2943,6 +2934,8 @@ getvalue(struct magic_set *ms, struct magic *m, const char **p, int action)
+ 		if (errno == 0)
+ 			*p = ep;
+ 		return 0;
++	case FILE_BEGUID:
++	case FILE_LEGUID:
+ 	case FILE_GUID:
+ 		if (file_parse_guid(*p, m->value.guid) == -1) {
+ 			file_magwarn(ms, "Error parsing guid `%s'", *p);
+@@ -3418,7 +3411,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
+ 
+ 	ptr = CAST(uint32_t *, map->p);
+ 	if (*ptr != MAGICNO) {
+-		if (swap4(*ptr) != MAGICNO) {
++		if (file_swap4(*ptr) != MAGICNO) {
+ 			file_error(ms, 0, "bad magic in `%s'", dbname);
+ 			return -1;
+ 		}
+@@ -3426,7 +3419,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
+ 	} else
+ 		needsbyteswap = 0;
+ 	if (needsbyteswap)
+-		version = swap4(ptr[1]);
++		version = file_swap4(ptr[1]);
+ 	else
+ 		version = ptr[1];
+ 	if (version != VERSIONNO) {
+@@ -3439,7 +3432,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
+ 	nentries = 0;
+ 	for (i = 0; i < MAGIC_SETS; i++) {
+ 		if (needsbyteswap)
+-			map->nmagic[i] = swap4(ptr[i + 2]);
++			map->nmagic[i] = file_swap4(ptr[i + 2]);
+ 		else
+ 			map->nmagic[i] = ptr[i + 2];
+ 		if (map->nmagic[i] > entries) {
+@@ -3577,69 +3570,6 @@ byteswap(struct magic *magic, uint32_t nmagic)
+ 		bs1(&magic[i]);
+ }
+ 
+-#if !defined(HAVE_BYTESWAP_H) && !defined(HAVE_SYS_BSWAP_H)
+-/*
+- * swap a short
+- */
+-file_private uint16_t
+-swap2(uint16_t sv)
+-{
+-	uint16_t rv;
+-	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
+-	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
+-	d[0] = s[1];
+-	d[1] = s[0];
+-	return rv;
+-}
+-
+-/*
+- * swap an int
+- */
+-file_private uint32_t
+-swap4(uint32_t sv)
+-{
+-	uint32_t rv;
+-	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
+-	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
+-	d[0] = s[3];
+-	d[1] = s[2];
+-	d[2] = s[1];
+-	d[3] = s[0];
+-	return rv;
+-}
+-
+-/*
+- * swap a quad
+- */
+-file_private uint64_t
+-swap8(uint64_t sv)
+-{
+-	uint64_t rv;
+-	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
+-	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
+-# if 0
+-	d[0] = s[3];
+-	d[1] = s[2];
+-	d[2] = s[1];
+-	d[3] = s[0];
+-	d[4] = s[7];
+-	d[5] = s[6];
+-	d[6] = s[5];
+-	d[7] = s[4];
+-# else
+-	d[0] = s[7];
+-	d[1] = s[6];
+-	d[2] = s[5];
+-	d[3] = s[4];
+-	d[4] = s[3];
+-	d[5] = s[2];
+-	d[6] = s[1];
+-	d[7] = s[0];
+-# endif
+-	return rv;
+-}
+-#endif
+-
+ file_protected uintmax_t 
+ file_varint2uintmax_t(const unsigned char *us, int t, size_t *l)
+ {
+@@ -3676,16 +3606,16 @@ file_varint2uintmax_t(const unsigned char *us, int t, size_t *l)
+ file_private void
+ bs1(struct magic *m)
+ {
+-	m->flag = swap2(m->flag);
+-	m->offset = swap4(CAST(uint32_t, m->offset));
+-	m->in_offset = swap4(CAST(uint32_t, m->in_offset));
+-	m->lineno = swap4(CAST(uint32_t, m->lineno));
++	m->flag = file_swap2(m->flag);
++	m->offset = file_swap4(CAST(uint32_t, m->offset));
++	m->in_offset = file_swap4(CAST(uint32_t, m->in_offset));
++	m->lineno = file_swap4(CAST(uint32_t, m->lineno));
+ 	if (IS_STRING(m->type)) {
+-		m->str_range = swap4(m->str_range);
+-		m->str_flags = swap4(m->str_flags);
++		m->str_range = file_swap4(m->str_range);
++		m->str_flags = file_swap4(m->str_flags);
+ 	} else {
+-		m->value.q = swap8(m->value.q);
+-		m->num_mask = swap8(m->num_mask);
++		m->value.q = file_swap8(m->value.q);
++		m->num_mask = file_swap8(m->num_mask);
+ 	}
+ }
+ 
+@@ -3708,6 +3638,7 @@ file_pstring_length_size(struct magic_set *ms, const struct magic *m)
+ 		return FILE_BADSIZE;
+ 	}
+ }
++
+ file_protected size_t
+ file_pstring_get_length(struct magic_set *ms, const struct magic *m,
+     const char *ss)
+diff --git a/src/file.h b/src/file.h
+index 258b776976..25e365351d 100644
+--- a/src/file.h
++++ b/src/file.h
+@@ -179,7 +179,7 @@
+ #define MAXstring 128		/* max len of "string" types */
+ 
+ #define MAGICNO		0xF11E041C
+-#define VERSIONNO	20
++#define VERSIONNO	21
+ #define FILE_MAGICSIZE	432
+ 
+ #define FILE_GUID_SIZE	sizeof("XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX")
+@@ -292,17 +292,19 @@ struct magic {
+ #define				FILE_CLEAR		47
+ #define				FILE_DER		48
+ #define				FILE_GUID		49
+-#define				FILE_OFFSET		50
+-#define				FILE_BEVARINT		51
+-#define				FILE_LEVARINT		52
+-#define				FILE_MSDOSDATE		53
+-#define				FILE_LEMSDOSDATE	54
+-#define				FILE_BEMSDOSDATE	55
+-#define				FILE_MSDOSTIME		56
+-#define				FILE_LEMSDOSTIME	57
+-#define				FILE_BEMSDOSTIME	58
+-#define				FILE_OCTAL		59
+-#define				FILE_NAMES_SIZE		60 /* size of array to contain all names */
++#define				FILE_LEGUID		50
++#define				FILE_BEGUID		51
++#define				FILE_OFFSET		52
++#define				FILE_BEVARINT		53
++#define				FILE_LEVARINT		54
++#define				FILE_MSDOSDATE		55
++#define				FILE_LEMSDOSDATE	56
++#define				FILE_BEMSDOSDATE	57
++#define				FILE_MSDOSTIME		58
++#define				FILE_LEMSDOSTIME	59
++#define				FILE_BEMSDOSTIME	60
++#define				FILE_OCTAL		61
++#define				FILE_NAMES_SIZE		62 /* size of array to contain all names */
+ 
+ #define IS_STRING(t) \
+ 	((t) == FILE_STRING || \
+@@ -558,7 +560,8 @@ file_protected int file_separator(struct magic_set *);
+ file_protected char *file_copystr(char *, size_t, size_t, const char *);
+ file_protected int file_checkfmt(char *, size_t, const char *);
+ file_protected size_t file_printedlen(const struct magic_set *);
+-file_protected int file_print_guid(char *, size_t, const uint64_t *);
++file_protected int file_print_leguid(char *, size_t, const uint64_t *);
++file_protected int file_print_beguid(char *, size_t, const uint64_t *);
+ file_protected int file_parse_guid(const char *, uint64_t *);
+ file_protected int file_replace(struct magic_set *, const char *, const char *);
+ file_protected int file_printf(struct magic_set *, const char *, ...)
+diff --git a/src/funcs.c b/src/funcs.c
+index dd80198f36..e5782bf2e8 100644
+--- a/src/funcs.c
++++ b/src/funcs.c
+@@ -27,6 +27,7 @@
+ #endif	/* lint */
+ 
+ #include "magic.h"
++#include "swap.h"
+ #include <assert.h>
+ #include <stdarg.h>
+ #include <stdlib.h>
+@@ -934,12 +935,9 @@ file_parse_guid(const char *s, uint64_t *guid)
+ 	return 0;
+ }
+ 
+-file_protected int
+-file_print_guid(char *str, size_t len, const uint64_t *guid)
++file_private int
++file_print_guid(char *str, size_t len, const struct guid *g)
+ {
+-	const struct guid *g = CAST(const struct guid *,
+-	    CAST(const void *, guid));
+-
+ #ifndef WIN32
+ 	return snprintf(str, len, "%.8X-%.4hX-%.4hX-%.2hhX%.2hhX-"
+ 	    "%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX",
+@@ -955,6 +953,26 @@ file_print_guid(char *str, size_t len, const uint64_t *guid)
+ #endif
+ }
+ 
++file_protected int
++file_print_leguid(char *str, size_t len, const uint64_t *guid)
++{
++	const struct guid *g = CAST(const struct guid *,
++	    CAST(const void *, guid));
++	return file_print_guid(str, len, g);
++}
++
++file_protected int
++file_print_beguid(char *str, size_t len, const uint64_t *guid)
++{
++	const struct guid *g = CAST(const struct guid *,
++	    CAST(const void *, guid));
++	struct guid gg = *g;
++	gg.data1 = file_swap4(gg.data1);
++	gg.data2 = file_swap2(gg.data2);
++	gg.data3 = file_swap2(gg.data3);
++	return file_print_guid(str, len, &gg);
++}
++
+ file_protected int
+ file_pipe_closexec(int *fds)
+ {
+diff --git a/src/print.c b/src/print.c
+index 0740fd67e2..ac0802f309 100644
+--- a/src/print.c
++++ b/src/print.c
+@@ -227,12 +227,17 @@ file_mdump(struct magic *m)
+ 		case FILE_DER:
+ 			(void) fprintf(stderr, "'%s'", m->value.s);
+ 			break;
++		case FILE_LEGUID:
+ 		case FILE_GUID:
+-			(void) file_print_guid(tbuf, sizeof(tbuf),
++			(void) file_print_leguid(tbuf, sizeof(tbuf),
++			    m->value.guid);
++			(void) fprintf(stderr, "%s", tbuf);
++			break;
++		case FILE_BEGUID:
++			(void) file_print_beguid(tbuf, sizeof(tbuf),
+ 			    m->value.guid);
+ 			(void) fprintf(stderr, "%s", tbuf);
+ 			break;
+-
+ 		default:
+ 			(void) fprintf(stderr, "*bad type %d*", m->type);
+ 			break;
+diff --git a/src/softmagic.c b/src/softmagic.c
+index 370be0a54d..2f04b5ce6c 100644
+--- a/src/softmagic.c
++++ b/src/softmagic.c
+@@ -812,7 +812,13 @@ mprint(struct magic_set *ms, struct magic *m)
+ 			return -1;
+ 		break;
+ 	case FILE_GUID:
+-		(void) file_print_guid(buf, sizeof(buf), ms->ms_value.guid);
++	case FILE_LEGUID:
++		(void) file_print_leguid(buf, sizeof(buf), ms->ms_value.guid);
++		if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
++			return -1;
++		break;
++	case FILE_BEGUID:
++		(void) file_print_beguid(buf, sizeof(buf), ms->ms_value.guid);
+ 		if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
+ 			return -1;
+ 		break;
+@@ -972,6 +978,8 @@ moffset(struct magic_set *ms, struct magic *m, size_t nbytes,
+ 		}
+ 		break;
+ 
++	case FILE_BEGUID:
++	case FILE_LEGUID:
+ 	case FILE_GUID:
+ 		o = CAST(int32_t, (ms->offset + 2 * sizeof(uint64_t)));
+ 		break;
+@@ -1333,6 +1341,8 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
+ 	case FILE_USE:
+ 	case FILE_DER:
+ 	case FILE_GUID:
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 		return 1;
+ 	default:
+ 		file_magerror(ms, "invalid type %d in mconvert()", m->type);
+@@ -1903,6 +1913,8 @@ mget(struct magic_set *ms, struct magic *m, const struct buffer *b,
+ 			return 0;
+ 		break;
+ 
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 	case FILE_GUID:
+ 		if (OFFSET_OOB(nbytes, offset, 16))
+ 			return 0;
+@@ -2416,6 +2428,8 @@ magiccheck(struct magic_set *ms, struct magic *m, file_regex_t **m_cache)
+ 			return 0;
+ 		}
+ 		return matched;
++	case FILE_BEGUID:
++	case FILE_LEGUID:
+ 	case FILE_GUID:
+ 		l = 0;
+ 		v = memcmp(m->value.guid, p->guid, sizeof(p->guid));
+diff --git a/src/swap.c b/src/swap.c
+new file mode 100644
+index 0000000000..f20e354237
+--- /dev/null
++++ b/src/swap.c
+@@ -0,0 +1,101 @@
++/*
++ * Copyright (c) Ian F. Darwin 1986-1995.
++ * Software written by Ian F. Darwin and others;
++ * maintained 1995-present by Christos Zoulas and others.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice immediately at the beginning of the file, without modification,
++ *    this list of conditions, and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
++ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ */
++/*
++ * apprentice - make one pass through /etc/magic, learning its secrets.
++ */
++
++#include "file.h"
++
++#ifndef	lint
++FILE_RCSID("@(#)$File: swap.c,v 1.1 2026/04/19 19:56:49 christos Exp $")
++#endif	/* lint */
++
++#include "swap.h"
++
++#if !defined(HAVE_BYTESWAP_H) && !defined(HAVE_SYS_BSWAP_H)
++/*
++ * swap a short
++ */
++file_protected uint16_t
++file_swap2(uint16_t sv)
++{
++	uint16_t rv;
++	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
++	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
++	d[0] = s[1];
++	d[1] = s[0];
++	return rv;
++}
++
++/*
++ * swap an int
++ */
++file_protected uint32_t
++file_swap4(uint32_t sv)
++{
++	uint32_t rv;
++	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
++	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
++	d[0] = s[3];
++	d[1] = s[2];
++	d[2] = s[1];
++	d[3] = s[0];
++	return rv;
++}
++
++/*
++ * swap a quad
++ */
++file_protected uint64_t
++file_swap8(uint64_t sv)
++{
++	uint64_t rv;
++	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
++	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
++# if 0
++	d[0] = s[3];
++	d[1] = s[2];
++	d[2] = s[1];
++	d[3] = s[0];
++	d[4] = s[7];
++	d[5] = s[6];
++	d[6] = s[5];
++	d[7] = s[4];
++# else
++	d[0] = s[7];
++	d[1] = s[6];
++	d[2] = s[5];
++	d[3] = s[4];
++	d[4] = s[3];
++	d[5] = s[2];
++	d[6] = s[1];
++	d[7] = s[0];
++# endif
++	return rv;
++}
++#endif
+diff --git a/src/swap.h b/src/swap.h
+new file mode 100644
+index 0000000000..9fc6428d7d
+--- /dev/null
++++ b/src/swap.h
+@@ -0,0 +1,48 @@
++/*
++ * Copyright (c) Ian F. Darwin 1986-1995.
++ * Software written by Ian F. Darwin and others;
++ * maintained 1995-present by Christos Zoulas and others.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice immediately at the beginning of the file, without modification,
++ *    this list of conditions, and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
++ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ */
++
++#ifdef HAVE_BYTESWAP_H
++#include <byteswap.h>
++#endif
++#ifdef HAVE_SYS_BSWAP_H
++#include <sys/bswap.h>
++#endif
++
++#if defined(HAVE_BYTESWAP_H)
++#define file_swap2(x)	bswap_16(x)
++#define file_swap4(x)	bswap_32(x)
++#define file_swap8(x)	bswap_64(x)
++#elif defined(HAVE_SYS_BSWAP_H)
++#define file_swap2(x)	bswap16(x)
++#define file_swap4(x)	bswap32(x)
++#define file_swap8(x)	bswap64(x)
++#else
++file_protected uint16_t file_swap2(uint16_t);
++file_protected uint32_t file_swap4(uint32_t);
++file_protected uint64_t file_swap8(uint64_t);
++#endif
diff --git a/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch b/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch
new file mode 100644
index 000000000000..ede424aaba7c
--- /dev/null
+++ b/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch
@@ -0,0 +1,82 @@
+From 7a2b2a4b6e0f9de8682e6098c514155f2198cc8e Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Sun, 17 May 2026 17:10:25 +0000
+Subject: [PATCH] Handle parsing guids in big endian machines (Christoph Biedl)
+
+(OPNA2608: removed hunks that change file modification dates, as they
+make it more difficult to apply the patch)
+
+---
+ src/compress.c |  7 +++----
+ src/file.h     |  3 ++-
+ src/funcs.c    | 21 ++++++++++++++++++++-
+ 3 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/src/compress.c b/src/compress.c
+index 76b7aad18..7f1d584d0 100644
+--- a/src/compress.c
++++ b/src/compress.c
+@@ -125,12 +125,11 @@ static const char *zlib_args[] = { "python", "-c", zlibcode, NULL };
+ static int
+ zlibcmp(const unsigned char *buf)
+ {
+-	unsigned short x = 1;
+-	unsigned char *s = CAST(unsigned char *, CAST(void *, &x));
++	unsigned short x;
+ 
+ 	if ((buf[0] & 0xf) != 8 || (buf[0] & 0x80) != 0)
+ 		return 0;
+-	if (s[0] != 1)	/* endianness test */
++	if (file_bigendian())	/* endianness test */
+ 		x = buf[0] | (buf[1] << 8);
+ 	else
+ 		x = buf[1] | (buf[0] << 8);
+diff --git a/src/file.h b/src/file.h
+index 497de9b91..6a39801e4 100644
+--- a/src/file.h
++++ b/src/file.h
+@@ -597,6 +597,7 @@ file_protected uint64_t file_signextend(struct magic_set *, struct magic *,
+ file_protected uintmax_t file_varint2uintmax_t(const unsigned char *, int,
+     size_t *);
+ 
++file_protected int file_bigendian(void);
+ file_protected void file_badread(struct magic_set *);
+ file_protected void file_badseek(struct magic_set *);
+ file_protected void file_oomem(struct magic_set *, size_t);
+diff --git a/src/funcs.c b/src/funcs.c
+index 8698f3312..0f2e6942b 100644
+--- a/src/funcs.c
++++ b/src/funcs.c
+@@ -52,6 +52,18 @@ FILE_RCSID("@(#)$File: funcs.c,v 1.151 2026/05/16 15:21:40 christos Exp $")
+ #define SIZE_MAX	((size_t)~0)
+ #endif
+ 
++file_protected int
++file_bigendian(void)
++{
++	union {
++		unsigned short x;
++		unsigned char s[sizeof(unsigned short)];
++	} u;
++
++	u.x = 1;
++	return u.s[0] != 1;
++}
++
+ file_protected char *
+ file_copystr(char *buf, size_t blen, size_t width, const char *str)
+ {
+@@ -931,6 +943,13 @@ file_parse_guid(const char *s, uint64_t *guid)
+ 	    !getxvalue(&g->data4[6], s + 8, 2) ||
+ 	    !getxvalue(&g->data4[7], s + 10, 2))
+ 		return -1;
++
++	if (file_bigendian()) {
++		g->data1 = file_swap4(g->data1);
++		g->data2 = file_swap2(g->data2);
++		g->data3 = file_swap2(g->data3);
++
++	}
+ 	return 0;
+ }
+ 
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index ae27a481b38f..4bd56f4dcfb3 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -3,6 +3,8 @@
   stdenv,
   fetchurl,
   buildPackages,
+  autoconf,
+  automake,
   zlib,
   libgnurx,
   updateAutotoolsGnuConfigScriptsHook,
@@ -41,16 +43,37 @@ stdenv.mkDerivation (finalAttrs: {
     ./0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
     # Fixes breakage of python3Packages.python-magic and xdg-utils
     ./0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
+
+    # Splits byteswapping functions into a separate file & reuses them across the codebase
+    # (needed for GUID parsing fix below)
+    # https://github.com/file/file/commit/797a275514c80303accbd821df9692b04f6020e6
+    # https://github.com/file/file/commit/2866af2e51beb40afe35d2ff5e765991ac459237
+    ./0003-Add-LE-BE-GUID.patch
+
+    # Fixes GUID parsing on big-endian
+    # https://github.com/file/file/commit/7a2b2a4b6e0f9de8682e6098c514155f2198cc8e
+    ./0004-Handle-parsing-guids-in-big-endian-machines.patch
   ];
 
   strictDeps = true;
   enableParallelBuilding = true;
 
   nativeBuildInputs = [
+    # 0003-Add-LE-BE-GUID.patch touches automake file, need to regenerate files
+    # autoreconfHook would cause inf rec (hook -> libtool -> file -> hook), adding the individual components we need
+    autoconf
+    automake
+
     updateAutotoolsGnuConfigScriptsHook
   ];
   buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW libgnurx;
 
+  # 0003-Add-LE-BE-GUID.patch touches automake file, need to regenerate files
+  # autoreconfHook would cause inf rec (hook -> libtool -> file -> hook), manually calling autoreconf
+  preConfigure = ''
+    autoreconf
+  '';
+
   # https://bugs.astron.com/view.php?id=382
   doCheck = !stdenv.buildPlatform.isMusl;
 

From 4ab3d2ee743058c1145e7b00f4a90f91e6d3b7e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 30 May 2026 12:11:52 -0700
Subject: [PATCH 0456/1209] python3Packages.fakeredis: 2.35.1 -> 2.36.0

Diff: https://github.com/cunla/fakeredis-py/compare/v2.35.1...v2.36.0

Changelog: https://github.com/cunla/fakeredis-py/releases/tag/v2.36.0
---
 pkgs/development/python-modules/fakeredis/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index 74e0f892129b..f3255b611a25 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fakeredis";
-  version = "2.35.1";
+  version = "2.36.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cunla";
     repo = "fakeredis-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-euhWKXFERpRoXX7G81ffAygt5e1mt7uy9Y9zAGacu38=";
+    hash = "sha256-rkq8fxQSNPMZE95mlNxSazdwxy5+DMlZKkVWweGVOtc=";
   };
 
   build-system = [ hatchling ];

From 6faf86656418e44e9936417490163cb95b3c45e5 Mon Sep 17 00:00:00 2001
From: Marcus Ramberg <marcus@means.no>
Date: Sat, 30 May 2026 17:00:51 +0200
Subject: [PATCH 0457/1209] perlPackages.HTTPDaemon: 6.16 -> 6.17

---
 pkgs/top-level/perl-packages.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 78b55a3f2817..d6da2712c7d7 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16650,12 +16650,12 @@ with self;
     };
   };
 
-  HTTPDaemon = buildPerlPackage {
+  HTTPDaemon = buildPerlModule {
     pname = "HTTP-Daemon";
-    version = "6.16";
+    version = "6.17";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Daemon-6.16.tar.gz";
-      hash = "sha256-s40JJyXm+k4MTcKkfhVwcEkbr6Db4Wx4o1joBqp+Fz0=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Daemon-6.17.tar.gz";
+      hash = "sha256-FigVgMQOIxCNAoQ0aYtdfVNje/kEyd+CJIHiU8vskgw=";
     };
     buildInputs = [
       ModuleBuildTiny

From f244bd930e120b0fdf1933dc19f834d5ef504669 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 May 2026 00:30:06 +0000
Subject: [PATCH 0458/1209] msgpack-cxx: 7.0.0 -> 8.0.0

---
 pkgs/by-name/ms/msgpack-cxx/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ms/msgpack-cxx/package.nix b/pkgs/by-name/ms/msgpack-cxx/package.nix
index 02789eb707ae..0954f22c251d 100644
--- a/pkgs/by-name/ms/msgpack-cxx/package.nix
+++ b/pkgs/by-name/ms/msgpack-cxx/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "msgpack-cxx";
-  version = "7.0.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "msgpack";
     repo = "msgpack-c";
     tag = "cpp-${finalAttrs.version}";
-    hash = "sha256-kg4mpNiigfZ59ZeL8LXEHwtkLU8Po+vgRcUcgTJd+h4=";
+    hash = "sha256-11eRM63rjmbIi0glwY5dEuKG9wnVOLx8VXb7CXqCbJE=";
   };
 
   strictDeps = true;

From 956eb0479ae8376ffb13b36659a9a841f124dc5c Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Fri, 24 Oct 2025 23:13:01 -0700
Subject: [PATCH 0459/1209] nixos/test-driver: add utils to manipulate efi
 variables

```python
machine.create_efi_vars()
machine.write_efi_vars([
    EfiVariable(
        uuid.UUID("65a72bd9-f42b-4039-8084-66cd1702cb24"),
        "AbrNextBoot",
        b"a",
        flags=EfiVariable.Flags.NON_VOLATILE
    )
])

machine.start()
```
---
 nixos/lib/test-driver/default.nix             |   2 +
 nixos/lib/test-driver/src/test_driver/efi.py  | 233 ++++++++++++++++++
 .../src/test_driver/machine/__init__.py       |  43 +++-
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/nixos-test-driver/efivars.nix     | 110 +++++++++
 .../python-modules/ovmfvartool/default.nix    |  12 +-
 6 files changed, 397 insertions(+), 4 deletions(-)
 create mode 100644 nixos/lib/test-driver/src/test_driver/efi.py
 create mode 100644 nixos/tests/nixos-test-driver/efivars.nix

diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index 77638397d11c..f92e7981c55d 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -11,6 +11,7 @@
   ptpython,
   pydantic,
   python,
+  ovmfvartool,
   remote-pdb,
   ruff,
   ty,
@@ -49,6 +50,7 @@ buildPythonApplication {
     junit-xml
     ptpython
     pydantic
+    ovmfvartool
     remote-pdb
   ]
   ++ extraPythonPackages python.pkgs;
diff --git a/nixos/lib/test-driver/src/test_driver/efi.py b/nixos/lib/test-driver/src/test_driver/efi.py
new file mode 100644
index 000000000000..fb547ded5dd9
--- /dev/null
+++ b/nixos/lib/test-driver/src/test_driver/efi.py
@@ -0,0 +1,233 @@
+import binascii
+import io
+import os.path
+import uuid
+from collections.abc import Generator
+from contextlib import contextmanager
+from pathlib import Path
+from typing import IO, Any, TypeVar
+
+from ovmfvartool import (
+    AuthenticatedVariable,
+    FirmwareVolumeHeader,
+    UEFITime,
+    VariableStoreHeader,
+    resolveUUID,
+)
+
+import test_driver.machine
+from test_driver.errors import RequestedAssertionFailed
+
+EfiVariableT = TypeVar("EfiVariableT", bound="EfiVariable")
+
+# See edk2.git/OvmfPkg/Bhyve/VarStore.fdf.inc
+_NV_FTW_WORKING_OFFSET = 0x41000
+_NV_FTW_WORKING_VALUE = binascii.unhexlify(
+    b"2b29589e687c7d49a0ce6500fd9f1b952caf2c64feffffffe00f000000000000"
+)
+_NV_FTW_SIZE = 0x42000
+_NV_FTW_MAIN_PLUS_SPARE_SIZE = _NV_FTW_SIZE * 2
+
+
+class EfiVariable(AuthenticatedVariable):
+    class Flags:
+        NON_VOLATILE = 0x1
+        BOOTSERVICE_ACCESS = 0x2
+        RUNTIME_ACCESS = 0x4
+        TIME_BASED_AUTHENTICATED_WRITE_ACCESS = 0x20
+
+    class State:
+        VAR_HEADER_VALID_ONLY = 0x7F
+        VAR_ADDED = 0x3F
+
+    volatile = False
+    boot_access = False
+    runtime_access = False
+    hardware_error_record = False
+    authenticated_write_access = False
+    time_based_authenticated_write_access = False
+    append_write = False
+
+    def __init__(
+        self,
+        vendor_uuid: uuid.UUID | None = None,
+        name: str | None = None,
+        data: bytes | None = None,
+        state: int | None = None,
+        flags: int | None = None,
+    ) -> None:
+        self.magic = 0x55AA
+        self.reserved1 = 0
+        self.monotonicCount = 0
+        self.timestamp = UEFITime()
+        self.pubKeyIdx = 0
+        self.state = 0
+        self.flags = 0
+
+        if vendor_uuid is not None:
+            self.vendorUUID = uuid.UUID(bytes=vendor_uuid.bytes_le)
+
+        if state is not None:
+            self.state = state ^ 0xFF
+        else:
+            self.state = (0x40 | 0x80) ^ 0xFF
+
+        if flags is not None:
+            self.flags = flags
+
+        if name is not None:
+            self.name = name
+            self.nameLen = len(name) * 2 + 2
+
+        if data is not None:
+            self.data = data
+            self.dataLen = len(data)
+
+    def _read_flags(self) -> None:
+        if not (self.flags & 0x1):
+            self.volatile = True
+        if self.flags & 0x2:
+            self.boot_access = True
+        if self.flags & 0x4:
+            self.runtime_access = True
+        if self.flags & 0x8:
+            self.hardware_error_record = True
+        if self.flags & 0x10:
+            self.authenticated_write_access = True
+        if self.flags & 0x20:
+            self.time_based_authenticated_write_access = True
+        if self.flags & 0x40:
+            self.append_write = True
+
+        self.flags &= ~(0x1 | 0x2 | 0x4 | 0x8 | 0x10 | 0x20 | 0x40)
+
+    @classmethod
+    def deserialize(cls: type[EfiVariableT], f: Any) -> EfiVariableT | None:
+        # pylint: disable=no-member
+        # false positive https://github.com/PyCQA/pylint/issues/981
+        ret = super().deserialize(f)
+        if ret:
+            ret._read_flags()
+        return ret
+
+    @classmethod
+    def deserializeFromDocument(  # noqa: N802
+        cls: type[EfiVariableT],
+        vendorID: str,  # noqa: N803
+        name: str,
+        doc: dict[str, Any],
+    ) -> EfiVariableT:
+        # pylint: disable=no-member
+        # false positive https://github.com/PyCQA/pylint/issues/981
+        ret = super(cls, cls).deserializeFromDocument(vendorID, name, doc)
+        if ret:
+            ret._read_flags()
+        return ret
+
+
+class EfiVars:
+    """A container around the ovmf variables"""
+
+    state_path: Path
+    machine: "test_driver.machine.QemuMachine"
+
+    def __init__(self, state_path: Path, machine: Any):
+        self.state_path = state_path
+        self.machine = machine
+
+    def _assert_stopped(self) -> None:
+        if self.machine.booted:
+            raise RequestedAssertionFailed(
+                "System is currently running and concurrent reads / writes to the OVMF variables is unsupported"
+            )
+
+    def read_content(self) -> dict[str, dict[str, EfiVariable]] | None:
+        self._assert_stopped()
+        try:
+            with open(self.state_path, "rb") as f:
+                fvh = FirmwareVolumeHeader.deserialize(f)
+                vsh = VariableStoreHeader.deserialize(f)
+                _ = fvh
+                _ = vsh
+                variables: dict[str, dict[str, EfiVariable]] = {}
+
+                while True:
+                    v = EfiVariable.deserialize(f)
+                    if not v:
+                        break
+                    if v.isDeleted:
+                        continue
+
+                    k = resolveUUID(v.vendorUUID)
+                    variables.setdefault(k, {})
+                    variables[k][v.name] = v
+
+                return variables
+
+        except FileNotFoundError:
+            return None
+
+    @contextmanager
+    def _write_store(self, *args, **kwargs) -> Generator[IO[bytes]]:
+        with open(self.state_path, "wb") as fo:
+            fm = io.BytesIO(b"\xff" * _NV_FTW_MAIN_PLUS_SPARE_SIZE)
+            fm.write(FirmwareVolumeHeader.create().serialize())
+            fm.write(VariableStoreHeader.create().serialize())
+
+            try:
+                yield fm
+            finally:
+                fm.seek(_NV_FTW_WORKING_OFFSET)
+                fm.write(_NV_FTW_WORKING_VALUE)
+                fm.seek(0)
+                fo.write(fm.read())
+
+    def create_empty(self) -> None:
+        self._assert_stopped()
+
+        if os.path.exists(self.state_path):
+            raise RequestedAssertionFailed("OVMF variables store exists")
+
+        with self._write_store():
+            pass
+
+    def write(self, add: list[EfiVariable]) -> None:
+        self._assert_stopped()
+
+        variables = self.read_content()
+        if not variables:
+            variables = {}
+
+        for var in add:
+            k = resolveUUID(var.vendorUUID)
+            variables.setdefault(k, {})
+            variables[k][var.name] = var
+
+        with self._write_store() as fm:
+            for _, vendor in variables.items():
+                for _, v in vendor.items():
+                    fm.write(v.serialize())
+                    if fm.tell() % 4:
+                        fm.write(b"\xff" * (4 - (fm.tell() % 4)))
+                    assert (fm.tell() % 4) == 0
+
+
+class EfiGuid:
+    from ovmfvartool import (
+        gEdkiiVarErrorFlagGuid,
+        gEfiAuthenticatedVariableGuid,
+        gEfiCertDbGuid,
+        gEfiCustomModeEnableGuid,
+        gEfiGlobalVariableGuid,
+        gEfiImageSecurityDatabaseGuid,
+        gEfiIp4Config2ProtocolGuid,
+        gEfiIScsiInitiatorNameProtocolGuid,
+        gEfiMemoryTypeInformationGuid,
+        gEfiSecureBootEnableDisableGuid,
+        gEfiSystemNvDataFvGuid,
+        gEfiVendorKeysNvGuid,
+        gIScsiConfigGuid,
+        gMicrosoftVendorGuid,
+        gMtcVendorGuid,
+        mBmHardDriveBootVariableGuid,
+    )
diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
index 790da705cf4f..f2ec18b00a56 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
@@ -22,6 +22,7 @@ from pathlib import Path
 from queue import Queue
 from typing import Any
 
+from test_driver.efi import EfiVariable, EfiVars
 from test_driver.errors import MachineError, RequestedAssertionFailed
 from test_driver.logger import AbstractLogger
 from test_driver.machine.ocr import (
@@ -192,6 +193,7 @@ class QemuStartCommand:
     def build_environment(
         state_dir: Path,
         shared_dir: Path,
+        efi_vars_path: Path | None = None,
     ) -> dict:
         # We make a copy to not update the current environment
         env = dict(os.environ)
@@ -202,6 +204,13 @@ class QemuStartCommand:
                 "USE_TMPDIR": "1",
             }
         )
+        if efi_vars_path is not None:
+            env.update(
+                {
+                    "NIX_EFI_VARS": str(efi_vars_path),
+                }
+            )
+
         return env
 
     def run(
@@ -212,6 +221,7 @@ class QemuStartCommand:
         qmp_socket_path: Path,
         shell_socket_path: Path,
         allow_reboot: bool,
+        efi_vars_path: Path | None = None,
         vsock_guest: Path | None = None,
     ) -> subprocess.Popen:
         return subprocess.Popen(
@@ -227,7 +237,9 @@ class QemuStartCommand:
             stderr=subprocess.STDOUT,
             shell=True,
             cwd=state_dir,
-            env=self.build_environment(state_dir, shared_dir),
+            env=self.build_environment(
+                state_dir, shared_dir, efi_vars_path=efi_vars_path
+            ),
         )
 
 
@@ -750,6 +762,9 @@ class QemuMachine(BaseMachine):
     # Store all console output for full log retrieval
     full_console_log: list[str]
 
+    efi_vars_path: Path
+    efi_vars: EfiVars
+
     def __init__(
         self,
         out_dir: Path,
@@ -791,6 +806,9 @@ class QemuMachine(BaseMachine):
         self.booted = False
         self.connected = False
 
+        self.efi_vars_path = self.state_dir / f"{self.name}-efi-vars.fd"
+        self.efi_vars = EfiVars(self.efi_vars_path, self)
+
     def ssh_backdoor_command(self) -> str:
         assert self.vsock_host is not None
         return f"ssh -o User=root vsock-mux/{self.vsock_host}"
@@ -1247,6 +1265,7 @@ class QemuMachine(BaseMachine):
             self.qmp_path,
             self.shell_path,
             allow_reboot,
+            self.efi_vars_path,
             self.vsock_guest,
         )
 
@@ -1431,6 +1450,28 @@ class QemuMachine(BaseMachine):
         self.connected = False
         self.connect()
 
+    def dump_efi_vars(self) -> None:
+        for var in self.read_efi_vars():
+            var.print()
+
+    def read_efi_vars(self) -> list[EfiVariable]:
+        config = self.efi_vars.read_content()
+        if not config:
+            return []
+
+        out = []
+        for vendor, variables in config.items():
+            for name, v in variables.items():
+                out.append(v)
+
+        return out
+
+    def create_efi_vars(self) -> None:
+        self.efi_vars.create_empty()
+
+    def write_efi_vars(self, add: list[EfiVariable]) -> None:
+        self.efi_vars.write(add)
+
 
 class NspawnMachine(BaseMachine):
     """
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b669f33158ee..51f4cb0f5a2e 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -166,6 +166,7 @@ in
           [[ 143 = $(cat $failed/testBuildFailure.exit) ]]
           touch $out
         '';
+    efivars = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/efivars.nix;
   };
 
   # NixOS vm tests and non-vm unit tests
diff --git a/nixos/tests/nixos-test-driver/efivars.nix b/nixos/tests/nixos-test-driver/efivars.nix
new file mode 100644
index 000000000000..953c69a0257e
--- /dev/null
+++ b/nixos/tests/nixos-test-driver/efivars.nix
@@ -0,0 +1,110 @@
+{ pkgs, lib, ... }:
+let
+  vendorUuid = "a19f72f8-b554-4bd7-a0c2-2762bd854691";
+  varName = "Demo";
+  readWriteVar = pkgs.writers.writePython3 "read-increment-efi-var" { } ''
+    import os
+    import sys
+    import fcntl
+    import array
+
+    if len(sys.argv) != 3:
+        print(f"Usage: {sys.argv[0]} NAME UUID", file=sys.stderr)
+        sys.exit(1)
+
+    name = sys.argv[1]
+    uuid = sys.argv[2]
+    path = f"/sys/firmware/efi/efivars/{name}-{uuid}"
+
+    FS_IMMUTABLE_FL = 0x00000010
+    FS_IOC_GETFLAGS = 0x80086601
+    FS_IOC_SETFLAGS = 0x40086602
+
+    if not os.path.exists(path):
+        print(f"{path}: does not exist", file=sys.stderr)
+        sys.exit(1)
+
+    with open(path, "rb") as f:
+        data = f.read()
+
+    # The first 4 bytes are attributes, the rest is the data
+    if data[4:] != b"\x2a":
+        print(f"0x2a value expected, got {data[4:]!r}", file=sys.stderr)
+        sys.exit(1)
+
+    fd = os.open(path, os.O_RDONLY)
+    arg = array.array("L", [0])
+    fcntl.ioctl(fd, FS_IOC_GETFLAGS, arg)
+    if arg[0] & FS_IMMUTABLE_FL:
+        arg[0] &= ~FS_IMMUTABLE_FL
+        fcntl.ioctl(fd, FS_IOC_SETFLAGS, arg)
+    os.close(fd)
+
+    with open(path, "wb") as f:
+        # Write 0x2b
+        data = bytes(list(data[:4]) + [0x2b])
+        f.write(data)
+  '';
+in
+{
+  name = "efivars";
+
+  nodes.machine = {
+    boot.loader.efi.canTouchEfiVariables = true;
+    virtualisation.useEFIBoot = true;
+  };
+
+  testScript = ''
+    import uuid
+    import unittest
+
+    from test_driver.efi import EfiVariable
+    from test_driver.errors import RequestedAssertionFailed
+
+
+    class TestConcurrentRead(unittest.TestCase):
+        def __init__(self, machine):
+            super().__init__()
+            self.machine = machine
+
+        def test_concurrent_read(self):
+            with self.assertRaises(RequestedAssertionFailed):
+                self.machine.read_efi_vars()
+
+
+    vendor_uuid = uuid.UUID('${vendorUuid}')
+    machine.create_efi_vars()
+    machine.write_efi_vars([
+        EfiVariable(
+            vendor_uuid=vendor_uuid,
+            name="${varName}",
+            data=bytes([0x2a]),
+            flags=EfiVariable.Flags.NON_VOLATILE | EfiVariable.Flags.BOOTSERVICE_ACCESS | EfiVariable.Flags.RUNTIME_ACCESS,
+        )
+    ])
+
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    print(machine.succeed('${readWriteVar} "${varName}" "${vendorUuid}"'))
+
+    TestConcurrentRead(machine).test_concurrent_read()
+    machine.crash()
+
+    machine.dump_efi_vars()
+    vars = machine.read_efi_vars()
+
+    guid = uuid.UUID(bytes=vendor_uuid.bytes_le)
+    predicate = lambda v: v.name == "${varName}" and v.vendorUUID == guid
+    var = next((v for v in vars if predicate(v)), None)
+
+    if var:
+        var.print()
+        if var.data == bytes([0x2b]):
+            print("Congrats!")
+        else:
+            raise ValueError("Value 0x2b expected")
+    else:
+        raise ValueError("Could not find ${varName} variable")
+  '';
+}
diff --git a/pkgs/development/python-modules/ovmfvartool/default.nix b/pkgs/development/python-modules/ovmfvartool/default.nix
index 9dea32157d9b..9518d6703921 100644
--- a/pkgs/development/python-modules/ovmfvartool/default.nix
+++ b/pkgs/development/python-modules/ovmfvartool/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   pyyaml,
+  nixosTests,
 }:
 
 buildPythonPackage {
@@ -11,10 +12,11 @@ buildPythonPackage {
   format = "setuptools";
 
   src = fetchFromGitHub {
-    owner = "hlandau";
+    # https://github.com/hlandau/ovmfvartool/pull/4
+    owner = "baloo";
     repo = "ovmfvartool";
-    rev = "45e6b1e53967ee6590faae454c076febce096931";
-    hash = "sha256-XbvcE/MXNj5S5N7A7jxdwgEE5yMuB82Xg+PYBsFRIm0=";
+    rev = "6a17190131bf44699ea27815543a65efff880142";
+    hash = "sha256-lIneg3kL21oxqjsraogGlOVsgmYnp38CPav1TwBg0p0=";
   };
 
   propagatedBuildInputs = [ pyyaml ];
@@ -24,6 +26,10 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "ovmfvartool" ];
 
+  passthru.tests = {
+    inherit (nixosTests.nixos-test-driver) efivars;
+  };
+
   meta = {
     description = "Parse and generate OVMF_VARS.fd from Yaml";
     mainProgram = "ovmfvartool";

From d08a97a02625f300a3c12da8fc5e5f7579cf38d8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 May 2026 10:06:49 +0000
Subject: [PATCH 0460/1209] systemd: 260.1 -> 260.2

---
 pkgs/os-specific/linux/systemd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a6dd663aef3c..43c90214fcea 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -202,13 +202,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "260.1";
+  version = "260.2";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FUKj3lvjz8TIsyu8NyJYtiNele+1BhdJPdw7r7nW6as=";
+    hash = "sha256-NXmmSV7/9WIW6C8wjdOwaerCy4v7Zcrd8+XDzcS8rEk=";
   };
 
   # PATCH POLICY

From 3dbcb86c1f33d575b16b78d576a16d4d3a2f0608 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Sun, 31 May 2026 11:43:03 +0300
Subject: [PATCH 0461/1209] systemd: drop upstreamed tmpfiles noatime patch

---
 pkgs/os-specific/linux/systemd/default.nix | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 43c90214fcea..15f0fc9f1a79 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,7 +5,6 @@
   pkgsCross,
   testers,
   fetchFromGitHub,
-  fetchpatch,
   buildPackages,
   makeBinaryWrapper,
   ninja,
@@ -238,13 +237,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./0003-add-rootprefix-to-lookup-dir-paths.patch
     ./0004-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
     ./0005-core-don-t-taint-on-unmerged-usr.patch
-
-    # TODO: remove the following patch when systemd v261 is released.
-    # see upstream PR: https://github.com/systemd/systemd/pull/41232
-    (fetchpatch {
-      url = "https://github.com/systemd/systemd/commit/df45055942330fcd2b77389e449905e7f6ca34ec.patch";
-      hash = "sha256-PDh4mP9rYGCglp25346nExU2v6P0WYPfLZgu+YwzZ9c=";
-    })
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch

From af777a46648460e2a5274f0e59ee7893e330c7c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 May 2026 14:51:03 +0000
Subject: [PATCH 0462/1209] nghttp3: 1.15.0 -> 1.16.0

---
 pkgs/by-name/ng/nghttp3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index 720cf47f0dd8..852ebfce6194 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nghttp3";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchurl {
     url = "https://github.com/ngtcp2/nghttp3/releases/download/v${finalAttrs.version}/nghttp3-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-xsSRpSgEgUCY5EZjDm78RZr8DT2nlS/+bL3As/mbK2I=";
+    hash = "sha256-IsBpidVL0mbUpx817vGS1JuJBlWfFqQfO4gssCNhdGM=";
   };
 
   outputs = [

From cb5f99314e980030c6f7367711ee0b87e33605ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 May 2026 14:57:19 +0000
Subject: [PATCH 0463/1209] ngtcp2: 1.22.1 -> 1.23.0

---
 pkgs/development/libraries/ngtcp2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index 12a385c9a946..a7f342c6eaf7 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ngtcp2";
-  version = "1.22.1";
+  version = "1.23.0";
 
   src = fetchurl {
     url = "https://github.com/ngtcp2/ngtcp2/releases/download/v${finalAttrs.version}/ngtcp2-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-hzVHltWssZvzEMt3vgS9IgDDImWmvnyUuGMeJsjpPKQ=";
+    hash = "sha256-3kuZ/8kNm5V0TESg2rYcnyqYSLiBuP3rl0rrXqEIAso=";
   };
 
   outputs = [

From 2483668ba5f034901c9bee6192cb4e014d2fd888 Mon Sep 17 00:00:00 2001
From: winston <hey@winston.sh>
Date: Sun, 31 May 2026 19:24:58 +0200
Subject: [PATCH 0464/1209] fuse2: fix aarch64 patch hash

---
 pkgs/os-specific/linux/fuse/common.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index 130d3e8c846c..935661f5aa00 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optional (!isFuse3 && (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isLoongArch64))
       (fetchpatch {
         url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
-        hash = "sha256-UsLE14P50Ell0xo3PESk5tIHH2HLalsaWiEubO9KdPE=";
+        hash = "sha256-6hqu5npSUN8I7XLZRiCl+b60Sweb1n2ZZz5LroIzkvA=";
       })
     ++ (
       if isFuse3 then

From 8600fca3a438f1c9d3c71bcf331595d461291d1d Mon Sep 17 00:00:00 2001
From: Raphael Borun Das Gupta <jj@raphael.dasgupta.ch>
Date: Sun, 31 May 2026 16:22:26 +0200
Subject: [PATCH 0465/1209] =?UTF-8?q?python3Packages.pytest-rerunfailures:?=
 =?UTF-8?q?=2016.1=20=E2=86=92=2016.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

upstream diff: https://github.com/pytest-dev/pytest-rerunfailures/compare/16.1...16.3

upstream changelog:
 * https://github.com/pytest-dev/pytest-rerunfailures/blob/4b3a2200b07b357cecfe192f4997f35764869c6f/CHANGES.rst#162-2026-05-13
 * https://github.com/pytest-dev/pytest-rerunfailures/blob/4b3a2200b07b357cecfe192f4997f35764869c6f/CHANGES.rst#163-2026-05-22
---
 .../python-modules/pytest-rerunfailures/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index 57bd62628ccd..7f681df0ce46 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "16.1";
+  version = "16.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = "pytest-rerunfailures";
     tag = version;
-    hash = "sha256-EvjgqJQb4Nw7rn/wVLfHoq9iUnJ4vQ1kwSL5fetHv6M=";
+    hash = "sha256-T4l4AoUHvT6GjHyRK2TA3vPTxRicZ5pvgFgDtbkOGMw=";
   };
 
   build-system = [ setuptools ];

From 0da5dbc05c158f9cddcf316e747c6df3ef952f18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:37:03 -0700
Subject: [PATCH 0466/1209] python3Packages.python-multipart: 0.0.29 -> 0.0.30

Diff: https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30

Changelog: https://github.com/Kludex/python-multipart/blob/0.0.30/CHANGELOG.md
---
 pkgs/development/python-modules/python-multipart/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-multipart/default.nix b/pkgs/development/python-modules/python-multipart/default.nix
index ed476d568dd8..f7abce349cc6 100644
--- a/pkgs/development/python-modules/python-multipart/default.nix
+++ b/pkgs/development/python-modules/python-multipart/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-multipart";
-  version = "0.0.29";
+  version = "0.0.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kludex";
     repo = "python-multipart";
     tag = finalAttrs.version;
-    hash = "sha256-1aV7gWLuulINesm3L8Wm3+prmeD9+OY/ihm36rtQPRs=";
+    hash = "sha256-qW/OkOaM+7sN6+mxO5tm6tuDDJ/c703XDNqo6i6YnXo=";
   };
 
   build-system = [ hatchling ];

From c858fde9b4cee4fb2622d649fe03767cf84057dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:39:33 -0700
Subject: [PATCH 0467/1209] python3Packages.python-multipart: remove unused
 patch

---
 .../CVE-2026-40347-part-2.patch               | 106 ------------------
 1 file changed, 106 deletions(-)
 delete mode 100644 pkgs/development/python-modules/python-multipart/CVE-2026-40347-part-2.patch

diff --git a/pkgs/development/python-modules/python-multipart/CVE-2026-40347-part-2.patch b/pkgs/development/python-modules/python-multipart/CVE-2026-40347-part-2.patch
deleted file mode 100644
index ea8e5b2e95f8..000000000000
--- a/pkgs/development/python-modules/python-multipart/CVE-2026-40347-part-2.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-Based on upstream d4452a78bbde94995dd3c0d1b4aff3610a5c472f, adjusted
-to apply to 0.0.22
-
-diff --git a/python_multipart/multipart.py b/python_multipart/multipart.py
-index 0f238c2..d2a597e 100644
---- a/python_multipart/multipart.py
-+++ b/python_multipart/multipart.py
-@@ -1418,12 +1418,8 @@ class MultipartParser(BaseParser):
-                     state = MultipartState.END
- 
-             elif state == MultipartState.END:
--                # Don't do anything if chunk ends with CRLF.
--                if c == CR and i + 1 < length and data[i + 1] == LF:
--                    i += 2
--                    continue
--                # Skip data after the last boundary.
--                self.logger.warning("Skipping data after last boundary")
-+                # Silently discard any epilogue data (RFC 2046 section 5.1.1 allows a CRLF and optional
-+                # epilogue after the closing boundary). Django and Werkzeug do the same.
-                 i = length
-                 break
- 
-diff --git a/tests/test_multipart.py b/tests/test_multipart.py
-index 75982b6..3e8dd89 100644
---- a/tests/test_multipart.py
-+++ b/tests/test_multipart.py
-@@ -1,6 +1,5 @@
- from __future__ import annotations
- 
--import logging
- import os
- import random
- import sys
-@@ -722,6 +721,14 @@ single_byte_tests = [
-     "single_field_single_file",
- ]
- 
-+EPILOGUE_TEST_HEAD = (
-+    "--boundary\r\n"
-+    'Content-Disposition: form-data; name="file"; filename="filename.txt"\r\n'
-+    "Content-Type: text/plain\r\n\r\n"
-+    "hello\r\n"
-+    "--boundary--"
-+).encode("latin-1")
-+
- 
- def split_all(val: bytes) -> Iterator[tuple[bytes, bytes]]:
-     """
-@@ -1266,7 +1273,7 @@ class TestFormParser(unittest.TestCase):
-         self.assert_file_data(files[0], b"hello")
- 
-     def test_multipart_parser_data_after_last_boundary(self) -> None:
--        """This test makes sure that the parser does not handle when there is junk data after the last boundary."""
-+        """Parser must short-circuit on arbitrary epilogue data after the closing boundary (no O(N) scan)."""
-         num = 50_000_000
-         data = (
-             "--boundary\r\n"
-@@ -1284,29 +1291,32 @@ class TestFormParser(unittest.TestCase):
-         f = FormParser("multipart/form-data", on_field=Mock(), on_file=on_file, boundary="boundary")
-         f.write(data.encode("latin-1"))
- 
--    @pytest.fixture(autouse=True)
--    def inject_fixtures(self, caplog: pytest.LogCaptureFixture) -> None:
--        self._caplog = caplog
--
--    def test_multipart_parser_data_end_with_crlf_without_warnings(self) -> None:
--        """This test makes sure that the parser does not handle when the data ends with a CRLF."""
--        data = (
--            "--boundary\r\n"
--            'Content-Disposition: form-data; name="file"; filename="filename.txt"\r\n'
--            "Content-Type: text/plain\r\n\r\n"
--            "hello\r\n"
--            "--boundary--\r\n"
--        )
-+    @parametrize(
-+        "chunks",
-+        [
-+            [EPILOGUE_TEST_HEAD + b"\r\n"],
-+            [EPILOGUE_TEST_HEAD + b"\r", b"\n"],
-+            [EPILOGUE_TEST_HEAD, b"\r\n"],
-+            [EPILOGUE_TEST_HEAD + b"\r\n--boundary\r\nthis is not a valid header\r\n\r\nnot a real part"],
-+        ],
-+    )
-+    def test_multipart_parser_ignores_epilogue(self, chunks: list[bytes]) -> None:
-+        """Epilogue data after the closing boundary must be ignored.
- 
-+        Covers both the single-chunk case and the case where trailing CRLF is split across `write()` calls.
-+        The final case asserts that epilogue bytes are not parsed or validated.
-+        """
-         files: list[File] = []
- 
-         def on_file(f: FileProtocol) -> None:
-             files.append(cast(File, f))
- 
-         f = FormParser("multipart/form-data", on_field=Mock(), on_file=on_file, boundary="boundary")
--        with self._caplog.at_level(logging.WARNING):
--            f.write(data.encode("latin-1"))
--            assert len(self._caplog.records) == 0
-+        for chunk in chunks:
-+            f.write(chunk)
-+
-+        assert len(files) == 1
-+        self.assert_file_data(files[0], b"hello")
- 
-     def test_max_size_multipart(self) -> None:
-         # Load test data.

From 0d240aa0d2224b4913c8686a57e221673aa885a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:39:54 -0700
Subject: [PATCH 0468/1209] python3Packages.python-multipart: add dotlambda to
 maintainers

---
 pkgs/development/python-modules/python-multipart/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/python-multipart/default.nix b/pkgs/development/python-modules/python-multipart/default.nix
index f7abce349cc6..5403a419d768 100644
--- a/pkgs/development/python-modules/python-multipart/default.nix
+++ b/pkgs/development/python-modules/python-multipart/default.nix
@@ -50,6 +50,9 @@ buildPythonPackage (finalAttrs: {
     description = "Streaming multipart parser for Python";
     homepage = "https://github.com/Kludex/python-multipart";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ ris ];
+    maintainers = with lib.maintainers; [
+      dotlambda
+      ris
+    ];
   };
 })

From 225844edfec6332f0ce5bd247ac4c784d365b120 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:51:18 -0700
Subject: [PATCH 0469/1209] gflags: 2.2.2 -> 2.3.0

Diff: https://github.com/gflags/gflags/compare/v2.2.2...v2.3.0

Changelog: https://github.com/gflags/gflags/blob/v2.3.0/ChangeLog.txt
---
 pkgs/by-name/gf/gflags/package.nix | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/gf/gflags/package.nix b/pkgs/by-name/gf/gflags/package.nix
index 665ed686a51c..6fa9a27b5ccb 100644
--- a/pkgs/by-name/gf/gflags/package.nix
+++ b/pkgs/by-name/gf/gflags/package.nix
@@ -2,31 +2,21 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   enableShared ? !stdenv.hostPlatform.isStatic,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gflags";
-  version = "2.2.2";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "gflags";
     repo = "gflags";
-    rev = "v${finalAttrs.version}";
-    sha256 = "147i3md3nxkjlrccqg4mq1kyzc7yrhvqv5902iibc7znkvzdvlp0";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sud3c6XH24YA6vzGQ7LhSoiKycan5JYehC5l2gH6DEo=";
   };
 
-  patches = [
-    # Fix the build with CMake 4.
-    (fetchpatch {
-      name = "gflags-fix-cmake-4.patch";
-      url = "https://github.com/gflags/gflags/commit/70c01a642f08734b7bddc9687884844ca117e080.patch";
-      hash = "sha256-TYdroBbF27Wvvm/rOahBEvhezuKCcxbtgh/ZhpA5ESo=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   # This isn't used by the build and breaks the CMake build on case-insensitive filesystems (e.g., on Darwin)
@@ -48,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
       It was owned by Google. google-gflags project has been renamed to gflags and maintained by new community.
     '';
     homepage = "https://gflags.github.io/gflags/";
+    changelog = "https://github.com/gflags/gflags/blob/${finalAttrs.src.tag}/ChangeLog.txt";
     license = lib.licenses.bsd3;
     maintainers = [ ];
     platforms = lib.platforms.all;

From 6f5cb5357ce5f049e4571c5fe16afbdb3644e971 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:59:26 -0700
Subject: [PATCH 0470/1209] ghostscript: 10.07.0 -> 10.07.1

Changelog: https://ghostscript.readthedocs.io/en/gs10.07.1/News.html
---
 pkgs/by-name/gh/ghostscript/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gh/ghostscript/package.nix b/pkgs/by-name/gh/ghostscript/package.nix
index 36b9ced6f56b..6cd7c4b18ed1 100644
--- a/pkgs/by-name/gh/ghostscript/package.nix
+++ b/pkgs/by-name/gh/ghostscript/package.nix
@@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ghostscript${lib.optionalString x11Support "-with-X"}";
-  version = "10.07.0";
+  version = "10.07.1";
 
   src = fetchurl {
     url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${
       lib.replaceStrings [ "." ] [ "" ] finalAttrs.version
     }/ghostscript-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3azk4XIflnpVA5uv9WSEAiXguqHU9UMiR8oczRRzt8E=";
+    hash = "sha256-HNt2bejbjx5YnIF/CcWFXqX2XfyFQORlpprBTBhBYCU=";
   };
 
   patches = [
@@ -233,6 +233,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.ghostscript.com/";
+    changelog = "https://ghostscript.readthedocs.io/en/gs${finalAttrs.version}/News.html";
     description = "PostScript interpreter (mainline version)";
     longDescription = ''
       Ghostscript is the name of a set of tools that provides (i) an

From 29533d61c20a8014b1a24f002441ade41cad28b8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 31 May 2026 21:03:00 +0100
Subject: [PATCH 0471/1209] sdl3: 3.4.8 -> 3.4.10

Changes: https://github.com/libsdl-org/SDL/releases/tag/release-3.4.10
---
 pkgs/by-name/sd/sdl3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index 19ee7429320d..c874d844d6a8 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -70,7 +70,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.4.8";
+  version = "3.4.10";
 
   outputs = [
     "lib"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-uBGyGxrUVx642Ku8qhR2sTy2JagcSioIhh/5RsXVAIM=";
+    hash = "sha256-6Dph2eLiJUmpQzPWe8EuY5LrWhrFwde2f2dwfgCcWNw=";
   };
 
   postPatch =

From 2ce99deb340dcee8037d514fdbddf5bc3b1606aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 13:04:21 -0700
Subject: [PATCH 0472/1209] giflib: 5.2.2 -> 6.1.3

---
 pkgs/by-name/gi/giflib/CVE-2021-40633.patch | 26 ---------------------
 pkgs/by-name/gi/giflib/CVE-2025-31344.patch | 15 ------------
 pkgs/by-name/gi/giflib/package.nix          |  6 ++---
 3 files changed, 2 insertions(+), 45 deletions(-)
 delete mode 100644 pkgs/by-name/gi/giflib/CVE-2021-40633.patch
 delete mode 100644 pkgs/by-name/gi/giflib/CVE-2025-31344.patch

diff --git a/pkgs/by-name/gi/giflib/CVE-2021-40633.patch b/pkgs/by-name/gi/giflib/CVE-2021-40633.patch
deleted file mode 100644
index 8a665bb1638b..000000000000
--- a/pkgs/by-name/gi/giflib/CVE-2021-40633.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From ccbc956432650734c91acb3fc88837f7b81267ff Mon Sep 17 00:00:00 2001
-From: "Eric S. Raymond" <esr@thyrsus.com>
-Date: Wed, 21 Feb 2024 18:55:00 -0500
-Subject: [PATCH] Clean up memory better at end of run (CVE-2021-40633)
-
----
- gif2rgb.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/gif2rgb.c b/gif2rgb.c
-index d51226d..fc2e683 100644
---- a/gif2rgb.c
-+++ b/gif2rgb.c
-@@ -517,6 +517,9 @@ static void GIF2RGB(int NumFiles, char *FileName, bool OneFileFlag,
- 	DumpScreen2RGB(OutFileName, OneFileFlag, ColorMap, ScreenBuffer,
- 	               GifFile->SWidth, GifFile->SHeight);
- 
-+	for (i = 0; i < GifFile->SHeight; i++) {
-+        	(void)free(ScreenBuffer[i]);
-+	}
- 	(void)free(ScreenBuffer);
- 
- 	{
--- 
-2.44.0
-
diff --git a/pkgs/by-name/gi/giflib/CVE-2025-31344.patch b/pkgs/by-name/gi/giflib/CVE-2025-31344.patch
deleted file mode 100644
index 04ef6c3ba755..000000000000
--- a/pkgs/by-name/gi/giflib/CVE-2025-31344.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff -up giflib-5.2.2/gif2rgb.c.omv~ giflib-5.2.2/gif2rgb.c
---- giflib-5.2.2/gif2rgb.c.omv~	2025-04-07 21:44:54.956355983 +0200
-+++ giflib-5.2.2/gif2rgb.c	2025-04-07 21:45:29.630769589 +0200
-@@ -329,6 +329,11 @@ static void DumpScreen2RGB(char *FileNam
- 			GifRow = ScreenBuffer[i];
- 			GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
- 			for (j = 0; j < ScreenWidth; j++) {
-+				/* Check if color is within color palete */
-+				if (GifRow[j] >= ColorMap->ColorCount) {
-+					GIF_EXIT(GifErrorString(
-+					    D_GIF_ERR_IMAGE_DEFECT));
-+				}
- 				ColorMapEntry = &ColorMap->Colors[GifRow[j]];
- 				Buffers[0][j] = ColorMapEntry->Red;
- 				Buffers[1][j] = ColorMapEntry->Green;
diff --git a/pkgs/by-name/gi/giflib/package.nix b/pkgs/by-name/gi/giflib/package.nix
index 579cbd5a3e3c..6763a9291735 100644
--- a/pkgs/by-name/gi/giflib/package.nix
+++ b/pkgs/by-name/gi/giflib/package.nix
@@ -8,16 +8,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "giflib";
-  version = "5.2.2";
+  version = "6.1.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/giflib/giflib-${finalAttrs.version}.tar.gz";
-    hash = "sha256-vn/70FfK3r4qoURUL9kMaDjGoIO16KkEi47jtmsp1fs=";
+    hash = "sha256-tltmuZ8EJLk1JfmHOG8i/F77naK/ySrUpTIkmq/7qw4=";
   };
 
   patches = [
-    ./CVE-2021-40633.patch
-    ./CVE-2025-31344.patch
   ]
   ++ lib.optionals stdenv.hostPlatform.isMinGW [
     # Build dll libraries.

From 802bd69ec7dee9f84283295128b74ff4e9b0f4ff Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sat, 2 Mar 2024 21:59:30 +0000
Subject: [PATCH 0473/1209] giflib: add some key reverse-dependencies to
 passthru.tests

---
 pkgs/by-name/gi/giflib/package.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/by-name/gi/giflib/package.nix b/pkgs/by-name/gi/giflib/package.nix
index 6763a9291735..b2142aa2869f 100644
--- a/pkgs/by-name/gi/giflib/package.nix
+++ b/pkgs/by-name/gi/giflib/package.nix
@@ -3,6 +3,17 @@
   lib,
   fetchurl,
   fixDarwinDylibNames,
+
+  # for passthru.tests
+  SDL2_image,
+  SDL_image,
+  gdal,
+  imlib2,
+  leptonica,
+  libjxl,
+  libwebp,
+  openimageio,
+  openjdk,
   pkgsStatic,
 }:
 
@@ -52,6 +63,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests = {
     static = pkgsStatic.giflib;
+    inherit
+      SDL2_image
+      SDL_image
+      gdal
+      imlib2
+      leptonica
+      libjxl
+      openimageio
+      openjdk
+      ;
   };
 
   meta = {

From cafb9bdee9ae9e947ba23cfb38aba28f49c18dbc Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 03:21:43 +0300
Subject: [PATCH 0474/1209] stdenv: distinguish stdenvNoCC name from stdenv

The default stdenvNoCC is constructed via stdenv.override and inherited
the parent stdenv's name verbatim. Every bootstrap stage thus produced
two derivations with identical names (one with a C compiler, one
without), which made bootstrap traces and per-stage drv counts
ambiguous.

Appending '-no-cc' makes each stage's stdenv/stdenvNoCC pair uniquely
identifiable in store paths and graph traces.
---
 pkgs/top-level/stage.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 4b0abd0361c6..b63aed1ce8d6 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -55,6 +55,7 @@ in
   # `stdenv` without a C compiler. Passing in this helps avoid infinite
   # recursions, and may eventually replace passing in the full stdenv.
   stdenvNoCC ? stdenv.override {
+    name = "${stdenv.name}-no-cc";
     cc = null;
     hasCC = false;
     # Darwin doesn’t need an SDK in `stdenvNoCC`.  Dropping it shrinks the closure

From bfb5cca84ea45d911a2badd9932ad2f064139e12 Mon Sep 17 00:00:00 2001
From: Hraban <hraban@0brg.net>
Date: Sun, 31 May 2026 17:24:14 -0400
Subject: [PATCH 0475/1209] sbcl: 2.6.4 -> 2.6.5

---
 pkgs/development/compilers/sbcl/default.nix |  2 +-
 pkgs/top-level/all-packages.nix             | 19 +++++++++----------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 36963b65f8d7..73d3cc08df88 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -30,8 +30,8 @@ let
     "2.4.10".sha256 = "sha256-zus5a2nSkT7uBIQcKva+ylw0LOFGTD/j5FPy3hDF4vg=";
     # By unofficial and very loose convention we keep the latest version of
     # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.6.3".sha256 = "sha256-50MvtkKVLdJaX8DFbSGPPQqlls5C0z76gwkbyn1pmIo=";
     "2.6.4".sha256 = "sha256-O6U+ZUtg/rfE9QRmGZ1tUmDyZhxxG6ItS3cLZVQA1Xs=";
+    "2.6.5".sha256 = "sha256-kex19kclLtbmrq6bGhP0fHxs/ZtoSI3Gnxpv6lrMtEA=";
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8d0e11e21108..63838e08073a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7537,15 +7537,6 @@ with pkgs;
     ];
   };
 
-  sbcl_2_6_3 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.6.3"; };
-
-    faslExt = "fasl";
-    flags = [
-      "--dynamic-space-size"
-      "3000"
-    ];
-  };
   sbcl_2_6_4 = wrapLisp {
     pkg = callPackage ../development/compilers/sbcl { version = "2.6.4"; };
     faslExt = "fasl";
@@ -7554,7 +7545,15 @@ with pkgs;
       "3000"
     ];
   };
-  sbcl = sbcl_2_6_4;
+  sbcl_2_6_5 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.6.5"; };
+    faslExt = "fasl";
+    flags = [
+      "--dynamic-space-size"
+      "3000"
+    ];
+  };
+  sbcl = sbcl_2_6_5;
 
   sbclPackages = recurseIntoAttrs sbcl.pkgs;
 

From 3b6cda4e40f81fada80e9cc10e040d59a2826a20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 15:01:48 -0700
Subject: [PATCH 0476/1209] python3Packages.pyjwt: 2.12.1 -> 2.13.0

Diff: https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0

Changelog: https://github.com/jpadilla/pyjwt/blob/2.13.0/CHANGELOG.rst
---
 pkgs/development/python-modules/pyjwt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 1d18045a863c..74754630a145 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.12.1";
+  version = "2.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jpadilla";
     repo = "pyjwt";
     tag = version;
-    hash = "sha256-wgOa5JhQT82ppoad6s8gPH7tGRNbbVWmJaaDF84d+r0=";
+    hash = "sha256-q4ynXCJVDsyZh70439dloyWgRTLVm+elDOahUVOT5vA=";
   };
 
   outputs = [

From c89633874a11ca514342575c7cda8e98fa73de54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 17:33:16 -0700
Subject: [PATCH 0477/1209] gperftools: 2.17.2 -> 2.18.1

Diff: https://github.com/gperftools/gperftools/compare/gperftools-2.17.2...gperftools-2.18.1

Changelog: https://github.com/gperftools/gperftools/releases/tag/gperftools-2.18.0
---
 pkgs/by-name/gp/gperftools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gp/gperftools/package.nix b/pkgs/by-name/gp/gperftools/package.nix
index a5888096c827..693d874cbf7b 100644
--- a/pkgs/by-name/gp/gperftools/package.nix
+++ b/pkgs/by-name/gp/gperftools/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gperftools";
-  version = "2.17.2";
+  version = "2.18.1";
 
   src = fetchFromGitHub {
     owner = "gperftools";
     repo = "gperftools";
     tag = "gperftools-${finalAttrs.version}";
-    hash = "sha256-WCEuiSjNIX/KhEBWndyVhrKlWs7H60mcHoPlWd7YWC4=";
+    hash = "sha256-LvLsq0UuMu51vcgxDrBkdnoUJ3qFH+tbXbTjreBxBqs=";
   };
 
   patches = [

From 07bc3407475405b03836980665277d31bfcb4b75 Mon Sep 17 00:00:00 2001
From: winston <hey@winston.sh>
Date: Mon, 1 Jun 2026 02:49:17 +0200
Subject: [PATCH 0478/1209] sdl3: increase test timeout for testrwlock

---
 pkgs/by-name/sd/sdl3/package.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index 19ee7429320d..c388fb0fe874 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -87,10 +87,17 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   postPatch =
-    # Tests timeout on Darwin
     lib.optionalString (finalAttrs.finalPackage.doCheck) ''
+      # Tests timeout on Darwin
       substituteInPlace test/CMakeLists.txt \
         --replace-fail 'set(noninteractive_timeout 10)' 'set(noninteractive_timeout 30)'
+
+      # intermittent test failure
+      # https://github.com/libsdl-org/SDL/issues/15346
+      substituteInPlace test/CMakeLists.txt \
+        --replace-fail \
+        'add_sdl_test_executable(testrwlock SOURCES testrwlock.c NONINTERACTIVE NONINTERACTIVE_TIMEOUT 20)' \
+        'add_sdl_test_executable(testrwlock SOURCES testrwlock.c NONINTERACTIVE NONINTERACTIVE_TIMEOUT 300)'
     ''
     + lib.optionalString waylandSupport ''
       substituteInPlace src/dialog/unix/SDL_zenitymessagebox.c \

From f382bf21aecb98e26d6c530c3e8db8b44c9fdedb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 17:53:47 -0700
Subject: [PATCH 0479/1209] graphviz: 12.2.1 -> 14.1.2

Diff: https://gitlab.com/graphviz/graphviz/-/compare/12.2.1...14.1.2

Changelog: https://gitlab.com/graphviz/graphviz/-/blob/14.1.2/CHANGELOG.md
---
 pkgs/by-name/gr/graphviz/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gr/graphviz/package.nix b/pkgs/by-name/gr/graphviz/package.nix
index 1172173dd326..f5686e0274d3 100644
--- a/pkgs/by-name/gr/graphviz/package.nix
+++ b/pkgs/by-name/gr/graphviz/package.nix
@@ -39,13 +39,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphviz";
-  version = "12.2.1";
+  version = "14.1.2";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
-    rev = finalAttrs.version;
-    hash = "sha256-Uxqg/7+LpSGX4lGH12uRBxukVw0IswFPfpb2EkLsaiI=";
+    tag = finalAttrs.version;
+    hash = "sha256-LkyiKl0ulS9ujEdVLfyeoc4CtjITd6CAc35IUtlHSfw=";
   };
 
   nativeBuildInputs = [
@@ -136,6 +136,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://graphviz.org";
+    changelog = "https://gitlab.com/graphviz/graphviz/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Graph visualization tools";
     license = lib.licenses.epl10;
     platforms = lib.platforms.unix;

From 0613f17f02ece886172619d25c4449a7d90a1c44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 18:43:14 -0700
Subject: [PATCH 0480/1209] python3Packages.pygraphviz: 1.14 ->
 1.14-unstable-2026-05-07

Diff: https://github.com/pygraphviz/pygraphviz/compare/pygraphviz-1.14...6b9efcd1a76a97836de79d1380c0d003c6f834e7
---
 .../python-modules/pygraphviz/default.nix     | 30 +++++++++++++++----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pygraphviz/default.nix b/pkgs/development/python-modules/pygraphviz/default.nix
index f8a7d37977dd..526fd967b103 100644
--- a/pkgs/development/python-modules/pygraphviz/default.nix
+++ b/pkgs/development/python-modules/pygraphviz/default.nix
@@ -2,24 +2,26 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   replaceVars,
   graphviz,
   coreutils,
   pkg-config,
   setuptools,
+  swig,
   pytest,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "pygraphviz";
-  version = "1.14";
+  version = "1.14-unstable-2026-05-07";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pygraphviz";
     repo = "pygraphviz";
-    tag = "pygraphviz-${version}";
-    hash = "sha256-RyUmT2djj2GnVG82xO9HULMAJZb2LYMUGDRvCwaYBg8=";
+    rev = "6b9efcd1a76a97836de79d1380c0d003c6f834e7";
+    hash = "sha256-ghtnwOevSnecshMBoASCZircgOsPF7+l+Cer+J+yEqM=";
   };
 
   patches = [
@@ -32,9 +34,27 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail ', "swig>4.1.0"' ""
+
+    # https://github.com/pygraphviz/pygraphviz/pull/573
+    substituteInPlace pygraphviz/graphviz.i \
+      --replace-fail '%cstring_output_allocate_size(char **result, unsigned int* size, free(*$1));' \
+                     '%cstring_output_allocate_size(char **result, size_t* size, free(*$1));' \
+      --replace-fail 'int gvRenderData(GVC_t *gvc, Agraph_t* g, char *format, char **result, unsigned int *size);' \
+                     'int gvRenderData(GVC_t *gvc, Agraph_t* g, char *format, char **result, size_t *size);'
+  '';
+
+  env.GRAPHVIZ_PREFIX = graphviz;
+
+  build-system = [
+    setuptools
+  ];
+
   nativeBuildInputs = [
     pkg-config
-    setuptools
+    swig
   ];
 
   buildInputs = [ graphviz ];

From 5a9c85ccce989df44b76d84d057c89d235aa6fc5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 20:08:52 -0700
Subject: [PATCH 0481/1209] gtk-doc: 1.35.1 -> 1.36.1

Diff: https://gitlab.gnome.org/GNOME/gtk-doc/-/compare/1.35.1...1.36.1

Changelog: https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/1.36.1/NEWS
---
 pkgs/by-name/gt/gtk-doc/package.nix                 | 13 ++++---------
 .../gt/gtk-doc/respect-xml-catalog-files-var.patch  | 13 -------------
 2 files changed, 4 insertions(+), 22 deletions(-)
 delete mode 100644 pkgs/by-name/gt/gtk-doc/respect-xml-catalog-files-var.patch

diff --git a/pkgs/by-name/gt/gtk-doc/package.nix b/pkgs/by-name/gt/gtk-doc/package.nix
index a2db2fee4788..9f58e9fb8f75 100644
--- a/pkgs/by-name/gt/gtk-doc/package.nix
+++ b/pkgs/by-name/gt/gtk-doc/package.nix
@@ -16,7 +16,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gtk-doc";
-  version = "1.35.1";
+  version = "1.36.1";
 
   outputDevdoc = "out";
 
@@ -26,14 +26,10 @@ python3.pkgs.buildPythonApplication rec {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gtk-doc";
-    rev = version;
-    hash = "sha256-EqU7lnBnOn3gR3hT95yjdTUb3cqX2XJK5UAKsFw2Q10=";
+    tag = version;
+    hash = "sha256-8hB43BCAtT1B7/ak2i0FAlYD3Kb4rNCWfsJ+wqGu3FA=";
   };
 
-  patches = [
-    passthru.respect_xml_catalog_files_var_patch
-  ];
-
   postPatch = ''
     substituteInPlace meson.build \
       --replace "pkg-config" "$PKG_CONFIG"
@@ -83,8 +79,6 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   passthru = {
-    # Consumers are expected to copy the m4 files to their source tree, let them reuse the patch
-    respect_xml_catalog_files_var_patch = ./respect-xml-catalog-files-var.patch;
     updateScript = gnome.updateScript {
       packageName = "gtk-doc";
       versionPolicy = "none";
@@ -92,6 +86,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   meta = {
+    changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${src.tag}/NEWS";
     description = "Tools to extract documentation embedded in GTK and GNOME source code";
     homepage = "https://gitlab.gnome.org/GNOME/gtk-doc";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/gt/gtk-doc/respect-xml-catalog-files-var.patch b/pkgs/by-name/gt/gtk-doc/respect-xml-catalog-files-var.patch
deleted file mode 100644
index 95f6879a0069..000000000000
--- a/pkgs/by-name/gt/gtk-doc/respect-xml-catalog-files-var.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/m4/gtkdoc_jh_check_xml_catalog.m4
-+++ b/m4/gtkdoc_jh_check_xml_catalog.m4
-@@ -5,8 +5,8 @@
- [
- 	AC_REQUIRE([JH_PATH_XML_CATALOG],[JH_PATH_XML_CATALOG(,[:])])dnl
- 	AC_MSG_CHECKING([for ifelse([$2],,[$1],[$2]) in XML catalog])
--	if $jh_found_xmlcatalog && \
--		AC_RUN_LOG([$XMLCATALOG --noout "$XML_CATALOG_FILE" "$1" >&2]); then
-+	# empty argument forces libxml to use XML_CATALOG_FILES variable
-+	if AC_RUN_LOG([$XMLCATALOG --noout "" "$1" >&2]); then
- 		AC_MSG_RESULT([found])
- 		ifelse([$3],,,[$3])
- 	else

From 10eb89c9785fa59847fbcadea0152e53c5512b8b Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Fri, 29 May 2026 01:22:29 +1000
Subject: [PATCH 0482/1209] gnat13: fix patch evaluation

The patch only applies on top of the iains gcc patchset, as it modifies
the abi added by that patchset.
---
 pkgs/development/compilers/gcc/patches/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 048cfee9ffde..cc0b5b47e9b4 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -187,7 +187,9 @@ optionals noSysDirs (
   .${majorVersion} or [ ]
 )
 
-++ optional (langAda && is13) ./13/gnat13-aarch64-darwin-trampoline.patch
+++ optional (
+  langAda && is13 && canApplyIainsDarwinPatches
+) ./13/gnat13-aarch64-darwin-trampoline.patch
 
 ++ optional (targetPlatform.isWindows || targetPlatform.isCygwin) (fetchpatch {
   name = "libstdc-fix-compilation-in-freestanding-win32.patch";

From e1e3ccda5d37e1796efbfbe2ca1b7e2887e17ab1 Mon Sep 17 00:00:00 2001
From: Yuxuan Shui <yshuiv7@gmail.com>
Date: Mon, 27 Apr 2026 12:22:29 +0100
Subject: [PATCH 0483/1209] ldacbt: use Sony AOSP source

Also build all functionalities into a single shared library: encoder,
decoder, and ABR.
---
 ...-support-for-dynamic-loading-libldac.patch | 164 ++++++++++++++++++
 pkgs/by-name/ld/ldacbt/package.nix            | 116 ++++++++++---
 2 files changed, 255 insertions(+), 25 deletions(-)
 create mode 100644 pkgs/by-name/ld/ldacbt/0001-abr-drop-support-for-dynamic-loading-libldac.patch

diff --git a/pkgs/by-name/ld/ldacbt/0001-abr-drop-support-for-dynamic-loading-libldac.patch b/pkgs/by-name/ld/ldacbt/0001-abr-drop-support-for-dynamic-loading-libldac.patch
new file mode 100644
index 000000000000..e054d75fd395
--- /dev/null
+++ b/pkgs/by-name/ld/ldacbt/0001-abr-drop-support-for-dynamic-loading-libldac.patch
@@ -0,0 +1,164 @@
+From 040210591a5e90fc3e0ca0ec438426273e86c497 Mon Sep 17 00:00:00 2001
+From: "yshuiv7@gmail.com" <Yuxuan Shui>
+Date: Mon, 27 Apr 2026 15:30:10 +0100
+Subject: [PATCH] abr: drop support for dynamic loading libldac
+
+---
+ abr/inc/ldacBT_abr.h |  2 +-
+ abr/src/ldacBT_abr.c | 76 +-------------------------------------------
+ 2 files changed, 2 insertions(+), 76 deletions(-)
+
+diff --git a/abr/inc/ldacBT_abr.h b/abr/inc/ldacBT_abr.h
+index 294e230..735ea67 100644
+--- a/abr/inc/ldacBT_abr.h
++++ b/abr/inc/ldacBT_abr.h
+@@ -89,7 +89,7 @@ typedef struct _ldacbt_abr_param * HANDLE_LDAC_ABR;
+  *  Return value
+  *      HANDLE_LDAC_ABR for success, NULL for failure.
+  */
+-LDAC_ABR_API HANDLE_LDAC_ABR ldac_ABR_get_handle(const char *libpath);
++LDAC_ABR_API HANDLE_LDAC_ABR ldac_ABR_get_handle(void);
+ 
+ /* Release of LDAC ABR handle.
+  *  Format
+diff --git a/abr/src/ldacBT_abr.c b/abr/src/ldacBT_abr.c
+index 0af6278..fad2dd0 100644
+--- a/abr/src/ldacBT_abr.c
++++ b/abr/src/ldacBT_abr.c
+@@ -8,10 +8,6 @@
+ 
+ #include <stdlib.h>
+ #include <string.h>
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-#include <dlfcn.h>
+-#include <errno.h>
+-#endif
+ 
+ #define LDAC_ABR_OBSERVING_TIME_MS 500   /* [ms] the time length for storing Tx Queue Depth */
+ #define LDAC_ABR_PENALTY_MAX 4
+@@ -56,18 +52,11 @@ typedef int (*tLDACBT_GET_ERR)(HANDLE_LDAC_BT hLdacBt);
+ 
+ typedef struct _ldacbt_api_param
+ {
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-    const char *lib_name;
+-    void *lib_handle;
+-#endif
+     tLDACBT_ALTER_EQMID_PRIORITY alter_eqmid_priority;
+     tLDACBT_GET_EQMID            get_eqmid;
+     tLDACBT_GET_ERR              get_error_code;
+ } LDACBT_API_PARAMS, * HANDLE_LDACBT_API;
+ 
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-static int open_lib(HANDLE_LDACBT_API hLdacBtApi, const char *lib_name );
+-#endif
+ 
+ static int load_ldacbt_api_functions(HANDLE_LDACBT_API hLdacBtApi);
+ 
+@@ -122,7 +111,7 @@ static const int sizeOfEqmidToBitrateSortedIdTable = (int)(sizeof(aEqmidToAbrQua
+                                                      / sizeof(aEqmidToAbrQualityModeID[0]));
+ 
+ /* Get LDAC ABR handle */
+-HANDLE_LDAC_ABR ldac_ABR_get_handle(const char *libpath)
++HANDLE_LDAC_ABR ldac_ABR_get_handle(void)
+ {
+     HANDLE_LDAC_ABR hLdacAbr;
+     ABRDBG( "" );
+@@ -131,15 +120,6 @@ HANDLE_LDAC_ABR ldac_ABR_get_handle(const char *libpath)
+         return NULL;
+     }
+     clear_data( hLdacAbr, sizeof(LDAC_ABR_PARAMS) );
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-    if (libpath != NULL) {
+-        if (open_lib( &hLdacAbr->ldacBtApi, libpath ) < 0) {
+-            ABRDBG( "[ERR] Failed to open shared library \"%s\".", libpath );
+-            ldac_ABR_free_handle(hLdacAbr);
+-            return NULL;
+-        }
+-    }
+-#endif
+     if( load_ldacbt_api_functions(&hLdacAbr->ldacBtApi) != 0 ){
+         ldac_ABR_free_handle(hLdacAbr);
+         return NULL;
+@@ -156,12 +136,6 @@ void ldac_ABR_free_handle(HANDLE_LDAC_ABR hLdacAbr)
+         if (hLdacAbr->TxQD_Info.pHist){
+             free(hLdacAbr->TxQD_Info.pHist);
+         }
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-        if (hLdacAbr->ldacBtApi.lib_handle != NULL) {
+-            dlclose(hLdacAbr->ldacBtApi.lib_handle);
+-            hLdacAbr->ldacBtApi.lib_handle = NULL;
+-        }
+-#endif
+         free(hLdacAbr);
+     }
+ }
+@@ -408,65 +382,17 @@ int ldac_ABR_Proc( HANDLE_LDAC_BT hLDAC, HANDLE_LDAC_ABR hLdacAbr,
+ }
+ 
+ 
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-static void *load_func(void *lib_handle, const char* func_name)
+-{
+-    void *func_ptr = dlsym(lib_handle, func_name);
+-    if(func_ptr == NULL){
+-        ABRDBG("[ERR] cannot find function '%s' in the library.\n", func_name);
+-        return NULL;
+-    }
+-    return func_ptr;
+-}
+-
+-static int open_lib(HANDLE_LDACBT_API hLdacBtApi, const char *lib_name )
+-{
+-    if( hLdacBtApi == NULL ){
+-        ABRDBG("[ERR] handle is NULL");
+-        return -1;
+-    }
+-    if( lib_name == NULL ){
+-        ABRDBG("[ERR] lib_name is NULL");
+-        return -1;
+-    }
+-    // open library
+-    hLdacBtApi->lib_handle = dlopen(lib_name, RTLD_NOW);
+-    if(hLdacBtApi->lib_handle == NULL){
+-#ifdef LOCAL_DEBUG
+-        char buffer_str[1024];
+-        strerror_r(errno, buffer_str, sizeof(buffer_str));
+-        ABRDBG("[ERR] cannot open library '%s': errno = %d (%s)\n",
+-                lib_name, errno, buffer_str);
+-#endif
+-        return -1;
+-    }
+-    return 0;
+-}
+-#endif /* LDAC_ABR_DYNAMIC_LINK_LDAC_API */
+-
+ // Load functions
+ static int load_ldacbt_api_functions(HANDLE_LDACBT_API hLdacBtApi)
+ {
+     hLdacBtApi->alter_eqmid_priority =
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-      load_func(hLdacBtApi->lib_handle, "ldacBT_alter_eqmid_priority");
+-#else
+       ldacBT_alter_eqmid_priority;
+-#endif
+ 
+     hLdacBtApi->get_eqmid =
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-      load_func(hLdacBtApi->lib_handle, "ldacBT_get_eqmid");
+-#else
+       ldacBT_get_eqmid;
+-#endif
+ 
+     hLdacBtApi->get_error_code =
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-      load_func(hLdacBtApi->lib_handle, "ldacBT_get_error_code");
+-#else
+       ldacBT_get_error_code;
+-#endif
+ 
+     if( (hLdacBtApi->alter_eqmid_priority == NULL) ||
+         (hLdacBtApi->get_eqmid == NULL) ||
+-- 
+2.53.0
+
diff --git a/pkgs/by-name/ld/ldacbt/package.nix b/pkgs/by-name/ld/ldacbt/package.nix
index 72320637739d..de766de0d615 100644
--- a/pkgs/by-name/ld/ldacbt/package.nix
+++ b/pkgs/by-name/ld/ldacbt/package.nix
@@ -2,19 +2,17 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ldacBT";
-  version = "2.0.2.3";
+  version = "2.0.72";
 
   src = fetchFromGitHub {
-    repo = "ldacBT";
-    owner = "ehfive";
-    tag = "v${finalAttrs.version}";
-    sha256 = "09dalysx4fgrgpfdm9a51x6slnf4iik1sqba4xjgabpvq91bnb63";
-    fetchSubmodules = true;
+    owner = "open-vela";
+    repo = "external_libldac";
+    rev = "5b4bf66096ba0d69615efb2422ba3d023c34c2fd";
+    hash = "sha256-5jeqTyhSBtYky15Xw1lIbUxeGZMQQQdM/EQUFicyi3Y=";
   };
 
   outputs = [
@@ -22,31 +20,99 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  nativeBuildInputs = [
-    cmake
+  patches = [
+    ./0001-abr-drop-support-for-dynamic-loading-libldac.patch
   ];
 
-  cmakeFlags = [
-    # CMakeLists.txt by default points to $out
-    "-DINSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-O2 -fPIC -fno-merge-constants -Wall -Iinc -Isrc -Iabr/inc";
 
-  # Fix the build with CMake 4.
-  #
-  # See: <https://github.com/EHfive/ldacBT/pull/1>
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail \
-        'cmake_minimum_required(VERSION 3.0)' \
-        'cmake_minimum_required(VERSION 3.0...3.10)'
+  # Verify finalAttrs.version matches LDACBT_LIB_VER_* in upstream source.
+  # Guards against silent version drift when the pinned commit changes.
+  preBuild = ''
+    awk -v want=${finalAttrs.version} '
+      /^#define LDACBT_LIB_VER_/ { v = v sep ($3+0); sep = "." }
+      END {
+        if (v != want) { print "version mismatch: package says " want ", source reports " v > "/dev/stderr"; exit 1 }
+      }
+    ' src/ldacBT_api.c
+  '';
+
+  # Upstream ships AOSP build files and a gcc/ makefile that only knows
+  # about the in-tree layout. Compile and link directly; the entire
+  # library is two umbrella translation units.
+  buildPhase = ''
+    runHook preBuild
+
+    soname=libldacBT.so.${lib.versions.major finalAttrs.version}
+    sofile=libldacBT.so.${finalAttrs.version}
+
+    $CC -shared -Wl,-soname,$soname src/ldaclib.c src/ldacBT.c abr/src/ldacBT_abr.c -lm -o $sofile
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 -t $out/lib $sofile
+    ln -s $sofile $out/lib/$soname
+    ln -s $sofile $out/lib/libldacBT.so
+
+    install -Dm644 inc/ldacBT.h $dev/include/ldac/ldacBT.h
+    install -Dm644 abr/inc/ldacBT_abr.h $dev/include/ldac/ldacBT_abr.h
+
+    mkdir -p $dev/lib/pkgconfig
+    cat > $dev/lib/pkgconfig/ldacBT-dec.pc <<EOF
+    prefix=$out
+    exec_prefix=\''${prefix}
+    libdir=$out/lib
+    includedir=$dev/include/ldac
+
+    Name: ldacBT-dec
+    Description: LDAC Bluetooth decoder
+    Version: ${finalAttrs.version}
+    Libs: -L\''${libdir} -lldacBT
+    Libs.private: -lm
+    Cflags: -I\''${includedir}
+    EOF
+
+    cat > $dev/lib/pkgconfig/ldacBT-enc.pc <<EOF
+    prefix=$out
+    exec_prefix=\''${prefix}
+    libdir=$out/lib
+    includedir=$dev/include/ldac
+
+    Name: ldacBT-enc
+    Description: LDAC Bluetooth encoder
+    Version: ${finalAttrs.version}
+    Libs: -L\''${libdir} -lldacBT
+    Libs.private: -lm
+    Cflags: -I\''${includedir}
+    EOF
+
+    cat > $dev/lib/pkgconfig/ldacBT-abr.pc <<EOF
+    prefix=$out
+    exec_prefix=\''${prefix}
+    libdir=$out/lib
+    includedir=$dev/include/ldac
+
+    Name: ldacBT-abr
+    Description: LDAC Bluetooth ABR library
+    Version: ${finalAttrs.version}
+    Libs: -L\''${libdir} -lldacBT
+    Libs.private: -lm
+    Cflags: -I\''${includedir}
+    EOF
+
+    runHook postInstall
   '';
 
   meta = {
-    description = "AOSP libldac dispatcher";
-    homepage = "https://github.com/EHfive/ldacBT";
+    description = "Sony LDAC Bluetooth decoder library (from AOSP via open-vela)";
+    homepage = "https://github.com/open-vela/external_libldac";
     license = lib.licenses.asl20;
-    # libldac code detects & #error's out on non-LE byte order
+    # LDAC bitstream format assumes LE; source has endian checks
     platforms = lib.platforms.littleEndian;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ qweered ];
   };
 })

From 39cb5677cf18e5b73918647973fe8685600d4181 Mon Sep 17 00:00:00 2001
From: Yuxuan Shui <yshuiv7@gmail.com>
Date: Mon, 27 Apr 2026 12:41:51 +0100
Subject: [PATCH 0484/1209] pipewire: drop libldac-dec from buildInputs

The now unified ldacbt has decoding support as well.

Fixes #511056
---
 pkgs/by-name/pi/pipewire/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index 3929f392ee6a..7f5ff1315146 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -52,7 +52,6 @@
   fdk_aac,
   libopus,
   ldacbt,
-  libldac-dec,
   spandsp,
   modemmanager,
   libpulseaudio,
@@ -176,7 +175,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional webrtcAudioProcessingSupport webrtc-audio-processing
   ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
   ++ lib.optional ldacbtSupport ldacbt
-  ++ lib.optional (ldacBtDecodeSupport && ldacbtSupport) libldac-dec
   ++ lib.optional libcameraSupport libcamera
   ++ lib.optional zeroconfSupport avahi
   ++ lib.optional raopSupport openssl

From 8d765834f4a0ec6e74938f52306ff24fc61fa951 Mon Sep 17 00:00:00 2001
From: Yuxuan Shui <yshuiv7@gmail.com>
Date: Mon, 27 Apr 2026 16:07:13 +0100
Subject: [PATCH 0485/1209] libldac-dec: drop

---
 pkgs/by-name/li/libldac-dec/package.nix | 85 -------------------------
 1 file changed, 85 deletions(-)
 delete mode 100644 pkgs/by-name/li/libldac-dec/package.nix

diff --git a/pkgs/by-name/li/libldac-dec/package.nix b/pkgs/by-name/li/libldac-dec/package.nix
deleted file mode 100644
index 89fa401ea258..000000000000
--- a/pkgs/by-name/li/libldac-dec/package.nix
+++ /dev/null
@@ -1,85 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libldac-dec";
-  version = "2.0.72";
-
-  src = fetchFromGitHub {
-    owner = "open-vela";
-    repo = "external_libldac";
-    rev = "5b4bf66096ba0d69615efb2422ba3d023c34c2fd";
-    hash = "sha256-5jeqTyhSBtYky15Xw1lIbUxeGZMQQQdM/EQUFicyi3Y=";
-  };
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  env.NIX_CFLAGS_COMPILE = "-O2 -fPIC -Wall -D_DECODE_ONLY -Iinc -Isrc";
-
-  # Verify finalAttrs.version matches LDACBT_LIB_VER_* in upstream source.
-  # Guards against silent version drift when the pinned commit changes.
-  preBuild = ''
-    awk -v want=${finalAttrs.version} '
-      /^#define LDACBT_LIB_VER_/ { v = v sep ($3+0); sep = "." }
-      END {
-        if (v != want) { print "version mismatch: package says " want ", source reports " v > "/dev/stderr"; exit 1 }
-      }
-    ' src/ldacBT_api.c
-  '';
-
-  # Upstream ships AOSP build files and a gcc/ makefile that only knows
-  # about the in-tree layout. Compile and link directly; the entire
-  # library is two umbrella translation units.
-  buildPhase = ''
-    runHook preBuild
-
-    soname=libldacBT_dec.so.${lib.versions.major finalAttrs.version}
-    sofile=libldacBT_dec.so.${finalAttrs.version}
-
-    $CC -shared -Wl,-soname,$soname src/ldaclib.c src/ldacBT.c -lm -o $sofile
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 -t $out/lib $sofile
-    ln -s $sofile $out/lib/$soname
-    ln -s $sofile $out/lib/libldacBT_dec.so
-
-    install -Dm644 inc/ldacBT.h $dev/include/ldac/ldacBT.h
-
-    mkdir -p $dev/lib/pkgconfig
-    cat > $dev/lib/pkgconfig/ldacBT-dec.pc <<EOF
-    prefix=$out
-    exec_prefix=\''${prefix}
-    libdir=$out/lib
-    includedir=$dev/include/ldac
-
-    Name: ldacBT-dec
-    Description: LDAC Bluetooth decoder
-    Version: ${finalAttrs.version}
-    Libs: -L\''${libdir} -lldacBT_dec
-    Libs.private: -lm
-    Cflags: -I\''${includedir}
-    EOF
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Sony LDAC Bluetooth decoder library (from AOSP via open-vela)";
-    homepage = "https://github.com/open-vela/external_libldac";
-    license = lib.licenses.asl20;
-    # LDAC bitstream format assumes LE; source has endian checks
-    platforms = lib.platforms.littleEndian;
-    maintainers = with lib.maintainers; [ qweered ];
-  };
-})

From 67b7303494c3e9d2e34f81adbb2eaefc3300adfb Mon Sep 17 00:00:00 2001
From: Yuxuan Shui <yshuiv7@gmail.com>
Date: Mon, 1 Jun 2026 08:19:33 +0100
Subject: [PATCH 0486/1209] pipewire: remove the ldacBtDecodeSupport option

Always enable it if ldac is available.
---
 pkgs/by-name/pi/pipewire/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index 7f5ff1315146..cd01b173b031 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -73,7 +73,6 @@
     x11Support
     && lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform
     && lib.meta.availableOn stdenv.hostPlatform ffado,
-  ldacBtDecodeSupport ? false,
   ffado,
   libselinux,
   libebur128,
@@ -243,7 +242,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "bluez5-codec-lc3plus" false)
     (lib.mesonEnable "bluez5-codec-lc3" bluezSupport)
     (lib.mesonEnable "bluez5-codec-ldac" (bluezSupport && ldacbtSupport))
-    (lib.mesonEnable "bluez5-codec-ldac-dec" (bluezSupport && ldacbtSupport && ldacBtDecodeSupport))
+    (lib.mesonEnable "bluez5-codec-ldac-dec" (bluezSupport && ldacbtSupport))
     (lib.mesonEnable "opus" true)
     (lib.mesonOption "sysconfdir" "/etc")
     (lib.mesonEnable "raop" raopSupport)

From b68c3b9b4d57cb70a18433316f8887fecc315d91 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 07:56:09 -0700
Subject: [PATCH 0487/1209] ibus: 1.5.33 -> 1.5.34

Diff: https://github.com/ibus/ibus/compare/1.5.33...1.5.34

Changelog: https://github.com/ibus/ibus/releases/tag/1.5.34
---
 pkgs/tools/inputmethods/ibus/default.nix            |  6 ++----
 pkgs/tools/inputmethods/ibus/vala-parallelism.patch | 13 -------------
 2 files changed, 2 insertions(+), 17 deletions(-)
 delete mode 100644 pkgs/tools/inputmethods/ibus/vala-parallelism.patch

diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index 8e8502ff557a..b164f6ead3a7 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -67,13 +67,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ibus";
-  version = "1.5.33";
+  version = "1.5.34";
 
   src = fetchFromGitHub {
     owner = "ibus";
     repo = "ibus";
     tag = finalAttrs.version;
-    hash = "sha256-cpNZI6KbL9zUJHw1szpWl4lOEAvlBdd+FA6xGh1sYYY=";
+    hash = "sha256-MCxzMnG+g2FC4pZtDOP2c7vSRG5Zk6EfrkGnEyFvBfQ=";
   };
 
   patches = [
@@ -88,8 +88,6 @@ stdenv.mkDerivation (finalAttrs: {
       PYTHON = null;
     })
     ./build-without-dbus-launch.patch
-    # https://github.com/NixOS/nixpkgs/issues/230290
-    ./vala-parallelism.patch
   ];
 
   outputs = [
diff --git a/pkgs/tools/inputmethods/ibus/vala-parallelism.patch b/pkgs/tools/inputmethods/ibus/vala-parallelism.patch
deleted file mode 100644
index f4c47a76c39c..000000000000
--- a/pkgs/tools/inputmethods/ibus/vala-parallelism.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/ui/gtk3/Makefile.am b/ui/gtk3/Makefile.am
-index 3ada6501..2066a8f5 100644
---- a/ui/gtk3/Makefile.am
-+++ b/ui/gtk3/Makefile.am
-@@ -304,6 +304,8 @@ panelbinding.o: $(srcdir)/panelbinding.c
- 	$(AM_V_CC_no)$(COMPILE) -c -o $@ $<
- 	$(NULL)
- 
-+.NOTPARALLEL:
-+
- MAINTAINERCLEANFILES += extension.c panelbinding.c
- 
- man_seven_DATA = ibus-emoji.7

From 17cca6ef4b16679ac17fdf407ccf4ba730cb1621 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 11:00:21 -0700
Subject: [PATCH 0488/1209] python3Packages.ipython: 9.9.0 -> 9.14.0

Changelog: https://github.com/ipython/ipython/blob/9.14.0/docs/source/whatsnew/version9.rst
---
 .../python-modules/ipython/default.nix         | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 556b9a91e21f..9d9e1d227c5b 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
-  pythonAtLeast,
   pythonOlder,
 
   # Build dependencies
@@ -16,6 +15,7 @@
   matplotlib-inline,
   pexpect,
   prompt-toolkit,
+  psutil,
   pygments,
   stack-data,
   traitlets,
@@ -36,7 +36,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ipython";
-  version = "9.9.0";
+  version = "9.14.0";
   outputs = [
     "out"
     "man"
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-SPvtGy3l4scXfu+hRKun/LgtrFFPCbV+KsnaNN21QiA=";
+    hash = "sha256-byf/Dx2eoFDgVR9xVovEs02KuleejxEcW0F19ErGtKo=";
   };
 
   build-system = [ setuptools ];
@@ -57,6 +57,7 @@ buildPythonPackage (finalAttrs: {
     matplotlib-inline
     pexpect
     prompt-toolkit
+    psutil
     pygments
     stack-data
     traitlets
@@ -84,16 +85,7 @@ buildPythonPackage (finalAttrs: {
     testpath
   ];
 
-  disabledTests = [
-    # UnboundLocalError: local variable 'child' referenced before assignment
-    "test_system_interrupt"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.13") [
-    # AttributeError: 'Pdb' object has no attribute 'curframe'. Did you mean: 'botframe'?
-    "test_run_debug_twice"
-    "test_run_debug_twice_with_breakpoint"
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+  disabledTests = lib.optionals (stdenv.hostPlatform.isDarwin) [
     # FileNotFoundError: [Errno 2] No such file or directory: 'pbpaste'
     "test_clipboard_get"
   ];

From 5a913250424c829e00c300968eefb71f5865d852 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 11:38:44 -0700
Subject: [PATCH 0489/1209] krb5: 1.22.1 -> 1.22.2

Changelog: https://web.mit.edu/Kerberos/krb5-1.22/
---
 pkgs/by-name/kr/krb5/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/kr/krb5/package.nix b/pkgs/by-name/kr/krb5/package.nix
index 0b504c6dc8a6..3c402ff11721 100644
--- a/pkgs/by-name/kr/krb5/package.nix
+++ b/pkgs/by-name/kr/krb5/package.nix
@@ -34,13 +34,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krb5";
-  version = "1.22.1";
+  version = "1.22.2";
 
   __structuredAttrs = true;
 
   src = fetchurl {
     url = "https://kerberos.org/dist/krb5/${lib.versions.majorMinor finalAttrs.version}/krb5-${finalAttrs.version}.tar.gz";
-    hash = "sha256-GogyuMrZI+u/E5T2fi789B46SfRgKFpm41reyPoAU68=";
+    hash = "sha256-MkP/vI6k1Kwi3cfdKh3FTFeHTEBki2D/lwCXY1VOrxM=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isFreeBSD [
@@ -170,6 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    changelog = "https://web.mit.edu/Kerberos/krb5-${lib.versions.majorMinor finalAttrs.version}/";
     description = "MIT Kerberos 5";
     homepage = "http://web.mit.edu/kerberos/";
     license = lib.licenses.mit;

From 857aca1e78b13278e34b95205aafd6ef757f4c78 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 24 May 2026 15:56:33 +0100
Subject: [PATCH 0490/1209] hyphen: 2.8.8 -> 2.8.9, switch to github

`hyphen` moved releases and repository to `github`. Switch source fetch
there and slightly refresh the derivation.

Co-authored-by: dotlambda <github@dotlambda.de>
---
 pkgs/development/libraries/hyphen/default.nix | 43 +++++++++----------
 1 file changed, 21 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/libraries/hyphen/default.nix b/pkgs/development/libraries/hyphen/default.nix
index 214149fc1f23..1be6ebb50247 100644
--- a/pkgs/development/libraries/hyphen/default.nix
+++ b/pkgs/development/libraries/hyphen/default.nix
@@ -1,33 +1,31 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  autoreconfHook,
   perl,
 }:
 
-let
-  version = "2.8.8";
-  folder =
-    with builtins;
-    let
-      parts = splitVersion version;
-    in
-    concatStringsSep "." [
-      (elemAt parts 0)
-      (elemAt parts 1)
-    ];
-in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hyphen";
-  inherit version;
+  version = "2.8.9";
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [
+    autoreconfHook
+    perl
+  ];
 
-  src = fetchurl {
-    url = "https://sourceforge.net/projects/hunspell/files/Hyphen/${folder}/${pname}-${version}.tar.gz";
-    sha256 = "01ap9pr6zzzbp4ky0vy7i1983fwyqy27pl0ld55s30fdxka3ciih";
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "hunspell";
+    repo = "hyphen";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-F7PJQjEiE5t5i1gi5B8wzrwAJQl8FWzopRA8uDsaZBc=";
   };
 
+  enableParallelBuilding = true;
+
   # Do not install the en_US dictionary.
   installPhase = ''
     runHook preInstall
@@ -36,14 +34,15 @@ stdenv.mkDerivation rec {
     make install-includeHEADERS
 
     # license
-    install -D -m644 COPYING "$out/share/licenses/${pname}/LICENSE"
+    install -D -m644 COPYING "$out/share/licenses/hyphen/LICENSE"
     runHook postInstall
   '';
 
   meta = {
+    changelog = "https://github.com/hunspell/hyphen/blob/${finalAttrs.src.tag}/NEWS";
     description = "Text hyphenation library";
     mainProgram = "substrings.pl";
-    homepage = "https://sourceforge.net/projects/hunspell/files/Hyphen/";
+    homepage = "https://github.com/hunspell/hyphen";
     platforms = lib.platforms.all;
     license = with lib.licenses; [
       gpl2
@@ -51,4 +50,4 @@ stdenv.mkDerivation rec {
       mpl11
     ];
   };
-}
+})

From 783b53f760b46e44e1cf98dd94018566030b67c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 13:04:11 -0700
Subject: [PATCH 0491/1209] python3Packages.aiohttp: 3.13.5 -> 3.14.0

Diff: https://github.com/aio-libs/aiohttp/compare/v3.13.5...v3.14.0

Changelog: https://docs.aiohttp.org/en/v3.14.0/changes.html
---
 pkgs/development/python-modules/aiohttp/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 9b76c5565090..b9c21b556fc3 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -50,14 +50,14 @@
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.13.5";
+  version = "3.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiohttp";
     tag = "v${version}";
-    hash = "sha256-bAP1/a2COHbe+39KY3GHXSo1Iq9x9xX8O2mLhmFlMlE=";
+    hash = "sha256-RRXdDDkQlL7erfYgs4+gSy6GMlVUG7PrDLTQBYJJ1To=";
   };
 
   postPatch = ''
@@ -68,6 +68,10 @@ buildPythonPackage rec {
     # don't install Cython using pip
     substituteInPlace Makefile \
       --replace-fail "cythonize: .install-cython" "cythonize:"
+
+    # don't depend on coverage for tests
+    substituteInPlace setup.cfg \
+      --replace-fail "ignore:Couldn't import C tracer:coverage.exceptions.CoverageWarning" ""
   '';
 
   build-system = [

From a5069b2b356a49d168890e5a25417a068f9ed7e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 13:06:00 -0700
Subject: [PATCH 0492/1209] python3Packages.aiohttp: use finalAttrs

---
 pkgs/development/python-modules/aiohttp/default.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index b9c21b556fc3..06844833573d 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -41,6 +41,7 @@
   pytest-codspeed,
   pytest-cov-stub,
   pytest-mock,
+  pytest-timeout,
   pytest-xdist,
   pytestCheckHook,
   re-assert,
@@ -48,7 +49,7 @@
   zlib-ng,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiohttp";
   version = "3.14.0";
   pyproject = true;
@@ -56,7 +57,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiohttp";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-RRXdDDkQlL7erfYgs4+gSy6GMlVUG7PrDLTQBYJJ1To=";
   };
 
@@ -99,7 +100,7 @@ buildPythonPackage rec {
     propcache
     yarl
   ]
-  ++ optional-dependencies.speedups;
+  ++ finalAttrs.passthru.optional-dependencies.speedups;
 
   optional-dependencies.speedups = [
     aiodns
@@ -119,6 +120,7 @@ buildPythonPackage rec {
     pytest-codspeed
     pytest-cov-stub
     pytest-mock
+    pytest-timeout
     pytest-xdist
     pytestCheckHook
     re-assert
@@ -167,10 +169,10 @@ buildPythonPackage rec {
   '';
 
   meta = {
-    changelog = "https://docs.aiohttp.org/en/${src.tag}/changes.html";
+    changelog = "https://docs.aiohttp.org/en/${finalAttrs.src.tag}/changes.html";
     description = "Asynchronous HTTP Client/Server for Python and asyncio";
     license = lib.licenses.asl20;
     homepage = "https://github.com/aio-libs/aiohttp";
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

From 4e5b779a751ed42eeb168c661a00e69b9c6b1a7f Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Mon, 1 Jun 2026 18:46:47 -0700
Subject: [PATCH 0493/1209] nixos/test-driver: rework timeout for
 wait_for_console_text

Before this commit, `wait_for_console_text` would read one line every
900ms before trying again to read the next line.

This commit fixes that behavior by greedily reading all buffer that is
available for match trying to find a match rather than reading one per
retry iteration.

In effect this moves the loop inside the `console_matches` helper and
makes the behavior of `wait_for_console_text` with timeout behave the
same way as with timeout.

This also provides a test that showcases the problem.
---
 .../src/test_driver/machine/__init__.py       | 21 ++++++++-------
 nixos/tests/all-tests.nix                     |  1 +
 .../nixos-test-driver/console-timeout.nix     | 26 +++++++++++++++++++
 3 files changed, 38 insertions(+), 10 deletions(-)
 create mode 100644 nixos/tests/nixos-test-driver/console-timeout.nix

diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
index db96445af912..0331e297a8a6 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
@@ -1164,24 +1164,25 @@ class QemuMachine(BaseMachine):
         # to match multiline regexes.
         console = io.StringIO()
 
-        def console_matches(_last_try: bool) -> bool:
+        def console_matches(_last_try: bool, block: bool = False) -> bool:
             nonlocal console
             try:
-                # This will return as soon as possible and
-                # sleep 1 second.
-                console.write(self.last_lines.get(block=False))
+                while True:
+                    # This will return as soon as possible and
+                    # sleep 1 second.
+                    console.write(self.last_lines.get(block=block))
+                    console.seek(0)
+                    matches = re.search(regex, console.read())
+                    if matches is not None:
+                        return True
             except queue.Empty:
-                pass
-            console.seek(0)
-            matches = re.search(regex, console.read())
-            return matches is not None
+                return False
 
         with self.nested(f"waiting for {regex} to appear on console"):
             if timeout is not None:
                 retry(console_matches, timeout)
             else:
-                while not console_matches(False):
-                    pass
+                console_matches(False, block=True)
 
     def get_console_log(self) -> str:
         """
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a4c63fcbc368..32f63661803f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -153,6 +153,7 @@ in
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
     skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
+    console-timeout = runTest ./nixos-test-driver/console-timeout.nix;
     options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
     driver-timeout =
       pkgs.runCommand "ensure-timeout-induced-failure"
diff --git a/nixos/tests/nixos-test-driver/console-timeout.nix b/nixos/tests/nixos-test-driver/console-timeout.nix
new file mode 100644
index 000000000000..504f4504bf9d
--- /dev/null
+++ b/nixos/tests/nixos-test-driver/console-timeout.nix
@@ -0,0 +1,26 @@
+{ pkgs, lib, ... }:
+{
+  name = "console-timeout";
+
+  nodes.machine = {
+    systemd.services.generate-output.script = ''
+      echo "match that"
+      sleep 1
+
+      for i in $(seq 15); do
+        echo "line $i"
+      done
+
+      echo "match this"
+    '';
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    machine.systemctl("start generate-output")
+    machine.wait_for_console_text("match that")
+    machine.wait_for_console_text("match this", timeout=10)
+  '';
+}

From 8d6931faca5c74caec9d5d667cdca019fc9bd76a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 21:18:59 -0700
Subject: [PATCH 0494/1209] libcbor: add meta.changelog

---
 pkgs/by-name/li/libcbor/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libcbor/package.nix b/pkgs/by-name/li/libcbor/package.nix
index f4a3790f9bbe..5b26d0db9e12 100644
--- a/pkgs/by-name/li/libcbor/package.nix
+++ b/pkgs/by-name/li/libcbor/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "PJK";
     repo = "libcbor";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-zjajNtj4jKbt3pLjfLrgtYljyMDYJtnzAC5JPdt+Wys=";
   };
 
@@ -61,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://github.com/PJK/libcbor/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "CBOR protocol implementation for C and others";
     homepage = "https://github.com/PJK/libcbor";
     license = lib.licenses.mit;

From 3c057b8e22a14e82a0899ad65542d32a72277fa1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 22:18:32 -0700
Subject: [PATCH 0495/1209] libconfig: 1.8 -> 1.8.2

Changelog: https://github.com/hyperrealm/libconfig/blob/v1.8.2/ChangeLog
---
 pkgs/by-name/li/libconfig/package.nix | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/li/libconfig/package.nix b/pkgs/by-name/li/libconfig/package.nix
index 0da2905d7725..d0c737104160 100644
--- a/pkgs/by-name/li/libconfig/package.nix
+++ b/pkgs/by-name/li/libconfig/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   # This also disables building tests.
   # on static windows cross-compile they fail to build
   doCheck ? with stdenv.hostPlatform; !(isWindows && isStatic),
@@ -10,24 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libconfig";
-  version = "1.8";
+  version = "1.8.2";
 
   src = fetchurl {
     url = "https://hyperrealm.github.io/libconfig/dist/libconfig-${finalAttrs.version}.tar.gz";
-    hash = "sha256-BR4V3Q6QfESQXzF5M/VIcxTypW6MZybIMEzpkIhIUKo=";
+    hash = "sha256-5Z/7kC3Vcx1dTk+4HTuYlpdhX+q3Lf18MGGBZ7kaQu4=";
   };
 
-  patches = [
-    # Fix tests on i686-linux:
-    #   https://github.com/hyperrealm/libconfig/pull/260
-    # TODO: remove with a next release
-    (fetchpatch {
-      name = "32-bit-tests.patch";
-      url = "https://github.com/hyperrealm/libconfig/commit/b90c45a18110fcca415d00a98ff79c908c42544b.patch";
-      hash = "sha256-8CihXbpKx0Rn0CFxyP6+f6m8vUYehCl/1EtTo98VpfM=";
-    })
-  ];
-
   inherit doCheck;
 
   configureFlags =
@@ -38,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://hyperrealm.github.io/libconfig/";
+    changelog = "https://github.com/hyperrealm/libconfig/blob/v${finalAttrs.version}/ChangeLog";
     description = "C/C++ library for processing configuration files";
     license = lib.licenses.lgpl3;
     maintainers = with lib.maintainers; [ stv0g ];

From eb64ffdbce253915ec1e43f6f055cfbbab87d586 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 22:25:35 -0700
Subject: [PATCH 0496/1209] libde265: 1.0.19 -> 1.1.0

Diff: https://github.com/strukturag/libde265/compare/v1.0.19...v1.1.0

Changelog: https://github.com/strukturag/libde265/releases/tag/v1.1.0
---
 pkgs/by-name/li/libde265/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libde265/package.nix b/pkgs/by-name/li/libde265/package.nix
index 65121864428c..80293886a1e1 100644
--- a/pkgs/by-name/li/libde265/package.nix
+++ b/pkgs/by-name/li/libde265/package.nix
@@ -15,14 +15,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.0.19";
+  version = "1.1.0";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-77OIclR2TwOigo/k5ps9S0TrDNvEjf290PqZyqBcydo=";
+    hash = "sha256-QhBi23HttVdIJCueSeKj3ZKwqX1iFcuAX7GmnMRCyN8=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/strukturag/libde265";
+    changelog = "https://github.com/strukturag/libde265/releases/tag/${finalAttrs.src.tag}";
     description = "Open h.265 video codec implementation";
     mainProgram = "dec265";
     license = lib.licenses.lgpl3;

From 55b813b5d77c96dce549930e1449e902839a1bad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Silva?= <andrerfosilva@gmail.com>
Date: Fri, 29 May 2026 10:01:50 +0100
Subject: [PATCH 0497/1209] rustPlatform.fetchCargoVendor: remove duplicate
 fetcher

---
 .../rust/fetch-cargo-vendor-util-v2.py        | 416 ------------------
 .../rust/fetch-cargo-vendor-util.py           |   5 +-
 .../build-support/rust/fetch-cargo-vendor.nix |  39 +-
 3 files changed, 18 insertions(+), 442 deletions(-)
 delete mode 100644 pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py b/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
deleted file mode 100644
index 5dc789c93ad9..000000000000
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
+++ /dev/null
@@ -1,416 +0,0 @@
-import functools
-import hashlib
-import json
-import multiprocessing as mp
-import re
-import shutil
-import subprocess
-import sys
-import tomllib
-from os.path import islink, realpath
-from pathlib import Path
-from typing import Any, TypedDict, cast
-from urllib.parse import unquote
-
-import requests
-import tomli_w
-from requests.adapters import HTTPAdapter, Retry
-
-eprint = functools.partial(print, file=sys.stderr)
-
-
-def load_toml(path: Path) -> dict[str, Any]:
-    with open(path, "rb") as f:
-        return tomllib.load(f)
-
-
-def get_lockfile_version(cargo_lock_toml: dict[str, Any]) -> int:
-    # lockfile v1 and v2 don't have the `version` key, so assume v2
-    version = cargo_lock_toml.get("version", 2)
-
-    # TODO: add logic for differentiating between v1 and v2
-
-    return version
-
-
-def create_http_session() -> requests.Session:
-    retries = Retry(
-        total=5,
-        backoff_factor=0.5,
-        status_forcelist=[500, 502, 503, 504]
-    )
-    session = requests.Session()
-    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
-    session.mount('http://', HTTPAdapter(max_retries=retries))
-    session.mount('https://', HTTPAdapter(max_retries=retries))
-    return session
-
-
-def download_file_with_checksum(session: requests.Session, url: str, destination_path: Path) -> str:
-    sha256_hash = hashlib.sha256()
-    with session.get(url, stream=True) as response:
-        if not response.ok:
-            raise Exception(f"Failed to fetch file from {url}. Status code: {response.status_code}")
-        with open(destination_path, "wb") as file:
-            for chunk in response.iter_content(1024):  # Download in chunks
-                if chunk:  # Filter out keep-alive chunks
-                    file.write(chunk)
-                    sha256_hash.update(chunk)
-
-    # Compute the final checksum
-    checksum = sha256_hash.hexdigest()
-    return checksum
-
-
-def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
-    # TODO: support other registries
-    #       maybe fetch config.json from the registry root and get the dl key
-    #       See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-    if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
-        raise Exception("Only the default crates.io registry is supported.")
-
-    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
-    # rate limit on the API servers.
-    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
-
-
-def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
-
-    url = get_download_url_for_tarball(pkg)
-    filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-    # TODO: allow legacy checksum specification, see importCargoLock for example
-    #       also, don't forget about the other usage of the checksum
-    expected_checksum = pkg["checksum"]
-
-    tarball_out_dir = out_dir / "tarballs" / filename
-    eprint(f"Fetching {url} -> tarballs/{filename}")
-
-    calculated_checksum = download_file_with_checksum(session, url, tarball_out_dir)
-
-    if calculated_checksum != expected_checksum:
-        raise Exception(f"Hash mismatch! File fetched from {url} had checksum {calculated_checksum}, expected {expected_checksum}.")
-
-
-def download_git_tree(url: str, git_sha_rev: str, out_dir: Path) -> None:
-
-    tree_out_dir = out_dir / "git" / git_sha_rev
-    eprint(f"Fetching {url}#{git_sha_rev} -> git/{git_sha_rev}")
-
-    cmd = ["nix-prefetch-git", "--builder", "--quiet", "--fetch-submodules", "--url", url, "--rev", git_sha_rev, "--out", str(tree_out_dir)]
-    subprocess.check_output(cmd)
-
-
-GIT_SOURCE_REGEX = re.compile("git\\+(?P<url>[^?]+)(\\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
-
-
-class GitSourceInfo(TypedDict):
-    url: str
-    type: str | None
-    value: str | None
-    git_sha_rev: str
-
-
-def parse_git_source(source: str, lockfile_version: int) -> GitSourceInfo:
-    match = GIT_SOURCE_REGEX.match(source)
-    if match is None:
-        raise Exception(f"Unable to process git source: {source}.")
-
-    source_info = cast(GitSourceInfo, match.groupdict(default=None))
-
-    # the source URL is URL-encoded in lockfile_version >=4
-    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
-    if lockfile_version >= 4 and source_info["value"] is not None:
-        source_info["value"] = unquote(source_info["value"])
-
-    return source_info
-
-
-def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    git_packages: list[dict[str, Any]] = []
-    registry_packages: list[dict[str, Any]] = []
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            eprint(f"Skipping local dependency: {pkg["name"]}")
-            continue
-        source = pkg["source"]
-
-        if source.startswith("git+"):
-            git_packages.append(pkg)
-        elif source.startswith("registry+"):
-            registry_packages.append(pkg)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-    git_sha_rev_to_url: dict[str, str] = {}
-    for pkg in git_packages:
-        source_info = parse_git_source(pkg["source"], lockfile_version)
-        git_sha_rev_to_url[source_info["git_sha_rev"]] = source_info["url"]
-
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    # fetch git trees sequentially, since fetching concurrently leads to flaky behaviour
-    if len(git_packages) != 0:
-        (out_dir / "git").mkdir()
-        for git_sha_rev, url in git_sha_rev_to_url.items():
-            download_git_tree(url, git_sha_rev, out_dir)
-
-    # run tarball download jobs in parallel, with at most 5 concurrent download jobs
-    with mp.Pool(min(5, mp.cpu_count())) as pool:
-        if len(registry_packages) != 0:
-            (out_dir / "tarballs").mkdir()
-            session = create_http_session()
-            tarball_args_gen = ((session, pkg, out_dir) for pkg in registry_packages)
-            pool.starmap(download_tarball, tarball_args_gen)
-
-
-def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
-    cmd = ["cargo", "metadata", "--format-version", "1", "--no-deps", "--manifest-path", str(manifest_path)]
-    output = subprocess.check_output(cmd)
-    return json.loads(output)
-
-
-def try_get_crate_manifest_path_from_manifest_path(manifest_path: Path, crate_name: str) -> Path | None:
-    try:
-        metadata = get_manifest_metadata(manifest_path)
-    except subprocess.CalledProcessError:
-        eprint(f"Warning: cargo metadata failed for {manifest_path}, skipping")
-        return None
-
-    for pkg in metadata["packages"]:
-        if pkg["name"] == crate_name:
-            return Path(pkg["manifest_path"])
-
-    return None
-
-
-def find_crate_manifest_in_tree(tree: Path, crate_name: str) -> Path:
-    # Scan all Cargo.toml files; sort by depth/path to make ordering deterministic
-    # and prefer less-nested manifests first.
-    manifest_paths = sorted(
-        tree.glob("**/Cargo.toml"),
-        key=lambda path: (len(path.parts), str(path)),
-    )
-
-    for manifest_path in manifest_paths:
-        res = try_get_crate_manifest_path_from_manifest_path(manifest_path, crate_name)
-        if res is not None:
-            return res
-
-    raise Exception(f"Couldn't find manifest for crate {crate_name} inside {tree}.")
-
-
-def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_dir: Path) -> None:
-
-    # This function will get called by copytree to decide which entries of a directory should be copied
-    # We'll copy everything except symlinks that are invalid
-    def ignore_func(dir_str: str, path_strs: list[str]) -> list[str]:
-        ignorelist: list[str] = []
-
-        dir = Path(realpath(dir_str, strict=True))
-
-        for path_str in path_strs:
-            path = dir / path_str
-            if not islink(path):
-                continue
-
-            # Filter out cyclic symlinks and symlinks pointing at nonexistant files
-            try:
-                target_path = Path(realpath(path, strict=True))
-            except OSError:
-                ignorelist.append(path_str)
-                eprint(f"Failed to resolve symlink, ignoring: {path}")
-                continue
-
-            # Filter out symlinks that point outside of the current crate's base git tree
-            # This can be useful if the nix build sandbox is turned off and there is a symlink to a common absolute path
-            if not target_path.is_relative_to(git_tree):
-                ignorelist.append(path_str)
-                eprint(f"Symlink points outside of the crate's base git tree, ignoring: {path} -> {target_path}")
-                continue
-
-        return ignorelist
-
-    crate_manifest_path = find_crate_manifest_in_tree(git_tree, crate_name)
-    crate_tree = crate_manifest_path.parent
-
-    eprint(f"Copying to {crate_out_dir}")
-    shutil.copytree(crate_tree, crate_out_dir, ignore=ignore_func)
-    crate_out_dir.chmod(0o755)
-
-    with open(crate_manifest_path, "r") as f:
-        manifest_data = f.read()
-
-    if "workspace" in manifest_data:
-        crate_manifest_metadata = get_manifest_metadata(crate_manifest_path)
-        workspace_root = Path(crate_manifest_metadata["workspace_root"])
-
-        root_manifest_path = workspace_root / "Cargo.toml"
-        manifest_path = crate_out_dir / "Cargo.toml"
-
-        manifest_path.chmod(0o644)
-        eprint(f"Patching {manifest_path}")
-
-        cmd = ["replace-workspace-values", str(manifest_path), str(root_manifest_path)]
-        subprocess.check_output(cmd)
-
-
-def extract_crate_tarball_contents(tarball_path: Path, crate_out_dir: Path) -> None:
-    eprint(f"Unpacking to {crate_out_dir}")
-    crate_out_dir.mkdir()
-    cmd = ["tar", "xf", str(tarball_path), "-C", str(crate_out_dir), "--strip-components=1"]
-    subprocess.check_output(cmd)
-
-
-def make_git_source_selector(source_info: GitSourceInfo) -> dict[str, str]:
-    selector = {}
-    selector["git"] = source_info["url"]
-    if source_info["type"] is not None:
-        selector[source_info["type"]] = source_info["value"]
-    return selector
-
-
-def make_registry_source_selector(source: str) -> dict[str, str]:
-    registry = source[9:] if source.startswith("registry+") else source
-    selector = {}
-    selector["registry"] = registry
-    return selector
-
-
-def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
-    lockfile_path = vendor_staging_dir / "Cargo.lock"
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    source_to_ind: dict[str, str] = {}
-    source_config = {}
-    next_registry_ind = 0
-    next_git_ind = 0
-
-    def add_source_replacement(
-        orig_key: str,
-        orig_selector: dict[str, str],
-        vendored_key: str,
-        vendored_dir: str
-    ) -> None:
-        source_config[vendored_key] = {}
-        source_config[vendored_key]["directory"] = vendored_dir
-        source_config[orig_key] = orig_selector
-        source_config[orig_key]["replace-with"] = vendored_key
-
-    # we reserve registry index 0 for crates-io
-    source_to_ind["registry+https://github.com/rust-lang/crates.io-index"] = "registry-0"
-    source_to_ind["sparse+https://index.crates.io/"] = "registry-0"
-    add_source_replacement(
-        orig_key="crates-io",
-        orig_selector={},  # there is an internal selector defined for the `crates-io` source
-        vendored_key="vendored-source-registry-0",
-        vendored_dir="@vendor@/source-registry-0"
-    )
-    next_registry_ind += 1
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependencies
-        if "source" not in pkg.keys():
-            continue
-        source: str = pkg["source"]
-        if source in source_to_ind:
-            continue
-
-        if source.startswith("git+"):
-            ind = f"git-{next_git_ind}"
-            next_git_ind += 1
-            source_info = parse_git_source(source, lockfile_version)
-            selector = make_git_source_selector(source_info)
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            ind = f"registry-{next_registry_ind}"
-            next_registry_ind += 1
-            selector = make_registry_source_selector(source)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-        source_to_ind[source] = ind
-        add_source_replacement(
-            orig_key=f"original-source-{ind}",
-            orig_selector=selector,
-            vendored_key=f"vendored-source-{ind}",
-            vendored_dir=f"@vendor@/source-{ind}"
-        )
-
-    config_path = out_dir / ".cargo" / "config.toml"
-    config_path.parent.mkdir()
-
-    with open(config_path, "wb") as config_file:
-        tomli_w.dump({"source": source_config}, config_file)
-
-    for pkg in cargo_lock_toml["package"]:
-
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            continue
-
-        source: str = pkg["source"]
-        source_ind = source_to_ind[source]
-        crate_dir_name = f"{pkg["name"]}-{pkg["version"]}"
-        source_dir_name = f"source-{source_ind}"
-        crate_out_dir = out_dir / source_dir_name / crate_dir_name
-        crate_out_dir.parent.mkdir(exist_ok=True)
-
-        if source.startswith("git+"):
-
-            source_info = parse_git_source(source, lockfile_version)
-
-            git_sha_rev = source_info["git_sha_rev"]
-            git_tree = vendor_staging_dir / "git" / git_sha_rev
-
-            copy_and_patch_git_crate_subtree(git_tree, pkg["name"], crate_out_dir)
-
-            # git based crates allow having no checksum information
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}}, f)
-
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-            # TODO: change this when non-crates-io registries are supported
-            dir_name = "tarballs"
-
-            tarball_path = vendor_staging_dir / dir_name / filename
-
-            extract_crate_tarball_contents(tarball_path, crate_out_dir)
-
-            # non-git based crates need the package checksum at minimum
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}, "package": pkg["checksum"]}, f)
-
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-
-def main() -> None:
-    subcommand = sys.argv[1]
-
-    subcommand_func_dict = {
-        "create-vendor-staging": lambda: create_vendor_staging(lockfile_path=Path(sys.argv[2]), out_dir=Path(sys.argv[3])),
-        "create-vendor": lambda: create_vendor(vendor_staging_dir=Path(sys.argv[2]), out_dir=Path(sys.argv[3]))
-    }
-
-    subcommand_func = subcommand_func_dict.get(subcommand)
-
-    if subcommand_func is None:
-        raise Exception(f"Unknown subcommand: '{subcommand}'. Must be one of {list(subcommand_func_dict.keys())}")
-
-    subcommand_func()
-
-
-if __name__ == "__main__":
-    main()
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util.py b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
index 3bee7e150c8e..5dc789c93ad9 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util.py
+++ b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
@@ -40,6 +40,7 @@ def create_http_session() -> requests.Session:
         status_forcelist=[500, 502, 503, 504]
     )
     session = requests.Session()
+    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
     session.mount('http://', HTTPAdapter(max_retries=retries))
     session.mount('https://', HTTPAdapter(max_retries=retries))
     return session
@@ -68,7 +69,9 @@ def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
     if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
         raise Exception("Only the default crates.io registry is supported.")
 
-    return f"https://crates.io/api/v1/crates/{pkg["name"]}/{pkg["version"]}/download"
+    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
+    # rate limit on the API servers.
+    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
 
 
 def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index 2802bf9e73f1..8d554a8dc3e2 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -37,29 +37,18 @@ let
     "hash"
   ];
 
-  mkFetchCargoVendorUtil =
-    name: src:
-    writers.writePython3Bin name {
-      libraries =
-        with python3Packages;
-        [
-          requests
-          tomli-w
-        ]
-        ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
-      flakeIgnore = [
-        "E501"
-      ];
-    } (builtins.readFile src);
-
-  # Separate util used only by the FOD `vendorStaging` stage below. Kept
-  # distinct from fetchCargoVendorUtil so that changes to the network-facing
-  # bits (User-Agent, download URL) don't invalidate the input-addressed
-  # `-vendor` stage and force a mass rebuild of every Rust package in nixpkgs.
-  # vendorStaging is an FOD, so swapping its util is free for consumers.
-  # TODO: unify with fetchCargoVendorUtil on the next `staging` cycle.
-  fetchCargoVendorUtilV2 = mkFetchCargoVendorUtil "fetch-cargo-vendor-util-v2" ./fetch-cargo-vendor-util-v2.py;
-  fetchCargoVendorUtil = mkFetchCargoVendorUtil "fetch-cargo-vendor-util" ./fetch-cargo-vendor-util.py;
+  fetchCargoVendorUtil = writers.writePython3Bin "fetch-cargo-vendor-util" {
+    libraries =
+      with python3Packages;
+      [
+        requests
+        tomli-w
+      ]
+      ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
+    flakeIgnore = [
+      "E501"
+    ];
+  } (builtins.readFile ./fetch-cargo-vendor-util.py);
 in
 
 {
@@ -79,7 +68,7 @@ let
       impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
       nativeBuildInputs = [
-        fetchCargoVendorUtilV2
+        fetchCargoVendorUtil
         cacert
         nix-prefetch-git'
       ]
@@ -92,7 +81,7 @@ let
           cd "$cargoRoot"
         fi
 
-        fetch-cargo-vendor-util-v2 create-vendor-staging ./Cargo.lock "$out"
+        fetch-cargo-vendor-util create-vendor-staging ./Cargo.lock "$out"
 
         runHook postBuild
       '';

From 100e23324c871a3b9210bd50c59d4f22e6cc452c Mon Sep 17 00:00:00 2001
From: Cathal Mullan <contact@cathal.dev>
Date: Sat, 21 Mar 2026 16:08:18 +0000
Subject: [PATCH 0498/1209] rustPlatform.fetchCargoVendor: de-duplicate git
 sources by selector

---
 .../rust/fetch-cargo-vendor-util.py           | 28 +++++++++++++------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util.py b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
index 5dc789c93ad9..825f07b175ee 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util.py
+++ b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
@@ -292,6 +292,7 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
     lockfile_version = get_lockfile_version(cargo_lock_toml)
 
     source_to_ind: dict[str, str] = {}
+    selector_to_ind: dict[tuple, str] = {}
     source_config = {}
     next_registry_ind = 0
     next_git_ind = 0
@@ -327,24 +328,35 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
             continue
 
         if source.startswith("git+"):
-            ind = f"git-{next_git_ind}"
-            next_git_ind += 1
             source_info = parse_git_source(source, lockfile_version)
             selector = make_git_source_selector(source_info)
+            selector_key = (source_info["url"], source_info["type"], source_info["value"])
+            if selector_key in selector_to_ind:
+                ind = selector_to_ind[selector_key]
+            else:
+                ind = f"git-{next_git_ind}"
+                next_git_ind += 1
+                selector_to_ind[selector_key] = ind
+                add_source_replacement(
+                    orig_key=f"original-source-{ind}",
+                    orig_selector=selector,
+                    vendored_key=f"vendored-source-{ind}",
+                    vendored_dir=f"@vendor@/source-{ind}"
+                )
         elif source.startswith("registry+") or source.startswith("sparse+"):
             ind = f"registry-{next_registry_ind}"
             next_registry_ind += 1
             selector = make_registry_source_selector(source)
+            add_source_replacement(
+                orig_key=f"original-source-{ind}",
+                orig_selector=selector,
+                vendored_key=f"vendored-source-{ind}",
+                vendored_dir=f"@vendor@/source-{ind}"
+            )
         else:
             raise Exception(f"Can't process source: {source}.")
 
         source_to_ind[source] = ind
-        add_source_replacement(
-            orig_key=f"original-source-{ind}",
-            orig_selector=selector,
-            vendored_key=f"vendored-source-{ind}",
-            vendored_dir=f"@vendor@/source-{ind}"
-        )
 
     config_path = out_dir / ".cargo" / "config.toml"
     config_path.parent.mkdir()

From 536f85e8fc0b8bcf2a341b973d2c1eb4c20077cd Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Tue, 2 Jun 2026 15:07:04 +0200
Subject: [PATCH 0499/1209] libheif: 1.22.2 -> 1.23.0

changelog: https://github.com/strukturag/libheif/releases/tag/v1.23.0
---
 pkgs/by-name/li/libheif/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index a24d7986b884..42171d469f5a 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libheif";
-  version = "1.22.2";
+  version = "1.23.0";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-z5vTfZATfwDn8Zwqt3piS7PaOQQ3UG+u20sR6j+dsUg=";
+    hash = "sha256-+LbYwDSxixy4TaraUCN2LiCnn32dkMppCA8EOFXbvtg=";
   };
 
   nativeBuildInputs = [

From 8310c133b7c8dfd173a135bdb9ac0b7a7fc6b5e6 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 2 Jun 2026 11:02:48 -0400
Subject: [PATCH 0500/1209] xvfb: 21.1.22 -> 21.1.23, drop rebuild avoidance

xorg announcement: https://lists.x.org/archives/xorg-announce/2026-June/003703.html
xorg advisory: https://lists.x.org/archives/xorg-announce/2026-June/003702.html
---
 pkgs/by-name/xv/xvfb/package.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix
index d14e35338776..934fade5a795 100644
--- a/pkgs/by-name/xv/xvfb/package.nix
+++ b/pkgs/by-name/xv/xvfb/package.nix
@@ -38,13 +38,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  # TODO: rebuild avoidance. revert on staging.
-  # inherit (xorg-server) src version;
-  version = "21.1.22";
-  src = fetchurl {
-    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-GiQsiRfEm6KczB9gIWE9iiuYBd0NJxpmrp0J9LC7BrM=";
-  };
+  inherit (xorg-server) src version;
 
   strictDeps = true;
 

From a1965737fa449140ba21039ec1e6bca06bb7828b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 2 Jun 2026 18:55:11 +0300
Subject: [PATCH 0501/1209] qt6.qtdeclarative: patch another upstream bug

---
 .../libraries/qt-6/modules/qtdeclarative/default.nix      | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 2f19e06a67fa..cfcdb5f6c59a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -49,6 +49,14 @@ qtModule {
       url = "https://github.com/qt/qtdeclarative/commit/8a2c82be6ad90e3f2a0760d8bab1e3a8cdb2473a.diff";
       hash = "sha256-3KbyoQPAiRyCwGnwwYV3y0yz2i6UAJcX70EPsXV0ZZM=";
     })
+
+    # backport required at least for [musescore][1], and perhaps many other
+    # applications.
+    # [1]: https://github.com/musescore/MuseScore/issues/33015
+    (fetchpatch {
+      url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.diff";
+      hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
+    })
   ];
 
   cmakeFlags = [

From fb17c8b453298170781a86be83f6927e7810ac58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 2 Jun 2026 09:10:55 -0700
Subject: [PATCH 0502/1209] libdvdcss: 1.4.3 -> 1.5.0

Diff: https://code.videolan.org/videolan/libdvdcss/-/compare/1.4.3...1.5.0

Changelog: https://code.videolan.org/videolan/libdvdcss/blob/1.5.0/NEWS
---
 pkgs/by-name/li/libdvdcss/package.nix | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libdvdcss/package.nix b/pkgs/by-name/li/libdvdcss/package.nix
index 2f57d64b6145..dac50c6c439d 100644
--- a/pkgs/by-name/li/libdvdcss/package.nix
+++ b/pkgs/by-name/li/libdvdcss/package.nix
@@ -1,20 +1,31 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  meson,
+  ninja,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdvdcss";
-  version = "1.4.3";
+  version = "1.5.0";
 
-  src = fetchurl {
-    url = "https://get.videolan.org/libdvdcss/${finalAttrs.version}/libdvdcss-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-IzzJL13AHF06lvWzWCvn1c7lo1pS06CBWHRdPYYHAHk=";
+  src = fetchFromGitLab {
+    domain = "code.videolan.org";
+    owner = "videolan";
+    repo = "libdvdcss";
+    tag = finalAttrs.version;
+    hash = "sha256-xQWfAfxqsaLZN0HMozsqY5mSIO9KvZ5RAb4bj/f6WWo=";
   };
 
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
   meta = {
     homepage = "http://www.videolan.org/developers/libdvdcss.html";
+    changelog = "https://code.videolan.org/videolan/libdvdcss/blob/${finalAttrs.src.tag}/NEWS";
     description = "Library for decrypting DVDs";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.unix;

From 28e00435eaa70225f2b912afc701d8364bc94e8a Mon Sep 17 00:00:00 2001
From: Conor <conorboyle07@protonmail.com>
Date: Tue, 2 Jun 2026 13:26:31 +0100
Subject: [PATCH 0503/1209] sdl2-compat: fix build on musl

---
 pkgs/by-name/sd/sdl2-compat/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/sd/sdl2-compat/package.nix b/pkgs/by-name/sd/sdl2-compat/package.nix
index 5b6376cd9538..28746819a118 100644
--- a/pkgs/by-name/sd/sdl2-compat/package.nix
+++ b/pkgs/by-name/sd/sdl2-compat/package.nix
@@ -64,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "SDL2COMPAT_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeFeature "CMAKE_INSTALL_RPATH" (lib.makeLibraryPath [ sdl3' ]))
+    (lib.cmakeFeature "CMAKE_BUILD_RPATH" (lib.makeLibraryPath [ sdl3' ]))
   ];
 
   # skip timing-based tests as those are flaky

From a7b6fa34c1c4955920c50349475f41c2581981b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 15:34:33 -0700
Subject: [PATCH 0504/1209] bzip2: patch CVE-2026-42250

---
 pkgs/tools/compression/bzip2/default.nix      |  3 ++
 .../bzip2/patches/CVE-2026-42250.patch        | 34 +++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch

diff --git a/pkgs/tools/compression/bzip2/default.nix b/pkgs/tools/compression/bzip2/default.nix
index de15b36aef1c..11d964fd2f06 100644
--- a/pkgs/tools/compression/bzip2/default.nix
+++ b/pkgs/tools/compression/bzip2/default.nix
@@ -30,6 +30,9 @@ stdenv.mkDerivation (
     patchFlags = [ "-p0" ];
 
     patches = [
+      # https://sourceware.org/cgit/bzip2/patch/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
+      ./patches/CVE-2026-42250.patch
+
       ./patches/bzip2-1.0.6.2-autoconfiscated.patch
     ];
     # Fix up hardcoded version from the above patch, e.g. seen in bzip2.pc or libbz2.so.1.0.N
diff --git a/pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch b/pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch
new file mode 100644
index 000000000000..db16326cdeb7
--- /dev/null
+++ b/pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch
@@ -0,0 +1,34 @@
+From 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 Mon Sep 17 00:00:00 2001
+From: Mark Wielaard <mark@klomp.org>
+Date: Thu, 28 May 2026 16:15:45 +0200
+Subject: bzip2recover: Make sure to not process more than
+ BZ_MAX_HANDLED_BLOCKS
+
+There is an off-by-one in the check before calling tooManyBlocks. This
+causes the scanning loop to run one more time and cause a possible
+read or write one past the global bStart, bEnd, rbStart and rbEnd
+buffers. There are no known exploits of this issue and you will need
+to compile with something like gcc -fsanitize=address (ASAN
+AddressSanitizer) to observe the faulty read/write.
+
+This has been assigned CVE-2026-42250.
+---
+ bzip2recover.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git bzip2recover.c bzip2recover.c
+index a8131e0..4b1c219 100644
+--- bzip2recover.c
++++ bzip2recover.c
+@@ -402,7 +402,7 @@ Int32 main ( Int32 argc, Char** argv )
+             rbEnd[rbCtr] = bEnd[currBlock];
+             rbCtr++;
+          }
+-         if (currBlock >= BZ_MAX_HANDLED_BLOCKS)
++         if (currBlock >= BZ_MAX_HANDLED_BLOCKS - 1)
+             tooManyBlocks(BZ_MAX_HANDLED_BLOCKS);
+          currBlock++;
+ 
+-- 
+cgit 
+

From ced25ca9a913c9238668f049d813626393d805e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 2 Jun 2026 10:45:38 -0700
Subject: [PATCH 0505/1209] bzip2_1_1: mark insecure

---
 pkgs/tools/compression/bzip2/1_1.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/compression/bzip2/1_1.nix b/pkgs/tools/compression/bzip2/1_1.nix
index d6ff290fd1a4..1becf083055f 100644
--- a/pkgs/tools/compression/bzip2/1_1.nix
+++ b/pkgs/tools/compression/bzip2/1_1.nix
@@ -51,5 +51,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkgConfigModules = [ "bz2" ];
     platforms = lib.platforms.all;
     maintainers = [ ];
+    knownVulnerabilities = [
+      "CVE-2026-42250"
+    ];
   };
 })

From 622480b3b0a933d5e80ef1306ae5b97c0e7ad75d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 2 Jun 2026 21:24:48 +0100
Subject: [PATCH 0506/1209] graphite2: 1.3.14 -> 1.3.15

Changes: https://github.com/silnrsi/graphite/releases/tag/1.3.15
---
 .../libraries/silgraphite/graphite2.nix       | 32 +++----------------
 1 file changed, 5 insertions(+), 27 deletions(-)

diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index b5ed5a969db7..40ae39918d8c 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   llvmPackages,
-  fetchpatch,
+  python3,
   fetchurl,
   pkg-config,
   freetype,
@@ -12,14 +12,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.3.14";
+  version = "1.3.15";
   pname = "graphite2";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/silnrsi/graphite/releases/download/${version}/${pname}-${version}.tgz";
-    sha256 = "1790ajyhk0ax8xxamnrk176gc9gvhadzy78qia4rd8jzm89ir7gr";
+    hash = "sha256-xryLQlJyRmUpf3ytDFWJcoXGc/m45ts1IqzoM1k/4LE=";
   };
 
   outputs = [
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
+    (python3.withPackages (ps: [ ps.fonttools ]))
     cmake
   ];
   buildInputs = [
@@ -40,14 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     }
   );
 
-  patches = [
-    # Fix build with gcc15
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/graphite2/raw/deba28323b0a3b7a3dcfd06df1efc2195b102ed7/f/graphite2-1.3.14-gcc15.patch";
-      hash = "sha256-vkkGkHkcsj1mD3OHCHLWWgpcmFDv8leC4YQm+TsbIUw=";
-    })
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
+  patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
   postPatch = ''
     # disable broken 'nametabletest' test, fails on gcc-13:
     #   https://github.com/silnrsi/graphite/pull/74
@@ -61,22 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
     # headers are located in the dev output:
     substituteInPlace CMakeLists.txt \
       --replace-fail ' ''${CMAKE_INSTALL_PREFIX}/include' " ${placeholder "dev"}/include"
-
-    # Fix the build with CMake 4.
-    #
-    # See: <https://github.com/silnrsi/graphite/issues/98>
-    badCmakeFiles=(
-      CMakeLists.txt
-      src/CMakeLists.txt
-      tests/{bittwiddling,json,sparsetest,utftest}/CMakeLists.txt
-      gr2fonttest/CMakeLists.txt
-    )
-    for file in "''${badCmakeFiles[@]}"; do
-      substituteInPlace "$file" \
-        --replace-fail \
-          'CMAKE_MINIMUM_REQUIRED(VERSION 2.8.0 FATAL_ERROR)' \
-          'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'
-    done
   '';
 
   cmakeFlags = lib.optionals static [

From f69f2fb4f5cc041546425ee565b054f1b702dc70 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 2 Jun 2026 22:21:47 +0200
Subject: [PATCH 0507/1209] =?UTF-8?q?ocamlPackages.lsp:=201.25.0=20?=
 =?UTF-8?q?=E2=86=92=201.26.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

dune: 3.21.1 -> 3.22.2

ocamlPackages.merlin: 5.6-504 → 5.7.1-504

ocaml-lsp-server: mark old versions as broken
---
 pkgs/by-name/du/dune/package.nix                     | 4 ++--
 pkgs/development/ocaml-modules/ocaml-lsp/default.nix | 2 +-
 pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix | 7 ++++++-
 pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix     | 2 +-
 pkgs/development/tools/ocaml/merlin/4.x.nix          | 5 +++--
 5 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/du/dune/package.nix b/pkgs/by-name/du/dune/package.nix
index 2a5b9122740a..e4aa233bf37b 100644
--- a/pkgs/by-name/du/dune/package.nix
+++ b/pkgs/by-name/du/dune/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   buildPackages,
-  version ? "3.21.1",
+  version ? "3.22.2",
 }:
 let
   # needed for pkgsStatic
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
       "https://github.com/ocaml/dune/releases/download/${version}/dune-${sfx}${version}.tbz";
     hash =
       {
-        "3.21.1" = "sha256-hPeoLG2ApxJPOEfppInoDPvq+3vtNXOsAShu9W/QjZQ=";
+        "3.22.2" = "sha256-wsz4vGsXr6R8RQKXNXSWMDqnyGgOMpt52Yxo41AToRg=";
         "2.9.3" = "sha256:1ml8bxym8sdfz25bx947al7cvsi2zg5lcv7x9w6xb01cmdryqr9y";
       }
       ."${version}";
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/default.nix b/pkgs/development/ocaml-modules/ocaml-lsp/default.nix
index 04f8867cb0ad..cc22bd5e1502 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/default.nix
@@ -85,6 +85,6 @@ buildDunePackage (finalAttrs: {
   meta = lsp.meta // {
     description = "OCaml Language Server Protocol implementation";
     mainProgram = "ocamllsp";
-    broken = lib.versions.majorMinor ocaml.version == "4.13";
+    broken = lib.versionAtLeast ocaml.version "4.13" && lib.versionOlder ocaml.version "5.4";
   };
 })
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
index c273d70b2c75..1c6bd1dcab7a 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
@@ -10,7 +10,7 @@
   ocaml,
   version ?
     if lib.versionAtLeast ocaml.version "5.4" then
-      "1.25.0"
+      "1.26.0"
     else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"
     else if lib.versionAtLeast ocaml.version "5.2" then
@@ -28,6 +28,11 @@
 let
   params =
     {
+      "1.26.0" = {
+        name = "lsp";
+        minimalOCamlVersion = "5.3";
+        sha256 = "sha256-tMgQ1mZKW/F1pvmUbIDIzCsY5GqYWTTBRQss4IDkaDI=";
+      };
       "1.25.0" = {
         name = "lsp";
         minimalOCamlVersion = "5.3";
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
index 7900a7261c08..55ebec5fba50 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
@@ -26,7 +26,7 @@
   ocaml,
   version ?
     if lib.versionAtLeast ocaml.version "5.4" then
-      "1.25.0"
+      "1.26.0"
     else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"
     else if lib.versionAtLeast ocaml.version "5.2" then
diff --git a/pkgs/development/tools/ocaml/merlin/4.x.nix b/pkgs/development/tools/ocaml/merlin/4.x.nix
index 4029c36ad3f4..6a9c1622f0ff 100644
--- a/pkgs/development/tools/ocaml/merlin/4.x.nix
+++ b/pkgs/development/tools/ocaml/merlin/4.x.nix
@@ -31,8 +31,8 @@
       "5.2.0" = "5.3-502";
       "5.2.1" = "5.3-502";
       "5.3.0" = "5.6-503";
-      "5.4.0" = "5.6-504";
-      "5.4.1" = "5.6-504";
+      "5.4.0" = "5.7.1-504";
+      "5.4.1" = "5.7.1-504";
     }
     ."${ocaml.version}",
 }:
@@ -52,6 +52,7 @@ let
     "5.4.1-503" = "sha256-SbO0x3jBISX8dAXnN5CwsxLV15dJ3XPUg4tlYqJTMCI=";
     "5.6-503" = "sha256-sNytCSqq96I/ZauaCJ6HYb1mXMcjV5CeCsbCGC9PwtQ=";
     "5.6-504" = "sha256-gtZIpBgNbVqjoIMhjii/GX9OnxR4hN6TArtoEa2Yt38=";
+    "5.7.1-504" = "sha256-E5sHPPkUs4tyXFT3W4tkL2VMNJjQpLqM+oMf8CqJcNU=";
   };
 
 in

From b359a44a033e0c805540f60c26d9834357ba341c Mon Sep 17 00:00:00 2001
From: Leon Klingele <git@leonklingele.de>
Date: Tue, 2 Jun 2026 22:41:39 +0200
Subject: [PATCH 0508/1209] go_1_26: 1.26.3 -> 1.26.4

---
 pkgs/development/compilers/go/1.26.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.26.nix b/pkgs/development/compilers/go/1.26.nix
index 01704593ad77..242fa4c91de8 100644
--- a/pkgs/development/compilers/go/1.26.nix
+++ b/pkgs/development/compilers/go/1.26.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.26.3";
+  version = "1.26.4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-HGRoddCqh5kTMYTtV895/yS97+jIggRwYCqdPW2Rkrg=";
+    hash = "sha256-T2aKMvv8ETLmqIH7lowvHa2mMUkqM5IRc1+7JVpCYC0=";
   };
 
   strictDeps = true;

From 55d225453e03f4e831f175ca64f62c680e6d2a34 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Tue, 2 Jun 2026 18:17:10 -0400
Subject: [PATCH 0509/1209] fontconfig: add expat to propagatedBuildInputs

This is listed in the pkg-config Requires, so it is needed.
---
 pkgs/development/libraries/fontconfig/default.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index dee1e197dd6e..6441985fdfe0 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -41,12 +41,9 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  buildInputs = [
-    expat
-  ];
-
   propagatedBuildInputs = [
     freetype
+    expat
   ];
 
   postPatch = ''

From 30b9aa9ab81a4807e47f37470a470d2b449ca3b7 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Tue, 2 Jun 2026 18:22:33 -0400
Subject: [PATCH 0510/1209] libtiff: Add pkg-config required deps to
 propagatedBuildInputs

---
 pkgs/by-name/li/libtiff/package.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libtiff/package.nix b/pkgs/by-name/li/libtiff/package.nix
index 3b6ba2345148..66f679f6c677 100644
--- a/pkgs/by-name/li/libtiff/package.nix
+++ b/pkgs/by-name/li/libtiff/package.nix
@@ -80,14 +80,17 @@ stdenv.mkDerivation (finalAttrs: {
     sphinx
   ];
 
-  buildInputs = [
-    libdeflate
+  # Things listed in the
+  # pkg-config file need to be propagated or else
+  # they will not be picked up properly
+  propagatedBuildInputs = [
     libjpeg
-    # libwebp depends on us; this will cause infinite recursion otherwise
-    (libwebp.override { tiffSupport = false; })
-    xz
     zlib
     zstd
+    libdeflate
+    xz
+    # libwebp depends on us; this will cause infinite recursion otherwise
+    (libwebp.override { tiffSupport = false; })
   ]
   ++ lib.optionals withLerc [
     lerc

From ffe9da38cb3464ae3009e0c0bdd88092f2035a77 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 02:38:31 +0200
Subject: [PATCH 0511/1209] python3Packages.hatchling: 1.29.0 -> 1.30.1

https://github.com/pypa/hatch/releases/tag/hatchling-v1.30.1
---
 .../development/python-modules/hatchling/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 569de133621d..e9c0556a05a5 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -17,14 +17,14 @@
   virtualenv,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "hatchling";
-  version = "1.29.0";
+  version = "1.30.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-eTwxgW2VLO5AW4NIjOABxxnzJdnNpp8fxM11BSdkDqY=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-7uT9RTV/cuuz16QuXXLPteKe1CbXnog2KIkmxCWNXy4=";
   };
 
   # listed in backend/pyproject.toml
@@ -65,11 +65,11 @@ buildPythonPackage rec {
     description = "Modern, extensible Python build backend";
     mainProgram = "hatchling";
     homepage = "https://hatch.pypa.io/latest/";
-    changelog = "https://github.com/pypa/hatch/releases/tag/hatchling-v${version}";
+    changelog = "https://github.com/pypa/hatch/releases/tag/hatchling-v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       hexa
       ofek
     ];
   };
-}
+})

From 48a07c243a9b20e4cc73082af7c55cee4ccb991a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:13:12 +0200
Subject: [PATCH 0512/1209] python3Packages.cython: 3.2.4 -> 3.2.5

https://github.com/cython/cython/blob/3.2.5/CHANGES.rst
---
 pkgs/development/python-modules/cython/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cython/default.nix b/pkgs/development/python-modules/cython/default.nix
index 5676bed17b70..34e82fb9f352 100644
--- a/pkgs/development/python-modules/cython/default.nix
+++ b/pkgs/development/python-modules/cython/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "cython";
-  version = "3.2.4";
+  version = "3.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cython";
     repo = "cython";
     tag = version;
-    hash = "sha256-8J5EcaQXexWEA+se5rCR06CwlEYao2XK5TnVNgFGHYQ=";
+    hash = "sha256-wes7UFSWW00tKTmp3Aqk0jDpMMRVHRIhonC6CD7pwB4=";
   };
 
   build-system = [

From 53d5fa93c30ae976777ddbb402ca15beeca00944 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:16:33 +0200
Subject: [PATCH 0513/1209] python3Packages.aiohappyeyeballs: 2.6.1 -> 2.7.0

https://github.com/bdraco/aiohappyeyeballs/blob/v2.7.0/CHANGELOG.md
---
 pkgs/development/python-modules/aiohappyeyeballs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohappyeyeballs/default.nix b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
index 8b66278e436f..61403273a997 100644
--- a/pkgs/development/python-modules/aiohappyeyeballs/default.nix
+++ b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "aiohappyeyeballs";
-  version = "2.6.1";
+  version = "2.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "aiohappyeyeballs";
     tag = "v${version}";
-    hash = "sha256-qqe/h633uEbJPpdsuCzZKW86Z6BQUmPdCju1vg7OLXc=";
+    hash = "sha256-BqwKo1zZ7CqkUZ9H05fbbHVj/z3m0xaERh5dGBDKFYI=";
   };
 
   outputs = [

From 299bfeb14d0ef2bc80150375195cd176bdc66da6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:16:45 +0200
Subject: [PATCH 0514/1209] python3Packages.propcache: 0.4.1 -> 0.5.2

https://github.com/aio-libs/propcache/blob/v0.5.2/CHANGES.rst
---
 pkgs/development/python-modules/propcache/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/propcache/default.nix b/pkgs/development/python-modules/propcache/default.nix
index d7d7db06793c..43aeadad29d1 100644
--- a/pkgs/development/python-modules/propcache/default.nix
+++ b/pkgs/development/python-modules/propcache/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "propcache";
-  version = "0.4.1";
+  version = "0.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "propcache";
     tag = "v${version}";
-    hash = "sha256-7HQUOggbFC7kWcXqatLeCTNJqo0fW9FRCy8UkYL6wvM=";
+    hash = "sha256-vn6FSdWEMk6c8Cu1mHyhZyH8ZlFK0kgYK8T7GKLHHwc=";
   };
 
   postPatch = ''

From 0035f9bcaf572609060a5c7aa40ea1bf7cdc2e11 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:17:29 +0200
Subject: [PATCH 0515/1209] python3Packages.pyjwt: 2.12.1 -> 2.13.0

https://github.com/jpadilla/pyjwt/blob/2.13.0/CHANGELOG.rst
---
 pkgs/development/python-modules/pyjwt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 1d18045a863c..74754630a145 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.12.1";
+  version = "2.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jpadilla";
     repo = "pyjwt";
     tag = version;
-    hash = "sha256-wgOa5JhQT82ppoad6s8gPH7tGRNbbVWmJaaDF84d+r0=";
+    hash = "sha256-q4ynXCJVDsyZh70439dloyWgRTLVm+elDOahUVOT5vA=";
   };
 
   outputs = [

From 2c8de341fc73e6577d1efc75b3d6bd9b4c21175f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:44:26 +0200
Subject: [PATCH 0516/1209] python3Packages.orjson: 3.11.7 -> 3.11.9

https://github.com/ijl/orjson/blob/3.11.9/CHANGELOG.md
---
 pkgs/development/python-modules/orjson/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index 4c59abd298a7..7232c5d0f8ea 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.11.7";
+  version = "3.11.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ijl";
     repo = "orjson";
     tag = version;
-    hash = "sha256-4a8vNQEe1P1t2BcqSL+d+GLHi1lhUtbA7p5/vj/J0Lc=";
+    hash = "sha256-CCwpD6pzO80GlMvjJt4HURQxbghYg53OG/6ZIJWggNU=";
   };
 
   patches = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
@@ -46,7 +46,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-eB7jVTsvBSUjtaKsbRnRtYSd+SqnCaoDyG76iExmSHc=";
+    hash = "sha256-F1TFEj26trVV0TjK6tkS8kiorWRF0uijb1jQko7RDSM=";
   };
 
   nativeBuildInputs = [

From e3f1572c2fd58153366a183cd821fc20014d2328 Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Wed, 3 Jun 2026 01:53:47 -0400
Subject: [PATCH 0517/1209] alsa-lib: 1.2.15.3 -> 1.2.16

---
 pkgs/by-name/al/alsa-lib/package.nix | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/al/alsa-lib/package.nix b/pkgs/by-name/al/alsa-lib/package.nix
index 8d0bffd2b12f..4304bf4ef467 100644
--- a/pkgs/by-name/al/alsa-lib/package.nix
+++ b/pkgs/by-name/al/alsa-lib/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   alsa-topology-conf,
   alsa-ucm-conf,
   testers,
@@ -11,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.15.3";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ewedYU1YLK3nq42yNk5lJx0Id6N9+HV6xKwMiXC+hh4=";
+    hash = "sha256-EiseMWbVX+GbzeZWU116NvKrEOZscsatL0PyD/3tCpY=";
   };
 
   patches = [
@@ -24,11 +23,6 @@ stdenv.mkDerivation (finalAttrs: {
     # "libs" field to declare locations for both native and 32bit plugins, in
     # order to support apps with 32bit sound running on x86_64 architecture.
     ./alsa-plugin-conf-multilib.patch
-    (fetchpatch {
-      name = "CVE-2026-25068.patch";
-      url = "https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40.patch";
-      hash = "sha256-4memtcg+FDOctX6wgiCdmnlG+IUS+5rL1f3LcsWS5lw=";
-    })
   ];
 
   enableParallelBuilding = true;

From 23d0fc9c1103daf3ab58273c12d454661435c4bd Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Wed, 3 Jun 2026 01:54:08 -0400
Subject: [PATCH 0518/1209] alsa-utils: 1.2.15.2 -> 1.2.16

---
 pkgs/by-name/al/alsa-utils/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alsa-utils/package.nix b/pkgs/by-name/al/alsa-utils/package.nix
index ff627a73cc83..e293ed8d10e7 100644
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@@ -32,11 +32,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-utils";
-  version = "1.2.15.2";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/utils/alsa-utils-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-eqqvv7AZQhE+wMMeUfcFkQ6BB5IFCIyi+PE3o4aeGjo=";
+    hash = "sha256-CSOZ1eh0mh1eGI45MVdSHOxLdWk7YOu3m7znKM/yIyw=";
   };
 
   nativeBuildInputs = [

From ef08008ae2d2321662e3cf83625dbf3ff2ea065f Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Wed, 3 Jun 2026 01:54:29 -0400
Subject: [PATCH 0519/1209] alsa-ucm-conf: 1.2.15.3 -> 1.2.16

---
 pkgs/by-name/al/alsa-ucm-conf/package.nix | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/al/alsa-ucm-conf/package.nix b/pkgs/by-name/al/alsa-ucm-conf/package.nix
index 5f0e2130bb84..176fb0e2086c 100644
--- a/pkgs/by-name/al/alsa-ucm-conf/package.nix
+++ b/pkgs/by-name/al/alsa-ucm-conf/package.nix
@@ -1,7 +1,6 @@
 {
   directoryListingUpdater,
   fetchurl,
-  fetchpatch,
   lib,
   stdenvNoCC,
   coreutils,
@@ -10,19 +9,15 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
-  version = "1.2.15.3";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-n3noE8CPyGz6Rt11xPzaGkpRtILbJgfh/PqvuS9YijE=";
+    hash = "sha256-rLyXLW5x7fo0Xnav3xDDmf0PHzz5DYSv20z1G/xKZUg=";
   };
 
   patches = [
-    # fix for typo in 1.2.15.3 – remove with subsequent release
-    (fetchpatch {
-      url = "https://github.com/alsa-project/alsa-ucm-conf/commit/95377000e849259764f37295e0ddd58fd8a55a76.patch";
-      hash = "sha256-o2qR69jiGXFWM0mxeIhXd+tCvGikYqnoalce1UOVppw=";
-    })
+
   ];
 
   dontBuild = true;

From efef7d2661da0fe1a31640df138cedeeb746b165 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 13:36:13 +0200
Subject: [PATCH 0520/1209] libxml2: 2.15.2 -> 2.15.3

Changelog: https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.15.3/NEWS

Fixes CVE-2026-6732
Other security issues fixed here seem to not have CVEs assigned (yet)
---
 pkgs/development/libraries/libxml2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 52a3ab58ad61..015688e4474b 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -46,13 +46,13 @@ let
       };
     };
     libxml2 = callPackage ./common.nix {
-      version = "2.15.2";
+      version = "2.15.3";
       src = fetchFromGitLab {
         domain = "gitlab.gnome.org";
         owner = "GNOME";
         repo = "libxml2";
         tag = "v${packages.libxml2.version}";
-        hash = "sha256-k5dZ75D/BOouYAjrof9Jm2lY29XZhOqS1kudDGmGY9Q=";
+        hash = "sha256-fDntZDyITs223by8n7ueOXiO7yyzshtANoWbY0+yeqo=";
       };
       extraMeta = {
         maintainers = with lib.maintainers; [

From bb8b3495ed290b4845703046d454edd6ee945b3c Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 3 Jun 2026 19:59:56 +0700
Subject: [PATCH 0521/1209] python3Packages.asgiref: migrate to pyproject

---
 pkgs/development/python-modules/asgiref/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index 727587c610cd..630a0f9b0d2a 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -5,13 +5,14 @@
   fetchFromGitHub,
   pytest-asyncio,
   pytestCheckHook,
+  setuptools,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   version = "3.11.0";
   pname = "asgiref";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django";
@@ -20,7 +21,9 @@ buildPythonPackage rec {
     hash = "sha256-2ZaUIWGF5cQVNj95b7WiKGsn2wYsoJmJ/CfPhIEZdjc=";
   };
 
-  propagatedBuildInputs = [ typing-extensions ];
+  build-system = [ setuptools ];
+
+  dependencies = [ typing-extensions ];
 
   nativeCheckInputs = [
     pytestCheckHook

From 652746146f7777862e37bec8a94287779985ad21 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 3 Jun 2026 20:01:27 +0700
Subject: [PATCH 0522/1209] python3Packages.asgiref: convert to finalAttrs

---
 pkgs/development/python-modules/asgiref/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index 630a0f9b0d2a..1012db942066 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -9,7 +9,7 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   version = "3.11.0";
   pname = "asgiref";
   pyproject = true;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "django";
     repo = "asgiref";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-2ZaUIWGF5cQVNj95b7WiKGsn2wYsoJmJ/CfPhIEZdjc=";
   };
 
@@ -37,10 +37,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "asgiref" ];
 
   meta = {
-    changelog = "https://github.com/django/asgiref/blob/${src.tag}/CHANGELOG.txt";
+    changelog = "https://github.com/django/asgiref/blob/${finalAttrs.src.tag}/CHANGELOG.txt";
     description = "Reference ASGI adapters and channel layers";
     homepage = "https://github.com/django/asgiref";
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})

From 5bd4f7ca04f3d7ff331f87e72faccd369539226a Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 3 Jun 2026 20:26:31 +0700
Subject: [PATCH 0523/1209] python3Packages.asgiref: add miniharinn as
 maintainer

---
 pkgs/development/python-modules/asgiref/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index 1012db942066..c0740de29df9 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -41,6 +41,6 @@ buildPythonPackage (finalAttrs: {
     description = "Reference ASGI adapters and channel layers";
     homepage = "https://github.com/django/asgiref";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ miniharinn ];
   };
 })

From e62c6b2316897e4aa9d141a3a9529c72d69b990e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 16:25:25 +0200
Subject: [PATCH 0524/1209] python3Packages.requests: 2.34.0 -> 2.34.2

https://github.com/psf/requests/blob/v2.34.2/HISTORY.md
---
 pkgs/development/python-modules/requests/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 17fca3669c1e..6f5c636620f1 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "requests";
-  version = "2.34.0";
+  version = "2.34.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "psf";
     repo = "requests";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DDx+UV3OuCLUXM7ESbURCGeZ7t2acFEfMTOMcJdfUbI=";
+    hash = "sha256-J2/sNpFUDHkNBeN7BfiMamv7YaWixZAZHxaqmPVEptc=";
   };
 
   build-system = [ setuptools ];

From 0d250a4f8d9b161f5520e083ffcb54c1aee8e74c Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 3 Jun 2026 21:26:10 +0700
Subject: [PATCH 0525/1209] python3Packages.atomicwrites-homeassistant: migrate
 to pyproject

---
 .../python-modules/atomicwrites-homeassistant/default.nix    | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/atomicwrites-homeassistant/default.nix b/pkgs/development/python-modules/atomicwrites-homeassistant/default.nix
index 7c7b1c87a056..871824449421 100644
--- a/pkgs/development/python-modules/atomicwrites-homeassistant/default.nix
+++ b/pkgs/development/python-modules/atomicwrites-homeassistant/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   pytestCheckHook,
+  setuptools,
 }:
 
 let
@@ -12,13 +13,15 @@ in
 
 buildPythonPackage {
   inherit pname version;
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-JWpnIQbxZ0VEUijZZiQLd7VfRqCW0gMFkBpXql0fTC8=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "atomicwrites" ];
 
   nativeCheckInputs = [ pytestCheckHook ];

From aca9a4c78cacffd210b8e55ba9f47ae3fe372ac5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 3 Jun 2026 10:14:01 -0700
Subject: [PATCH 0526/1209] libical: 3.0.20 -> 4.0.2

Diff: https://github.com/libical/libical/compare/v3.0.20...v4.0.2

Changelog: https://github.com/libical/libical/blob/v4.0.2/CHANGELOG.md
---
 pkgs/by-name/li/libical/package.nix           |  26 +--
 .../li/libical/respect-env-tzdir.patch        |  29 ---
 pkgs/by-name/li/libical/static.patch          | 205 ------------------
 3 files changed, 10 insertions(+), 250 deletions(-)
 delete mode 100644 pkgs/by-name/li/libical/respect-env-tzdir.patch
 delete mode 100644 pkgs/by-name/li/libical/static.patch

diff --git a/pkgs/by-name/li/libical/package.nix b/pkgs/by-name/li/libical/package.nix
index 63b3fae8a7ec..e0366ede8ad7 100644
--- a/pkgs/by-name/li/libical/package.nix
+++ b/pkgs/by-name/li/libical/package.nix
@@ -16,6 +16,7 @@
   fixDarwinDylibNames,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
+    && !stdenv.hostPlatform.isStatic
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
   buildPackages,
   gobject-introspection,
@@ -24,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libical";
-  version = "3.0.20";
+  version = "4.0.2";
 
   outputs = [
     "out"
@@ -34,8 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libical";
     repo = "libical";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-KIMqZ6QAh+fTcKEYrcLlxgip91CLAwL9rwjUdKzBsQk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xrPG3FBUY5OCEHBqcNN4Rj4c4j7kLXUsC0hXRRh76Vg=";
   };
 
   strictDeps = true;
@@ -79,24 +80,17 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DENABLE_GTK_DOC=False"
+    "-DLIBICAL_GLIB_BUILD_DOCS=False"
     "-DLIBICAL_BUILD_EXAMPLES=False"
-    "-DGOBJECT_INTROSPECTION=${if withIntrospection then "True" else "False"}"
-    "-DICAL_GLIB_VAPI=${if withIntrospection then "True" else "False"}"
-    "-DSTATIC_ONLY=${if stdenv.hostPlatform.isStatic then "True" else "False"}"
+    "-DLIBICAL_JAVA_BINDINGS=False"
+    "-DLIBICAL_GOBJECT_INTROSPECTION=${if withIntrospection then "True" else "False"}"
+    "-DLIBICAL_GLIB_VAPI=${if withIntrospection then "True" else "False"}"
+    "-DLIBICAL_STATIC=${if stdenv.hostPlatform.isStatic then "True" else "False"}"
   ]
   ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "-DIMPORT_ICAL_GLIB_SRC_GENERATOR=${lib.getDev pkgsBuildBuild.libical}/lib/cmake/LibIcal/IcalGlibSrcGenerator.cmake"
   ];
 
-  patches = [
-    # Will appear in 3.1.0
-    # https://github.com/libical/libical/issues/350
-    ./respect-env-tzdir.patch
-
-    ./static.patch
-  ];
-
   # Using install check so we do not have to manually set GI_TYPELIB_PATH
   # Musl does not support TZDIR.
   doInstallCheck = !stdenv.hostPlatform.isMusl;
@@ -124,7 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/libical/libical";
     description = "Open Source implementation of the iCalendar protocols";
-    changelog = "https://github.com/libical/libical/raw/v${finalAttrs.version}/ReleaseNotes.txt";
+    changelog = "https://github.com/libical/libical/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mpl20;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/li/libical/respect-env-tzdir.patch b/pkgs/by-name/li/libical/respect-env-tzdir.patch
deleted file mode 100644
index 59d23e490e5a..000000000000
--- a/pkgs/by-name/li/libical/respect-env-tzdir.patch
+++ /dev/null
@@ -1,29 +0,0 @@
---- a/src/libical/icaltz-util.c
-+++ b/src/libical/icaltz-util.c
-@@ -94,9 +94,9 @@
- static const char *zdir = NULL;
- 
- static const char *search_paths[] = {
-+    "/etc/zoneinfo",
-     "/usr/share/zoneinfo",
-     "/usr/lib/zoneinfo",
--    "/etc/zoneinfo",
-     "/usr/share/lib/zoneinfo"
- };
- 
-@@ -178,6 +178,15 @@
-     const char *fname = ZONES_TAB_SYSTEM_FILENAME;
-     size_t i, num_search_paths;
- 
-+   const char *env_tzdir = getenv ("TZDIR");
-+   if (env_tzdir) {
-+       sprintf (file_path, "%s/%s", env_tzdir, fname);
-+       if (!access (file_path, F_OK|R_OK)) {
-+           zdir = env_tzdir;
-+           return;
-+       }
-+   }
-+
-     num_search_paths = sizeof(search_paths) / sizeof(search_paths[0]);
-     for (i = 0; i < num_search_paths; i++) {
-         snprintf(file_path, MAXPATHLEN, "%s/%s", search_paths[i], fname);
diff --git a/pkgs/by-name/li/libical/static.patch b/pkgs/by-name/li/libical/static.patch
deleted file mode 100644
index 23678ecd50a6..000000000000
--- a/pkgs/by-name/li/libical/static.patch
+++ /dev/null
@@ -1,205 +0,0 @@
-From 38fe473fb2c90960a64ddda5c4305d958d460e05 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Thu, 3 Jul 2025 19:52:23 +0200
-Subject: [PATCH] Link ICU components in the right order
-
-When static linking, a library that refers to symbols in another
-library has to come before the latter library in the linker command
-line.
-
-Before this change, I get linker errors like the following.  With this
-change, no error.
-
-FAILED: src/test/icalrecurtest
-: && /nix/store/m8ggqv2dfrw6raz49ipnnab98cljx1k2-x86_64-unknown-linux-musl-gcc-wrapper-14.3.0/bin/x86_64-unknown-linux-musl-g++ -O2       -fvisibility=hidden       -Weffc++ -Wno-deprecated -Wall -Wextra -Woverloaded-virtual -Winit-self -Wunused       -Wno-div-by-zero -Wundef -Wpointer-arith -Wtype-limits -Wwrite-strings -Wreturn-type -Wunused-but-set-variable -Wlogical-op -Wsizeof-pointer-memaccess -Wreorder -Wformat-security -Wredundant-decls -Wunreachable-code -Wvarargs -D_XOPEN_SOURCE=500 -D_DEFAULT_SOURCE -D_GNU_SOURCE -Wall -Wextra -Wformat -Wformat=2 -Wconversion -Wsign-conversion -Wtrampolines -Wimplicit-fallthrough -Wbidi-chars=any -Wformat-security -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS -fstrict-flex-arrays=3 -fstack-clash-protection -fstack-protector-strong -fcf-protection=full -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -O3 -DNDEBUG -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,relro -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,relro -Wl,--as-needed -Wl,--no-copy-dt-needed-entries src/test/CMakeFiles/icalrecurtest.dir/icalrecur_test.c.o -o src/test/icalrecurtest  lib/libical.a  lib/libicalss.a  lib/libicalvcal.a  lib/libical.a  /nix>
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_getAvailable_76':
-(.text.ucal_getAvailable_76+0x1): undefined reference to `uloc_getAvailable_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_countAvailable_76':
-(.text.ucal_countAvailable_76+0x1): undefined reference to `uloc_countAvailable_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_getKeywordValuesForLocale_76':
-(.text.ucal_getKeywordValuesForLocale_76+0xec): undefined reference to `ulist_createEmptyList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x132): undefined reference to `ulist_resetList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x260): undefined reference to `ulist_addItemEndList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x2e2): undefined reference to `ulist_containsString_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x2f6): undefined reference to `ulist_addItemEndList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x304): undefined reference to `ulist_deleteList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x333): undefined reference to `ulist_deleteList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x10): undefined reference to `ulist_close_keyword_values_iterator_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x18): undefined reference to `ulist_count_keyword_values_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x28): undefined reference to `ulist_next_keyword_value_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x30): undefined reference to `ulist_reset_keyword_values_iterator_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::SharedCalendar::~SharedCalendar()':
-(.text._ZN6icu_7614SharedCalendarD2Ev+0x32): undefined reference to `icu_76::SharedObject::~SharedObject()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::BasicCalendarFactory::~BasicCalendarFactory()':
-(.text._ZN6icu_7620BasicCalendarFactoryD2Ev+0xf): undefined reference to `icu_76::LocaleKeyFactory::~LocaleKeyFactory()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::DefaultCalendarFactory::~DefaultCalendarFactory()':
-(.text._ZN6icu_7622DefaultCalendarFactoryD2Ev+0xf): undefined reference to `icu_76::ICUResourceBundleFactory::~ICUResourceBundleFactory()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::CalendarService::~CalendarService()':
-(.text._ZN6icu_7615CalendarServiceD2Ev+0xf): undefined reference to `icu_76::ICULocaleService::~ICULocaleService()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::clone() const':
-(.text._ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE5cloneEv[_ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE5cloneEv]+0x65): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::CalendarService::isDefault() const':
-(.text._ZNK6icu_7615CalendarService9isDefaultEv[_ZNK6icu_7615CalendarService9isDefaultEv]+0x5): undefined reference to `icu_76::ICUService::countFactories() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::initCalendarService(UErrorCode&) [clone .cold]':
-(.text.unlikely._ZN6icu_76L19initCalendarServiceER10UErrorCode+0x16): undefined reference to `icu_76::ICULocaleService::~ICULocaleService()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::initCalendarService(UErrorCode&)':
-(.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xa9): undefined reference to `icu_76::ICULocaleService::ICULocaleService(icu_76::UnicodeString const&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xe1): undefined reference to `icu_76::ICUResourceBundleFactory::ICUResourceBundleFactory()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xfe): undefined reference to `icu_76::ICUService::registerFactory(icu_76::ICUServiceFactory*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0x12c): undefined reference to `icu_76::LocaleKeyFactory::LocaleKeyFactory(int)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getAvailableLocales(int&)':
-(.text._ZN6icu_768Calendar19getAvailableLocalesERi+0x1): undefined reference to `icu_76::Locale::getAvailableLocales(int&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getLocale(ULocDataLocaleType, UErrorCode&) const':
-(.text._ZNK6icu_768Calendar9getLocaleE18ULocDataLocaleTypeR10UErrorCode+0x34): undefined reference to `icu_76::LocaleBased::getLocale(ULocDataLocaleType, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getLocaleID(ULocDataLocaleType, UErrorCode&) const':
-(.text._ZNK6icu_768Calendar11getLocaleIDE18ULocDataLocaleTypeR10UErrorCode+0x30): undefined reference to `icu_76::LocaleBased::getLocaleID(ULocDataLocaleType, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::~LocaleCacheKey()':
-(.text._ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED2Ev[_ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED5Ev]+0x3b): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::setWeekData(icu_76::Locale const&, char const*, UErrorCode&)':
-(.text._ZN6icu_768Calendar11setWeekDataERKNS_6LocaleEPKcR10UErrorCode+0x31e): undefined reference to `icu_76::LocaleBased::setLocaleIDs(char const*, char const*)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::makeInstance(icu_76::Locale const&, UErrorCode&)':
-(.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0xd2): undefined reference to `icu_76::LocaleUtility::initLocaleFromName(icu_76::UnicodeString const&, icu_76::Locale&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0x112): undefined reference to `icu_76::ICULocaleService::get(icu_76::Locale const&, int, icu_76::Locale*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0x1d4): undefined reference to `icu_76::ICULocaleService::get(icu_76::Locale const&, int, icu_76::Locale*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::createObject(void const*, UErrorCode&) const':
-(.text._ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE12createObjectEPKvR10UErrorCode+0x69): undefined reference to `icu_76::SharedObject::addRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::DefaultCalendarFactory::create(icu_76::ICUServiceKey const&, icu_76::ICUService const*, UErrorCode&) const':
-(.text._ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x31): undefined reference to `typeinfo for icu_76::LocaleKey'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x38): undefined reference to `typeinfo for icu_76::ICUServiceKey'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::BasicCalendarFactory::create(icu_76::ICUServiceKey const&, icu_76::ICUService const*, UErrorCode&) const':
-(.text._ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x33): undefined reference to `typeinfo for icu_76::LocaleKey'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x3a): undefined reference to `typeinfo for icu_76::ICUServiceKey'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::~LocaleCacheKey()':
-(.text._ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED0Ev[_ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED5Ev]+0x36): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `void icu_76::UnifiedCache::getByLocale<icu_76::SharedCalendar>(icu_76::Locale const&, icu_76::SharedCalendar const*&, UErrorCode&)':
-(.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x2e): undefined reference to `icu_76::UnifiedCache::getInstance(UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0xdf): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x123): undefined reference to `icu_76::UnifiedCache::_get(icu_76::CacheKeyBase const&, icu_76::SharedObject const*&, void const*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x141): undefined reference to `icu_76::SharedObject::removeRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x186): undefined reference to `icu_76::SharedObject::removeRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x1a5): undefined reference to `icu_76::SharedObject::addRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x20c): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::createInstance(icu_76::TimeZone*, icu_76::Locale const&, UErrorCode&)':
-(.text._ZN6icu_768Calendar14createInstanceEPNS_8TimeZoneERKNS_6LocaleER10UErrorCode+0x56): undefined reference to `icu_76::SharedObject::removeRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getCalendarTypeFromLocale(icu_76::Locale const&, char*, int, UErrorCode&)':
-(.text._ZN6icu_768Calendar25getCalendarTypeFromLocaleERKNS_6LocaleEPciR10UErrorCode+0x69): undefined reference to `icu_76::SharedObject::removeRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7614SharedCalendarE[_ZTIN6icu_7614SharedCalendarE]+0x10): undefined reference to `typeinfo for icu_76::SharedObject'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_768CacheKeyINS_14SharedCalendarEEE[_ZTIN6icu_768CacheKeyINS_14SharedCalendarEEE]+0x10): undefined reference to `typeinfo for icu_76::CacheKeyBase'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7620BasicCalendarFactoryE[_ZTIN6icu_7620BasicCalendarFactoryE]+0x10): undefined reference to `typeinfo for icu_76::LocaleKeyFactory'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7622DefaultCalendarFactoryE[_ZTIN6icu_7622DefaultCalendarFactoryE]+0x10): undefined reference to `typeinfo for icu_76::ICUResourceBundleFactory'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7615CalendarServiceE[_ZTIN6icu_7615CalendarServiceE]+0x10): undefined reference to `typeinfo for icu_76::ICULocaleService'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x20): undefined reference to `icu_76::LocaleKeyFactory::getDynamicClassID() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x38): undefined reference to `icu_76::LocaleKeyFactory::getDisplayName(icu_76::UnicodeString const&, icu_76::Locale const&, icu_76::UnicodeString&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x40): undefined reference to `icu_76::LocaleKeyFactory::handlesKey(icu_76::ICUServiceKey const&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x48): undefined reference to `icu_76::LocaleKeyFactory::handleCreate(icu_76::Locale const&, int, icu_76::ICUService const*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x50): undefined reference to `icu_76::LocaleKeyFactory::getSupportedIDs(UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x20): undefined reference to `icu_76::ICUResourceBundleFactory::getDynamicClassID() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x30): undefined reference to `icu_76::LocaleKeyFactory::updateVisibleIDs(icu_76::Hashtable&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x38): undefined reference to `icu_76::LocaleKeyFactory::getDisplayName(icu_76::UnicodeString const&, icu_76::Locale const&, icu_76::UnicodeString&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x40): undefined reference to `icu_76::LocaleKeyFactory::handlesKey(icu_76::ICUServiceKey const&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x48): undefined reference to `icu_76::ICUResourceBundleFactory::handleCreate(icu_76::Locale const&, int, icu_76::ICUService const*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x50): undefined reference to `icu_76::ICUResourceBundleFactory::getSupportedIDs(UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x20): undefined reference to `icu_76::ICUNotifier::addListener(icu_76::EventListener const*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x28): undefined reference to `icu_76::ICUNotifier::removeListener(icu_76::EventListener const*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x30): undefined reference to `icu_76::ICUNotifier::notifyChanged()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x38): undefined reference to `icu_76::ICUService::acceptsListener(icu_76::EventListener const&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x40): undefined reference to `icu_76::ICUService::notifyListener(icu_76::EventListener&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x48): undefined reference to `icu_76::ICUService::getKey(icu_76::ICUServiceKey&, icu_76::UnicodeString*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x50): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::UnicodeString const&, signed char, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x58): undefined reference to `icu_76::ICUService::registerFactory(icu_76::ICUServiceFactory*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x60): undefined reference to `icu_76::ICUService::unregister(void const*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x68): undefined reference to `icu_76::ICUService::reset()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x78): undefined reference to `icu_76::ICULocaleService::createKey(icu_76::UnicodeString const*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x88): undefined reference to `icu_76::ICUService::createSimpleFactory(icu_76::UObject*, icu_76::UnicodeString const&, signed char, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x90): undefined reference to `icu_76::ICUService::reInitializeFactories()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xa0): undefined reference to `icu_76::ICUService::clearCaches()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xa8): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xb0): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, int, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xb8): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, int, int, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xc0): undefined reference to `icu_76::ICULocaleService::getAvailableLocales() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xc8): undefined reference to `icu_76::ICULocaleService::createKey(icu_76::UnicodeString const*, int, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(timezone.ao): in function `icu_76::TimeZone::parseCustomID(icu_76::UnicodeString const&, int&, int&, int&, int&)':
-(.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x6f): undefined reference to `u_strncasecmp_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0xf3): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x168): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x1cd): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseSingleLocalizedDigit(icu_76::UnicodeString const&, int, int&) const':
-(.text._ZNK6icu_7614TimeZoneFormat25parseSingleLocalizedDigitERKNS_13UnicodeStringEiRi+0x56): undefined reference to `u_charDigitValue_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetFieldsWithPattern(icu_76::UnicodeString const&, int, icu_76::UVector*, signed char, int&, int&, int&) const':
-(.text._ZNK6icu_7614TimeZoneFormat28parseOffsetFieldsWithPatternERKNS_13UnicodeStringEiPNS_7UVectorEaRiS6_S6_+0x116): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetLocalizedGMTPattern(icu_76::UnicodeString const&, int, signed char, int&) const':
-(.text._ZNK6icu_7614TimeZoneFormat30parseOffsetLocalizedGMTPatternERKNS_13UnicodeStringEiaRi+0x13e): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat30parseOffsetLocalizedGMTPatternERKNS_13UnicodeStringEiaRi+0x1a9): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetDefaultLocalizedGMT(icu_76::UnicodeString const&, int, int&) const':
-(.text._ZNK6icu_7614TimeZoneFormat30parseOffsetDefaultLocalizedGMTERKNS_13UnicodeStringEiRi+0x65): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetLocalizedGMT(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const':
-(.text._ZNK6icu_7614TimeZoneFormat23parseOffsetLocalizedGMTERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x121): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao):(.text._ZNK6icu_7614TimeZoneFormat23parseOffsetLocalizedGMTERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x1bb): more undefined references to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const' follow
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetISO8601(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const [clone .cold]':
-(.text.unlikely._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x4): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.unlikely._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0xc): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetISO8601(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const':
-(.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0xaf): undefined reference to `vtable for icu_76::ParsePosition'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x120): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x1c4): undefined reference to `vtable for icu_76::ParsePosition'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x207): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parse(UTimeZoneFormatStyle, icu_76::UnicodeString const&, icu_76::ParsePosition&, int, UTimeZoneFormatTimeType*) const [clone .cold]':
-(.text.unlikely._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x2c): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parse(UTimeZoneFormatStyle, icu_76::UnicodeString const&, icu_76::ParsePosition&, int, UTimeZoneFormatTimeType*) const':
-(.text._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x99): undefined reference to `vtable for icu_76::ParsePosition'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x2c6): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::getGenericLocationName(icu_76::UnicodeString const&)':
-(.text._ZN6icu_768TZGNCore22getGenericLocationNameERKNS_13UnicodeStringE+0x1ea): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore22getGenericLocationNameERKNS_13UnicodeStringE+0x342): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::getPartialLocationName(icu_76::UnicodeString const&, icu_76::UnicodeString const&, signed char, icu_76::UnicodeString const&)':
-(.text._ZN6icu_768TZGNCore22getPartialLocationNameERKNS_13UnicodeStringES3_aS3_+0x288): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::initialize(icu_76::Locale const&, UErrorCode&)':
-(.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x172): undefined reference to `icu_76::SimpleFormatter::applyPatternMinMaxArguments(icu_76::UnicodeString const&, int, int, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x18f): undefined reference to `icu_76::SimpleFormatter::applyPatternMinMaxArguments(icu_76::UnicodeString const&, int, int, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x1a5): undefined reference to `icu_76::LocaleDisplayNames::createInstance(icu_76::Locale const&, UDialectHandling)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::TZGNCore(icu_76::Locale const&, UErrorCode&) [clone .cold]':
-(.text.unlikely._ZN6icu_768TZGNCoreC2ERKNS_6LocaleER10UErrorCode+0x21): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.unlikely._ZN6icu_768TZGNCoreC2ERKNS_6LocaleER10UErrorCode+0x2d): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::~TZGNCore()':
-(.text._ZN6icu_768TZGNCoreD2Ev+0x48): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCoreD2Ev+0x54): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::formatGenericNonLocationName(icu_76::TimeZone const&, UTimeZoneGenericNameType, double, icu_76::UnicodeString&) const':
-(.text._ZNK6icu_768TZGNCore28formatGenericNonLocationNameERKNS_8TimeZoneE24UTimeZoneGenericNameTypedRNS_13UnicodeStringE+0x692): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tznames_impl.ao): in function `icu_76::TextTrieMap::search(icu_76::CharacterNode*, icu_76::UnicodeString const&, int, int, icu_76::TextTrieMapSearchResultHandler*, UErrorCode&) const':
-(.text._ZNK6icu_7611TextTrieMap6searchEPNS_13CharacterNodeERKNS_13UnicodeStringEiiPNS_30TextTrieMapSearchResultHandlerER10UErrorCode+0x153): undefined reference to `icu_76::UnicodeString::foldCase(unsigned int)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tznames_impl.ao): in function `icu_76::TextTrieMap::putImpl(icu_76::UnicodeString const&, void*, UErrorCode&)':
-(.text._ZN6icu_7611TextTrieMap7putImplERKNS_13UnicodeStringEPvR10UErrorCode+0x135): undefined reference to `icu_76::UnicodeString::foldCase(unsigned int)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::parseObject(icu_76::UnicodeString const&, icu_76::Formattable&, UErrorCode&) const [clone .cold]':
-(.text.unlikely._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x4): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::parseObject(icu_76::UnicodeString const&, icu_76::Formattable&, UErrorCode&) const':
-(.text._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x25): undefined reference to `vtable for icu_76::ParsePosition'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x57): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::getLocale(ULocDataLocaleType, UErrorCode&) const':
-(.text._ZNK6icu_766Format9getLocaleE18ULocDataLocaleTypeR10UErrorCode+0x31): undefined reference to `icu_76::LocaleBased::getLocale(ULocDataLocaleType, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::getLocaleID(ULocDataLocaleType, UErrorCode&) const':
-(.text._ZNK6icu_766Format11getLocaleIDE18ULocDataLocaleTypeR10UErrorCode+0x2d): undefined reference to `icu_76::LocaleBased::getLocaleID(ULocDataLocaleType, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::setLocaleIDs(char const*, char const*)':
-(.text._ZN6icu_766Format12setLocaleIDsEPKcS2_+0x2d): undefined reference to `icu_76::LocaleBased::setLocaleIDs(char const*, char const*)'
-collect2: error: ld returned 1 exit status
-
-Link: https://github.com/libical/libical/pull/930
----
- CMakeLists.txt | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index aad02e1e..7dcf516c 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -211,7 +211,7 @@ if(NOT DEFINED ENV{ICU_ROOT} AND APPLE)
-   #Use the homebrew version. MacOS provided ICU doesn't provide development files
-   set(ICU_ROOT "/usr/local/opt/icu4c")
- endif()
--find_package(ICU COMPONENTS uc i18n data)
-+find_package(ICU COMPONENTS i18n uc data)
- set_package_properties(ICU PROPERTIES
-   TYPE RECOMMENDED
-   PURPOSE "For RSCALE (RFC7529) support"
--- 
-2.49.0
-

From facc8845a479693e47647f5e02e1620343bea6e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 3 Jun 2026 10:45:42 -0700
Subject: [PATCH 0527/1209] libjpeg_turbo: 3.1.4 -> 3.1.4.1

Diff: https://github.com/libjpeg-turbo/libjpeg-turbo/compare/3.1.4...3.1.4.1

Changelog: https://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/3.1.4.1
---
 pkgs/by-name/li/libjpeg_turbo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libjpeg_turbo/package.nix b/pkgs/by-name/li/libjpeg_turbo/package.nix
index 5156d1f87d5c..0181dabd9757 100644
--- a/pkgs/by-name/li/libjpeg_turbo/package.nix
+++ b/pkgs/by-name/li/libjpeg_turbo/package.nix
@@ -32,13 +32,13 @@ assert !(enableJpeg7 && enableJpeg8); # pick only one or none, not both
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libjpeg-turbo";
-  version = "3.1.4";
+  version = "3.1.4.1";
 
   src = fetchFromGitHub {
     owner = "libjpeg-turbo";
     repo = "libjpeg-turbo";
     tag = finalAttrs.version;
-    hash = "sha256-mxmJejgUqS6OC0U0gHsHHe74X0MTVBY5OCbqxIyWa3Q=";
+    hash = "sha256-jBajigX4/j4jG11prTPeGkTVRrRzheFL/LxgnPufzb4=";
   };
 
   patches =

From b4fe75ea95b626f164d4be0bde21b9ede60be20a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 3 Jun 2026 19:03:07 +0000
Subject: [PATCH 0528/1209] ucc: 1.7.0 -> 1.8.0

---
 pkgs/by-name/uc/ucc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/uc/ucc/package.nix b/pkgs/by-name/uc/ucc/package.nix
index ae59eabb2cf3..016b2111d234 100644
--- a/pkgs/by-name/uc/ucc/package.nix
+++ b/pkgs/by-name/uc/ucc/package.nix
@@ -40,13 +40,13 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   pname = "ucc";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "openucx";
     repo = "ucc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YGvagagGcG6Jiy5VppnfdZ03Sb5+5dYU6NV+RS/KnHY=";
+    hash = "sha256-rH/bG0pYO4VKfrnkXLXy/67hjaz6i3R0YoYdsGBqPsU=";
   };
 
   outputs = [

From 3cea6f05bd8acb21e4d0c135f69c8c8a669d195d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 3 Jun 2026 21:26:39 +0100
Subject: [PATCH 0529/1209] hwdata: 0.407 -> 0.408

Changes: https://github.com/vcrhonek/hwdata/compare/v0.407...v0.408
---
 pkgs/by-name/hw/hwdata/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index 9624dc7a05c6..0fc7c9022a62 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.407";
+  version = "0.408";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JrEUmXH1/fua6EJjHHwny19QS0HvYGRPelKF0UroDhc=";
+    hash = "sha256-fgKOvVGAdB3uBFuKfGPFfF9wQEdLtnlMdQrLNIr3teo=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)

From 33961684091fb623efc13c0fb1a889b8aeb79eac Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 23:41:50 +0200
Subject: [PATCH 0530/1209] apparmor-parser: fix for apparmor 5.0

---
 pkgs/by-name/ap/apparmor-parser/package.nix | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix
index 47927ab6477b..0191929c5efe 100644
--- a/pkgs/by-name/ap/apparmor-parser/package.nix
+++ b/pkgs/by-name/ap/apparmor-parser/package.nix
@@ -6,6 +6,7 @@
   bison,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   buildPackages,
+  zstd,
 
   # apparmor deps
   libapparmor,
@@ -23,15 +24,23 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     patchShebangs .
+
+    substituteInPlace init/rc.apparmor.functions \
+      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" \
+      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
+    sed -i init/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+
     cd parser
 
     substituteInPlace Makefile \
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" # FIXME
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
-    sed -i rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+
+    # strict format check causes yacc auto-generated code to fail.
+    # This is known, see https://gitlab.com/apparmor/apparmor/-/merge_requests/2039
+    # removing the compile-time check here downgrades the issue and allows compilation to succeed
+    substituteInPlace parser.h \
+      --replace-fail 'extern void yyerror(const char *msg, ...) __attribute__((noreturn, format(printf, 1, 2)));' \
+        'extern void yyerror(const char *msg, ...);'
   '';
 
   nativeBuildInputs = [
@@ -42,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libapparmor
+    zstd
     runtimeShellPackage
   ];
 

From a6b392bab03e99a052ff914e582163fdbeb85360 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 23:43:03 +0200
Subject: [PATCH 0531/1209] apparmor-profiles: fix test for apparmor 5.0

---
 pkgs/by-name/ap/apparmor-profiles/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/ap/apparmor-profiles/package.nix b/pkgs/by-name/ap/apparmor-profiles/package.nix
index db3c21009b4c..7ecb3ba5cb3c 100644
--- a/pkgs/by-name/ap/apparmor-profiles/package.nix
+++ b/pkgs/by-name/ap/apparmor-profiles/package.nix
@@ -1,7 +1,9 @@
 {
+  lib,
   stdenv,
   which,
   callPackage,
+  python3,
 
   # apparmor deps
   libapparmor,
@@ -28,9 +30,16 @@ stdenv.mkDerivation {
     apparmor-utils
   ];
 
+  checkInputs = [
+    python3
+  ];
+
   preCheck = ''
     export USE_SYSTEM=1
     export LOGPROF="aa-logprof --configdir ${callPackage ./test_config.nix { }} --no-check-mountpoint"
+    patchShebangs ../parser/tst
+    substituteInPlace ../parser/tst/test_profile.py \
+      --replace-fail '../parser/apparmor_parser' '${lib.getExe apparmor-parser}'
   '';
 
   doCheck = true;

From 3b5d44bff532312e311282d9768c5204fc8d601a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 4 Jun 2026 01:51:51 +0200
Subject: [PATCH 0532/1209] python3Packages.django_5: 5.2.14 -> 5.2.15

https://docs.djangoproject.com/en/5.2/releases/5.2.15/
https://www.djangoproject.com/weblog/2026/jun/03/security-releases/

Fixes:
CVE-2026-6873, CVE-2026-7666, CVE-2026-8404, CVE-2026-35193,
CVE-2026-48587
---
 pkgs/development/python-modules/django/5.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 3a7274793a2b..273b61da19c9 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.2.14";
+  version = "5.2.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django";
     repo = "django";
     tag = version;
-    hash = "sha256-gb/4WL2VLoqRucpXuKyPsMSwKZ6gaxy5JA7QTeeazjk=";
+    hash = "sha256-K9yFHr3IkVNMqoeumESszVlju2fW2r8hS8z6M2OdVpE=";
   };
 
   patches = [

From 75a1c47a4ecd29ee975f6606131ad9169e281d4c Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Sun, 31 May 2026 13:32:51 +0100
Subject: [PATCH 0533/1209] tests.{qt5,qt6}.wrapQtAppsHook: add coverage

Test that wrapQtAppsHook:
- normalizes qtWrapperArgs to a bash array
- preserves user-supplied wrapper arguments
- appends the expected Qt wrapper arguments
- produces wrappers with the expected runtime behaviour
---
 .../libraries/qt-5/5.15/default.nix           |   5 +
 pkgs/development/libraries/qt-6/default.nix   |   5 +
 .../qt-6/tests/wrap-qt-apps-hook.nix          | 162 ++++++++++++++++++
 pkgs/test/default.nix                         |  10 ++
 4 files changed, 182 insertions(+)
 create mode 100644 pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix

diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 6302d6ab5b31..735afc3c5146 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -10,6 +10,7 @@
   generateSplicesForMkScope,
   lib,
   stdenv,
+  callPackages,
   gcc14Stdenv,
   fetchurl,
   fetchgit,
@@ -297,6 +298,7 @@ let
 
       wrapQtAppsHook = callPackage (
         {
+          wrapQtAppsHook,
           makeBinaryWrapper,
           qtbase,
           qtwayland,
@@ -308,6 +310,9 @@ let
             makeBinaryWrapper
           ]
           ++ lib.optional stdenv.hostPlatform.isLinux qtwayland.dev;
+          passthru.tests = callPackages ../../qt-6/tests/wrap-qt-apps-hook.nix {
+            inherit qtbase wrapQtAppsHook;
+          };
           meta.license = lib.licenses.mit;
         } ../hooks/wrap-qt-apps-hook.sh
       ) { };
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index dc7233f11a8c..b8a7afb5496c 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -2,6 +2,7 @@
   newScope,
   lib,
   stdenv,
+  callPackages,
   generateSplicesForMkScope,
   makeScopeWithSplicing',
   fetchurl,
@@ -124,6 +125,7 @@ let
 
       wrapQtAppsHook = callPackage (
         {
+          wrapQtAppsHook,
           makeBinaryWrapper,
           qtwayland,
           qtbase,
@@ -134,6 +136,9 @@ let
           depsTargetTargetPropagated = [
             (onlyPluginsAndQml qtbase)
           ];
+          passthru.tests = callPackages ./tests/wrap-qt-apps-hook.nix {
+            inherit qtbase wrapQtAppsHook;
+          };
           meta.license = lib.licenses.mit;
         } ./hooks/wrap-qt-apps-hook.sh
       ) { };
diff --git a/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix b/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
new file mode 100644
index 000000000000..e43ff3b6e3ac
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
@@ -0,0 +1,162 @@
+{
+  lib,
+  qtbase,
+  runCommandLocal,
+  stdenv,
+  wrapQtAppsHook,
+}:
+let
+  testProgram = stdenv.mkDerivation {
+    pname = "qt-wrapper-test-program";
+    version = "0.0.1";
+    __structuredAttrs = true;
+
+    dontUnpack = true;
+
+    src = /* c */ ''
+      #include <stdio.h>
+      #include <stdlib.h>
+      #include <string.h>
+
+      int main(void) {
+          const char *wrapperTest = getenv("WRAPPER_TEST");
+          if (!wrapperTest || strcmp(wrapperTest, "expected") != 0) {
+              fprintf(stderr,
+                      "expected WRAPPER_TEST=expected, got=%s\n",
+                      wrapperTest);
+              return 1;
+          }
+
+          const char *plugin_path = getenv("QT_PLUGIN_PATH");
+          if (!plugin_path) {
+              fprintf(stderr, "QT_PLUGIN_PATH not set\n");
+              return 1;
+          }
+
+          if (!strstr(plugin_path,
+                      "${qtbase}/${qtbase.qtPluginPrefix}")) {
+              fprintf(stderr,
+                      "QT_PLUGIN_PATH missing Qt plugin dir:\n%s\n",
+                      plugin_path);
+              return 1;
+          }
+
+          return 0;
+      }
+    '';
+
+    buildPhase = ''
+      "$CC" -x c - -o test <<<"$src"
+    '';
+
+    installPhase = ''
+      mkdir -p $out/bin
+      install -m755 test $out/bin/test
+    '';
+
+    meta.mainProgram = "test";
+  };
+
+  # Test that wrapQtAppsHook produces the expected qtWrapperArgs bash array
+  checkWrapperArgsArray =
+    {
+      name,
+      qtWrapperArgs,
+    }:
+    runCommandLocal "${name}-check-qtWrapperArgs"
+      {
+        inherit qtWrapperArgs;
+        buildInputs = [ qtbase ];
+        nativeBuildInputs = [ wrapQtAppsHook ];
+      }
+      ''
+        ${lib.toShellVars {
+          # The resulting array should start with the exact user-defined args:
+          userDefinedArgs = qtWrapperArgs;
+
+          # The hook's setup should also add internal flags, including:
+          internalArgs = [
+            "QT_PLUGIN_PATH"
+            "${qtbase}/${qtbase.qtPluginPrefix}"
+          ];
+        }}
+
+        # The hook should have run its setup already, converting qtWrapperArgs
+        # to an array and appending internal flags.
+        type=$(declare -p qtWrapperArgs)
+        [[ "$type" == "declare -"*a* ]] || {
+          echo "Expected qtWrapperArgs to be an array, found: ''${type%%=*}" >&2
+          exit 1
+        }
+
+        # The start of the array should equal the user-defined args
+        for i in "''${!userDefinedArgs[@]}"; do
+          actual="''${qtWrapperArgs[$i]}"
+          expected="''${userDefinedArgs[$i]}"
+          [ "$expected" = "$actual" ] || {
+            echo "qtWrapperArgs[$i]: expected '$expected', found '$actual'" >&2
+            exit 1
+          }
+        done
+
+        # Internal args should be appended to the array
+        internalSlice=("''${qtWrapperArgs[@]:''${#userDefinedArgs[@]}}")
+        for expected in "''${internalArgs[@]}"; do
+          found=
+          for actual in "''${internalSlice[@]}"; do
+            if [ "$expected" = "$actual" ]; then
+              found=1
+              break
+            fi
+          done
+
+          [ -n "$found" ] || {
+            echo "Internal arg '$expected' not found in internal qtWrapperArgs" >&2
+            exit 1
+          }
+        done
+
+        # The hook should've defined the wrapQtAppsHook function
+        [ "$(type -t wrapQtAppsHook)" = function ] || {
+          echo "wrapQtAppsHook is not declared as a function" >&2
+          exit 1
+        }
+
+        touch "$out"
+      '';
+in
+
+{
+
+  simple = checkWrapperArgsArray {
+    name = "simple";
+    qtWrapperArgs = [
+      "--chdir"
+      "/foo"
+    ];
+  };
+
+  # Integration test: assert program is wrapped with the expected environment
+  runtime =
+    runCommandLocal "simple-wrapper-runtime"
+      {
+        qtWrapperArgs = [
+          "--set"
+          "WRAPPER_TEST"
+          "expected"
+        ];
+
+        buildInputs = [ qtbase ];
+        nativeBuildInputs = [ wrapQtAppsHook ];
+      }
+      ''
+        # Install the test program
+        mkdir -p "$out/bin"
+        cp ${lib.getExe testProgram} "$out/bin/test"
+
+        # Wrap and run the test
+        wrapQtAppsHook
+        "$out/bin/test"
+      '';
+
+}
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 63e8e2b32aae..d02f45fb4884 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -254,6 +254,16 @@ in
     ) pkgs.arrayUtilities
   );
 
+  # Accumulate all passthru.tests from qt5 into a single attribute set.
+  qt5 = recurseIntoAttrs {
+    wrapQtAppsHook = recurseIntoAttrs pkgs.qt5.wrapQtAppsHook.passthru.tests;
+  };
+
+  # Accumulate all passthru.tests from qt6 into a single attribute set.
+  qt6 = recurseIntoAttrs {
+    wrapQtAppsHook = recurseIntoAttrs pkgs.qt6.wrapQtAppsHook.passthru.tests;
+  };
+
   srcOnly = callPackage ../build-support/src-only/tests.nix { };
 
   systemd = callPackage ./systemd { };

From cd5e77db802275de6b21c6eccde59f1f4b88d4f4 Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Sun, 31 May 2026 10:40:59 +0100
Subject: [PATCH 0534/1209] wrapQtAppsHook: support structuredAttrs

With `__structuredAttrs = true`, `qtWrapperArgs` is provided as an
array; without it, it is provided as a string.

Use stdenv's `concatTo` helper to normalize `qtWrapperArgs` to a bash
array, regardless of its representation.

Adjust the hook's tests to cover both __structuredAttrs true and false.
---
 .../libraries/qt-5/hooks/wrap-qt-apps-hook.sh    |  7 +++++--
 .../libraries/qt-6/hooks/wrap-qt-apps-hook.sh    |  7 +++++--
 .../libraries/qt-6/tests/wrap-qt-apps-hook.nix   | 16 ++++++++++++++--
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index 6f7cdac0c941..0bbdeea1796a 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -3,8 +3,11 @@ __nix_wrapQtAppsHook=1
 # wrap only once per output
 declare -a qtWrapperDoneForOuputs
 
-# Inherit arguments given in mkDerivation
-qtWrapperArgs=( ${qtWrapperArgs-} )
+# Normalize qtWrapperArgs to an array
+declare -a _qtWrapperArgsTmp
+concatTo _qtWrapperArgsTmp qtWrapperArgs
+qtWrapperArgs=("${_qtWrapperArgsTmp[@]}")
+unset _qtWrapperArgsTmp
 
 qtHostPathSeen=()
 
diff --git a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
index 18056b9ddf3b..248d00b3dda2 100644
--- a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
@@ -3,8 +3,11 @@ if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
     # wrap only once per output
     declare -a qtWrapperDoneForOuputs
 
-    # Inherit arguments given in mkDerivation
-    qtWrapperArgs=(${qtWrapperArgs-})
+    # Normalize qtWrapperArgs to an array
+    declare -a _qtWrapperArgsTmp
+    concatTo _qtWrapperArgsTmp qtWrapperArgs
+    qtWrapperArgs=("${_qtWrapperArgsTmp[@]}")
+    unset _qtWrapperArgsTmp
 
     qtHostPathSeen=()
 
diff --git a/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix b/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
index e43ff3b6e3ac..e9010031e879 100644
--- a/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
+++ b/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
@@ -68,6 +68,7 @@ let
         inherit qtWrapperArgs;
         buildInputs = [ qtbase ];
         nativeBuildInputs = [ wrapQtAppsHook ];
+        __structuredAttrs = true;
       }
       ''
         ${lib.toShellVars {
@@ -126,7 +127,7 @@ let
       '';
 in
 
-{
+lib.fix (self: {
 
   simple = checkWrapperArgsArray {
     name = "simple";
@@ -136,6 +137,11 @@ in
     ];
   };
 
+  simple-no-structuredAttrs = self.simple.overrideAttrs (prevAttrs: {
+    name = prevAttrs.name + "-no-structuredAttrs";
+    __structuredAttrs = false;
+  });
+
   # Integration test: assert program is wrapped with the expected environment
   runtime =
     runCommandLocal "simple-wrapper-runtime"
@@ -148,6 +154,7 @@ in
 
         buildInputs = [ qtbase ];
         nativeBuildInputs = [ wrapQtAppsHook ];
+        __structuredAttrs = true;
       }
       ''
         # Install the test program
@@ -159,4 +166,9 @@ in
         "$out/bin/test"
       '';
 
-}
+  runtime-no-structuredAttrs = self.runtime.overrideAttrs (prevAttrs: {
+    name = prevAttrs.name + "-no-structuredAttrs";
+    __structuredAttrs = false;
+  });
+
+})

From 00afd89038299abbf2c32c34b46299087e94e9a9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 4 Jun 2026 03:32:33 +0200
Subject: [PATCH 0535/1209] python3Packages.sphinx-autodoc-typehints: 3.10.2 ->
 3.10.5

https://github.com/tox-dev/sphinx-autodoc-typehints/releases/tag/3.10.5
---
 .../python-modules/sphinx-autodoc-typehints/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index fcfc2e4b9893..a084e1a54962 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sphinx-autodoc-typehints";
-  version = "3.10.2";
+  version = "3.10.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "sphinx-autodoc-typehints";
     tag = finalAttrs.version;
-    hash = "sha256-ZdUKD8qUWjndhkqnUVk9NoSFgH/Fl2yG7LKHUB4T9CA=";
+    hash = "sha256-ClRfCv3UvUdnSnm5XuyrWj8oFQMSAPb3ZCDokAWI4cE=";
   };
 
   build-system = [

From e1696ec3f65797711183e94344b9dc273a8ab929 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 4 Jun 2026 15:25:22 +0700
Subject: [PATCH 0536/1209] python3Packages.asgiref: 3.11.0 -> 3.11.1

Release: https://github.com/django/asgiref/releases/tag/3.11.1
Diff: https://github.com/django/asgiref/compare/3.11.0...3.11.1
---
 pkgs/development/python-modules/asgiref/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index c0740de29df9..516fb48f8b5f 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -10,7 +10,7 @@
 }:
 
 buildPythonPackage (finalAttrs: {
-  version = "3.11.0";
+  version = "3.11.1";
   pname = "asgiref";
   pyproject = true;
 
@@ -18,7 +18,7 @@ buildPythonPackage (finalAttrs: {
     owner = "django";
     repo = "asgiref";
     tag = finalAttrs.version;
-    hash = "sha256-2ZaUIWGF5cQVNj95b7WiKGsn2wYsoJmJ/CfPhIEZdjc=";
+    hash = "sha256-Mhnaowgv5a+O2hN0ZSdtdhCBQx8HoKSwtRC3gHodgKY=";
   };
 
   build-system = [ setuptools ];

From 1d5b338a702df84b5bca635b589a23ef88cbe4ae Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 4 Jun 2026 14:32:05 +0200
Subject: [PATCH 0537/1209] coqPackages_8_20.coq-elpi: fix build

coqPackages_8_20.stalmarck-tactic: fix build
---
 pkgs/applications/science/logic/coq/default.nix    | 14 ++++++++++++++
 pkgs/by-name/du/dune/package.nix                   |  1 +
 pkgs/development/coq-modules/coq-elpi/default.nix  |  3 ++-
 pkgs/development/coq-modules/stalmarck/default.nix |  3 ++-
 pkgs/top-level/coq-packages.nix                    |  1 +
 5 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index a5f7e9e861aa..cee47f70a062 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -105,11 +105,25 @@ let
     substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
     substituteInPlace plugins/micromega/coq_micromega.ml --replace "System.is_in_system_path \"csdp\"" "true"
   '';
+  dune =
+    if lib.versions.isEq coq-version "8.20" then
+      args.dune.override { version = "3.21.1"; }
+    else
+      args.dune;
   ocamlPackages =
     if customOCamlPackages != null then
       customOCamlPackages
     else
       lib.switch coq-version [
+        {
+          case = lib.versions.isEq "8.20";
+          out = ocamlPackages_4_14.overrideScope (
+            self: super: {
+              inherit dune;
+              dune_3 = dune;
+            }
+          );
+        }
         {
           case = lib.versions.range "8.16" "9.1";
           out = ocamlPackages_4_14;
diff --git a/pkgs/by-name/du/dune/package.nix b/pkgs/by-name/du/dune/package.nix
index e4aa233bf37b..0dfaf0a82ca8 100644
--- a/pkgs/by-name/du/dune/package.nix
+++ b/pkgs/by-name/du/dune/package.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation {
     hash =
       {
         "3.22.2" = "sha256-wsz4vGsXr6R8RQKXNXSWMDqnyGgOMpt52Yxo41AToRg=";
+        "3.21.1" = "sha256-hPeoLG2ApxJPOEfppInoDPvq+3vtNXOsAShu9W/QjZQ=";
         "2.9.3" = "sha256:1ml8bxym8sdfz25bx947al7cvsi2zg5lcv7x9w6xb01cmdryqr9y";
       }
       ."${version}";
diff --git a/pkgs/development/coq-modules/coq-elpi/default.nix b/pkgs/development/coq-modules/coq-elpi/default.nix
index b0134851418b..0f8f15d72388 100644
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@@ -2,6 +2,7 @@
   lib,
   mkCoqDerivation,
   which,
+  dune,
   coq,
   stdlib,
   version ? null,
@@ -33,7 +34,7 @@ let
   propagatedBuildInputs_wo_elpi = [
     coq.ocamlPackages.findlib
   ];
-  derivation = mkCoqDerivation {
+  derivation = mkCoqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
     pname = "elpi";
     repo = "coq-elpi";
     owner = "LPCIC";
diff --git a/pkgs/development/coq-modules/stalmarck/default.nix b/pkgs/development/coq-modules/stalmarck/default.nix
index e493321d8a0a..369fea9639e3 100644
--- a/pkgs/development/coq-modules/stalmarck/default.nix
+++ b/pkgs/development/coq-modules/stalmarck/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   mkCoqDerivation,
+  dune,
   coq,
   stdlib,
   version ? null,
@@ -38,7 +39,7 @@ let
         else
           "A two-level approach to prove tautologies using Stålmarck's algorithm in Coq.";
     in
-    mkCoqDerivation {
+    mkCoqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
       inherit
         version
         pname
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index b2cd7f2ada19..a93fb26666c9 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -17,6 +17,7 @@
   fetchpatch,
   makeWrapper,
   coq2html,
+  dune,
 }@args:
 let
   lib = import ../build-support/coq/extra-lib.nix { inherit (args) lib; };

From d59aeb80e50481c69e9535b6421c84a4a398531f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 4 Jun 2026 17:38:16 +0200
Subject: [PATCH 0538/1209] perl: backport security fixes

Perl ships with some CPAN modules vendored as "dual-life", this commit
inject updated versions certain modules directly from CPAN rather than
applying patches from upstream, as they can be tricky to maintain.

It also includes a patch for CVE-2026-8376 which affects 32-bit
platforms.

- perl: CVE-2026-8376
  https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c

- HTTP-Tiny 0.094: CVE-2026-7010
  https://metacpan.org/release/HAARG/HTTP-Tiny-0.094/changes

- Compress-Raw-Zlib 2.222: CVE-2026-3381, CVE-2026-4176
  https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.222/changes

- Compress-Raw-Bzip2 2.218
  https://metacpan.org/release/PMQS/Compress-Raw-Bzip2-2.218/changes

- IO-Compress 2.220: CVE-2026-48959, CVE-2026-48961, CVE-2026-48962
  https://metacpan.org/release/PMQS/IO-Compress-2.220/changes

- Archive-Tar 3.12: CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
  https://metacpan.org/release/BINGOS/Archive-Tar-3.12/changes

Assisted-by: Codex (OpenAI)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../interpreters/perl/CVE-2026-8376.patch     | 20 ++++++
 .../interpreters/perl/interpreter.nix         | 65 +++++++++++++++++--
 2 files changed, 81 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/interpreters/perl/CVE-2026-8376.patch

diff --git a/pkgs/development/interpreters/perl/CVE-2026-8376.patch b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
new file mode 100644
index 000000000000..c8ad72298178
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
@@ -0,0 +1,20 @@
+Targeted patch for CVE-2026-8376, based on 5e7f119eb2bb1181be908701f22bf7068e722f1c but avoids changes to t/re/pat_psycho.t as they do not apply cleanly.
+
+diff --git a/regcomp_study.c b/regcomp_study.c
+index b513454a4258..1602663f4b26 100644
+--- a/regcomp_study.c
++++ b/regcomp_study.c
+@@ -2784,6 +2784,13 @@ Perl_study_chunk(pTHX_
+                                                (U8 *) SvEND(data->last_found))
+                                 - (U8*)s;
+                         l -= old;
++
++                        if (l > 0 &&
++                            (mincount >= SSize_t_MAX / (SSize_t)l
++                             || old > SSize_t_MAX - mincount * (SSize_t)l)) {
++                            FAIL("Regexp out of space");
++                        }
++
+                         /* Get the added string: */
+                         last_str = newSVpvn_utf8(s  + old, l, UTF);
+                         last_chrs = UTF ? utf8_length((U8*)(s + old),
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index fce8e1c9e0f0..cdb03912b517 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -36,6 +36,8 @@ let
   commonPatches = [
     # Do not look in /usr etc. for dependencies.
     ./no-sys-dirs.patch
+
+    ./CVE-2026-8376.patch
   ]
 
   # Fix build on Solaris on x86_64
@@ -79,6 +81,61 @@ let
   # Some more details: https://arsv.github.io/perl-cross/modules.html
   ++ lib.optional crossCompiling ./cross.patch;
 
+  # Inject fixed CPAN releases for bundled dual-life distributions until the
+  # next perl maintenance release includes them.
+  vendoredPerlDistributions = [
+    {
+      # CVE-2026-7010
+      path = "cpan/HTTP-Tiny";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/H/HA/HAARG/HTTP-Tiny-0.094.tar.gz";
+        hash = "sha256-poQemfwbVdFd6VlHzL17dnvsxRxxAhl/qPBE333cB0M=";
+      };
+    }
+    {
+      # CVE-2026-3381, CVE-2026-4176
+      path = "cpan/Compress-Raw-Zlib";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.222.tar.gz";
+        hash = "sha256-Hf19URplVifIGBXTDTurwo+luIRV/wP4sECZ3LUShrg=";
+      };
+    }
+    {
+      # Runtime dependency of IO-Compress 2.220.
+      path = "cpan/Compress-Raw-Bzip2";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.218.tar.gz";
+        hash = "sha256-iRU+ai69pSNJSTsHT6S3VJ/x+QU952E8GKXgXFtBX6g=";
+      };
+    }
+    {
+      # CVE-2026-48962, CVE-2026-48961, CVE-2026-48959
+      path = "cpan/IO-Compress";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
+        hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
+      };
+    }
+    {
+      # CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
+      path = "cpan/Archive-Tar";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.12.tar.gz";
+        hash = "sha256-ARTvObZfSfiWgoOrR3Gdfoj5jXNg/jZJvjMcf1PVgyw=";
+      };
+    }
+  ];
+
+  replaceVendoredPerlDistributions = lib.concatMapStringsSep "\n" (d: ''
+    rm -rf ${d.path}
+    mkdir -p ${d.path}
+
+    tar --strip-components=1 -C ${d.path} -xf ${d.src}
+
+    # Remove executable bits to make t/porting/exec-bit.t happy.
+    find ${d.path} -type f -exec chmod a-x {} +
+  '') vendoredPerlDistributions;
+
   libc = if stdenv.cc.libc or null != null then stdenv.cc.libc else "/usr";
   libcInc = lib.getDev libc;
   libcLib = lib.getLib libc;
@@ -136,10 +193,10 @@ stdenv.mkDerivation (
               --replace "/bin/pwd" "$(type -P pwd)"
           ''
       )
-      +
-      # Perl's build system uses the src variable, and its value may end up in
-      # the output in some cases (when cross-compiling)
-      ''
+      + replaceVendoredPerlDistributions
+      + ''
+        # Perl's build system uses the src variable, and its value may end up in
+        # the output in some cases (when cross-compiling).
         unset src
       '';
 

From a42608a7a8c0d84c9ef80ab8acb05507052e6bbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 4 Jun 2026 09:47:51 -0700
Subject: [PATCH 0539/1209] krb5: patch CVE-2026-40355 and CVE-2026-40356

---
 .../CVE-2026-40355-and-CVE-2026-40356.patch   | 61 +++++++++++++++++++
 pkgs/by-name/kr/krb5/package.nix              |  6 +-
 2 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch

diff --git a/pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch b/pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch
new file mode 100644
index 000000000000..fe37f894fdc4
--- /dev/null
+++ b/pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch
@@ -0,0 +1,61 @@
+From acea6182e46fff3d1d64a3172cdff307b07ca441 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 8 Apr 2026 17:57:59 -0400
+Subject: [PATCH] Fix two NegoEx parsing vulnerabilities
+
+In parse_nego_message(), check the result of the second call to
+vector_base() before dereferencing it.  In parse_message(), check for
+a short header_len to prevent an integer underflow when calculating
+the remaining message length.
+
+Reported by Cem Onat Karagun.
+
+CVE-2026-40355:
+
+In MIT krb5 release 1.18 and later, if an application calls
+gss_accept_sec_context() on a system with a NegoEx mechanism
+registered in /etc/gss/mech, an unauthenticated remote attacker can
+trigger a null pointer dereference, causing the process to terminate.
+
+CVE-2026-40356:
+
+In MIT krb5 release 1.18 and later, if an application calls
+gss_accept_sec_context() on a system with a NegoEx mechanism
+registered in /etc/gss/mech, an unauthenticated remote attacker can
+trigger a read overrun of up to 52 bytes, possibly causing the process
+to terminate.  Exfiltration of the bytes read does not appear
+possible.
+
+(cherry picked from commit 2e75f0d9362fb979f5fc92829431a590a130929f)
+
+ticket: 9205
+version_fixed: 1.22.3
+---
+ lib/gssapi/spnego/negoex_util.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/gssapi/spnego/negoex_util.c b/src/lib/gssapi/spnego/negoex_util.c
+index edc5462e844..a65238e5730 100644
+--- a/lib/gssapi/spnego/negoex_util.c
++++ b/lib/gssapi/spnego/negoex_util.c
+@@ -253,6 +253,10 @@ parse_nego_message(OM_uint32 *minor, struct k5input *in,
+     offset = k5_input_get_uint32_le(in);
+     count = k5_input_get_uint16_le(in);
+     p = vector_base(offset, count, EXTENSION_LENGTH, msg_base, msg_len);
++    if (p == NULL) {
++        *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
++        return GSS_S_DEFECTIVE_TOKEN;
++    }
+     for (i = 0; i < count; i++) {
+         extension_type = load_32_le(p + i * EXTENSION_LENGTH);
+         if (extension_type & EXTENSION_FLAG_CRITICAL) {
+@@ -391,7 +395,8 @@ parse_message(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, struct k5input *in,
+     msg_len = k5_input_get_uint32_le(in);
+     conv_id = k5_input_get_bytes(in, GUID_LENGTH);
+ 
+-    if (in->status || msg_len > token_remaining || header_len > msg_len) {
++    if (in->status || msg_len > token_remaining ||
++        header_len < (size_t)(in->ptr - msg_base) || header_len > msg_len) {
+         *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
+         return GSS_S_DEFECTIVE_TOKEN;
+     }
diff --git a/pkgs/by-name/kr/krb5/package.nix b/pkgs/by-name/kr/krb5/package.nix
index 3c402ff11721..c4e35061d41a 100644
--- a/pkgs/by-name/kr/krb5/package.nix
+++ b/pkgs/by-name/kr/krb5/package.nix
@@ -43,7 +43,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-MkP/vI6k1Kwi3cfdKh3FTFeHTEBki2D/lwCXY1VOrxM=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isFreeBSD [
+  patches = [
+    # https://github.com/krb5/krb5/pull/1506
+    ./CVE-2026-40355-and-CVE-2026-40356.patch
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
     (fetchpatch {
       name = "fix-missing-ENODATA.patch";
       url = "https://cgit.freebsd.org/ports/plain/security/krb5-122/files/patch-lib_krad_packet.c?id=0501f716c4aff7880fde56e42d641ef504593b7d";

From 41a37cc08306ebf7b9036d364f9e4266ec3600b3 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Thu, 4 Jun 2026 22:08:37 +0200
Subject: [PATCH 0540/1209] apparmor-parser: pick upstream patch for yacc
 format-security issues

---
 pkgs/by-name/ap/apparmor-parser/package.nix | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix
index 0191929c5efe..de39713f0c10 100644
--- a/pkgs/by-name/ap/apparmor-parser/package.nix
+++ b/pkgs/by-name/ap/apparmor-parser/package.nix
@@ -7,6 +7,7 @@
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   buildPackages,
   zstd,
+  fetchpatch,
 
   # apparmor deps
   libapparmor,
@@ -34,15 +35,17 @@ stdenv.mkDerivation (finalAttrs: {
 
     substituteInPlace Makefile \
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-
-    # strict format check causes yacc auto-generated code to fail.
-    # This is known, see https://gitlab.com/apparmor/apparmor/-/merge_requests/2039
-    # removing the compile-time check here downgrades the issue and allows compilation to succeed
-    substituteInPlace parser.h \
-      --replace-fail 'extern void yyerror(const char *msg, ...) __attribute__((noreturn, format(printf, 1, 2)));' \
-        'extern void yyerror(const char *msg, ...);'
   '';
 
+  patches = [
+    (fetchpatch {
+      # https://gitlab.com/apparmor/apparmor/-/merge_requests/2133
+      # Patches generated yacc parser code to compile with format-security
+      url = "https://gitlab.com/apparmor/apparmor/-/commit/6bdec74d5e74660b97e00b4b8fafc014b05907b7.diff";
+      hash = "sha256-7c5EFByrGIDj2lc31bRttyeybwndDm4iS4qdPMVaG/I=";
+    })
+  ];
+
   nativeBuildInputs = [
     bison
     flex

From 1248ec4209746baabbda8bea23f4333f5aef8f1c Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Thu, 4 Jun 2026 21:23:45 -0400
Subject: [PATCH 0541/1209] seatd: replace systemd dependency with systemdLibs

---
 pkgs/by-name/se/seatd/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/seatd/package.nix b/pkgs/by-name/se/seatd/package.nix
index 7c11389a81c5..759ac9650f53 100644
--- a/pkgs/by-name/se/seatd/package.nix
+++ b/pkgs/by-name/se/seatd/package.nix
@@ -6,8 +6,8 @@
   pkg-config,
   scdoc,
   stdenv,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   nixosTests,
 }:
 
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     scdoc
   ];
 
-  buildInputs = lib.optionals systemdSupport [ systemd ];
+  buildInputs = lib.optionals systemdSupport [ systemdLibs ];
 
   mesonFlags = [
     "-Dlibseat-logind=${if systemdSupport then "systemd" else "disabled"}"

From 439b608eaad9ebf2865ac28173b4b1a8b10e7a97 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 4 Jun 2026 19:41:36 +0700
Subject: [PATCH 0542/1209] python3Packages.appnope: migrate to pyproject

---
 pkgs/development/python-modules/appnope/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/appnope/default.nix b/pkgs/development/python-modules/appnope/default.nix
index 55a66aaf8271..3bf73257df54 100644
--- a/pkgs/development/python-modules/appnope/default.nix
+++ b/pkgs/development/python-modules/appnope/default.nix
@@ -2,13 +2,14 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "appnope";
   version = "0.1.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "minrk";
@@ -17,6 +18,8 @@ buildPythonPackage rec {
     hash = "sha256-We7sZKVbQFIMdZpS+VMdi0RH1O/qtFNrfJNg/98tO5A=";
   };
 
+  build-system = [ setuptools ];
+
   checkInputs = [ pytestCheckHook ];
 
   meta = {

From ff068130907f799841650773ab49b0ed07a40c75 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 4 Jun 2026 19:47:12 +0700
Subject: [PATCH 0543/1209] python3Packages.appnope: modernize

---
 pkgs/development/python-modules/appnope/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/appnope/default.nix b/pkgs/development/python-modules/appnope/default.nix
index 3bf73257df54..3a621522f28b 100644
--- a/pkgs/development/python-modules/appnope/default.nix
+++ b/pkgs/development/python-modules/appnope/default.nix
@@ -6,7 +6,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "appnope";
   version = "0.1.4";
   pyproject = true;
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "minrk";
     repo = "appnope";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-We7sZKVbQFIMdZpS+VMdi0RH1O/qtFNrfJNg/98tO5A=";
   };
 
@@ -22,6 +22,8 @@ buildPythonPackage rec {
 
   checkInputs = [ pytestCheckHook ];
 
+  pythonImportsCheck = [ "appnope" ];
+
   meta = {
     description = "Disable App Nap on macOS";
     homepage = "https://github.com/minrk/appnope";
@@ -29,4 +31,4 @@ buildPythonPackage rec {
     maintainers = with lib.maintainers; [ OPNA2608 ];
     # Not Darwin-specific because dummy fallback may be used cross-platform
   };
-}
+})

From bf40241078d01a2c76bcfdc04fbc534574c0d908 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 4 Jun 2026 19:51:05 +0700
Subject: [PATCH 0544/1209] python3Packages.appnope: add meta.changelog

---
 pkgs/development/python-modules/appnope/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/appnope/default.nix b/pkgs/development/python-modules/appnope/default.nix
index 3a621522f28b..12e720eb3618 100644
--- a/pkgs/development/python-modules/appnope/default.nix
+++ b/pkgs/development/python-modules/appnope/default.nix
@@ -27,6 +27,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Disable App Nap on macOS";
     homepage = "https://github.com/minrk/appnope";
+    changelog = "https://github.com/minrk/appnope/releases/tag/${finalAttrs.version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ OPNA2608 ];
     # Not Darwin-specific because dummy fallback may be used cross-platform

From 54439a1843c029099bcb8a82ca0afc089148e9e7 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Fri, 5 Jun 2026 06:41:48 +0300
Subject: [PATCH 0545/1209] procps: enable `__structuredAttrs` & `strictDeps`

---
 pkgs/os-specific/linux/procps-ng/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index ecd877096f93..b12df1dce429 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [ "usrbin_execdir=$(out)/bin" ] ++ lib.optionals watchOnly [ "src/watch" ];
 
   enableParallelBuilding = true;
+  strictDeps = true;
+  __structuredAttrs = true;
 
   # Too red; 8bit support for fixing https://github.com/NixOS/nixpkgs/issues/275220
   configureFlags = [

From d4e5c45837e5dedccf65e60f9955e5661a9af9fb Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Fri, 5 Jun 2026 06:43:42 +0300
Subject: [PATCH 0546/1209] procps: add `doc`, `man`, `dev` outputs

---
 pkgs/os-specific/linux/procps-ng/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index b12df1dce429..ff53296d9aba 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -31,6 +31,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Z76m+8OkKlNaAjDJ6JHl3ftNnTlCLUZWWimQ0azhUhY=";
   };
 
+  outputs = [
+    "out"
+    "man"
+    "dev"
+  ]
+  ++ lib.optionals (!watchOnly) [
+    "doc"
+  ];
+
   buildInputs = [ ncurses ] ++ lib.optionals withSystemd [ systemdLibs ];
   nativeBuildInputs = [
     pkg-config

From 316db7c96c1096ae2bf0a40bdec1fc630e1498a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 5 Jun 2026 12:52:54 +0200
Subject: [PATCH 0547/1209] libpng: 1.6.56 -> 1.6.58

Fixes: CVE-2026-34757 and CVE-2026-40930 (#528286)
---
 pkgs/by-name/li/libpng/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/li/libpng/package.nix b/pkgs/by-name/li/libpng/package.nix
index d533f3ed56bb..7d52bcffb378 100644
--- a/pkgs/by-name/li/libpng/package.nix
+++ b/pkgs/by-name/li/libpng/package.nix
@@ -11,10 +11,10 @@
 assert zlib != null;
 
 let
-  patchVersion = "1.6.56";
+  patchVersion = "1.6.58";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    hash = "sha256-nOMtSidjoqxfJYcmui9J6QETJ8HujDCGKjLQ8wiJ++g=";
+    hash = "sha256-7ufeoi7VAoaAF5cchsY8TtHmCF3guuv9zD0zIvAPPrA=";
   };
   whenPatched = lib.optionalString apngSupport;
 
@@ -24,11 +24,11 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "libpng" + whenPatched "-apng";
-  version = "1.6.56";
+  version = "1.6.58";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${finalAttrs.version}.tar.xz";
-    hash = "sha256-99i/FgG3gE9YOiVKs0OmVJymzyfSVcMCxHry2dNqbxg=";
+    hash = "sha256-KOtAP1Hw90BSSRMs7P6C6lwO+X8bMsWmWCiBSuDTR3U=";
   };
   postPatch =
     whenPatched "gunzip < ${patch_src} | patch -Np1"

From e049e243cb58d7e4430aec87f7b5ccb66a12e66b Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Fri, 5 Jun 2026 08:45:42 -0400
Subject: [PATCH 0548/1209] groff: set meta.mainProgram

---
 pkgs/by-name/gr/groff/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/gr/groff/package.nix b/pkgs/by-name/gr/groff/package.nix
index a824d9a82f02..260dda44e791 100644
--- a/pkgs/by-name/gr/groff/package.nix
+++ b/pkgs/by-name/gr/groff/package.nix
@@ -193,6 +193,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ pSub ];
+    mainProgram = "groff";
 
     longDescription = ''
       groff is the GNU implementation of troff, a document formatting

From a3cd26c1e597242b9748b2c9826259d0bb258fa5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 5 Jun 2026 12:08:29 -0700
Subject: [PATCH 0549/1209] bluez: support libical 4.0

---
 pkgs/by-name/bl/bluez/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/bl/bluez/package.nix b/pkgs/by-name/bl/bluez/package.nix
index 20a9bcce09da..81ec00b045ca 100644
--- a/pkgs/by-name/bl/bluez/package.nix
+++ b/pkgs/by-name/bl/bluez/package.nix
@@ -44,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=21e13976f2e375d701b8b7032ba5c1b2e56c305f";
       hash = "sha256-JrdmYiC+U0KeMP8oVg12Z8CvkMEKWBVgiiUACx0E7dY=";
     })
+    (fetchpatch2 {
+      name = "support-libical-4.0.patch";
+      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=e60d07255327db3fc4e3a28d7fcc792cd42c34d0";
+      hash = "sha256-1uw+5nTjh+t1/L++fRNIlQWblwDwTJifH0EvAn3dym8=";
+    })
     ./lreadline.patch
   ];
 

From 42ccf4cdaf07008fd84ddcf385b104558d526d7b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 5 Jun 2026 13:14:40 -0700
Subject: [PATCH 0550/1209] Revert "libical: 3.0.20 -> 4.0.2"

This reverts commit aca9a4c78cacffd210b8e55ba9f47ae3fe372ac5 because it
broke too many reverse dependencies.
---
 pkgs/by-name/li/libical/package.nix           |  26 ++-
 .../li/libical/respect-env-tzdir.patch        |  29 +++
 pkgs/by-name/li/libical/static.patch          | 205 ++++++++++++++++++
 3 files changed, 250 insertions(+), 10 deletions(-)
 create mode 100644 pkgs/by-name/li/libical/respect-env-tzdir.patch
 create mode 100644 pkgs/by-name/li/libical/static.patch

diff --git a/pkgs/by-name/li/libical/package.nix b/pkgs/by-name/li/libical/package.nix
index e0366ede8ad7..63b3fae8a7ec 100644
--- a/pkgs/by-name/li/libical/package.nix
+++ b/pkgs/by-name/li/libical/package.nix
@@ -16,7 +16,6 @@
   fixDarwinDylibNames,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
-    && !stdenv.hostPlatform.isStatic
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
   buildPackages,
   gobject-introspection,
@@ -25,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libical";
-  version = "4.0.2";
+  version = "3.0.20";
 
   outputs = [
     "out"
@@ -35,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libical";
     repo = "libical";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-xrPG3FBUY5OCEHBqcNN4Rj4c4j7kLXUsC0hXRRh76Vg=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-KIMqZ6QAh+fTcKEYrcLlxgip91CLAwL9rwjUdKzBsQk=";
   };
 
   strictDeps = true;
@@ -80,17 +79,24 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DLIBICAL_GLIB_BUILD_DOCS=False"
+    "-DENABLE_GTK_DOC=False"
     "-DLIBICAL_BUILD_EXAMPLES=False"
-    "-DLIBICAL_JAVA_BINDINGS=False"
-    "-DLIBICAL_GOBJECT_INTROSPECTION=${if withIntrospection then "True" else "False"}"
-    "-DLIBICAL_GLIB_VAPI=${if withIntrospection then "True" else "False"}"
-    "-DLIBICAL_STATIC=${if stdenv.hostPlatform.isStatic then "True" else "False"}"
+    "-DGOBJECT_INTROSPECTION=${if withIntrospection then "True" else "False"}"
+    "-DICAL_GLIB_VAPI=${if withIntrospection then "True" else "False"}"
+    "-DSTATIC_ONLY=${if stdenv.hostPlatform.isStatic then "True" else "False"}"
   ]
   ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "-DIMPORT_ICAL_GLIB_SRC_GENERATOR=${lib.getDev pkgsBuildBuild.libical}/lib/cmake/LibIcal/IcalGlibSrcGenerator.cmake"
   ];
 
+  patches = [
+    # Will appear in 3.1.0
+    # https://github.com/libical/libical/issues/350
+    ./respect-env-tzdir.patch
+
+    ./static.patch
+  ];
+
   # Using install check so we do not have to manually set GI_TYPELIB_PATH
   # Musl does not support TZDIR.
   doInstallCheck = !stdenv.hostPlatform.isMusl;
@@ -118,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/libical/libical";
     description = "Open Source implementation of the iCalendar protocols";
-    changelog = "https://github.com/libical/libical/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/libical/libical/raw/v${finalAttrs.version}/ReleaseNotes.txt";
     license = lib.licenses.mpl20;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/li/libical/respect-env-tzdir.patch b/pkgs/by-name/li/libical/respect-env-tzdir.patch
new file mode 100644
index 000000000000..59d23e490e5a
--- /dev/null
+++ b/pkgs/by-name/li/libical/respect-env-tzdir.patch
@@ -0,0 +1,29 @@
+--- a/src/libical/icaltz-util.c
++++ b/src/libical/icaltz-util.c
+@@ -94,9 +94,9 @@
+ static const char *zdir = NULL;
+ 
+ static const char *search_paths[] = {
++    "/etc/zoneinfo",
+     "/usr/share/zoneinfo",
+     "/usr/lib/zoneinfo",
+-    "/etc/zoneinfo",
+     "/usr/share/lib/zoneinfo"
+ };
+ 
+@@ -178,6 +178,15 @@
+     const char *fname = ZONES_TAB_SYSTEM_FILENAME;
+     size_t i, num_search_paths;
+ 
++   const char *env_tzdir = getenv ("TZDIR");
++   if (env_tzdir) {
++       sprintf (file_path, "%s/%s", env_tzdir, fname);
++       if (!access (file_path, F_OK|R_OK)) {
++           zdir = env_tzdir;
++           return;
++       }
++   }
++
+     num_search_paths = sizeof(search_paths) / sizeof(search_paths[0]);
+     for (i = 0; i < num_search_paths; i++) {
+         snprintf(file_path, MAXPATHLEN, "%s/%s", search_paths[i], fname);
diff --git a/pkgs/by-name/li/libical/static.patch b/pkgs/by-name/li/libical/static.patch
new file mode 100644
index 000000000000..23678ecd50a6
--- /dev/null
+++ b/pkgs/by-name/li/libical/static.patch
@@ -0,0 +1,205 @@
+From 38fe473fb2c90960a64ddda5c4305d958d460e05 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Thu, 3 Jul 2025 19:52:23 +0200
+Subject: [PATCH] Link ICU components in the right order
+
+When static linking, a library that refers to symbols in another
+library has to come before the latter library in the linker command
+line.
+
+Before this change, I get linker errors like the following.  With this
+change, no error.
+
+FAILED: src/test/icalrecurtest
+: && /nix/store/m8ggqv2dfrw6raz49ipnnab98cljx1k2-x86_64-unknown-linux-musl-gcc-wrapper-14.3.0/bin/x86_64-unknown-linux-musl-g++ -O2       -fvisibility=hidden       -Weffc++ -Wno-deprecated -Wall -Wextra -Woverloaded-virtual -Winit-self -Wunused       -Wno-div-by-zero -Wundef -Wpointer-arith -Wtype-limits -Wwrite-strings -Wreturn-type -Wunused-but-set-variable -Wlogical-op -Wsizeof-pointer-memaccess -Wreorder -Wformat-security -Wredundant-decls -Wunreachable-code -Wvarargs -D_XOPEN_SOURCE=500 -D_DEFAULT_SOURCE -D_GNU_SOURCE -Wall -Wextra -Wformat -Wformat=2 -Wconversion -Wsign-conversion -Wtrampolines -Wimplicit-fallthrough -Wbidi-chars=any -Wformat-security -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS -fstrict-flex-arrays=3 -fstack-clash-protection -fstack-protector-strong -fcf-protection=full -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -O3 -DNDEBUG -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,relro -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,relro -Wl,--as-needed -Wl,--no-copy-dt-needed-entries src/test/CMakeFiles/icalrecurtest.dir/icalrecur_test.c.o -o src/test/icalrecurtest  lib/libical.a  lib/libicalss.a  lib/libicalvcal.a  lib/libical.a  /nix>
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_getAvailable_76':
+(.text.ucal_getAvailable_76+0x1): undefined reference to `uloc_getAvailable_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_countAvailable_76':
+(.text.ucal_countAvailable_76+0x1): undefined reference to `uloc_countAvailable_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_getKeywordValuesForLocale_76':
+(.text.ucal_getKeywordValuesForLocale_76+0xec): undefined reference to `ulist_createEmptyList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x132): undefined reference to `ulist_resetList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x260): undefined reference to `ulist_addItemEndList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x2e2): undefined reference to `ulist_containsString_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x2f6): undefined reference to `ulist_addItemEndList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x304): undefined reference to `ulist_deleteList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x333): undefined reference to `ulist_deleteList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x10): undefined reference to `ulist_close_keyword_values_iterator_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x18): undefined reference to `ulist_count_keyword_values_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x28): undefined reference to `ulist_next_keyword_value_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x30): undefined reference to `ulist_reset_keyword_values_iterator_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::SharedCalendar::~SharedCalendar()':
+(.text._ZN6icu_7614SharedCalendarD2Ev+0x32): undefined reference to `icu_76::SharedObject::~SharedObject()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::BasicCalendarFactory::~BasicCalendarFactory()':
+(.text._ZN6icu_7620BasicCalendarFactoryD2Ev+0xf): undefined reference to `icu_76::LocaleKeyFactory::~LocaleKeyFactory()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::DefaultCalendarFactory::~DefaultCalendarFactory()':
+(.text._ZN6icu_7622DefaultCalendarFactoryD2Ev+0xf): undefined reference to `icu_76::ICUResourceBundleFactory::~ICUResourceBundleFactory()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::CalendarService::~CalendarService()':
+(.text._ZN6icu_7615CalendarServiceD2Ev+0xf): undefined reference to `icu_76::ICULocaleService::~ICULocaleService()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::clone() const':
+(.text._ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE5cloneEv[_ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE5cloneEv]+0x65): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::CalendarService::isDefault() const':
+(.text._ZNK6icu_7615CalendarService9isDefaultEv[_ZNK6icu_7615CalendarService9isDefaultEv]+0x5): undefined reference to `icu_76::ICUService::countFactories() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::initCalendarService(UErrorCode&) [clone .cold]':
+(.text.unlikely._ZN6icu_76L19initCalendarServiceER10UErrorCode+0x16): undefined reference to `icu_76::ICULocaleService::~ICULocaleService()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::initCalendarService(UErrorCode&)':
+(.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xa9): undefined reference to `icu_76::ICULocaleService::ICULocaleService(icu_76::UnicodeString const&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xe1): undefined reference to `icu_76::ICUResourceBundleFactory::ICUResourceBundleFactory()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xfe): undefined reference to `icu_76::ICUService::registerFactory(icu_76::ICUServiceFactory*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0x12c): undefined reference to `icu_76::LocaleKeyFactory::LocaleKeyFactory(int)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getAvailableLocales(int&)':
+(.text._ZN6icu_768Calendar19getAvailableLocalesERi+0x1): undefined reference to `icu_76::Locale::getAvailableLocales(int&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getLocale(ULocDataLocaleType, UErrorCode&) const':
+(.text._ZNK6icu_768Calendar9getLocaleE18ULocDataLocaleTypeR10UErrorCode+0x34): undefined reference to `icu_76::LocaleBased::getLocale(ULocDataLocaleType, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getLocaleID(ULocDataLocaleType, UErrorCode&) const':
+(.text._ZNK6icu_768Calendar11getLocaleIDE18ULocDataLocaleTypeR10UErrorCode+0x30): undefined reference to `icu_76::LocaleBased::getLocaleID(ULocDataLocaleType, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::~LocaleCacheKey()':
+(.text._ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED2Ev[_ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED5Ev]+0x3b): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::setWeekData(icu_76::Locale const&, char const*, UErrorCode&)':
+(.text._ZN6icu_768Calendar11setWeekDataERKNS_6LocaleEPKcR10UErrorCode+0x31e): undefined reference to `icu_76::LocaleBased::setLocaleIDs(char const*, char const*)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::makeInstance(icu_76::Locale const&, UErrorCode&)':
+(.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0xd2): undefined reference to `icu_76::LocaleUtility::initLocaleFromName(icu_76::UnicodeString const&, icu_76::Locale&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0x112): undefined reference to `icu_76::ICULocaleService::get(icu_76::Locale const&, int, icu_76::Locale*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0x1d4): undefined reference to `icu_76::ICULocaleService::get(icu_76::Locale const&, int, icu_76::Locale*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::createObject(void const*, UErrorCode&) const':
+(.text._ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE12createObjectEPKvR10UErrorCode+0x69): undefined reference to `icu_76::SharedObject::addRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::DefaultCalendarFactory::create(icu_76::ICUServiceKey const&, icu_76::ICUService const*, UErrorCode&) const':
+(.text._ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x31): undefined reference to `typeinfo for icu_76::LocaleKey'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x38): undefined reference to `typeinfo for icu_76::ICUServiceKey'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::BasicCalendarFactory::create(icu_76::ICUServiceKey const&, icu_76::ICUService const*, UErrorCode&) const':
+(.text._ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x33): undefined reference to `typeinfo for icu_76::LocaleKey'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x3a): undefined reference to `typeinfo for icu_76::ICUServiceKey'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::~LocaleCacheKey()':
+(.text._ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED0Ev[_ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED5Ev]+0x36): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `void icu_76::UnifiedCache::getByLocale<icu_76::SharedCalendar>(icu_76::Locale const&, icu_76::SharedCalendar const*&, UErrorCode&)':
+(.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x2e): undefined reference to `icu_76::UnifiedCache::getInstance(UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0xdf): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x123): undefined reference to `icu_76::UnifiedCache::_get(icu_76::CacheKeyBase const&, icu_76::SharedObject const*&, void const*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x141): undefined reference to `icu_76::SharedObject::removeRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x186): undefined reference to `icu_76::SharedObject::removeRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x1a5): undefined reference to `icu_76::SharedObject::addRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x20c): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::createInstance(icu_76::TimeZone*, icu_76::Locale const&, UErrorCode&)':
+(.text._ZN6icu_768Calendar14createInstanceEPNS_8TimeZoneERKNS_6LocaleER10UErrorCode+0x56): undefined reference to `icu_76::SharedObject::removeRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getCalendarTypeFromLocale(icu_76::Locale const&, char*, int, UErrorCode&)':
+(.text._ZN6icu_768Calendar25getCalendarTypeFromLocaleERKNS_6LocaleEPciR10UErrorCode+0x69): undefined reference to `icu_76::SharedObject::removeRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7614SharedCalendarE[_ZTIN6icu_7614SharedCalendarE]+0x10): undefined reference to `typeinfo for icu_76::SharedObject'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_768CacheKeyINS_14SharedCalendarEEE[_ZTIN6icu_768CacheKeyINS_14SharedCalendarEEE]+0x10): undefined reference to `typeinfo for icu_76::CacheKeyBase'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7620BasicCalendarFactoryE[_ZTIN6icu_7620BasicCalendarFactoryE]+0x10): undefined reference to `typeinfo for icu_76::LocaleKeyFactory'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7622DefaultCalendarFactoryE[_ZTIN6icu_7622DefaultCalendarFactoryE]+0x10): undefined reference to `typeinfo for icu_76::ICUResourceBundleFactory'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7615CalendarServiceE[_ZTIN6icu_7615CalendarServiceE]+0x10): undefined reference to `typeinfo for icu_76::ICULocaleService'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x20): undefined reference to `icu_76::LocaleKeyFactory::getDynamicClassID() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x38): undefined reference to `icu_76::LocaleKeyFactory::getDisplayName(icu_76::UnicodeString const&, icu_76::Locale const&, icu_76::UnicodeString&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x40): undefined reference to `icu_76::LocaleKeyFactory::handlesKey(icu_76::ICUServiceKey const&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x48): undefined reference to `icu_76::LocaleKeyFactory::handleCreate(icu_76::Locale const&, int, icu_76::ICUService const*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x50): undefined reference to `icu_76::LocaleKeyFactory::getSupportedIDs(UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x20): undefined reference to `icu_76::ICUResourceBundleFactory::getDynamicClassID() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x30): undefined reference to `icu_76::LocaleKeyFactory::updateVisibleIDs(icu_76::Hashtable&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x38): undefined reference to `icu_76::LocaleKeyFactory::getDisplayName(icu_76::UnicodeString const&, icu_76::Locale const&, icu_76::UnicodeString&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x40): undefined reference to `icu_76::LocaleKeyFactory::handlesKey(icu_76::ICUServiceKey const&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x48): undefined reference to `icu_76::ICUResourceBundleFactory::handleCreate(icu_76::Locale const&, int, icu_76::ICUService const*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x50): undefined reference to `icu_76::ICUResourceBundleFactory::getSupportedIDs(UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x20): undefined reference to `icu_76::ICUNotifier::addListener(icu_76::EventListener const*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x28): undefined reference to `icu_76::ICUNotifier::removeListener(icu_76::EventListener const*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x30): undefined reference to `icu_76::ICUNotifier::notifyChanged()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x38): undefined reference to `icu_76::ICUService::acceptsListener(icu_76::EventListener const&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x40): undefined reference to `icu_76::ICUService::notifyListener(icu_76::EventListener&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x48): undefined reference to `icu_76::ICUService::getKey(icu_76::ICUServiceKey&, icu_76::UnicodeString*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x50): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::UnicodeString const&, signed char, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x58): undefined reference to `icu_76::ICUService::registerFactory(icu_76::ICUServiceFactory*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x60): undefined reference to `icu_76::ICUService::unregister(void const*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x68): undefined reference to `icu_76::ICUService::reset()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x78): undefined reference to `icu_76::ICULocaleService::createKey(icu_76::UnicodeString const*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x88): undefined reference to `icu_76::ICUService::createSimpleFactory(icu_76::UObject*, icu_76::UnicodeString const&, signed char, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x90): undefined reference to `icu_76::ICUService::reInitializeFactories()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xa0): undefined reference to `icu_76::ICUService::clearCaches()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xa8): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xb0): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, int, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xb8): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, int, int, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xc0): undefined reference to `icu_76::ICULocaleService::getAvailableLocales() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xc8): undefined reference to `icu_76::ICULocaleService::createKey(icu_76::UnicodeString const*, int, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(timezone.ao): in function `icu_76::TimeZone::parseCustomID(icu_76::UnicodeString const&, int&, int&, int&, int&)':
+(.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x6f): undefined reference to `u_strncasecmp_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0xf3): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x168): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x1cd): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseSingleLocalizedDigit(icu_76::UnicodeString const&, int, int&) const':
+(.text._ZNK6icu_7614TimeZoneFormat25parseSingleLocalizedDigitERKNS_13UnicodeStringEiRi+0x56): undefined reference to `u_charDigitValue_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetFieldsWithPattern(icu_76::UnicodeString const&, int, icu_76::UVector*, signed char, int&, int&, int&) const':
+(.text._ZNK6icu_7614TimeZoneFormat28parseOffsetFieldsWithPatternERKNS_13UnicodeStringEiPNS_7UVectorEaRiS6_S6_+0x116): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetLocalizedGMTPattern(icu_76::UnicodeString const&, int, signed char, int&) const':
+(.text._ZNK6icu_7614TimeZoneFormat30parseOffsetLocalizedGMTPatternERKNS_13UnicodeStringEiaRi+0x13e): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat30parseOffsetLocalizedGMTPatternERKNS_13UnicodeStringEiaRi+0x1a9): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetDefaultLocalizedGMT(icu_76::UnicodeString const&, int, int&) const':
+(.text._ZNK6icu_7614TimeZoneFormat30parseOffsetDefaultLocalizedGMTERKNS_13UnicodeStringEiRi+0x65): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetLocalizedGMT(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const':
+(.text._ZNK6icu_7614TimeZoneFormat23parseOffsetLocalizedGMTERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x121): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao):(.text._ZNK6icu_7614TimeZoneFormat23parseOffsetLocalizedGMTERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x1bb): more undefined references to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const' follow
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetISO8601(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const [clone .cold]':
+(.text.unlikely._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x4): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.unlikely._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0xc): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetISO8601(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const':
+(.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0xaf): undefined reference to `vtable for icu_76::ParsePosition'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x120): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x1c4): undefined reference to `vtable for icu_76::ParsePosition'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x207): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parse(UTimeZoneFormatStyle, icu_76::UnicodeString const&, icu_76::ParsePosition&, int, UTimeZoneFormatTimeType*) const [clone .cold]':
+(.text.unlikely._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x2c): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parse(UTimeZoneFormatStyle, icu_76::UnicodeString const&, icu_76::ParsePosition&, int, UTimeZoneFormatTimeType*) const':
+(.text._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x99): undefined reference to `vtable for icu_76::ParsePosition'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x2c6): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::getGenericLocationName(icu_76::UnicodeString const&)':
+(.text._ZN6icu_768TZGNCore22getGenericLocationNameERKNS_13UnicodeStringE+0x1ea): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore22getGenericLocationNameERKNS_13UnicodeStringE+0x342): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::getPartialLocationName(icu_76::UnicodeString const&, icu_76::UnicodeString const&, signed char, icu_76::UnicodeString const&)':
+(.text._ZN6icu_768TZGNCore22getPartialLocationNameERKNS_13UnicodeStringES3_aS3_+0x288): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::initialize(icu_76::Locale const&, UErrorCode&)':
+(.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x172): undefined reference to `icu_76::SimpleFormatter::applyPatternMinMaxArguments(icu_76::UnicodeString const&, int, int, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x18f): undefined reference to `icu_76::SimpleFormatter::applyPatternMinMaxArguments(icu_76::UnicodeString const&, int, int, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x1a5): undefined reference to `icu_76::LocaleDisplayNames::createInstance(icu_76::Locale const&, UDialectHandling)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::TZGNCore(icu_76::Locale const&, UErrorCode&) [clone .cold]':
+(.text.unlikely._ZN6icu_768TZGNCoreC2ERKNS_6LocaleER10UErrorCode+0x21): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.unlikely._ZN6icu_768TZGNCoreC2ERKNS_6LocaleER10UErrorCode+0x2d): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::~TZGNCore()':
+(.text._ZN6icu_768TZGNCoreD2Ev+0x48): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCoreD2Ev+0x54): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::formatGenericNonLocationName(icu_76::TimeZone const&, UTimeZoneGenericNameType, double, icu_76::UnicodeString&) const':
+(.text._ZNK6icu_768TZGNCore28formatGenericNonLocationNameERKNS_8TimeZoneE24UTimeZoneGenericNameTypedRNS_13UnicodeStringE+0x692): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tznames_impl.ao): in function `icu_76::TextTrieMap::search(icu_76::CharacterNode*, icu_76::UnicodeString const&, int, int, icu_76::TextTrieMapSearchResultHandler*, UErrorCode&) const':
+(.text._ZNK6icu_7611TextTrieMap6searchEPNS_13CharacterNodeERKNS_13UnicodeStringEiiPNS_30TextTrieMapSearchResultHandlerER10UErrorCode+0x153): undefined reference to `icu_76::UnicodeString::foldCase(unsigned int)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tznames_impl.ao): in function `icu_76::TextTrieMap::putImpl(icu_76::UnicodeString const&, void*, UErrorCode&)':
+(.text._ZN6icu_7611TextTrieMap7putImplERKNS_13UnicodeStringEPvR10UErrorCode+0x135): undefined reference to `icu_76::UnicodeString::foldCase(unsigned int)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::parseObject(icu_76::UnicodeString const&, icu_76::Formattable&, UErrorCode&) const [clone .cold]':
+(.text.unlikely._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x4): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::parseObject(icu_76::UnicodeString const&, icu_76::Formattable&, UErrorCode&) const':
+(.text._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x25): undefined reference to `vtable for icu_76::ParsePosition'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x57): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::getLocale(ULocDataLocaleType, UErrorCode&) const':
+(.text._ZNK6icu_766Format9getLocaleE18ULocDataLocaleTypeR10UErrorCode+0x31): undefined reference to `icu_76::LocaleBased::getLocale(ULocDataLocaleType, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::getLocaleID(ULocDataLocaleType, UErrorCode&) const':
+(.text._ZNK6icu_766Format11getLocaleIDE18ULocDataLocaleTypeR10UErrorCode+0x2d): undefined reference to `icu_76::LocaleBased::getLocaleID(ULocDataLocaleType, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::setLocaleIDs(char const*, char const*)':
+(.text._ZN6icu_766Format12setLocaleIDsEPKcS2_+0x2d): undefined reference to `icu_76::LocaleBased::setLocaleIDs(char const*, char const*)'
+collect2: error: ld returned 1 exit status
+
+Link: https://github.com/libical/libical/pull/930
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index aad02e1e..7dcf516c 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -211,7 +211,7 @@ if(NOT DEFINED ENV{ICU_ROOT} AND APPLE)
+   #Use the homebrew version. MacOS provided ICU doesn't provide development files
+   set(ICU_ROOT "/usr/local/opt/icu4c")
+ endif()
+-find_package(ICU COMPONENTS uc i18n data)
++find_package(ICU COMPONENTS i18n uc data)
+ set_package_properties(ICU PROPERTIES
+   TYPE RECOMMENDED
+   PURPOSE "For RSCALE (RFC7529) support"
+-- 
+2.49.0
+

From 5c20ed83ddf3e00269fad3e98bd1ab38264bdeb1 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 01:05:26 +0300
Subject: [PATCH 0551/1209] stdenv: linux: centralise
 updateAutotoolsGnuConfigScriptsHook in stageFun
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hook was added six times — once in each of stages 1, xgcc, 2, 3, 4
(and again at the final stdenv) — to teach configure scripts about
non-x86_64 architectures. Wire it once inside stageFun instead, guarded
by `prevStage ? updateAutotoolsGnuConfigScriptsHook` so the dummy stage
(whose prevStage is the raw stub) is unaffected.

The final stdenv (built outside stageFun) keeps its explicit entry.

Eval-verified: stdenv.drvPath is unchanged from master
(q2xn5647kadsgpz40xcmjssa0pmdmiwi-stdenv-linux.drv).
---
 pkgs/stdenv/linux/default.nix | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index feb7f90a147f..c95675239cbe 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -181,7 +181,13 @@ let
         buildPlatform = localSystem;
         hostPlatform = localSystem;
         targetPlatform = localSystem;
-        inherit extraNativeBuildInputs;
+        # Every real (post-dummy) stage needs this hook so configure scripts
+        # can recognise architectures (LoongArch, RISC-V, etc.).
+        extraNativeBuildInputs =
+          extraNativeBuildInputs
+          ++ lib.optional (
+            prevStage ? updateAutotoolsGnuConfigScriptsHook
+          ) prevStage.updateAutotoolsGnuConfigScriptsHook;
         inherit (stage0) initialPath;
         preHook = ''
           # Don't patch #!/interpreter because it leads to retained
@@ -311,9 +317,6 @@ in
           };
         });
       };
-
-      # `gettext` comes with obsolete config.sub/config.guess that don't recognize LoongArch64.
-      extraNativeBuildInputs = [ prevStage.updateAutotoolsGnuConfigScriptsHook ];
     }
   )
 
@@ -427,9 +430,6 @@ in
               '';
             });
       };
-
-      # `gettext` comes with obsolete config.sub/config.guess that don't recognize LoongArch64.
-      extraNativeBuildInputs = [ prevStage.updateAutotoolsGnuConfigScriptsHook ];
     }
   )
 
@@ -531,10 +531,6 @@ in
         );
 
       };
-
-      # `gettext` comes with obsolete config.sub/config.guess that don't recognize LoongArch64.
-      # `libtool` comes with obsolete config.sub/config.guess that don't recognize Risc-V.
-      extraNativeBuildInputs = [ prevStage.updateAutotoolsGnuConfigScriptsHook ];
     }
   )
 
@@ -605,8 +601,6 @@ in
         };
       extraNativeBuildInputs = [
         prevStage.patchelf
-        # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
-        prevStage.updateAutotoolsGnuConfigScriptsHook
       ];
     }
   )
@@ -671,8 +665,6 @@ in
       extraNativeBuildInputs = [
         prevStage.patchelf
         prevStage.xz
-        # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
-        prevStage.updateAutotoolsGnuConfigScriptsHook
       ];
     }
   )

From 0a27772068b2658b0dc7911375c1e42cc6bc301d Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 01:38:17 +0300
Subject: [PATCH 0552/1209] stdenv: linux: drop dead enableGold=false override
 from stage1

The override at `super.binutils-unwrapped.override { enableGold = false; }`
defined a stage1 `binutils-unwrapped` derivation that was never used:
xgcc-stage and stage2 both build their own fresh `super.binutils-unwrapped`
without inheriting from stage1, so the gold-disabled rebuild never appeared
in the build graph (verified via `nix-store --query --requisites`).

Verified by drv-hash equality: stdenv.drvPath is unchanged
(q2xn5647kadsgpz40xcmjssa0pmdmiwi-stdenv-linux.drv).
---
 pkgs/stdenv/linux/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index c95675239cbe..511248c81957 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -283,11 +283,7 @@ in
     stageFun prevStage {
       name = "bootstrap-stage1";
 
-      # Rebuild binutils to use from stage2 onwards.
       overrides = self: super: {
-        binutils-unwrapped = super.binutils-unwrapped.override {
-          enableGold = false;
-        };
         inherit (prevStage)
           ccWrapperStdenv
           gcc-unwrapped

From 053f02f232a7ca7cb23ca75335a07808c2a95ff9 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 01:38:37 +0300
Subject: [PATCH 0553/1209] stdenv: linux: drop dead dejagnu.doCheck=false
 override from stage2

dejagnu is never demand-built in the bootstrap closure (verified via
`nix-store --query --requisites | grep dejagnu` returning empty on
master). The override existed but the resulting derivation was never
referenced by anything stage2+ actually builds.

Verified by drv-hash equality: stdenv.drvPath is unchanged
(q2xn5647kadsgpz40xcmjssa0pmdmiwi-stdenv-linux.drv).
---
 pkgs/stdenv/linux/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 511248c81957..d0b55753569d 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -458,9 +458,6 @@ in
           texinfo
           which
           ;
-        dejagnu = super.dejagnu.overrideAttrs (a: {
-          doCheck = false;
-        });
 
         # Avoids infinite recursion, as this is in the build-time dependencies of libc.
         libiconv = self.libcIconv prevStage.libc;

From 4df33765698ad9b6ff28e2eb958f3971e23d1065 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 06:59:50 +0300
Subject: [PATCH 0554/1209] stdenv: linux: inherit nukeReferences through
 xgcc/stage2/stage3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

nukeReferences was rebuilt at every stage where it appeared (xgcc, stage2,
stage3 — 3 redundant builds beyond stage1's initial build). It is used only
at build time (to scrub references from libidn2/libunistring at stage2),
never appears in the final stdenv's runtime closure, and its outputs are
not propagated into other final-closure derivations.

Adding it to the inherit list at xgcc, stage2, and stage3 collapses the
chain to a single stage1 build. Stage4 still produces its own nukeReferences
through the regular package set; that one is unused by the final stdenv.

Build-only dependency, so this is safe with respect to the
`disallowedRequisites` check on the final stdenv-linux.
---
 pkgs/stdenv/linux/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index d0b55753569d..61b4a996b03e 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -343,6 +343,7 @@ in
           gnum4
           perl
           patchelf
+          nukeReferences
           ;
         ${localSystem.libc} = prevStage.${localSystem.libc};
         gmp = super.gmp.override { cxx = false; };
@@ -457,6 +458,7 @@ in
           bison
           texinfo
           which
+          nukeReferences
           ;
 
         # Avoids infinite recursion, as this is in the build-time dependencies of libc.
@@ -565,6 +567,7 @@ in
             libidn2
             libunistring
             libxcrypt
+            nukeReferences
             ;
           # We build a special copy of libgmp which doesn't use libstdc++, because
           # xgcc++'s libstdc++ references the bootstrap-files (which is what

From f40b936a8643c4f9b7a178e2fc231c45579fd630 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 07:00:07 +0300
Subject: [PATCH 0555/1209] stdenv: linux: inherit autoconf269 at stage2/stage3

autoconf269 was being rebuilt at stages 2 and 3. It is used only as a
native build input (to regenerate `configure` scripts in autotools-using
packages); its outputs never appear in the final stdenv's runtime closure.

Inheriting it from prevStage at stage2 and stage3 collapses 2 -> 1 build.

Build-only dependency, safe with respect to the `disallowedRequisites`
check on the final stdenv-linux.
---
 pkgs/stdenv/linux/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 61b4a996b03e..e9116d03be92 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -459,6 +459,7 @@ in
           texinfo
           which
           nukeReferences
+          autoconf269
           ;
 
         # Avoids infinite recursion, as this is in the build-time dependencies of libc.
@@ -568,6 +569,7 @@ in
             libunistring
             libxcrypt
             nukeReferences
+            autoconf269
             ;
           # We build a special copy of libgmp which doesn't use libstdc++, because
           # xgcc++'s libstdc++ references the bootstrap-files (which is what

From dcda21b1556f0b3618dc8f7bd196eaab1fd5089c Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 07:00:22 +0300
Subject: [PATCH 0556/1209] stdenv: linux: inherit python3Minimal at
 stage3/stage4

python3Minimal was being rebuilt at stages 3 and 4. It is used only as a
native build input (e.g. meson, glib build helpers); its outputs do not
appear in the final stdenv's runtime closure.

Inheriting from prevStage at stage3 and stage4 collapses 2 -> 1 build.

Build-only dependency, safe with respect to the `disallowedRequisites`
check on the final stdenv-linux.
---
 pkgs/stdenv/linux/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index e9116d03be92..80802992360d 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -570,6 +570,7 @@ in
             libxcrypt
             nukeReferences
             autoconf269
+            python3Minimal
             ;
           # We build a special copy of libgmp which doesn't use libstdc++, because
           # xgcc++'s libstdc++ references the bootstrap-files (which is what
@@ -634,6 +635,7 @@ in
           linuxHeaders
           libidn2
           libunistring
+          python3Minimal
           ;
         ${localSystem.libc} = prevStage.${localSystem.libc};
         # Since this is the first fresh build of binutils since stage2, our own runtimeShell will be used.

From 1d37095ba040f5f6a0cad5b4f9356a55824d394a Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 08:38:09 +0300
Subject: [PATCH 0557/1209] stdenv: linux: inherit libxcrypt at xgcc/stage2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

libxcrypt was built twice (xgcc and stage2). Adding it to the inherit list
at xgcc and stage2 chains it through: stage1 produces the single build,
xgcc/stage2/stage3 inherit. Total bootstrap-stage builds: 2 -> 1.

libxcrypt is build-time-only — it is needed at build time by tools that
support libcrypt-style password hashing, but its `out` is not in the final
stdenv runtime closure (glibc no longer depends on libxcrypt at runtime;
applications that need it link directly).

Safe with respect to the `disallowedRequisites` check on the final
stdenv-linux.
---
 pkgs/stdenv/linux/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 80802992360d..34fdac07cff5 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -344,6 +344,7 @@ in
           perl
           patchelf
           nukeReferences
+          libxcrypt
           ;
         ${localSystem.libc} = prevStage.${localSystem.libc};
         gmp = super.gmp.override { cxx = false; };
@@ -460,6 +461,7 @@ in
           which
           nukeReferences
           autoconf269
+          libxcrypt
           ;
 
         # Avoids infinite recursion, as this is in the build-time dependencies of libc.

From a630049d801392ad6e30bf7280b5e73d998fcb45 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 6 Jun 2026 03:40:44 +0000
Subject: [PATCH 0558/1209] fontconfig: 2.17.1 -> 2.18.1

---
 pkgs/development/libraries/fontconfig/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index dee1e197dd6e..9e4c1fb36057 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fontconfig";
-  version = "2.17.1";
+  version = "2.18.1";
 
   outputs = [
     "bin"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   # ref: https://github.com/NixOS/nixpkgs/pull/401037#discussion_r2055430206
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/api/v4/projects/890/packages/generic/fontconfig/${finalAttrs.version}/fontconfig-${finalAttrs.version}.tar.xz";
-    hash = "sha256-n1yuk/T//B+8Ba6ZzfxwjNYN/WYS/8BRKCcCXAJvpUE=";
+    hash = "sha256-IwDz2/pyU7OkT0/uzbyN+kXd5dws+3H86vMfOUy0EDE=";
   };
 
   nativeBuildInputs = [

From a06fb593b6facc51ec4348cfb4f105536e319739 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Fri, 5 Jun 2026 22:16:08 -0400
Subject: [PATCH 0559/1209] freetype: add patches for four vulnerabilities from
 project zero

- https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1419 /
  https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1420
- https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1421
- https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1423
- https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1425
---
 pkgs/by-name/fr/freetype/package.nix | 48 ++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/pkgs/by-name/fr/freetype/package.nix b/pkgs/by-name/fr/freetype/package.nix
index 1eb213ab71f1..2f5f6ccef0a8 100644
--- a/pkgs/by-name/fr/freetype/package.nix
+++ b/pkgs/by-name/fr/freetype/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   buildPackages,
   pkgsHostHost,
   pkg-config,
@@ -69,6 +70,53 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./enable-table-validation.patch
+
+    # https://project-zero.issues.chromium.org/issues/505355061
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1419
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1420
+    (fetchpatch {
+      name = "truetype-shz-limit-heap-buffer-overflow-part1.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/1803559c4ee407d0bcbf2a67dbe96690cee869d2.patch";
+      hash = "sha256-zxtJ2pJz8pNofgYrJ6c8/eZqRvxTotanF2IdU9ckpM4=";
+    })
+    (fetchpatch {
+      name = "truetype-shz-limit-heap-buffer-overflow-part2.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/7d600a022e1d813e85a8c94ffd395f6135872267.patch";
+      hash = "sha256-aHE11C9Cr23D2lqNmTVUDA5E07xxUm+AcYdWJG9zLFs=";
+    })
+
+    # https://project-zero.issues.chromium.org/issues/505357209
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1421
+    (fetchpatch {
+      name = "truetype-iup-integer-overflow.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/7974be74d8b5a2fbf99aa88f0461d1f80af51cee.patch";
+      hash = "sha256-b5Px0ALsnC5K1+601YioAjCLkLVXNnvTIZ1aQtCeNoQ=";
+    })
+
+    # https://project-zero.issues.chromium.org/issues/506902245
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1423
+    # https://gitlab.freedesktop.org/freetype/freetype/-/merge_requests/428
+    (fetchpatch {
+      name = "truetype-variation-handling-signednes-mismatch.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/0d45c7f1911bc6db0bf072eea0c8cdccd77bc6b3.patch";
+      hash = "sha256-bw/9O86sZQa+vwdgx2MTqxWi6vjMcRTyC42ba9CaZ3I=";
+    })
+
+    # prerequisite for the below to apply, since this changes formatting of
+    # affected code.
+    (fetchpatch {
+      name = "ftobjs-formatting.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/590b77014bd920d0bdf64c039fddbce89a288b83.patch";
+      hash = "sha256-govOzLBzQMAjSKABVFryDnSn2by2f/W9BgGG3o+qSuE=";
+    })
+
+    # https://project-zero.issues.chromium.org/issues/507321912
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1425
+    (fetchpatch {
+      name = "sub-byte-bitmaps-heap-buffer-over-read.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/cbe12767ea73d1006edc75fcd61c0b0d2a88f34e.patch";
+      hash = "sha256-jMeqY9uX7Ryfdd8icGDT4kEKl6aGRWafSN8GzOhGW7g=";
+    })
   ]
   ++ lib.optional useEncumberedCode ./enable-subpixel-rendering.patch;
 

From c81db54284de3ff7df95e57514171af285aeba1a Mon Sep 17 00:00:00 2001
From: Ricardo Correia <someplaceguy@wizy.org>
Date: Sat, 6 Jun 2026 13:37:40 +0000
Subject: [PATCH 0560/1209] minimal-bootstrap.gnumake-musl: fix build

GNU Make's release tarball contains pregenerated Autotools files and
depends on archive mtimes to keep them newer than their inputs.

The Mes-built gnutar used by gnumake-musl does not preserve those mtimes.
That can make configure.ac and m4 files appear newer than aclocal.m4 or
Makefile.in, causing make to try to run aclocal/automake during the
minimal bootstrap build.

Use gnutar-musl here, which is already documented as preserving mtimes for
pregenerated files.

Assisted-by: OpenAI Codex (GPT-5.5)
---
 pkgs/os-specific/linux/minimal-bootstrap/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index dae72f79852a..d52c50d80e5d 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -184,6 +184,9 @@ lib.makeScope
           tinycc = tinycc-musl;
           gawk = gawk-mes;
           gnumakeBoot = gnumake;
+          # GNU Make's release tarball relies on preserved mtimes for
+          # pregenerated Autotools files.
+          gnutar = gnutar-musl;
         };
 
         gnumake-static = callPackage ./gnumake/static.nix {

From af9f83d9f225ad51b4aeefe509f6ceb645b9f593 Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Sun, 7 Jun 2026 01:09:26 -0400
Subject: [PATCH 0561/1209] alsa-{lib,utils,ucm-conf}: adopt packages

---
 pkgs/by-name/al/alsa-lib/package.nix      | 4 +++-
 pkgs/by-name/al/alsa-ucm-conf/package.nix | 1 +
 pkgs/by-name/al/alsa-utils/package.nix    | 4 +++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alsa-lib/package.nix b/pkgs/by-name/al/alsa-lib/package.nix
index 4304bf4ef467..4c02e2a8d7eb 100644
--- a/pkgs/by-name/al/alsa-lib/package.nix
+++ b/pkgs/by-name/al/alsa-lib/package.nix
@@ -60,6 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
       "alsa-topology"
     ];
     platforms = with lib.platforms; linux ++ freebsd;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
   };
 })
diff --git a/pkgs/by-name/al/alsa-ucm-conf/package.nix b/pkgs/by-name/al/alsa-ucm-conf/package.nix
index 176fb0e2086c..eace84e7b18f 100644
--- a/pkgs/by-name/al/alsa-ucm-conf/package.nix
+++ b/pkgs/by-name/al/alsa-ucm-conf/package.nix
@@ -58,6 +58,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       roastiek
       mvs
+      nick-linux
     ];
 
     platforms = lib.platforms.linux ++ lib.platforms.freebsd;
diff --git a/pkgs/by-name/al/alsa-utils/package.nix b/pkgs/by-name/al/alsa-utils/package.nix
index e293ed8d10e7..4476b715cdcf 100644
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@@ -98,6 +98,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
   };
 })

From 373f683e561aa9d1c80e59ff6330735739df4fcb Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Sun, 7 Jun 2026 02:15:25 -0600
Subject: [PATCH 0562/1209] python3Packages.requests-toolbelt: switch to
 pyproject

---
 .../python-modules/requests-toolbelt/default.nix   | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/requests-toolbelt/default.nix b/pkgs/development/python-modules/requests-toolbelt/default.nix
index f9e79d5955c3..59354d41092b 100644
--- a/pkgs/development/python-modules/requests-toolbelt/default.nix
+++ b/pkgs/development/python-modules/requests-toolbelt/default.nix
@@ -6,20 +6,22 @@
   pyopenssl,
   pytestCheckHook,
   requests,
+  setuptools,
   trustme,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "requests-toolbelt";
   version = "1.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-doGgo9BHAStb3A7jfX+PB+vnarCMrsz8OSHOI8iNW8Y=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+  dependencies = [ requests ];
 
   nativeCheckInputs = [
     betamax
@@ -43,8 +45,8 @@ buildPythonPackage rec {
   meta = {
     description = "Toolbelt of useful classes and functions to be used with requests";
     homepage = "http://toolbelt.rtfd.org";
-    changelog = "https://github.com/requests/toolbelt/blob/${version}/HISTORY.rst";
+    changelog = "https://github.com/requests/toolbelt/blob/${finalAttrs.version}/HISTORY.rst";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ matthiasbeyer ];
   };
-}
+})

From 10978e39f8ed8df22c8097fe16c4d95d77838c10 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:33 +0200
Subject: [PATCH 0563/1209] grpc: 1.80.0 -> 1.81.0

---
 pkgs/by-name/gr/grpc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/grpc/package.nix b/pkgs/by-name/gr/grpc/package.nix
index fd682d3b0516..84e80bfc5b7d 100644
--- a/pkgs/by-name/gr/grpc/package.nix
+++ b/pkgs/by-name/gr/grpc/package.nix
@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation (finalAttrs: {
   pname = "grpc";
-  version = "1.80.0"; # N.B: if you change this, please update:
+  version = "1.81.0"; # N.B: if you change this, please update:
   # pythonPackages.grpcio
   # pythonPackages.grpcio-channelz
   # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "grpc";
     repo = "grpc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/dpTRG5JcZY2VAsqOYNIpFW7ouSy/eC2STulP7qdSYg=";
+    hash = "sha256-o1wfHrgD2VE6HcPPEWQPQZXrMh+8+GNoUjbCQoRlIWg=";
     fetchSubmodules = true;
   };
 

From 6b60525b2184c5e5c3a2896dc5f5ff9128d63326 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:37 +0200
Subject: [PATCH 0564/1209] python3Packages.grpcio: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 880782e6c683..7b786ec380ba 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -18,12 +18,12 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KayhXt0GiMIroB18wBywANcrIDP0o8cqgaGbVv0UMlc=";
+    hash = "sha256-pazX79Ox/ptOsLyqoVB+7WigrQZ4tlTD97Rk35up3KU=";
   };
 
   postPatch = ''

From ac6c2aecd82f33322997c1229fae09c47aec653a Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:39 +0200
Subject: [PATCH 0565/1209] python3Packages.grpcio-channelz: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-channelz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index 028c63669ca3..634811c727e9 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_channelz";
     inherit version;
-    hash = "sha256-fs6As480ti6Q5uHFqghYXwwPE8GpyI6vdNioZxw6n6E=";
+    hash = "sha256-V6Gr5QURNJv9iafEJtHbaRmOLJzUcbr2wNVgbDTbmt8=";
   };
 
   build-system = [ setuptools ];

From 3881bdb4619328cde88fcd1a87245eaf946c6344 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:42 +0200
Subject: [PATCH 0566/1209] python3Packages.grpcio-health-checking: 1.80.0 ->
 1.81.0

---
 .../python-modules/grpcio-health-checking/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index 2db14472125a..3d65fef2e464 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -11,13 +11,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.80.0";
+  version = "1.81.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_health_checking";
     inherit version;
-    hash = "sha256-LMXwi8i4FrhlWrb1nHFFAGO6IHZtMeIaST6RLjVgyLE=";
+    hash = "sha256-CfMWdPGs3PIUvE5kDru77xZbB3of1kg0eVGW1Sv9zjk=";
   };
 
   propagatedBuildInputs = [

From 5ae2c501e9590672dd714d700828b94a8339332e Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:44 +0200
Subject: [PATCH 0567/1209] python3Packages.grpcio-reflection: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-reflection/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index 914cffe15618..87e145bb3513 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_reflection";
     inherit version;
-    hash = "sha256-6cdqq8QyQnmUW3C8dqPUG8T5OWv/zxz8EBGlccLFYiE=";
+    hash = "sha256-UZHbeqbKsbaYGwh5+kT9zdQ7pkTwMBxAuXb4E+tO/wY=";
   };
 
   build-system = [ setuptools ];

From ad1a906f4eb4058616dcc4be20481c35066f2ada Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:47 +0200
Subject: [PATCH 0568/1209] python3Packages.grpcio-status: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-status/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index a4ebf1aaf5a2..03c03473d5ad 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.80.0";
+  version = "1.81.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_status";
     inherit version;
-    hash = "sha256-33OAKkyJo+qIqir/lx6Ib8zOFivC5lEUCLPWehRDgc0=";
+    hash = "sha256-tv6XiM/dHw9jwFKKHgv9tB6P8Fg+kg0tjoiIWYwBu2k=";
   };
 
   postPatch = ''

From c0254a8c03861d8875a71a59274071a90c39e278 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:49 +0200
Subject: [PATCH 0569/1209] python3Packages.grpcio-testing: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-testing/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 812e24eaf438..b3f68350d32f 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_testing";
     inherit version;
-    hash = "sha256-+1rVfED/36l3MEPfo46MN3Oa+ONHHxZwoh54BRzRmv0=";
+    hash = "sha256-MjcL3/wM0Jq63pKP2ID5Gb8HCv5dASot4UEkJ7LcGSE=";
   };
 
   postPatch = ''

From 1949fdb81e69d77f0bfbfce33692dda39f5771f0 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:53 +0200
Subject: [PATCH 0570/1209] python3Packages.grpcio-tools: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index d079a2447a3f..bf74b27fcea2 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -13,13 +13,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_tools";
     inherit version;
-    hash = "sha256-JgUrGcbODc9S0QJElq6j4r36hkFZ8G3HuXsi0EGpSyY=";
+    hash = "sha256-BzPXc+yoy0YfTyobecZMEj25ZhvkGwgYS4FJeyuZHMs=";
   };
 
   postPatch = ''

From 53c65555da322ff0ea39d13278c5a4eff02c06e9 Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Sun, 7 Jun 2026 13:51:11 +0300
Subject: [PATCH 0571/1209] ocl-icd: 2.3.4 -> 2.3.5

This adds support for opencl 3.1.
---
 pkgs/by-name/oc/ocl-icd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/oc/ocl-icd/package.nix b/pkgs/by-name/oc/ocl-icd/package.nix
index 1b6fad3afa82..f5440bf9270b 100644
--- a/pkgs/by-name/oc/ocl-icd/package.nix
+++ b/pkgs/by-name/oc/ocl-icd/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ocl-icd";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "OCL-dev";
     repo = "ocl-icd";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-7q5+33oWMA/PQOz6awC+LOBVTKeXNluHxDNAq8bJPYU=";
+    sha256 = "sha256-J7j68KlcwdlwtBo171xZd5iLWeo1suYm43G1JiFs2AE=";
   };
 
   nativeBuildInputs = [

From 80edf6a63022180fcf57ad25c4255dfefda2f65c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 09:25:39 -0700
Subject: [PATCH 0572/1209] libde265: 1.1.0 -> 1.1.1

Diff: https://github.com/strukturag/libde265/compare/v1.1.0...v1.1.1

Changelog: https://github.com/strukturag/libde265/releases/tag/v1.1.1
---
 pkgs/by-name/li/libde265/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libde265/package.nix b/pkgs/by-name/li/libde265/package.nix
index 80293886a1e1..771b9e336634 100644
--- a/pkgs/by-name/li/libde265/package.nix
+++ b/pkgs/by-name/li/libde265/package.nix
@@ -15,14 +15,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.1.0";
+  version = "1.1.1";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QhBi23HttVdIJCueSeKj3ZKwqX1iFcuAX7GmnMRCyN8=";
+    hash = "sha256-ZHfPC86oylqt2bwWMJRWVjdMEEmX6UOKR7XkR0HPyok=";
   };
 
   nativeBuildInputs = [

From 33f6a6e239d813d65e627086d78bd9579823d708 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 10:30:58 -0700
Subject: [PATCH 0573/1209] libmemcached: 1.0.18 -> 1.1.4

We switch the upstream to https://github.com/awesomized/libmemcached as
did e.g. Alpine Linux and Arch Linux.

Diff: https://github.com/awesomized/libmemcached/compare/1.0.18...1.1.4

Changelog: https://github.com/awesomized/libmemcached/blob/1.1.4/ChangeLog-1.1.md
---
 pkgs/by-name/li/libmemcached/musl-fixes.patch | 58 -------------------
 pkgs/by-name/li/libmemcached/package.nix      | 42 +++++++-------
 2 files changed, 21 insertions(+), 79 deletions(-)
 delete mode 100644 pkgs/by-name/li/libmemcached/musl-fixes.patch

diff --git a/pkgs/by-name/li/libmemcached/musl-fixes.patch b/pkgs/by-name/li/libmemcached/musl-fixes.patch
deleted file mode 100644
index eb2a6bc980eb..000000000000
--- a/pkgs/by-name/li/libmemcached/musl-fixes.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-diff --git a/libhashkit/fnv_64.cc b/libhashkit/fnv_64.cc
-index 68e4dd0..64656b7 100644
---- a/libhashkit/fnv_64.cc
-+++ b/libhashkit/fnv_64.cc
-@@ -37,8 +37,9 @@
- 
- 
- #include <libhashkit/common.h>
-+#include <limits.h>
- 
--#if __WORDSIZE == 64 && defined(HAVE_FNV64_HASH)
-+#if (LONG_BITS == 64) && defined(HAVE_FNV64_HASH)
- 
- /* FNV hash'es lifted from Dustin Sallings work */
- static uint64_t FNV_64_INIT= 0xcbf29ce484222325;
-diff --git a/libhashkit/has.cc b/libhashkit/has.cc
-index 843e32e..4153e5e 100644
---- a/libhashkit/has.cc
-+++ b/libhashkit/has.cc
-@@ -37,6 +37,7 @@
- 
- 
- #include <libhashkit/common.h>
-+#include <limits.h>
- 
- bool libhashkit_has_algorithm(const hashkit_hash_algorithm_t algo)
- {
-@@ -44,7 +45,7 @@ bool libhashkit_has_algorithm(const hashkit_hash_algorithm_t algo)
-   {
-   case HASHKIT_HASH_FNV1_64:
-   case HASHKIT_HASH_FNV1A_64:
--#if __WORDSIZE == 64 && defined(HAVE_FNV64_HASH)
-+#if (LONG_BITS == 64) && defined(HAVE_FNV64_HASH)
-     return true;
- #else
-     return false;
-diff --git a/libtest/cmdline.cc b/libtest/cmdline.cc
-index 29a22de..161c646 100644
---- a/libtest/cmdline.cc
-+++ b/libtest/cmdline.cc
-@@ -61,7 +61,7 @@ using namespace libtest;
- #include <algorithm>
- #include <stdexcept>
- 
--#ifndef __USE_GNU
-+#ifndef _GNU_SOURCE
- static char **environ= NULL;
- #endif
- 
-@@ -201,7 +201,7 @@ Application::error_t Application::run(const char *args[])
- 
-   fatal_assert(posix_spawnattr_setsigmask(&spawnattr, &mask) == 0);
- 
--#if defined(POSIX_SPAWN_USEVFORK) || defined(__linux__)
-+#if defined(POSIX_SPAWN_USEVFORK) || defined(__GLIBC__)
-   // Use USEVFORK on linux
-   flags |= POSIX_SPAWN_USEVFORK;
- #endif
diff --git a/pkgs/by-name/li/libmemcached/package.nix b/pkgs/by-name/li/libmemcached/package.nix
index dfcd86d022de..e28220062207 100644
--- a/pkgs/by-name/li/libmemcached/package.nix
+++ b/pkgs/by-name/li/libmemcached/package.nix
@@ -1,41 +1,41 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  fetchpatch,
+  fetchFromGitHub,
+  bison,
+  cmake,
+  flex,
   cyrus_sasl,
   libevent,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmemcached";
-  version = "1.0.18";
+  version = "1.1.4";
 
-  src = fetchurl {
-    url = "https://launchpad.net/libmemcached/${lib.versions.majorMinor finalAttrs.version}/${finalAttrs.version}/+download/libmemcached-${finalAttrs.version}.tar.gz";
-    sha256 = "10jzi14j32lpq0if0p9vygcl2c1352hwbywzvr9qzq7x6aq0nb72";
+  src = fetchFromGitHub {
+    owner = "awesomized";
+    repo = "libmemcached";
+    tag = finalAttrs.version;
+    hash = "sha256-jEw6L2/139oo4sGprl9Xp0DTarxAK1bEF2ak2kHWSAs=";
   };
 
-  # Fix linking against libpthread (patch from Fedora)
-  # https://bugzilla.redhat.com/show_bug.cgi?id=1037707
-  # https://bugs.launchpad.net/libmemcached/+bug/1281907
-  # Fix building on macOS (patch from Homebrew)
-  # https://bugs.launchpad.net/libmemcached/+bug/1245562
-  patches =
-    lib.optional stdenv.hostPlatform.isLinux ./libmemcached-fix-linking-with-libpthread.patch
-    ++ lib.optional stdenv.hostPlatform.isDarwin (fetchpatch {
-      url = "https://raw.githubusercontent.com/Homebrew/homebrew/bfd4a0a4626b61c2511fdf573bcbbc6bbe86340e/Library/Formula/libmemcached.rb";
-      sha256 = "1gjf3vd7hiyzxjvlg2zfc3y2j0lyr6nhbws4xb5dmin3csyp8qb8";
-    })
-    ++ lib.optional stdenv.hostPlatform.isMusl ./musl-fixes.patch;
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+  ];
+
+  cmakeFlags = [
+    "-DENABLE_SASL=ON"
+  ];
 
   buildInputs = [ libevent ];
   propagatedBuildInputs = [ cyrus_sasl ];
 
-  env.NIX_CFLAGS_COMPILE = "-fpermissive";
-
   meta = {
-    homepage = "https://libmemcached.org";
+    homepage = "https://github.com/awesomized/libmemcached";
+    changelog = "https://github.com/awesomized/libmemcached/blob/${finalAttrs.src.tag}/ChangeLog-${lib.versions.majorMinor finalAttrs.version}.md";
     description = "Open source C/C++ client library and tools for the memcached server";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;

From 0c743500cbc0bd3ec743c42b80370c7e5b3da857 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 10:59:24 -0700
Subject: [PATCH 0574/1209] phpExtensions.memcached: drop superfluous configure
 flag

---
 pkgs/development/php-packages/memcached/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/php-packages/memcached/default.nix b/pkgs/development/php-packages/memcached/default.nix
index fdbda0292e59..f2c5125dd677 100644
--- a/pkgs/development/php-packages/memcached/default.nix
+++ b/pkgs/development/php-packages/memcached/default.nix
@@ -24,12 +24,12 @@ buildPecl rec {
 
   configureFlags = [
     "--with-zlib-dir=${zlib.dev}"
-    "--with-libmemcached-dir=${libmemcached}"
   ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     cyrus_sasl
+    libmemcached
     zlib
   ];
 

From 4114a35469875a3ade9771da6458aebf131354c9 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:41:55 +0300
Subject: [PATCH 0575/1209] minimal-bootstrap: split aggregate tests

Split minimal-bootstrap.test into bootstrap-chain, static-tools, and compiler aggregate tests. This keeps the full aggregate while allowing static-tool edits to be verified without rebuilding unrelated compiler checks.

Assisted-by: codex with gpt-5.5-high
---
 .../linux/minimal-bootstrap/default.nix       | 77 ++++++++++++-------
 1 file changed, 49 insertions(+), 28 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index dae72f79852a..a6189bddb3ff 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -366,61 +366,82 @@ lib.makeScope
           writeTextFile
           writeText
           ;
-        test = kaem.runCommand "minimal-bootstrap-test" { } (
-          ''
+
+        tests = {
+          bootstrap-chain = kaem.runCommand "minimal-bootstrap-bootstrap-chain-test" { } ''
             echo ${bash.tests.get-version}
-            echo ${bash-static.tests.get-version}
             echo ${bash_2_05.tests.get-version}
             echo ${binutils.tests.get-version}
-            echo ${binutils-static.tests.get-version}
             echo ${bison.tests.get-version}
             echo ${bzip2.tests.get-version}
-            echo ${bzip2-static.tests.get-version}
             echo ${coreutils-musl.tests.get-version}
-            echo ${coreutils-static.tests.get-version}
             echo ${diffutils.tests.get-version}
-            echo ${diffutils-static.tests.get-version}
             echo ${findutils.tests.get-version}
-            echo ${findutils-static.tests.get-version}
             echo ${gawk.tests.get-version}
             echo ${gawk-mes.tests.get-version}
-            echo ${gawk-static.tests.get-version}
-            echo ${gcc46.tests.get-version}
-            echo ${gcc46-cxx.tests.hello-world}
-            echo ${gcc10.tests.hello-world}
-            echo ${gcc-latest.tests.hello-world}
             echo ${gnugrep.tests.get-version}
-            echo ${gnugrep-static.tests.get-version}
             echo ${gnum4.tests.get-version}
             echo ${gnumake-musl.tests.get-version}
-            echo ${gnumake-static.tests.get-version}
-            echo ${gnupatch-static.tests.get-version}
             echo ${gnused.tests.get-version}
             echo ${gnused-mes.tests.get-version}
-            echo ${gnused-static.tests.get-version}
             echo ${gnutar.tests.get-version}
             echo ${gnutar-latest.tests.get-version}
             echo ${gnutar-musl.tests.get-version}
-            echo ${gnutar-static.tests.get-version}
             echo ${gzip.tests.get-version}
-            echo ${gzip-static.tests.get-version}
             echo ${heirloom.tests.get-version}
             echo ${mes.compiler.tests.get-version}
             echo ${musl.tests.hello-world}
-            echo ${patchelf-static.tests.get-version}
             echo ${python.tests.get-version}
             echo ${tinycc-mes.compiler.tests.chain}
             echo ${tinycc-musl.compiler.tests.hello-world}
             echo ${xz.tests.get-version}
-          ''
-          + (lib.strings.optionalString (hostPlatform.libc == "glibc") ''
-            echo ${gcc-glibc.tests.hello-world}
-            echo ${glibc.tests.hello-world}
-          '')
-          + ''
             mkdir ''${out}
-          ''
-        );
+          '';
+
+          static-tools = kaem.runCommand "minimal-bootstrap-static-tools-test" { } ''
+            echo ${bash-static.tests.get-version}
+            echo ${binutils-static.tests.get-version}
+            echo ${bzip2-static.tests.get-version}
+            echo ${coreutils-static.tests.get-version}
+            echo ${diffutils-static.tests.get-version}
+            echo ${findutils-static.tests.get-version}
+            echo ${gawk-static.tests.get-version}
+            echo ${gnugrep-static.tests.get-version}
+            echo ${gnumake-static.tests.get-version}
+            echo ${gnupatch-static.tests.get-version}
+            echo ${gnused-static.tests.get-version}
+            echo ${gnutar-static.tests.get-version}
+            echo ${gzip-static.tests.get-version}
+            echo ${patchelf-static.tests.get-version}
+            echo ${xz-static.tests.get-version}
+            mkdir ''${out}
+          '';
+
+          compiler = kaem.runCommand "minimal-bootstrap-compiler-test" { } (
+            ''
+              echo ${gcc46.tests.get-version}
+              echo ${gcc46-cxx.tests.hello-world}
+              echo ${gcc10.tests.hello-world}
+              echo ${gcc-latest.tests.hello-world}
+            ''
+            + (lib.strings.optionalString (hostPlatform.libc == "glibc") ''
+              echo ${gcc-glibc.tests.hello-world}
+              echo ${glibc.tests.hello-world}
+            '')
+            + ''
+              mkdir ''${out}
+            ''
+          );
+
+          full = kaem.runCommand "minimal-bootstrap-test" { } ''
+            echo ${tests.bootstrap-chain}
+            echo ${tests.static-tools}
+            echo ${tests.compiler}
+            mkdir ''${out}
+          '';
+        };
+
+        test = tests.full;
       }
       // (lib.optionalAttrs (hostPlatform.libc == "glibc")) {
         gcc-glibc = callPackage ./gcc/glibc.nix {

From a540814c6f5df4b0d484a26eb7c00fc70ac02509 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:41:25 +0300
Subject: [PATCH 0576/1209] minimal-bootstrap: drop patchelf compiler reference

Static patchelf does not need build-compiler paths in debug or source metadata. Add deterministic compiler flags and disallow references to the bootstrap compiler.

Size impact against upstream/staging:

- patchelf-static closure: 167.634 MiB -> 1.237 MiB (-166.397 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
index 7bf32df8ecb9..d14ca2df1d49 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
@@ -43,6 +43,8 @@ bash.runCommand "${pname}-${version}"
       gzip
     ];
 
+    disallowedReferences = [ gcc ];
+
     passthru.tests.get-version =
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
@@ -70,7 +72,7 @@ bash.runCommand "${pname}-${version}"
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
       CC=musl-gcc \
-      CXXFLAGS=-static
+      CXXFLAGS="-static -g0 -O2 -DNDEBUG -ffile-prefix-map=${gcc}=. -fmacro-prefix-map=${gcc}=."
 
     # Build
     make -j $NIX_BUILD_CORES

From 4b9eb9aca1bd14880cfa93c02195eef04a901936 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 13:46:05 -0700
Subject: [PATCH 0577/1209] libmemcached: run tests

---
 pkgs/by-name/li/libmemcached/package.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/by-name/li/libmemcached/package.nix b/pkgs/by-name/li/libmemcached/package.nix
index e28220062207..bb3b5a90e3d2 100644
--- a/pkgs/by-name/li/libmemcached/package.nix
+++ b/pkgs/by-name/li/libmemcached/package.nix
@@ -7,6 +7,8 @@
   flex,
   cyrus_sasl,
   libevent,
+  ctestCheckHook,
+  memcached,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -27,12 +29,25 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
     "-DENABLE_SASL=ON"
   ];
 
   buildInputs = [ libevent ];
   propagatedBuildInputs = [ cyrus_sasl ];
 
+  doCheck = true;
+
+  nativeCheckInputs = [
+    ctestCheckHook
+    memcached
+  ];
+
+  disabledTests = [
+    "bin/memcapable"
+    "memcached_regression_lp583031"
+  ];
+
   meta = {
     homepage = "https://github.com/awesomized/libmemcached";
     changelog = "https://github.com/awesomized/libmemcached/blob/${finalAttrs.src.tag}/ChangeLog-${lib.versions.majorMinor finalAttrs.version}.md";

From 9f3e988fbf681238c067972db498dd5f2581f075 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:05 +0300
Subject: [PATCH 0578/1209] minimal-bootstrap: make xz-static actually static

Force the xz build through a static libtool link, disallow the musl runtime reference, and remove unused installed libraries, headers, docs, and auxiliary decoder tools.

Size impact against upstream/staging:

- xz-static closure: 26.517 MiB -> 0.277 MiB (-26.239 MiB)

Assisted-by: codex with gpt-5.5-high
---
 .../linux/minimal-bootstrap/xz/static.nix         | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
index d7eec96dff2a..c663c4cf04f8 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
@@ -39,10 +39,12 @@ bash.runCommand "${pname}-${version}"
       gzip
     ];
 
+    disallowedReferences = [ musl ];
+
     passthru.tests.get-version =
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
-        ${lib.getExe result} --version
+        ${result}/bin/xz --version
         mkdir $out
       '';
 
@@ -65,8 +67,8 @@ bash.runCommand "${pname}-${version}"
 
     # Configure
     export CC=musl-gcc
-    export CFLAGS=-static
-    export CXXFLAGS=-static
+    export CFLAGS="-g0 -O2 -DNDEBUG"
+    export CXXFLAGS="$CFLAGS"
     export LDFLAGS=-static
     bash ./configure \
       --prefix=$out \
@@ -78,11 +80,16 @@ bash.runCommand "${pname}-${version}"
       --disable-nls \
       --disable-shared \
       --disable-scripts \
+      --disable-doc \
+      --disable-xzdec \
+      --disable-lzmadec \
+      --disable-lzmainfo \
       --disable-assembler
 
     # Build
-    make -j $NIX_BUILD_CORES
+    make -j $NIX_BUILD_CORES LDFLAGS=-all-static
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/include $out/lib $out/share
   ''

From 338f91240fc29826aa672597e2d7e312155f1369 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:41:35 +0300
Subject: [PATCH 0579/1209] minimal-bootstrap: trim bash-static output

Disable NLS and remove installed documentation from the static bash used in stage0. The bootstrap path keeps bash and the sh symlink only.

Size impact against upstream/staging:

- bash-static closure: 9.643 MiB -> 1.333 MiB (-8.310 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix
index 742379b94603..31ec4ebc5836 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix
@@ -63,6 +63,7 @@ bash.runCommand "${pname}-${version}"
       --host=${hostPlatform.config} \
       --without-bash-malloc \
       --disable-dependency-tracking \
+      --disable-nls \
       --enable-static-link \
       CC=musl-gcc
 
@@ -72,5 +73,6 @@ bash.runCommand "${pname}-${version}"
     # Install
     make -j $NIX_BUILD_CORES install-strip
     rm $out/bin/bashbug
+    rm -rf $out/share
     ln -s $out/bin/bash $out/bin/sh
   ''

From ffe5913f5677ae84c08f95d886592375af323172 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:41:43 +0300
Subject: [PATCH 0580/1209] minimal-bootstrap: trim binutils-static output

Drop unused installed libraries and headers, avoid building unused gprof/libctf components, and replace duplicate target-prefixed tools with symlinks while keeping the conventional paths available.

Size impact against upstream/staging:

- binutils-static closure: 42.482 MiB -> 21.093 MiB (-21.389 MiB)

Assisted-by: codex with gpt-5.5-high
---
 .../minimal-bootstrap/binutils/static.nix     | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
index 90e2eb8126ea..6461f6523c0b 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
@@ -46,6 +46,8 @@ let
     "--enable-deterministic-archives"
     # depends on bison
     "--disable-gprofng"
+    # unused downstream
+    "--disable-gprof"
 
     # Turn on --enable-new-dtags by default to make the linker set
     # RUNPATH instead of RPATH on binaries.  This is important because
@@ -57,6 +59,8 @@ let
     # path to force users to declare their use of these libraries.
     "--with-lib-path=:"
     "--disable-gold"
+    # unused in the bootstrap path and removed from the output
+    "--disable-libctf"
     "--disable-plugins"
   ];
 in
@@ -83,6 +87,7 @@ bash.runCommand "${pname}-${version}"
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
         ${result}/bin/ld --version
+        ${result}/${hostPlatform.config}/bin/ld --version
         mkdir $out
       '';
   }
@@ -106,5 +111,17 @@ bash.runCommand "${pname}-${version}"
 
     # gprof/addr2line/elfedit + man pages are unused downstream.
     rm -f $out/bin/gprof $out/bin/addr2line $out/bin/elfedit
-    rm -rf $out/share/info $out/share/man
+    rm -rf $out/include $out/lib $out/share
+
+    # The target-prefixed tools duplicate the unprefixed tools byte-for-byte.
+    # Keep the conventional target-prefixed paths, but make them symlinks.
+    targetBin=$out/${hostPlatform.config}/bin
+    if [ -d "$targetBin" ]; then
+      for tool in ar as ld ld.bfd nm objcopy objdump ranlib readelf strip; do
+        if [ -e "$targetBin/$tool" ] && cmp -s "$out/bin/$tool" "$targetBin/$tool"; then
+          rm "$targetBin/$tool"
+          ln -s ../../bin/$tool "$targetBin/$tool"
+        fi
+      done
+    fi
   ''

From b200ae73ec2e3435b569cae82a5af7c4be6ba0e5 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:13 +0300
Subject: [PATCH 0581/1209] minimal-bootstrap: trim gawk-static output

Disable optional gawk features not used by the bootstrap path and prune installed helper files, headers, libraries, documentation, locale data, and awk library scripts. The smoke test now covers a simple awk program, not only --version.

Size impact against upstream/staging:

- gawk-static closure: 6.001 MiB -> 1.549 MiB (-4.453 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
index 2abe73c2aa0c..c6175308d59d 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
@@ -48,6 +48,7 @@ bash.runCommand "${pname}-${version}"
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
         ${result}/bin/awk --version
+        ${result}/bin/awk 'BEGIN { if (2 + 2 != 4) exit 1 }'
         mkdir $out
       '';
   }
@@ -62,6 +63,10 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-extensions \
+      --disable-mpfr \
+      --disable-nls \
+      --disable-pma \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -71,4 +76,6 @@ bash.runCommand "${pname}-${version}"
     # Install
     make -j $NIX_BUILD_CORES install-strip
     rm $out/bin/gawkbug
+    rm -rf $out/etc $out/include $out/lib $out/libexec
+    rm -rf $out/share
   ''

From 3a2649965b33b5d8ad71c24ccefe0bfa229d7fc7 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:22 +0300
Subject: [PATCH 0582/1209] minimal-bootstrap: trim findutils-static output

Disable NLS and keep only the bootstrap-relevant find and xargs tools. Drop locate, updatedb, frcode, documentation, locale data, and the var directory.

Size impact against upstream/staging:

- findutils-static closure: 2.830 MiB -> 0.592 MiB (-2.237 MiB)

Assisted-by: codex with gpt-5.5-high
---
 .../linux/minimal-bootstrap/findutils/static.nix           | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
index aa68c36eb73b..c6b1c6e2ba0c 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
@@ -47,6 +47,7 @@ bash.runCommand "${pname}-${version}"
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
         ${result}/bin/find --version
+        ${result}/bin/xargs --version
         mkdir $out
       '';
 
@@ -69,6 +70,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -77,5 +79,8 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
-    rm $out/bin/updatedb
+
+    # Keep only the bootstrap-relevant find/xargs tools.
+    rm -f $out/bin/locate $out/bin/updatedb
+    rm -rf $out/libexec $out/share $out/var
   ''

From 61300f0b34bd7c16f2bf87fa6c2bdffa1a97c71d Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:33 +0300
Subject: [PATCH 0583/1209] minimal-bootstrap: trim gnumake-static output

Disable NLS and remove installed headers and documentation. The bootstrap path only needs the static make binary.

Size impact against upstream/staging:

- gnumake-static closure: 0.963 MiB -> 0.325 MiB (-0.638 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix
index 1a7da3f1aff3..d24f0e6d12ce 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix
@@ -79,6 +79,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS="-static -std=gnu17"
 
@@ -87,4 +88,7 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+
+    # Remove files not needed to execute make in the bootstrap chain.
+    rm -rf $out/include $out/share
   ''

From cf5986d6ce1563ee59016e9341e4387a03e2e34b Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:42 +0300
Subject: [PATCH 0584/1209] minimal-bootstrap: trim diffutils-static output

Disable NLS and remove installed documentation from the static diffutils output. The bootstrap path keeps the diff, cmp, diff3, and sdiff binaries.

Size impact against upstream/staging:

- diffutils-static closure: 0.896 MiB -> 0.661 MiB (-0.235 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix
index 063d1f0a4100..f46805411c61 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix
@@ -69,6 +69,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static \
       ac_cv_path_PR_PROGRAM=pr
@@ -78,4 +79,7 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+
+    # Remove documentation not needed in the bootstrap chain.
+    rm -rf $out/share
   ''

From 978f2e3f80c8190238780d4f27af71cc781e6b98 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:50 +0300
Subject: [PATCH 0585/1209] minimal-bootstrap: trim gnugrep-static output

Disable NLS and remove installed documentation after keeping only the grep binary. The existing egrep and fgrep pruning remains in place.

Size impact against upstream/staging:

- gnugrep-static closure: 0.546 MiB -> 0.381 MiB (-0.165 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
index 69f8dadd22ab..6083a70b2410 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
@@ -70,6 +70,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -79,4 +80,7 @@ bash.runCommand "${pname}-${version}"
     # Install
     make -j $NIX_BUILD_CORES install-strip
     rm $out/bin/{egrep,fgrep}
+
+    # Remove documentation not needed in the bootstrap chain.
+    rm -rf $out/share
   ''

From 0bc798232d8c05a61fde41cbd392a724796a6bfe Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:43:00 +0300
Subject: [PATCH 0586/1209] minimal-bootstrap: trim bzip2-static output

Install the single bzip2 binary with bunzip2 and bzcat symlinks instead of duplicate binaries, and skip unused recovery tools, headers, libraries, scripts, and man pages. The smoke test covers compression plus both decompression entry points.

Size impact against upstream/staging:

- bzip2-static closure: 0.665 MiB -> 0.159 MiB (-0.505 MiB)

Assisted-by: codex with gpt-5.5-high
---
 .../linux/minimal-bootstrap/bzip2/static.nix  | 37 ++++++++++++++-----
 .../linux/minimal-bootstrap/default.nix       |  1 +
 2 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix
index fcdb8131957e..540f86112aa4 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix
@@ -33,12 +33,28 @@ bash.runCommand "${pname}-${version}"
       gzip
     ];
 
-    passthru.tests.get-version =
-      result:
-      bash.runCommand "${pname}-get-version-${version}" { } ''
-        ${result}/bin/bzip2 --help
-        mkdir $out
-      '';
+    passthru.tests = {
+      get-version =
+        result:
+        bash.runCommand "${pname}-get-version-${version}" { } ''
+          ${result}/bin/bzip2 --help
+          mkdir $out
+        '';
+
+      compress =
+        result:
+        bash.runCommand "${pname}-compress-${version}" { } ''
+          printf 'bootstrap\n' > input
+          ${result}/bin/bzip2 -k input
+          ${result}/bin/bunzip2 -c input.bz2 > bunzip2-output
+          read -r bunzip2Output < bunzip2-output
+          test "$bunzip2Output" = bootstrap
+          ${result}/bin/bzcat input.bz2 > bzcat-output
+          read -r bzcatOutput < bzcat-output
+          test "$bzcatOutput" = bootstrap
+          mkdir $out
+        '';
+    };
 
     meta = {
       description = "High-quality data compression program";
@@ -58,12 +74,15 @@ bash.runCommand "${pname}-${version}"
       -j $NIX_BUILD_CORES \
       CC=musl-gcc \
       CFLAGS=-static \
-      bzip2 bzip2recover
+      bzip2
 
     # Install
-    make install -j $NIX_BUILD_CORES PREFIX=$out
+    mkdir -p $out/bin
+    cp bzip2 $out/bin/bzip2
+    ln -s bzip2 $out/bin/bunzip2
+    ln -s bzip2 $out/bin/bzcat
 
     # Strip
     # Ignore failures, because strip may fail on non-elf files.
-    find $out/{bin,lib} -type f -exec strip --strip-debug {} + || true
+    strip --strip-debug $out/bin/bzip2 || true
   ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index a6189bddb3ff..40a2f9b5cac7 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -402,6 +402,7 @@ lib.makeScope
             echo ${bash-static.tests.get-version}
             echo ${binutils-static.tests.get-version}
             echo ${bzip2-static.tests.get-version}
+            echo ${bzip2-static.tests.compress}
             echo ${coreutils-static.tests.get-version}
             echo ${diffutils-static.tests.get-version}
             echo ${findutils-static.tests.get-version}

From e6c8f21c055266f969ab42d57f823de49abf9010 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:43:09 +0300
Subject: [PATCH 0587/1209] minimal-bootstrap: trim gnutar-static output

Disable NLS and remove installed documentation plus the remote tape helper. The stage0 bootstrap path only needs the static tar binary.

Size impact against upstream/staging:

- gnutar-static closure: 3.772 MiB -> 0.826 MiB (-2.946 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix
index 3add87dc6f3a..07eba0ef2fe4 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix
@@ -62,6 +62,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -70,4 +71,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/libexec $out/share
   ''

From 022df297033c8b5f01e918d116e2083a2a2f4233 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sun, 7 Jun 2026 23:41:05 +0300
Subject: [PATCH 0588/1209] minimal-bootstrap: trim gzip-static output

Remove installed info and man pages. The stage0 bootstrap path only needs the static gzip binary.

Size impact against upstream/staging:

- gzip-static closure: 0.249 MiB -> 0.175 MiB (-0.073 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix
index 5697ce229934..f449fdcd3609 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix
@@ -77,4 +77,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES bin_SCRIPTS= install-strip
+    rm -rf $out/share
   ''

From 2c001ac5ad4e9f04908c8720c01dbf397266b793 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sun, 7 Jun 2026 23:41:16 +0300
Subject: [PATCH 0589/1209] minimal-bootstrap: trim gnused-static output

Disable NLS and remove installed documentation. The stage0 bootstrap path only needs the static sed binary.

Size impact against upstream/staging:

- gnused-static closure: 0.480 MiB -> 0.276 MiB (-0.204 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
index f086c21747ff..8ebb1791e55c 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
@@ -62,6 +62,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -70,4 +71,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/share
   ''

From 4bd6d06b87eabe898940b6c7b7c7128e6b455819 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sun, 7 Jun 2026 23:41:31 +0300
Subject: [PATCH 0590/1209] minimal-bootstrap: trim gnupatch-static output

Remove the installed man page. The stage0 bootstrap path only needs the static patch binary.

Size impact against upstream/staging:

- gnupatch-static closure: 0.273 MiB -> 0.241 MiB (-0.032 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix
index 7cf5c0d1e786..ee25341e0b3b 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix
@@ -78,4 +78,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/share
   ''

From d250f7fa96c7278fdbe24a2d221d4a06211e8048 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sun, 7 Jun 2026 23:41:38 +0300
Subject: [PATCH 0591/1209] minimal-bootstrap: trim patchelf-static output

Remove installed shell completion, documentation, and man page. The stage0 bootstrap path only needs the static patchelf binary.

Size impact after the compiler-reference cleanup:

- patchelf-static closure: 1.237 MiB -> 1.225 MiB (-0.012 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
index d14ca2df1d49..1bec275f7b2a 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
@@ -79,4 +79,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/share
   ''

From ca76ad5f3d2a3dd2bace6e5f45e82298eb8e2920 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 14:15:18 -0700
Subject: [PATCH 0592/1209] libnice: add meta.changelog

---
 pkgs/by-name/li/libnice/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 99b58d0dc778..93c4e7de9df1 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -75,6 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = false;
 
   meta = {
+    changelog = "https://gitlab.freedesktop.org/libnice/libnice/-/blob/${finalAttrs.version}/NEWS";
     description = "GLib ICE implementation";
     longDescription = ''
       Libnice is an implementation of the IETF's Interactice Connectivity

From 386925859c7f6e0abb6d2c0c1f0116e1b904acec Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Mon, 8 Jun 2026 00:19:19 +0300
Subject: [PATCH 0593/1209] minimal-bootstrap: trim coreutils-static output

Remove the empty share directory left behind after pruning installed coreutils documentation. The stage0 bootstrap path only needs the single static coreutils binary and symlink entry points.

Size impact against the previous trimmed output:

- coreutils-static closure: 2,250,112 B -> 2,249,944 B (-168 B)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
index 22eca3a3c873..2291a5dedba3 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
@@ -80,5 +80,5 @@ bash.runCommand "${pname}-${version}"
     make -j $NIX_BUILD_CORES install-strip
 
     # Remove documentation not needed in the bootstrap chain.
-    rm -rf $out/share/info $out/share/man
+    rm -rf $out/share
   ''

From a86e904e5a6c23b94a16dda04a016ef7a3acccb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 14:24:01 -0700
Subject: [PATCH 0594/1209] libpaper: 1.1.29 -> 2.2.8

Diff: https://github.com/rrthomas/libpaper/compare/v1.1.29...v2.2.8
---
 pkgs/by-name/li/libpaper/package.nix | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libpaper/package.nix b/pkgs/by-name/li/libpaper/package.nix
index d15318f30b06..71c6f5326aeb 100644
--- a/pkgs/by-name/li/libpaper/package.nix
+++ b/pkgs/by-name/li/libpaper/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.1.29";
+  version = "2.2.8";
   pname = "libpaper";
 
   src = fetchurl {
-    url = "mirror://debian/pool/main/libp/libpaper/libpaper_${finalAttrs.version}.tar.gz";
-    hash = "sha256-JjMOIemjEkZY1RX9hQsM3lRv9C2JsllqUmTF8Wd/BUc=";
+    url = "https://github.com/rrthomas/libpaper/releases/download/v${finalAttrs.version}/libpaper-${finalAttrs.version}.tar.gz";
+    hash = "sha256-HjMFcWkBkYdOykFex2iJ3RG6uYh6IwLWo2Zc0IHE13s=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -36,9 +36,15 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    changelog = "https://github.com/rrthomas/libpaper/releases/tag/v${finalAttrs.version}";
     description = "Library for handling paper characteristics";
-    homepage = "http://packages.debian.org/unstable/source/libpaper";
-    license = lib.licenses.gpl2;
+    homepage = "https://github.com/rrthomas/libpaper";
+    license = with lib.licenses; [
+      gpl2Only
+      gpl3Plus
+      mit
+      publicDomain
+    ];
     platforms = lib.platforms.unix;
   };
 })

From 3d3f33094c92102067a996c83216bed3b5c11764 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 8 Jun 2026 00:45:11 +0000
Subject: [PATCH 0595/1209] wayland-protocols: 1.48 -> 1.49

---
 pkgs/development/libraries/wayland/protocols.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 8a14819a2805..3aeaf002b5dd 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayland-protocols";
-  version = "1.48";
+  version = "1.49";
 
   doCheck =
     stdenv.hostPlatform == stdenv.buildPlatform
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/${finalAttrs.pname}/-/releases/${finalAttrs.version}/downloads/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-OYA2rA62SEmC3b3n/4aEjXUyMfnN7q6YPwa1KUZiWqE=";
+    hash = "sha256-7EyPdJQtbf96zotM5HZPDvn/YYqTXZdOp37e4q0kCxQ=";
   };
 
   postPatch = lib.optionalString finalAttrs.finalPackage.doCheck ''

From ff0334da83c1a0e1ecb3864fcb84dd24dbcaecc5 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Mon, 8 Jun 2026 16:42:44 +0200
Subject: [PATCH 0596/1209] rsync: 3.4.3 -> 3.4.4

https://github.com/RsyncProject/rsync/releases/tag/v3.4.4
---
 pkgs/by-name/rs/rsync/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index c8137c8cf3c3..a6d869ad44da 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rsync";
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchurl {
     # signed with key 9FEF 112D CE19 A0DC 7E88  2CB8 1BB2 4997 A853 5F6F
     url = "mirror://samba/rsync/src/rsync-${finalAttrs.version}.tar.gz";
-    hash = "sha256-xy5jyjAhy8gLqG7DAQJ3P0xWMfvEkrUudzs5WPgqU9M=";
+    hash = "sha256-vYjPgvplPaMjFPsikTZAfFyQ+A0XWNj0sJF2eHfY+pY=";
   };
 
   preBuild = ''

From 2bb71590023462a801b3f3a6dab783b2556acbed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 8 Jun 2026 08:54:54 -0700
Subject: [PATCH 0597/1209] python3Packages.aiohttp: 3.14.0 -> 3.14.1

Diff: https://github.com/aio-libs/aiohttp/compare/v3.14.0...v3.14.1

Changelog: https://docs.aiohttp.org/en/v3.14.1/changes.html
---
 pkgs/development/python-modules/aiohttp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 06844833573d..bd20ca8fc845 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -51,14 +51,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiohttp";
-  version = "3.14.0";
+  version = "3.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiohttp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RRXdDDkQlL7erfYgs4+gSy6GMlVUG7PrDLTQBYJJ1To=";
+    hash = "sha256-OJSLv/NfVrKESZqNr51FJUzLRz7wLMRdGoNjKC5EhlI=";
   };
 
   postPatch = ''

From 25cb117512e908090514b9a06b57a5d4900b3026 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 8 Jun 2026 08:57:14 -0700
Subject: [PATCH 0598/1209] python3Packages.pytest-aiohttp: 1.1.0 -> 1.1.1

Diff: https://github.com/aio-libs/pytest-aiohttp/compare/v1.1.0...v1.1.1

Changelog: https://github.com/aio-libs/pytest-aiohttp/blob/refs/tags/v1.1.1/CHANGES.rst
---
 pkgs/development/python-modules/pytest-aiohttp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-aiohttp/default.nix b/pkgs/development/python-modules/pytest-aiohttp/default.nix
index ba963a0b67b7..dbe4e0674c5a 100644
--- a/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/pkgs/development/python-modules/pytest-aiohttp/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-aiohttp";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   __darwinAllowLocalNetworking = true;
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "pytest-aiohttp";
     tag = "v${version}";
-    hash = "sha256-5xUY3SVaoZzCZE/qfAP4R49HbtBMYj5jMN5viLEzEkM=";
+    hash = "sha256-SYMwVmcgPLOasW6TQGqqNO+sbp8zQQtDHb3IyAVO6KI=";
   };
 
   build-system = [

From 94c6cc8ea1eeccbd47b1de266b781c7bdd2df433 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Mon, 8 Jun 2026 11:37:32 -0700
Subject: [PATCH 0599/1209] replaceVarsWith: properly set pname, version

Link: https://github.com/NixOS/nixpkgs/issues/485742

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/build-support/replace-vars/replace-vars-with.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/replace-vars/replace-vars-with.nix b/pkgs/build-support/replace-vars/replace-vars-with.nix
index abbb9a1cc1a0..60e48f841a19 100644
--- a/pkgs/build-support/replace-vars/replace-vars-with.nix
+++ b/pkgs/build-support/replace-vars/replace-vars-with.nix
@@ -122,7 +122,8 @@ in
 
 stdenvNoCC.mkDerivation (
   {
-    name = baseNameOf src;
+    pname = optionalAttrs.pname or optionalAttrs.name or (baseNameOf src);
+    version = "26.11pre-git";
   }
   // optionalAttrs
   // forcedAttrs

From f3fc4042f5058ab5766b7fb65046bebe26f13b76 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Wed, 20 May 2026 15:41:22 -0400
Subject: [PATCH 0600/1209] cargo-auditable: 0.7.2 -> 0.7.5

---
 pkgs/by-name/ca/cargo-auditable/builder.nix | 2 ++
 pkgs/by-name/ca/cargo-auditable/package.nix | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-auditable/builder.nix b/pkgs/by-name/ca/cargo-auditable/builder.nix
index 348ff29ef61a..0fa045556116 100644
--- a/pkgs/by-name/ca/cargo-auditable/builder.nix
+++ b/pkgs/by-name/ca/cargo-auditable/builder.nix
@@ -21,6 +21,8 @@ lib.extendMkDerivation {
     {
       inherit auditable pname;
 
+      __structuredAttrs = true;
+
       src = fetchFromGitHub {
         owner = "rust-secure-code";
         repo = "cargo-auditable";
diff --git a/pkgs/by-name/ca/cargo-auditable/package.nix b/pkgs/by-name/ca/cargo-auditable/package.nix
index b74e0abbd515..371169459144 100644
--- a/pkgs/by-name/ca/cargo-auditable/package.nix
+++ b/pkgs/by-name/ca/cargo-auditable/package.nix
@@ -18,9 +18,9 @@ let
     auditable-bootstrap = bootstrap;
   };
 
-  version = "0.7.2";
-  hash = "sha256-hR6PjTOps8JSM7UbfGlCoZmmwtWExVqYwh4lxDiFWdc=";
-  cargoHash = "sha256-JEfnUJ9J6Xak3AOCwQCnu+v+3Wl3QbXX20qVFWB6040=";
+  version = "0.7.5";
+  hash = "sha256-0VONJCv/msLcGenItWMLJ7DH79RTD6vsU9gX/nphh1g=";
+  cargoHash = "sha256-/iAYib+xDQSJ8B559/V7b994ErSUGsPSDx64jFF5B6I=";
 
   # cargo-auditable cannot be built with cargo-auditable until cargo-auditable is built
   bootstrap = auditableBuilder {

From 5cd317d2dab4c51471a8603f55ad3728eea811e1 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 8 Jun 2026 16:42:07 -0400
Subject: [PATCH 0601/1209] cargo-auditable: add nix-update-script

---
 pkgs/by-name/ca/cargo-auditable/builder.nix | 5 ++++-
 pkgs/by-name/ca/cargo-auditable/package.nix | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ca/cargo-auditable/builder.nix b/pkgs/by-name/ca/cargo-auditable/builder.nix
index 0fa045556116..da652a61fcad 100644
--- a/pkgs/by-name/ca/cargo-auditable/builder.nix
+++ b/pkgs/by-name/ca/cargo-auditable/builder.nix
@@ -16,6 +16,7 @@ lib.extendMkDerivation {
       auditable ? true,
       hash ? "",
       cargoHash ? "",
+      passthru ? { },
       ...
     }:
     {
@@ -47,7 +48,9 @@ lib.extendMkDerivation {
         installManPage cargo-auditable/cargo-auditable.1
       '';
 
-      passthru.bootstrap = auditable-bootstrap;
+      passthru = passthru // {
+        bootstrap = auditable-bootstrap;
+      };
 
       meta = {
         description = "Tool to make production Rust binaries auditable";
diff --git a/pkgs/by-name/ca/cargo-auditable/package.nix b/pkgs/by-name/ca/cargo-auditable/package.nix
index 371169459144..064df430d374 100644
--- a/pkgs/by-name/ca/cargo-auditable/package.nix
+++ b/pkgs/by-name/ca/cargo-auditable/package.nix
@@ -2,6 +2,7 @@
   buildPackages,
   callPackage,
   makeRustPlatform,
+  nix-update-script,
 }:
 let
   # Need to use the build platform rustc and Cargo so that
@@ -32,4 +33,5 @@ in
 auditableBuilder {
   inherit version hash cargoHash;
   auditable = true;
+  passthru.updateScript = nix-update-script { };
 }

From edca5f9152e3806b66bbce2bc93ff5dd41ece6b9 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 8 Jun 2026 22:32:15 +0100
Subject: [PATCH 0602/1209] sdl2-compat: 2.32.68 -> 2.32.70

Changes: https://github.com/libsdl-org/sdl2-compat/releases/tag/release-2.32.70
---
 pkgs/by-name/sd/sdl2-compat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sd/sdl2-compat/package.nix b/pkgs/by-name/sd/sdl2-compat/package.nix
index 5b6376cd9538..b1143ff1a0fc 100644
--- a/pkgs/by-name/sd/sdl2-compat/package.nix
+++ b/pkgs/by-name/sd/sdl2-compat/package.nix
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl2-compat";
-  version = "2.32.68";
+  version = "2.32.70";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "sdl2-compat";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-66AHlsl53q9efRqZOzI4JiUbaGByrSMoQFj3K7udTsQ=";
+    hash = "sha256-IKfcF03I+kCewjdEcw7ANd6sCZvjNksIhBfJan9SSUY=";
   };
 
   nativeBuildInputs = [

From c1d0c1eaa6e38af35b25325f625e1e7acf807f4d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 00:57:07 +0000
Subject: [PATCH 0603/1209] hwloc: 2.13.0 -> 2.14.0

---
 pkgs/by-name/hw/hwloc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hw/hwloc/package.nix b/pkgs/by-name/hw/hwloc/package.nix
index c49a9c9b78ad..5ad26d3e89a3 100644
--- a/pkgs/by-name/hw/hwloc/package.nix
+++ b/pkgs/by-name/hw/hwloc/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwloc";
-  version = "2.13.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "open-mpi";
     repo = "hwloc";
     tag = "hwloc-${finalAttrs.version}";
-    hash = "sha256-W/WiLj4lqJZMGRhH+PXuSJS6mtW+fir4xmDTH9mcOtE=";
+    hash = "sha256-lbh8tkKeUcHta7/q9TuHQhccyWjkBgrC5fVifFJqQyY=";
   };
 
   configureFlags = [

From 02c36547a4e27c0474de8f6bd32397092f62e69a Mon Sep 17 00:00:00 2001
From: OttNorml <2350859+ottnorml@users.noreply.github.com>
Date: Tue, 9 Jun 2026 05:37:24 +0200
Subject: [PATCH 0604/1209] prek: 0.3.13 -> 0.4.4

Diff: https://github.com/j178/prek/compare/v0.3.13...v0.4.4

Changelog: https://github.com/j178/prek/blob/v0.4.4/CHANGELOG.md
---
 pkgs/by-name/pr/prek/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index 4f4920e06410..7d791d9cd57e 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.3.13";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OPH1H571jw0b8EsyzRcVdG54sQ7KeOclmnHCeVGteRI=";
+    hash = "sha256-PAEmRQ5Vro83fkegOWsdY59U7WAQxBPSEalzxZV6K4o=";
   };
 
-  cargoHash = "sha256-lvB09qOvVXmSdhR1TRJQ3rvYyn6cFSOGpogJZDajPuQ=";
+  cargoHash = "sha256-EmlR6Lmt5XR0uS/y3FqY5yGNeVBSdtLtEGH9jZLcP2o=";
 
   nativeBuildInputs = [
     installShellFiles

From e64ef4b13710934154312e52349f882a82a2002e Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 8 Jun 2026 16:12:55 +0200
Subject: [PATCH 0605/1209] wrapGAppsHook: make more bash variables local

---
 .../setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh             | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
index ea3e81bfdf27..92b7a5eee3e7 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -51,6 +51,8 @@ wrapGAppsHook() {
     wrapGAppsHookHasRunForOutput["$output"]=1
 
     if [[ -z "${dontWrapGApps:-}" ]]; then
+        local targetDirsThatExist targetDirsRealPath targetDirs targetDir
+
         targetDirsThatExist=()
         targetDirsRealPath=()
 
@@ -71,6 +73,7 @@ wrapGAppsHook() {
         # wrap links to binaries that point outside targetDirs
         # Note: links to binaries within targetDirs do not need
         #       to be wrapped as the binaries have already been wrapped
+        local linkPathReal targetPath
         if [[ ${#targetDirsThatExist[@]} -ne 0 ]]; then
             find "${targetDirsThatExist[@]}" -type l -xtype f -executable -print0 |
                 while IFS= read -r -d '' linkPath; do

From bf6855be79dcf742403084ab8851121e03261949 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Tue, 9 Jun 2026 17:55:30 +0200
Subject: [PATCH 0606/1209] libssh: Add optional support for gssapi

Similar to the openssh package, I am introducing a new package,
libsshWithGssapi, which enables the gssapi flag
---
 pkgs/by-name/li/libssh/package.nix           | 20 ++++++++++++++++----
 pkgs/by-name/li/libsshWithGssapi/package.nix |  3 +++
 2 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/by-name/li/libsshWithGssapi/package.nix

diff --git a/pkgs/by-name/li/libssh/package.nix b/pkgs/by-name/li/libssh/package.nix
index 93876d1b72d8..2c786b504b1a 100644
--- a/pkgs/by-name/li/libssh/package.nix
+++ b/pkgs/by-name/li/libssh/package.nix
@@ -8,6 +8,9 @@
   openssl,
   libsodium,
 
+  withGssapi ? false,
+  krb5,
+
   # for passthru.tests
   ffmpeg,
   sshping,
@@ -28,20 +31,29 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
   postPatch = ''
     # Fix headers to use libsodium instead of NaCl
     sed -i 's,nacl/,sodium/,g' ./include/libssh/curve25519.h src/curve25519.c
   '';
 
-  # Don’t build examples, which are not installed and require additional dependencies not
-  # included in `buildInputs` such as libx11.
-  cmakeFlags = [ "-DWITH_EXAMPLES=OFF" ];
+  cmakeFlags = [
+    # Don’t build examples, which are not installed and require additional dependencies not
+    # included in `buildInputs` such as libx11.
+    "-DWITH_EXAMPLES=OFF"
+
+    (lib.cmakeBool "USE_GSSAPI" withGssapi)
+  ];
 
   buildInputs = [
     zlib
     openssl
     libsodium
-  ];
+  ]
+  ++ lib.optional withGssapi krb5;
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/li/libsshWithGssapi/package.nix b/pkgs/by-name/li/libsshWithGssapi/package.nix
new file mode 100644
index 000000000000..73876b693484
--- /dev/null
+++ b/pkgs/by-name/li/libsshWithGssapi/package.nix
@@ -0,0 +1,3 @@
+{ libssh }:
+
+libssh.override { withGssapi = true; }

From 0a9601a870530381284330b108b2b9123473de6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 9 Jun 2026 11:10:34 -0700
Subject: [PATCH 0607/1209] python3Packages.pytest-aiohttp: use finalAttrs

---
 .../development/python-modules/pytest-aiohttp/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-aiohttp/default.nix b/pkgs/development/python-modules/pytest-aiohttp/default.nix
index dbe4e0674c5a..0952681a5135 100644
--- a/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/pkgs/development/python-modules/pytest-aiohttp/default.nix
@@ -10,7 +10,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pytest-aiohttp";
   version = "1.1.1";
   pyproject = true;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "pytest-aiohttp";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-SYMwVmcgPLOasW6TQGqqNO+sbp8zQQtDHb3IyAVO6KI=";
   };
 
@@ -45,9 +45,9 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/aio-libs/pytest-aiohttp/";
-    changelog = "https://github.com/aio-libs/pytest-aiohttp/blob/${src.rev}/CHANGES.rst";
+    changelog = "https://github.com/aio-libs/pytest-aiohttp/blob/${finalAttrs.src.tag}/CHANGES.rst";
     description = "Pytest plugin for aiohttp support";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

From 09c2f2401300d7300d9cc771b2dd00ac76435833 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 9 Jun 2026 20:15:36 +0100
Subject: [PATCH 0608/1209] serd: 0.32.8 -> 0.32.10

Changes: https://drobilla.net/2026/06/08/serd-0-32-10.html
---
 pkgs/by-name/se/serd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/se/serd/package.nix b/pkgs/by-name/se/serd/package.nix
index 3ba0fafb9096..1e1fbf775862 100644
--- a/pkgs/by-name/se/serd/package.nix
+++ b/pkgs/by-name/se/serd/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "serd";
-  version = "0.32.8";
+  version = "0.32.10";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.drobilla.net/serd-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9HJZvDi6VTsN64ttq2tbc9NjBGmnyUOczcqA4G18Hs4=";
+    hash = "sha256-sOk7SeUvAaBJR1t4hu8UBAcRWjLTseXcX5UUHIgnXRw=";
   };
 
   nativeBuildInputs = [

From 37928491dffcfcb7c6a9668a82de2b01edf871d0 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 26 May 2026 06:26:21 +0100
Subject: [PATCH 0609/1209] librsvg: 2.62.1 -> 2.62.3

Changes:
- https://gitlab.gnome.org/GNOME/librsvg/-/tags/2.62.2
- https://gitlab.gnome.org/GNOME/librsvg/-/tags/2.62.3

Co-authored-by: dotlambda <github@dotlambda.de>
---
 pkgs/by-name/li/librsvg/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/librsvg/package.nix b/pkgs/by-name/li/librsvg/package.nix
index 333015e1927c..297c1a0eae32 100644
--- a/pkgs/by-name/li/librsvg/package.nix
+++ b/pkgs/by-name/li/librsvg/package.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.62.1";
+  version = "2.62.3";
 
   outputs = [
     "out"
@@ -62,13 +62,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tByoQgYkL93YJqK/djSNfN9SwQUMv6BguGboGiUhRcM=";
+    hash = "sha256-frRJsnIqdoAhNW9m3+4yAsIptU7U5qcM5AwJDpf/FvI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-Px7H2Z4ShCCuZNskuKj427lE9dvIc6xRo8R1S4fK+ZQ=";
+    hash = "sha256-9ubfIl9R2BdcAWn7i050KBbb4cMdlakvrKdnjpZCQjA=";
     dontConfigure = true;
   };
 

From 2a6942aa98776405d1f99a554efe711c7b001968 Mon Sep 17 00:00:00 2001
From: Anton Tetov Johansson <anton@tetov.se>
Date: Tue, 9 Jun 2026 14:16:11 +0200
Subject: [PATCH 0610/1209] less: 702 -> 704

---
 pkgs/by-name/le/less/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/le/less/package.nix b/pkgs/by-name/le/less/package.nix
index bc017a199195..00823f701cde 100644
--- a/pkgs/by-name/le/less/package.nix
+++ b/pkgs/by-name/le/less/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "less";
-  version = "702";
+  version = "704";
 
   # `less` is provided by the following sources:
   # - meta.homepage
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   # homepage, and only those not marked as beta.
   src = fetchurl {
     url = "https://www.greenwoodsoftware.com/less/less-${finalAttrs.version}.tar.gz";
-    hash = "sha256-JCpkwA8C2W+O4gjPY4rhcotyfH9f34Kn1PTK4y+whOI=";
+    hash = "sha256-IKCworslJfpTx+7pvrhUtMnPFy6rsgmvcCB0NUe/6fs=";
   };
 
   buildInputs = [

From 8ee977fe7fb6aee0d47c0aeb20f6af09cf15d357 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Wed, 10 Jun 2026 09:21:32 +0200
Subject: [PATCH 0611/1209] rsync: fix test failure on darwin

---
 pkgs/by-name/rs/rsync/package.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index a6d869ad44da..2a6cdd676a9f 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
 
   updateAutotoolsGnuConfigScriptsHook,
   perl,
@@ -36,6 +37,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-vYjPgvplPaMjFPsikTZAfFyQ+A0XWNj0sJF2eHfY+pY=";
   };
 
+  patches = [
+    # Fixes test failure on darwin
+    (fetchpatch {
+      url = "https://github.com/RsyncProject/rsync/commit/e1c5f0e93a75dd45f32f3b92ba221ef158ac2e5f.patch";
+      hash = "sha256-pg65K9BCTq/WvS5icK6KT28ARccFKedp2445wLYdRsE=";
+      excludes = [
+        ".github/workflows/cygwin-build.yml"
+      ];
+    })
+  ];
+
   preBuild = ''
     patchShebangs ./runtests.py
   '';

From 774054e73cca482dba984a78ac7e488f5f57db73 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Wed, 10 Jun 2026 16:52:00 +0200
Subject: [PATCH 0612/1209] python3Packages.pygobject3: 3.56.2 -> 3.56.3

changelog: https://gitlab.gnome.org/GNOME/pygobject/-/raw/3.56.3/NEWS

diff: https://gitlab.gnome.org/GNOME/pygobject/-/compare/3.56.2...3.56.3
---
 pkgs/development/python-modules/pygobject/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index b912d6b04bb8..c728dbbbd82c 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.56.2";
+  version = "3.56.3";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/pygobject/${lib.versions.majorMinor version}/pygobject-${version}.tar.gz";
-    hash = "sha256-uBYJiWlUQIHenuztuUrWrFnHfk1XH+cFHxi+vOwHQxM=";
+    hash = "sha256-EnYOSg49BLbrleBveifjYsgm1WfqYTNzqSwAO2xw0tY=";
   };
 
   depsBuildBuild = [ pkg-config ];

From 5750c4a1f5379f5d462e0c661079d0f9ebf3c6f5 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Wed, 3 Jun 2026 10:28:27 +0200
Subject: [PATCH 0613/1209] =?UTF-8?q?dune:=203.22.2=20=E2=86=92=203.23.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/du/dune/package.nix                           | 3 ++-
 .../ocaml-modules/dune-configurator/default.nix            | 5 ++++-
 pkgs/development/ocaml-modules/stdune/default.nix          | 7 ++++++-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/du/dune/package.nix b/pkgs/by-name/du/dune/package.nix
index 0dfaf0a82ca8..0f50adc7b00f 100644
--- a/pkgs/by-name/du/dune/package.nix
+++ b/pkgs/by-name/du/dune/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   buildPackages,
-  version ? "3.22.2",
+  version ? "3.23.1",
 }:
 let
   # needed for pkgsStatic
@@ -21,6 +21,7 @@ stdenv.mkDerivation {
       "https://github.com/ocaml/dune/releases/download/${version}/dune-${sfx}${version}.tbz";
     hash =
       {
+        "3.23.1" = "sha256-k7TnFX9rqP62HPxfhgCO/SxZA3unigF9krSr8wYyNI8=";
         "3.22.2" = "sha256-wsz4vGsXr6R8RQKXNXSWMDqnyGgOMpt52Yxo41AToRg=";
         "3.21.1" = "sha256-hPeoLG2ApxJPOEfppInoDPvq+3vtNXOsAShu9W/QjZQ=";
         "2.9.3" = "sha256:1ml8bxym8sdfz25bx947al7cvsi2zg5lcv7x9w6xb01cmdryqr9y";
diff --git a/pkgs/development/ocaml-modules/dune-configurator/default.nix b/pkgs/development/ocaml-modules/dune-configurator/default.nix
index d17a866141b9..2ede486e1a14 100644
--- a/pkgs/development/ocaml-modules/dune-configurator/default.nix
+++ b/pkgs/development/ocaml-modules/dune-configurator/default.nix
@@ -1,14 +1,17 @@
 {
   lib,
   buildDunePackage,
+  ocaml,
   dune,
   csexp,
+  version ? if lib.versionAtLeast ocaml.version "4.13" then dune.version else "3.22.2",
 }:
 
 buildDunePackage {
   pname = "dune-configurator";
+  inherit version;
 
-  inherit (dune) src version;
+  inherit (dune.override { inherit version; }) src;
 
   dontAddPrefix = true;
 
diff --git a/pkgs/development/ocaml-modules/stdune/default.nix b/pkgs/development/ocaml-modules/stdune/default.nix
index 04b3fc3d1267..f4d61e9241f9 100644
--- a/pkgs/development/ocaml-modules/stdune/default.nix
+++ b/pkgs/development/ocaml-modules/stdune/default.nix
@@ -1,5 +1,7 @@
 {
+  lib,
   buildDunePackage,
+  ocaml,
   dune,
   dyn,
   ordering,
@@ -7,11 +9,14 @@
   csexp,
   fs-io,
   top-closure,
+  version ? if lib.versionAtLeast ocaml.version "4.13" then dune.version else "3.22.2",
 }:
 
 buildDunePackage {
   pname = "stdune";
-  inherit (dune) version src;
+  inherit version;
+
+  inherit (dune.override { inherit version; }) src;
 
   dontAddPrefix = true;
 

From 1691b9e047c61f725377168894abe3af20a7fdc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 10 Jun 2026 12:45:56 -0700
Subject: [PATCH 0614/1209] python3Packages.httpx: only unset $SSL_CERT_FILE if
 path doesn't exist

---
 pkgs/development/python-modules/httpx/setup-hook.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/httpx/setup-hook.sh b/pkgs/development/python-modules/httpx/setup-hook.sh
index 7e9ced07b69c..fe567877ef1a 100644
--- a/pkgs/development/python-modules/httpx/setup-hook.sh
+++ b/pkgs/development/python-modules/httpx/setup-hook.sh
@@ -1,5 +1,7 @@
 httpxSslCertFileUnset() {
+  if [ ! -e "${SSL_CERT_FILE-}" ]; then
     unset SSL_CERT_FILE
+  fi
 }
 
 postHooks+=(httpxSslCertFileUnset)

From 4071736d8c5b8fe22079531ee0339710fb975fa6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 10 Jun 2026 12:53:16 -0700
Subject: [PATCH 0615/1209] python3Packages.pyreqwest: remove httpx workaround

---
 pkgs/development/python-modules/pyreqwest/default.nix | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pyreqwest/default.nix b/pkgs/development/python-modules/pyreqwest/default.nix
index 10b189757108..3d6fe0e9c825 100644
--- a/pkgs/development/python-modules/pyreqwest/default.nix
+++ b/pkgs/development/python-modules/pyreqwest/default.nix
@@ -43,6 +43,7 @@ buildPythonPackage (finalAttrs: {
   pythonImportsCheck = [ "pyreqwest" ];
 
   nativeCheckInputs = [
+    cacert
     dirty-equals
     docker
     granian
@@ -57,12 +58,6 @@ buildPythonPackage (finalAttrs: {
     yarl
   ];
 
-  preCheck = ''
-    # Without this tests fails with
-    #     unexpected error: No CA certificates were loaded from the system
-    export SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"
-  '';
-
   disabledTestPaths = [
     # requires a running Docker daemon
     "tests/test_examples.py"

From 902d6dd64bd7361ff57530c3fb4bb8db1f30b2be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 10 Jun 2026 13:18:41 -0700
Subject: [PATCH 0616/1209] python3Packages.prowlpy: remove httpx workaround

---
 pkgs/development/python-modules/prowlpy/default.nix | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/prowlpy/default.nix b/pkgs/development/python-modules/prowlpy/default.nix
index f69da1bc04c0..a6368e345efe 100644
--- a/pkgs/development/python-modules/prowlpy/default.nix
+++ b/pkgs/development/python-modules/prowlpy/default.nix
@@ -43,6 +43,7 @@ buildPythonPackage (finalAttrs: {
   pythonImportsCheck = [ "prowlpy" ];
 
   nativeCheckInputs = [
+    cacert
     pytest-asyncio
     pytest-cov-stub
     pytestCheckHook
@@ -50,12 +51,6 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
-  preCheck = ''
-    # Without this pyreqwest fails with
-    #     unexpected error: No CA certificates were loaded from the system
-    export SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"
-  '';
-
   # tests fail without this
   pytestFlags = [ "-v" ];
 

From 811bd13927b21ba798a7648966c530a31738c83e Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Tue, 9 Jun 2026 19:28:19 +0300
Subject: [PATCH 0617/1209] diffutils: move to by-name

Also drop diffutils from the `inherit (prevStage)` overrides in
pkgs/stdenv/linux/default.nix. Once the package lives in pkgs/by-name,
that pin gives the top-level `diffutils` attribute a source location
even though it is defined via `_internalCallByNamePackageFile`, which
nixpkgs-vet rejects (NPV-102). Dropping the pin lets the by-name
auto-definition stand on its own, at the cost of no longer reusing the
bootstrap-stage build (a stdenv-class rebuild, hence staging).

Co-authored-by: Philip Taron <philip.taron@gmail.com>
Assisted-by: Claude Code (claude-opus-4-8)
---
 .../gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch          | 0
 pkgs/{tools/text => by-name/di}/diffutils/musl-llvm.patch       | 0
 .../diffutils/default.nix => by-name/di/diffutils/package.nix}  | 0
 pkgs/stdenv/linux/default.nix                                   | 1 -
 pkgs/top-level/all-packages.nix                                 | 2 --
 5 files changed, 3 deletions(-)
 rename pkgs/{tools/text => by-name/di}/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch (100%)
 rename pkgs/{tools/text => by-name/di}/diffutils/musl-llvm.patch (100%)
 rename pkgs/{tools/text/diffutils/default.nix => by-name/di/diffutils/package.nix} (100%)

diff --git a/pkgs/tools/text/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch b/pkgs/by-name/di/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
similarity index 100%
rename from pkgs/tools/text/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
rename to pkgs/by-name/di/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
diff --git a/pkgs/tools/text/diffutils/musl-llvm.patch b/pkgs/by-name/di/diffutils/musl-llvm.patch
similarity index 100%
rename from pkgs/tools/text/diffutils/musl-llvm.patch
rename to pkgs/by-name/di/diffutils/musl-llvm.patch
diff --git a/pkgs/tools/text/diffutils/default.nix b/pkgs/by-name/di/diffutils/package.nix
similarity index 100%
rename from pkgs/tools/text/diffutils/default.nix
rename to pkgs/by-name/di/diffutils/package.nix
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 5c19d616c960..c9b64c3086e8 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -832,7 +832,6 @@ in
               xz
               bashNonInteractive
               coreutils
-              diffutils
               findutils
               gawk
               gnused
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 138c354620c2..ee64420ed000 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2072,8 +2072,6 @@ with pkgs;
     enableBloat = false;
   };
 
-  diffutils = callPackage ../tools/text/diffutils { };
-
   inherit (import ../build-support/dlang/dub-support.nix { inherit lib callPackage; })
     dub-to-nix
     importDubLock

From d76fd9e7e88c3f5e4bb74c0f2d1f79edb5903cf6 Mon Sep 17 00:00:00 2001
From: Adam Thompson-Sharpe <adamthompsonsharpe@gmail.com>
Date: Wed, 10 Jun 2026 21:37:03 -0400
Subject: [PATCH 0618/1209] file: 5.47 -> 5.48

The patches that were required for v5.47 are now part of the v5.48
release.

Changelog: <https://github.com/file/file/compare/FILE5_47...FILE5_48>
---
 ...-Don-t-flush-when-trying-to-set-nega.patch |  57 --
 ...Revert-previous-and-always-set-offse.patch |  26 -
 .../tools/misc/file/0003-Add-LE-BE-GUID.patch | 631 ------------------
 ...parsing-guids-in-big-endian-machines.patch |  82 ---
 pkgs/tools/misc/file/default.nix              |  38 +-
 5 files changed, 2 insertions(+), 832 deletions(-)
 delete mode 100644 pkgs/tools/misc/file/0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
 delete mode 100644 pkgs/tools/misc/file/0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
 delete mode 100644 pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
 delete mode 100644 pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch

diff --git a/pkgs/tools/misc/file/0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch b/pkgs/tools/misc/file/0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
deleted file mode 100644
index 77ad10f252c7..000000000000
--- a/pkgs/tools/misc/file/0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 12b76648185104ce9118d8b5fa57aa34a77ad084 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Wed, 15 Apr 2026 20:00:20 +0000
-Subject: [PATCH] PR/745: streamout: Don't flush when trying to set negative
- offsets     on pipes, just continue, fixes 'cat file.zip | file -'
-
----
- ChangeLog       |  2 ++
- src/softmagic.c | 22 ++++++++++++++++------
- 2 files changed, 18 insertions(+), 6 deletions(-)
-
-diff --git a/src/softmagic.c b/src/softmagic.c
-index 7cf7c798..a5e758eb 100644
---- a/src/softmagic.c
-+++ b/src/softmagic.c
-@@ -245,14 +245,19 @@ match(struct magic_set *ms, struct magic *magic, file_regex_t **magic_rxcomp,
- flush:
- 			/* Skip sub-tests */
- 			while (magindex < nmagic - 1 &&
--			    magic[magindex + 1].cont_level != 0)
-+			    magic[magindex + 1].cont_level != 0) {
- 				magindex++;
-+			}
- 			cont_level = 0;
- 			continue; /* Skip to next top-level test*/
- 		}
- 
--		if (msetoffset(ms, m, &bb, b, offset, cont_level) == -1)
--			goto flush;
-+		if (msetoffset(ms, m, &bb, b, offset, cont_level) == -1) {
-+			if (b->elen == FILE_BADSIZE)
-+				continue;
-+			else
-+				goto flush;
-+		}
- 		ms->line = m->lineno;
- 
- 		/* if main entry matches, print it... */
-@@ -347,8 +352,13 @@ flush:
- 				 */
- 				cont_level = m->cont_level;
- 			}
--			if (msetoffset(ms, m, &bb, b, offset, cont_level) == -1)
--				goto flush;
-+			if (msetoffset(ms, m, &bb, b, offset, cont_level)
-+			    == -1) {
-+				if (b->elen == FILE_BADSIZE)
-+					continue;
-+				else
-+					goto flush;
-+			}
- 			if (m->flag & OFFADD) {
- 				if (cont_level == 0) {
- 					if ((ms->flags & MAGIC_DEBUG) != 0)
--- 
-2.53.0
-
diff --git a/pkgs/tools/misc/file/0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch b/pkgs/tools/misc/file/0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
deleted file mode 100644
index ff405c446597..000000000000
--- a/pkgs/tools/misc/file/0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From c54605718190ad8fe9c25cb475f1f32ca7cd54f7 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Sun, 12 Apr 2026 22:15:14 +0000
-Subject: [PATCH] PR/725: inliniac: Revert previous and always set offset.
-
----
- src/softmagic.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/src/softmagic.c b/src/softmagic.c
-index 9aaf8b3e..7cf7c798 100644
---- a/src/softmagic.c
-+++ b/src/softmagic.c
-@@ -1577,8 +1577,7 @@ normal:
- 			ms->offset = offset;
- 			ms->eoffset = 0;
- 		} else {
--			if (b->fd != -1)
--				ms->offset = ms->eoffset + offset;
-+			ms->offset = ms->eoffset + offset;
- 		}
- 	}
- 	if ((ms->flags & MAGIC_DEBUG) != 0) {
--- 
-2.51.2
-
diff --git a/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch b/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
deleted file mode 100644
index 69e52586b5f6..000000000000
--- a/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
+++ /dev/null
@@ -1,631 +0,0 @@
-From 797a275514c80303accbd821df9692b04f6020e6 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Sun, 19 Apr 2026 19:56:49 +0000
-Subject: [PATCH] Add LE/BE GUID
-
-(OPNA2608: removed hunks that change file modification dates, as they
-make it more difficult to apply the patch)
-
-(OPNA2608: merge typo fix 2866af2e51beb40afe35d2ff5e765991ac459237)
-
----
- doc/magic.man    |   8 ++--
- src/Makefile.am  |   3 +-
- src/apprentice.c | 121 ++++++++++-------------------------------------
- src/file.h       |  31 ++++++------
- src/funcs.c      |  30 +++++++++---
- src/print.c      |  11 +++--
- src/softmagic.c  |  18 ++++++-
- src/swap.c       | 101 +++++++++++++++++++++++++++++++++++++++
- src/swap.h       |  48 +++++++++++++++++++
- 9 files changed, 247 insertions(+), 124 deletions(-)
- create mode 100644 src/swap.c
- create mode 100644 src/swap.h
-
-diff --git a/doc/magic.man b/doc/magic.man
-index aa9f8da247..bad8111b28 100644
---- a/doc/magic.man
-+++ b/doc/magic.man
-@@ -373,7 +373,9 @@ The DER types are:
- .Dv rel-oid-iri .
- These types can be followed by an optional numeric size, which indicates
- the field width in bytes.
--.It Dv guid
-+.It Dv guid ,
-+.It Dv leguid ,
-+.It Dv beguid 
- A Globally Unique Identifier, parsed and printed as
- XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.
- Its format is a string.
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 64c0414367..10cf6fcb23 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -10,7 +10,8 @@ AM_CFLAGS = $(CFLAG_VISIBILITY) @WARNINGS@
- libmagic_la_SOURCES = buffer.c magic.c apprentice.c softmagic.c ascmagic.c \
- 	encoding.c compress.c is_csv.c is_json.c is_simh.c is_tar.c readelf.c \
- 	print.c fsmagic.c funcs.c file.h readelf.h tar.h apptype.c der.c der.h \
--	file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h
-+	file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h \
-+	swap.c swap.h
- libmagic_la_LDFLAGS = -no-undefined -version-info 1:0:0
- if MINGW
- MINGWLIBS = -lgnurx -lshlwapi
-diff --git a/src/apprentice.c b/src/apprentice.c
-index a6ab9e7c30..b67897b45a 100644
---- a/src/apprentice.c
-+++ b/src/apprentice.c
-@@ -32,6 +32,7 @@
- #endif	/* lint */
- 
- #include "magic.h"
-+#include "swap.h"
- #include <stdlib.h>
- #ifdef HAVE_UNISTD_H
- #include <unistd.h>
-@@ -50,12 +51,6 @@ FILE_RCSID("@(#)$File: apprentice.c,v 1.373 2026/04/17 14:58:57 christos Exp $")
- #endif
- #include <dirent.h>
- #include <limits.h>
--#ifdef HAVE_BYTESWAP_H
--#include <byteswap.h>
--#endif
--#ifdef HAVE_SYS_BSWAP_H
--#include <sys/bswap.h>
--#endif
- 
- 
- #define	EATAB {while (*l && isascii(CAST(unsigned char, *l)) && \
-@@ -131,20 +126,6 @@ file_private void mlist_free(struct mlist *);
- file_private void byteswap(struct magic *, uint32_t);
- file_private void bs1(struct magic *);
- 
--#if defined(HAVE_BYTESWAP_H)
--#define swap2(x)	bswap_16(x)
--#define swap4(x)	bswap_32(x)
--#define swap8(x)	bswap_64(x)
--#elif defined(HAVE_SYS_BSWAP_H)
--#define swap2(x)	bswap16(x)
--#define swap4(x)	bswap32(x)
--#define swap8(x)	bswap64(x)
--#else
--file_private uint16_t swap2(uint16_t);
--file_private uint32_t swap4(uint32_t);
--file_private uint64_t swap8(uint64_t);
--#endif
--
- file_private char *mkdbname(struct magic_set *, const char *, int);
- file_private struct magic_map *apprentice_buf(struct magic_set *, struct magic *,
-     size_t);
-@@ -285,6 +266,8 @@ static const struct type_tbl_s type_tbl[] = {
- 	{ XX("clear"),		FILE_CLEAR,		FILE_FMT_NONE },
- 	{ XX("der"),		FILE_DER,		FILE_FMT_STR },
- 	{ XX("guid"),		FILE_GUID,		FILE_FMT_STR },
-+	{ XX("leguid"),		FILE_LEGUID,		FILE_FMT_STR },
-+	{ XX("beguid"),		FILE_BEGUID,		FILE_FMT_STR },
- 	{ XX("offset"),		FILE_OFFSET,		FILE_FMT_QUAD },
- 	{ XX("bevarint"),	FILE_BEVARINT,		FILE_FMT_STR },
- 	{ XX("levarint"),	FILE_LEVARINT,		FILE_FMT_STR },
-@@ -926,6 +909,8 @@ typesize(int type)
- 	case FILE_LEVARINT:
- 		return 8;
- 
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 	case FILE_GUID:
- 		return 16;
- 
-@@ -989,6 +974,8 @@ apprentice_magic_strength_1(const struct magic *m)
- 	case FILE_BEVARINT:
- 	case FILE_LEVARINT:
- 	case FILE_GUID:
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 	case FILE_BEID3:
- 	case FILE_LEID3:
- 	case FILE_OFFSET:
-@@ -1251,6 +1238,8 @@ set_test_type(struct magic *mstart, struct magic *m)
- 	case FILE_LEVARINT:
- 	case FILE_DER:
- 	case FILE_GUID:
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 	case FILE_OFFSET:
- 	case FILE_MSDOSDATE:
- 	case FILE_BEMSDOSDATE:
-@@ -1733,6 +1722,8 @@ file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
- 		case FILE_CLEAR:
- 		case FILE_DER:
- 		case FILE_GUID:
-+		case FILE_LEGUID:
-+		case FILE_BEGUID:
- 		case FILE_OCTAL:
- 			break;
- 		default:
-@@ -2943,6 +2934,8 @@ getvalue(struct magic_set *ms, struct magic *m, const char **p, int action)
- 		if (errno == 0)
- 			*p = ep;
- 		return 0;
-+	case FILE_BEGUID:
-+	case FILE_LEGUID:
- 	case FILE_GUID:
- 		if (file_parse_guid(*p, m->value.guid) == -1) {
- 			file_magwarn(ms, "Error parsing guid `%s'", *p);
-@@ -3418,7 +3411,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
- 
- 	ptr = CAST(uint32_t *, map->p);
- 	if (*ptr != MAGICNO) {
--		if (swap4(*ptr) != MAGICNO) {
-+		if (file_swap4(*ptr) != MAGICNO) {
- 			file_error(ms, 0, "bad magic in `%s'", dbname);
- 			return -1;
- 		}
-@@ -3426,7 +3419,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
- 	} else
- 		needsbyteswap = 0;
- 	if (needsbyteswap)
--		version = swap4(ptr[1]);
-+		version = file_swap4(ptr[1]);
- 	else
- 		version = ptr[1];
- 	if (version != VERSIONNO) {
-@@ -3439,7 +3432,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
- 	nentries = 0;
- 	for (i = 0; i < MAGIC_SETS; i++) {
- 		if (needsbyteswap)
--			map->nmagic[i] = swap4(ptr[i + 2]);
-+			map->nmagic[i] = file_swap4(ptr[i + 2]);
- 		else
- 			map->nmagic[i] = ptr[i + 2];
- 		if (map->nmagic[i] > entries) {
-@@ -3577,69 +3570,6 @@ byteswap(struct magic *magic, uint32_t nmagic)
- 		bs1(&magic[i]);
- }
- 
--#if !defined(HAVE_BYTESWAP_H) && !defined(HAVE_SYS_BSWAP_H)
--/*
-- * swap a short
-- */
--file_private uint16_t
--swap2(uint16_t sv)
--{
--	uint16_t rv;
--	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
--	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
--	d[0] = s[1];
--	d[1] = s[0];
--	return rv;
--}
--
--/*
-- * swap an int
-- */
--file_private uint32_t
--swap4(uint32_t sv)
--{
--	uint32_t rv;
--	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
--	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
--	d[0] = s[3];
--	d[1] = s[2];
--	d[2] = s[1];
--	d[3] = s[0];
--	return rv;
--}
--
--/*
-- * swap a quad
-- */
--file_private uint64_t
--swap8(uint64_t sv)
--{
--	uint64_t rv;
--	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
--	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
--# if 0
--	d[0] = s[3];
--	d[1] = s[2];
--	d[2] = s[1];
--	d[3] = s[0];
--	d[4] = s[7];
--	d[5] = s[6];
--	d[6] = s[5];
--	d[7] = s[4];
--# else
--	d[0] = s[7];
--	d[1] = s[6];
--	d[2] = s[5];
--	d[3] = s[4];
--	d[4] = s[3];
--	d[5] = s[2];
--	d[6] = s[1];
--	d[7] = s[0];
--# endif
--	return rv;
--}
--#endif
--
- file_protected uintmax_t 
- file_varint2uintmax_t(const unsigned char *us, int t, size_t *l)
- {
-@@ -3676,16 +3606,16 @@ file_varint2uintmax_t(const unsigned char *us, int t, size_t *l)
- file_private void
- bs1(struct magic *m)
- {
--	m->flag = swap2(m->flag);
--	m->offset = swap4(CAST(uint32_t, m->offset));
--	m->in_offset = swap4(CAST(uint32_t, m->in_offset));
--	m->lineno = swap4(CAST(uint32_t, m->lineno));
-+	m->flag = file_swap2(m->flag);
-+	m->offset = file_swap4(CAST(uint32_t, m->offset));
-+	m->in_offset = file_swap4(CAST(uint32_t, m->in_offset));
-+	m->lineno = file_swap4(CAST(uint32_t, m->lineno));
- 	if (IS_STRING(m->type)) {
--		m->str_range = swap4(m->str_range);
--		m->str_flags = swap4(m->str_flags);
-+		m->str_range = file_swap4(m->str_range);
-+		m->str_flags = file_swap4(m->str_flags);
- 	} else {
--		m->value.q = swap8(m->value.q);
--		m->num_mask = swap8(m->num_mask);
-+		m->value.q = file_swap8(m->value.q);
-+		m->num_mask = file_swap8(m->num_mask);
- 	}
- }
- 
-@@ -3708,6 +3638,7 @@ file_pstring_length_size(struct magic_set *ms, const struct magic *m)
- 		return FILE_BADSIZE;
- 	}
- }
-+
- file_protected size_t
- file_pstring_get_length(struct magic_set *ms, const struct magic *m,
-     const char *ss)
-diff --git a/src/file.h b/src/file.h
-index 258b776976..25e365351d 100644
---- a/src/file.h
-+++ b/src/file.h
-@@ -179,7 +179,7 @@
- #define MAXstring 128		/* max len of "string" types */
- 
- #define MAGICNO		0xF11E041C
--#define VERSIONNO	20
-+#define VERSIONNO	21
- #define FILE_MAGICSIZE	432
- 
- #define FILE_GUID_SIZE	sizeof("XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX")
-@@ -292,17 +292,19 @@ struct magic {
- #define				FILE_CLEAR		47
- #define				FILE_DER		48
- #define				FILE_GUID		49
--#define				FILE_OFFSET		50
--#define				FILE_BEVARINT		51
--#define				FILE_LEVARINT		52
--#define				FILE_MSDOSDATE		53
--#define				FILE_LEMSDOSDATE	54
--#define				FILE_BEMSDOSDATE	55
--#define				FILE_MSDOSTIME		56
--#define				FILE_LEMSDOSTIME	57
--#define				FILE_BEMSDOSTIME	58
--#define				FILE_OCTAL		59
--#define				FILE_NAMES_SIZE		60 /* size of array to contain all names */
-+#define				FILE_LEGUID		50
-+#define				FILE_BEGUID		51
-+#define				FILE_OFFSET		52
-+#define				FILE_BEVARINT		53
-+#define				FILE_LEVARINT		54
-+#define				FILE_MSDOSDATE		55
-+#define				FILE_LEMSDOSDATE	56
-+#define				FILE_BEMSDOSDATE	57
-+#define				FILE_MSDOSTIME		58
-+#define				FILE_LEMSDOSTIME	59
-+#define				FILE_BEMSDOSTIME	60
-+#define				FILE_OCTAL		61
-+#define				FILE_NAMES_SIZE		62 /* size of array to contain all names */
- 
- #define IS_STRING(t) \
- 	((t) == FILE_STRING || \
-@@ -558,7 +560,8 @@ file_protected int file_separator(struct magic_set *);
- file_protected char *file_copystr(char *, size_t, size_t, const char *);
- file_protected int file_checkfmt(char *, size_t, const char *);
- file_protected size_t file_printedlen(const struct magic_set *);
--file_protected int file_print_guid(char *, size_t, const uint64_t *);
-+file_protected int file_print_leguid(char *, size_t, const uint64_t *);
-+file_protected int file_print_beguid(char *, size_t, const uint64_t *);
- file_protected int file_parse_guid(const char *, uint64_t *);
- file_protected int file_replace(struct magic_set *, const char *, const char *);
- file_protected int file_printf(struct magic_set *, const char *, ...)
-diff --git a/src/funcs.c b/src/funcs.c
-index dd80198f36..e5782bf2e8 100644
---- a/src/funcs.c
-+++ b/src/funcs.c
-@@ -27,6 +27,7 @@
- #endif	/* lint */
- 
- #include "magic.h"
-+#include "swap.h"
- #include <assert.h>
- #include <stdarg.h>
- #include <stdlib.h>
-@@ -934,12 +935,9 @@ file_parse_guid(const char *s, uint64_t *guid)
- 	return 0;
- }
- 
--file_protected int
--file_print_guid(char *str, size_t len, const uint64_t *guid)
-+file_private int
-+file_print_guid(char *str, size_t len, const struct guid *g)
- {
--	const struct guid *g = CAST(const struct guid *,
--	    CAST(const void *, guid));
--
- #ifndef WIN32
- 	return snprintf(str, len, "%.8X-%.4hX-%.4hX-%.2hhX%.2hhX-"
- 	    "%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX",
-@@ -955,6 +953,26 @@ file_print_guid(char *str, size_t len, const uint64_t *guid)
- #endif
- }
- 
-+file_protected int
-+file_print_leguid(char *str, size_t len, const uint64_t *guid)
-+{
-+	const struct guid *g = CAST(const struct guid *,
-+	    CAST(const void *, guid));
-+	return file_print_guid(str, len, g);
-+}
-+
-+file_protected int
-+file_print_beguid(char *str, size_t len, const uint64_t *guid)
-+{
-+	const struct guid *g = CAST(const struct guid *,
-+	    CAST(const void *, guid));
-+	struct guid gg = *g;
-+	gg.data1 = file_swap4(gg.data1);
-+	gg.data2 = file_swap2(gg.data2);
-+	gg.data3 = file_swap2(gg.data3);
-+	return file_print_guid(str, len, &gg);
-+}
-+
- file_protected int
- file_pipe_closexec(int *fds)
- {
-diff --git a/src/print.c b/src/print.c
-index 0740fd67e2..ac0802f309 100644
---- a/src/print.c
-+++ b/src/print.c
-@@ -227,12 +227,17 @@ file_mdump(struct magic *m)
- 		case FILE_DER:
- 			(void) fprintf(stderr, "'%s'", m->value.s);
- 			break;
-+		case FILE_LEGUID:
- 		case FILE_GUID:
--			(void) file_print_guid(tbuf, sizeof(tbuf),
-+			(void) file_print_leguid(tbuf, sizeof(tbuf),
-+			    m->value.guid);
-+			(void) fprintf(stderr, "%s", tbuf);
-+			break;
-+		case FILE_BEGUID:
-+			(void) file_print_beguid(tbuf, sizeof(tbuf),
- 			    m->value.guid);
- 			(void) fprintf(stderr, "%s", tbuf);
- 			break;
--
- 		default:
- 			(void) fprintf(stderr, "*bad type %d*", m->type);
- 			break;
-diff --git a/src/softmagic.c b/src/softmagic.c
-index 370be0a54d..2f04b5ce6c 100644
---- a/src/softmagic.c
-+++ b/src/softmagic.c
-@@ -812,7 +812,13 @@ mprint(struct magic_set *ms, struct magic *m)
- 			return -1;
- 		break;
- 	case FILE_GUID:
--		(void) file_print_guid(buf, sizeof(buf), ms->ms_value.guid);
-+	case FILE_LEGUID:
-+		(void) file_print_leguid(buf, sizeof(buf), ms->ms_value.guid);
-+		if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
-+			return -1;
-+		break;
-+	case FILE_BEGUID:
-+		(void) file_print_beguid(buf, sizeof(buf), ms->ms_value.guid);
- 		if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
- 			return -1;
- 		break;
-@@ -972,6 +978,8 @@ moffset(struct magic_set *ms, struct magic *m, size_t nbytes,
- 		}
- 		break;
- 
-+	case FILE_BEGUID:
-+	case FILE_LEGUID:
- 	case FILE_GUID:
- 		o = CAST(int32_t, (ms->offset + 2 * sizeof(uint64_t)));
- 		break;
-@@ -1333,6 +1341,8 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
- 	case FILE_USE:
- 	case FILE_DER:
- 	case FILE_GUID:
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 		return 1;
- 	default:
- 		file_magerror(ms, "invalid type %d in mconvert()", m->type);
-@@ -1903,6 +1913,8 @@ mget(struct magic_set *ms, struct magic *m, const struct buffer *b,
- 			return 0;
- 		break;
- 
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 	case FILE_GUID:
- 		if (OFFSET_OOB(nbytes, offset, 16))
- 			return 0;
-@@ -2416,6 +2428,8 @@ magiccheck(struct magic_set *ms, struct magic *m, file_regex_t **m_cache)
- 			return 0;
- 		}
- 		return matched;
-+	case FILE_BEGUID:
-+	case FILE_LEGUID:
- 	case FILE_GUID:
- 		l = 0;
- 		v = memcmp(m->value.guid, p->guid, sizeof(p->guid));
-diff --git a/src/swap.c b/src/swap.c
-new file mode 100644
-index 0000000000..f20e354237
---- /dev/null
-+++ b/src/swap.c
-@@ -0,0 +1,101 @@
-+/*
-+ * Copyright (c) Ian F. Darwin 1986-1995.
-+ * Software written by Ian F. Darwin and others;
-+ * maintained 1995-present by Christos Zoulas and others.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice immediately at the beginning of the file, without modification,
-+ *    this list of conditions, and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
-+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+/*
-+ * apprentice - make one pass through /etc/magic, learning its secrets.
-+ */
-+
-+#include "file.h"
-+
-+#ifndef	lint
-+FILE_RCSID("@(#)$File: swap.c,v 1.1 2026/04/19 19:56:49 christos Exp $")
-+#endif	/* lint */
-+
-+#include "swap.h"
-+
-+#if !defined(HAVE_BYTESWAP_H) && !defined(HAVE_SYS_BSWAP_H)
-+/*
-+ * swap a short
-+ */
-+file_protected uint16_t
-+file_swap2(uint16_t sv)
-+{
-+	uint16_t rv;
-+	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
-+	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
-+	d[0] = s[1];
-+	d[1] = s[0];
-+	return rv;
-+}
-+
-+/*
-+ * swap an int
-+ */
-+file_protected uint32_t
-+file_swap4(uint32_t sv)
-+{
-+	uint32_t rv;
-+	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
-+	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
-+	d[0] = s[3];
-+	d[1] = s[2];
-+	d[2] = s[1];
-+	d[3] = s[0];
-+	return rv;
-+}
-+
-+/*
-+ * swap a quad
-+ */
-+file_protected uint64_t
-+file_swap8(uint64_t sv)
-+{
-+	uint64_t rv;
-+	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
-+	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
-+# if 0
-+	d[0] = s[3];
-+	d[1] = s[2];
-+	d[2] = s[1];
-+	d[3] = s[0];
-+	d[4] = s[7];
-+	d[5] = s[6];
-+	d[6] = s[5];
-+	d[7] = s[4];
-+# else
-+	d[0] = s[7];
-+	d[1] = s[6];
-+	d[2] = s[5];
-+	d[3] = s[4];
-+	d[4] = s[3];
-+	d[5] = s[2];
-+	d[6] = s[1];
-+	d[7] = s[0];
-+# endif
-+	return rv;
-+}
-+#endif
-diff --git a/src/swap.h b/src/swap.h
-new file mode 100644
-index 0000000000..9fc6428d7d
---- /dev/null
-+++ b/src/swap.h
-@@ -0,0 +1,48 @@
-+/*
-+ * Copyright (c) Ian F. Darwin 1986-1995.
-+ * Software written by Ian F. Darwin and others;
-+ * maintained 1995-present by Christos Zoulas and others.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice immediately at the beginning of the file, without modification,
-+ *    this list of conditions, and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
-+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+
-+#ifdef HAVE_BYTESWAP_H
-+#include <byteswap.h>
-+#endif
-+#ifdef HAVE_SYS_BSWAP_H
-+#include <sys/bswap.h>
-+#endif
-+
-+#if defined(HAVE_BYTESWAP_H)
-+#define file_swap2(x)	bswap_16(x)
-+#define file_swap4(x)	bswap_32(x)
-+#define file_swap8(x)	bswap_64(x)
-+#elif defined(HAVE_SYS_BSWAP_H)
-+#define file_swap2(x)	bswap16(x)
-+#define file_swap4(x)	bswap32(x)
-+#define file_swap8(x)	bswap64(x)
-+#else
-+file_protected uint16_t file_swap2(uint16_t);
-+file_protected uint32_t file_swap4(uint32_t);
-+file_protected uint64_t file_swap8(uint64_t);
-+#endif
diff --git a/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch b/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch
deleted file mode 100644
index ede424aaba7c..000000000000
--- a/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 7a2b2a4b6e0f9de8682e6098c514155f2198cc8e Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Sun, 17 May 2026 17:10:25 +0000
-Subject: [PATCH] Handle parsing guids in big endian machines (Christoph Biedl)
-
-(OPNA2608: removed hunks that change file modification dates, as they
-make it more difficult to apply the patch)
-
----
- src/compress.c |  7 +++----
- src/file.h     |  3 ++-
- src/funcs.c    | 21 ++++++++++++++++++++-
- 3 files changed, 25 insertions(+), 6 deletions(-)
-
-diff --git a/src/compress.c b/src/compress.c
-index 76b7aad18..7f1d584d0 100644
---- a/src/compress.c
-+++ b/src/compress.c
-@@ -125,12 +125,11 @@ static const char *zlib_args[] = { "python", "-c", zlibcode, NULL };
- static int
- zlibcmp(const unsigned char *buf)
- {
--	unsigned short x = 1;
--	unsigned char *s = CAST(unsigned char *, CAST(void *, &x));
-+	unsigned short x;
- 
- 	if ((buf[0] & 0xf) != 8 || (buf[0] & 0x80) != 0)
- 		return 0;
--	if (s[0] != 1)	/* endianness test */
-+	if (file_bigendian())	/* endianness test */
- 		x = buf[0] | (buf[1] << 8);
- 	else
- 		x = buf[1] | (buf[0] << 8);
-diff --git a/src/file.h b/src/file.h
-index 497de9b91..6a39801e4 100644
---- a/src/file.h
-+++ b/src/file.h
-@@ -597,6 +597,7 @@ file_protected uint64_t file_signextend(struct magic_set *, struct magic *,
- file_protected uintmax_t file_varint2uintmax_t(const unsigned char *, int,
-     size_t *);
- 
-+file_protected int file_bigendian(void);
- file_protected void file_badread(struct magic_set *);
- file_protected void file_badseek(struct magic_set *);
- file_protected void file_oomem(struct magic_set *, size_t);
-diff --git a/src/funcs.c b/src/funcs.c
-index 8698f3312..0f2e6942b 100644
---- a/src/funcs.c
-+++ b/src/funcs.c
-@@ -52,6 +52,18 @@ FILE_RCSID("@(#)$File: funcs.c,v 1.151 2026/05/16 15:21:40 christos Exp $")
- #define SIZE_MAX	((size_t)~0)
- #endif
- 
-+file_protected int
-+file_bigendian(void)
-+{
-+	union {
-+		unsigned short x;
-+		unsigned char s[sizeof(unsigned short)];
-+	} u;
-+
-+	u.x = 1;
-+	return u.s[0] != 1;
-+}
-+
- file_protected char *
- file_copystr(char *buf, size_t blen, size_t width, const char *str)
- {
-@@ -931,6 +943,13 @@ file_parse_guid(const char *s, uint64_t *guid)
- 	    !getxvalue(&g->data4[6], s + 8, 2) ||
- 	    !getxvalue(&g->data4[7], s + 10, 2))
- 		return -1;
-+
-+	if (file_bigendian()) {
-+		g->data1 = file_swap4(g->data1);
-+		g->data2 = file_swap2(g->data2);
-+		g->data3 = file_swap2(g->data3);
-+
-+	}
- 	return 0;
- }
- 
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 4bd56f4dcfb3..da9968755584 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -3,8 +3,6 @@
   stdenv,
   fetchurl,
   buildPackages,
-  autoconf,
-  automake,
   zlib,
   libgnurx,
   updateAutotoolsGnuConfigScriptsHook,
@@ -18,14 +16,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "file";
-  version = "5.47";
+  version = "5.48";
 
   src = fetchurl {
     urls = [
       "https://astron.com/pub/file/file-${finalAttrs.version}.tar.gz"
       "https://distfiles.macports.org/file/file-${finalAttrs.version}.tar.gz"
     ];
-    hash = "sha256-RWcv7BZctMwTWKLXa11X0ih23Ll6sWlCesOFy+HVWXo=";
+    hash = "sha256-7RRlaIOyOjZLQFfAVZXZMlLam8Rz0wEGUZUZ0NoUEoM=";
   };
 
   outputs = [
@@ -34,46 +32,14 @@ stdenv.mkDerivation (finalAttrs: {
     "man"
   ];
 
-  patches = [
-    # Fixes `cat archive.zip | file -` just showing a generic "data" type. See:
-    # - https://bugs.astron.com/view.php?id=764
-    # - https://github.com/file/file/commit/12b76648185104ce9118d8b5fa57aa34a77ad084
-    # Vendored patch because using fetchpatch is impossible for a package in
-    # this part of the bootstrap chain.
-    ./0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
-    # Fixes breakage of python3Packages.python-magic and xdg-utils
-    ./0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
-
-    # Splits byteswapping functions into a separate file & reuses them across the codebase
-    # (needed for GUID parsing fix below)
-    # https://github.com/file/file/commit/797a275514c80303accbd821df9692b04f6020e6
-    # https://github.com/file/file/commit/2866af2e51beb40afe35d2ff5e765991ac459237
-    ./0003-Add-LE-BE-GUID.patch
-
-    # Fixes GUID parsing on big-endian
-    # https://github.com/file/file/commit/7a2b2a4b6e0f9de8682e6098c514155f2198cc8e
-    ./0004-Handle-parsing-guids-in-big-endian-machines.patch
-  ];
-
   strictDeps = true;
   enableParallelBuilding = true;
 
   nativeBuildInputs = [
-    # 0003-Add-LE-BE-GUID.patch touches automake file, need to regenerate files
-    # autoreconfHook would cause inf rec (hook -> libtool -> file -> hook), adding the individual components we need
-    autoconf
-    automake
-
     updateAutotoolsGnuConfigScriptsHook
   ];
   buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW libgnurx;
 
-  # 0003-Add-LE-BE-GUID.patch touches automake file, need to regenerate files
-  # autoreconfHook would cause inf rec (hook -> libtool -> file -> hook), manually calling autoreconf
-  preConfigure = ''
-    autoreconf
-  '';
-
   # https://bugs.astron.com/view.php?id=382
   doCheck = !stdenv.buildPlatform.isMusl;
 

From 972ffeccf531af0017aff7b20b5a88d28611ef47 Mon Sep 17 00:00:00 2001
From: n0099 <git@n0099.com>
Date: Wed, 10 Jun 2026 05:39:29 +0000
Subject: [PATCH 0619/1209] libtpms: fix building with `-march=x86-64-v4`

fix #528643
https://github.com/stefanberger/libtpms/pull/588
---
 pkgs/by-name/li/libtpms/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/li/libtpms/package.nix b/pkgs/by-name/li/libtpms/package.nix
index caecbaaaacc9..bd26f5b5639d 100644
--- a/pkgs/by-name/li/libtpms/package.nix
+++ b/pkgs/by-name/li/libtpms/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   pkg-config,
   autoreconfHook,
   openssl,
@@ -19,6 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-wCipOOr3LnLq1NqDtxw6hq0VTyniDwp18vBxyET/WGM=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/stefanberger/libtpms/pull/588.patch?full_index=1";
+      hash = "sha256-MVHy0sdg8ywKzu9M4ueRjH786uXQK8al21k8f+mAdR0=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

From 55199b0bb1cc0e1959002da688529970b9619e62 Mon Sep 17 00:00:00 2001
From: lukas-sgx <lukas.soigneux@epitech.eu>
Date: Thu, 11 Jun 2026 08:02:25 +0200
Subject: [PATCH 0620/1209] hwdata: 0.406 -> 0.408

---
 pkgs/by-name/hw/hwdata/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index 0678443277a9..0fc7c9022a62 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.406";
+  version = "0.408";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6GXXkDzunbtea+MmmWV2gpHgCgdGi75U+TV9H/6Emtk=";
+    hash = "sha256-fgKOvVGAdB3uBFuKfGPFfF9wQEdLtnlMdQrLNIr3teo=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)

From f7876e60c7afdab2f50f2686c94e2ec507861cce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Jun 2026 06:53:15 +0000
Subject: [PATCH 0621/1209] lilv: 0.26.4 -> 0.28.0

---
 pkgs/by-name/li/lilv/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/lilv/package.nix b/pkgs/by-name/li/lilv/package.nix
index acc3ff565858..ebdff4c26be8 100644
--- a/pkgs/by-name/li/lilv/package.nix
+++ b/pkgs/by-name/li/lilv/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lilv";
-  version = "0.26.4";
+  version = "0.28.0";
 
   outputs = [
     "out"
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.drobilla.net/lilv-${version}.tar.xz";
-    hash = "sha256-HItfy3hxgXPmfXblGtQj9RE6n/aEY/JWYZWuRjlgieM=";
+    hash = "sha256-jctwrbXPByM1EVprCR9BE3EL3HOrqtqj+enB5VlXsUk=";
   };
 
   nativeBuildInputs = [

From 7ee32846927cf8f453b06cfaedd7dde105233bfd Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Thu, 11 Jun 2026 11:40:31 +0200
Subject: [PATCH 0622/1209] imagemagick: 7.1.2-24 -> 7.1.2-25

changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md

diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-24...7.1.2-25
---
 pkgs/by-name/im/imagemagick/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/imagemagick/package.nix b/pkgs/by-name/im/imagemagick/package.nix
index 88faea3ca8c0..12c419172032 100644
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -88,13 +88,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-24";
+  version = "7.1.2-25";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-oSH0dsQ3cuFNYJIIr6LHbv82FbFxxcmkjQ5csTNsYCA=";
+    hash = "sha256-7z1oIKXZcumsESLrFRvU6z0M8JVsogG7yDWwF62jPwo=";
   };
 
   outputs = [

From ce0ee926172806aab3b159638fcd311546a2ca60 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 11 Jun 2026 13:01:27 +0200
Subject: [PATCH 0623/1209] Revert "replaceVarsWith: properly set pname,
 version"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Breaks stdenv, e.g. python3Minimal, where the build fails with

> find: ‘nuke-refs’: No such file or directory
---
 pkgs/build-support/replace-vars/replace-vars-with.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/build-support/replace-vars/replace-vars-with.nix b/pkgs/build-support/replace-vars/replace-vars-with.nix
index 60e48f841a19..abbb9a1cc1a0 100644
--- a/pkgs/build-support/replace-vars/replace-vars-with.nix
+++ b/pkgs/build-support/replace-vars/replace-vars-with.nix
@@ -122,8 +122,7 @@ in
 
 stdenvNoCC.mkDerivation (
   {
-    pname = optionalAttrs.pname or optionalAttrs.name or (baseNameOf src);
-    version = "26.11pre-git";
+    name = baseNameOf src;
   }
   // optionalAttrs
   // forcedAttrs

From 2c67d1303cc3b0d3afe90549d169c1ded72d5e2d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 10 Jun 2026 23:35:07 +0200
Subject: [PATCH 0624/1209] python314: 3.14.5 -> 3.14.6

https://docs.python.org/release/3.14.6/whatsnew/changelog.html
---
 pkgs/development/interpreters/python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 1efc8c14f0ae..5c7e4eafb3cd 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -20,10 +20,10 @@
         sourceVersion = {
           major = "3";
           minor = "14";
-          patch = "5";
+          patch = "6";
           suffix = "";
         };
-        hash = "sha256-fjJZe5nl2aOavtNd5Gk/oWnfPlhQ1MM0M3/9ahmjbbY=";
+        hash = "sha256-FDsd3e+uw70uIeO4ObNKK3+5hCJyiDxXZCDWBenzDGM=";
       };
     };
 

From 584d8c9e355d66259bc5d6627e8d8d034bee8897 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 10 Jun 2026 23:36:32 +0200
Subject: [PATCH 0625/1209] python313: 3.13.13 -> 3.13.14

https://docs.python.org/release/3.13.13/whatsnew/changelog.html

Fixes: CVE-2026-4224, CVE-2026-3644, CVE-2026-2297
---
 pkgs/development/interpreters/python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 5c7e4eafb3cd..f1dcae961908 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -59,10 +59,10 @@
       sourceVersion = {
         major = "3";
         minor = "13";
-        patch = "13";
+        patch = "14";
         suffix = "";
       };
-      hash = "sha256-Krkf9AF4PMymT3XRDIgulXvf1g4r9acvhCF5Nym3inE=";
+      hash = "sha256-Y55DJDxiCjCPloIT354A8vj2IzL3rbqnp+65eDBXxpA=";
       inherit passthruFun;
     };
 

From b6f477e6e78c740ed2f26e7a24b0430e2708fd63 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 10 Jun 2026 19:14:48 +0200
Subject: [PATCH 0626/1209] gbenchmark: fix eval and build on musl

glibcLocales is only non-null when stdenv.hostPlatform.isLinux &&
stdenv.hostPlatform.isGnu, so when it was added it broke eval of this
package on musl.  Fix the platform checks to be more accurate, and
backport an upstream fix for more accurate platform checks on their
side, to get building on musl again.

Fixes: f6da9198396a ("gbenchmark: 1.9.4 -> 1.9.5")
---
 pkgs/by-name/gb/gbenchmark/package.nix | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index 9d21e2c8a84b..a35f4781dba1 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   ninja,
   gtest,
@@ -20,6 +21,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Mm4pG7zMB00iof32CxreoNBFnduPZTMp3reHMCIAFPQ=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "portability.patch";
+      url = "https://github.com/google/benchmark/commit/b5ba9bab85d80f29a161dd634b7d234cf3722f90.patch";
+      hash = "sha256-/X01AWXK0eJ59F8oSREZ7V5Cpw1y35n9uFB1mCvMOus=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
@@ -27,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gtest ];
 
-  nativeCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ glibcLocales ];
+  nativeCheckInputs = lib.optionals (glibcLocales != null) [ glibcLocales ];
 
   cmakeFlags = [
     (lib.cmakeBool "BENCHMARK_USE_BUNDLED_GTEST" false)
@@ -45,10 +54,12 @@ stdenv.mkDerivation (finalAttrs: {
     # with Xcode, but we just work around it by silencing the warning.
     NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++17-attribute-extensions";
   }
-  // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+  // lib.optionalAttrs stdenv.hostPlatform.isGnu {
     # For test:locale_impermeability_test
     LANG = "en_US.UTF-8";
     LC_ALL = "en_US.UTF-8";
+  }
+  // lib.optionalAttrs (glibcLocales != null) {
     LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive";
   };
 

From d1215feef7546678557856166b0601dd9e7d2ad3 Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Thu, 11 Jun 2026 10:04:11 -0700
Subject: [PATCH 0627/1209] libtpms: bump commit id from PR to the one that
 merged master

---
 pkgs/by-name/li/libtpms/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libtpms/package.nix b/pkgs/by-name/li/libtpms/package.nix
index bd26f5b5639d..d0b6a1f2e0a2 100644
--- a/pkgs/by-name/li/libtpms/package.nix
+++ b/pkgs/by-name/li/libtpms/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     (fetchpatch2 {
-      url = "https://github.com/stefanberger/libtpms/pull/588.patch?full_index=1";
+      url = "https://github.com/stefanberger/libtpms/commit/2d9b00c4e42677cd0a9b67344f4d873ddc409a21.patch?full_index=1";
       hash = "sha256-MVHy0sdg8ywKzu9M4ueRjH786uXQK8al21k8f+mAdR0=";
     })
   ];

From 6e58884bf2f556471a83ac74eef646371d86cedb Mon Sep 17 00:00:00 2001
From: Nathan Henrie <nate@n8henrie.com>
Date: Thu, 11 Jun 2026 17:27:05 -0600
Subject: [PATCH 0628/1209] qt6.qtbase: fix darwin permissions for statically
 linked plugins

Assisted-by: Claude (Fable)

Fixes https://github.com/NixOS/nixpkgs/issues/530884
---
 .../libraries/qt-6/modules/qtbase/default.nix      | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index fa3ae210d281..bc27472bba7a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -275,6 +275,13 @@ stdenv.mkDerivation {
         --replace-quiet /usr/libexec/PlistBuddy '${lib.getExe' xcbuild "PlistBuddy"}'
     done
 
+    # Unlike Apple's PlistBuddy, xcbuild's only accepts capitalized commands,
+    # so the usage-description probe in permissions.prf always fails and the
+    # darwin permission plugins (Bluetooth, camera, ...) are silently never
+    # linked into qmake-built apps.
+    substituteInPlace mkspecs/features/permissions.prf \
+      --replace-fail "-c 'print " "-c 'Print "
+
     substituteInPlace mkspecs/common/macx.conf \
       --replace-fail 'CONFIG += ' 'CONFIG += no_default_rpath '
   '';
@@ -332,7 +339,12 @@ stdenv.mkDerivation {
   postFixup = ''
     moveToOutput      "mkspecs/modules" "$dev"
     fixQtModulePaths  "$dev/mkspecs/modules"
-    fixQtBuiltinPaths "$out" '*.pr?'
+    # fixQtBuiltinPaths reads qtPluginPrefix/qtQmlPrefix from the environment,
+    # but the setup hook only exports them for downstream packages; without
+    # them e.g. $$[QT_INSTALL_PLUGINS] in qt.prf is rewritten to "$out/"
+    # instead of "$out/${qtPluginPrefix}", breaking static plugin linking.
+    qtPluginPrefix=${qtPluginPrefix} qtQmlPrefix=${qtQmlPrefix} \
+      fixQtBuiltinPaths "$out" '*.pr?'
 
     # @out@ would be automagically replaced inside makeSetupHook by the output of that derivation,
     # but we need it to be the output of this derivation.

From 3b6967c20926a7c6423ebd9875a6cd18a7f254d5 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 7 Jun 2026 20:34:11 -0400
Subject: [PATCH 0629/1209] libressl: fix Darwin build

https://hydra.nixos.org/build/331199232
---
 pkgs/by-name/li/libressl/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 4ccc79407ba7..4bf139efc381 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -61,6 +61,10 @@ let
 
       doCheck = !(stdenv.hostPlatform.isPower64 || stdenv.hostPlatform.isRiscV);
       preCheck = ''
+        export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
+        export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
+      ''
+      + lib.optionalString stdenv.hostPlatform.isElf ''
         # Bail if any shared object has executable stack enabled. This can
         # happen when an object produced from an assmbly file in libcrypto is
         # missing a .note.GNU-stack section. An executable stack is dangerous
@@ -76,9 +80,6 @@ let
           }
           END { exit res }
         '
-
-        export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
-        export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
       '';
       postCheck = ''
         export ${ldLibPathEnvName}=$PREVIOUS_${ldLibPathEnvName}

From ed6faeb409235bf6b3b85082fbd00fe658593ca1 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Fri, 12 Jun 2026 09:02:45 +0200
Subject: [PATCH 0630/1209] openssl_3_6: 3.6.2 -> 3.6.3

Update to fix multiple CVEs.

See: https://github.com/openssl/openssl/releases/tag/openssl-3.6.3

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/development/libraries/openssl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 7762b0283a02..8a9699572d64 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -507,8 +507,8 @@ in
   };
 
   openssl_3_6 = common {
-    version = "3.6.2";
-    hash = "sha256-qvUaH+BkOE+BHa6utOxNznNA7IvYkwJ+7mdq8x6DoE8=";
+    version = "3.6.3";
+    hash = "sha256-JDqGZJz28j7rai/yRW4J5dd92QGKVNPZawxr3Wumx/E=";
 
     patches = [
       # Support for NIX_SSL_CERT_FILE, motivation:

From d0c441bcc6940d1eeef5d8e9b6cc39802916ce28 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 11 Jun 2026 18:37:24 +0200
Subject: [PATCH 0631/1209] minijail: 2025.07.02 -> 2026.05.18

Fixes build with Linux 6.19 headers.
---
 pkgs/by-name/mi/minijail/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/minijail/package.nix b/pkgs/by-name/mi/minijail/package.nix
index c2a72c604cd7..a00a16045076 100644
--- a/pkgs/by-name/mi/minijail/package.nix
+++ b/pkgs/by-name/mi/minijail/package.nix
@@ -8,12 +8,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "minijail";
-  version = "2025.07.02";
+  version = "2026.05.18";
 
   src = fetchFromGitiles {
     url = "https://chromium.googlesource.com/chromiumos/platform/minijail";
     tag = "linux-v${finalAttrs.version}";
-    hash = "sha256-GRnr2O6ZpWtRDGJ6Am0XPT426Xh7wxTJsoEqyTUECYY=";
+    hash = "sha256-15TQnTFIx2DSdAQZPCVhBPs8a+V6YV3IrA1LqfMWcRQ=";
   };
 
   buildInputs = [ libcap ];

From 097d5c78f5886ab6323892f516503b6b036eb777 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 10:34:10 +0300
Subject: [PATCH 0632/1209] freetype: simplify src's fetchurl

---
 pkgs/by-name/fr/freetype/package.nix | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/fr/freetype/package.nix b/pkgs/by-name/fr/freetype/package.nix
index 1eb213ab71f1..1bcb6b83642c 100644
--- a/pkgs/by-name/fr/freetype/package.nix
+++ b/pkgs/by-name/fr/freetype/package.nix
@@ -41,14 +41,10 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "freetype";
   version = "2.14.3";
 
-  src =
-    let
-      inherit (finalAttrs) pname version;
-    in
-    fetchurl {
-      url = "mirror://savannah/freetype/freetype-${version}.tar.xz";
-      sha256 = "sha256-NrxPHMQTM1No7mVsQq/KZcWjmH6HaMwozxG6d154Wl8=";
-    };
+  src = fetchurl {
+    url = "mirror://savannah/freetype/freetype-${finalAttrs.version}.tar.xz";
+    hash = "sha256-NrxPHMQTM1No7mVsQq/KZcWjmH6HaMwozxG6d154Wl8=";
+  };
 
   propagatedBuildInputs = [
     zlib

From c6bebdf2efefdd9ce086de61d352fc674f3933a3 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 10:03:51 +0300
Subject: [PATCH 0633/1209] python3Packages.matplotlib: add doronbehar to
 maintainers

---
 pkgs/development/python-modules/matplotlib/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 2311afef7a39..969219e1b5e7 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -206,6 +206,7 @@ buildPythonPackage rec {
     ];
     maintainers = with lib.maintainers; [
       veprbl
+      doronbehar
     ];
   };
 }

From cb9baef75053d218e66640fd140e9b40644e5b93 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 10:22:20 +0300
Subject: [PATCH 0634/1209] python3Packages.matplotlib: use finalAttrs pattern

---
 pkgs/development/python-modules/matplotlib/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 969219e1b5e7..3d49760d3cd8 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -75,13 +75,13 @@ let
   interactive = enableTk || enableGtk3 || enableQt;
 in
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   version = "3.10.9";
   pname = "matplotlib";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-/WZQjoxod9mOWGZUtgigRW241+ilRuseJgDv2VcwI1g=";
   };
 
@@ -199,7 +199,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python plotting library, making publication quality plots";
     homepage = "https://matplotlib.org/";
-    changelog = "https://github.com/matplotlib/matplotlib/releases/tag/v${version}";
+    changelog = "https://github.com/matplotlib/matplotlib/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       psfl
       bsd0
@@ -209,4 +209,4 @@ buildPythonPackage rec {
       doronbehar
     ];
   };
-}
+})

From c4a9aae5c70072807d7a9baee32dbbcab4ebea4b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 10:03:26 +0300
Subject: [PATCH 0635/1209] python3Packages.matplotlib: 3.10.9 -> 3.11.0

Changelog: https://github.com/matplotlib/matplotlib/releases/tag/v3.11.0

Disable withOutdatedFreetype passthru test, comment explains why.
---
 .../python-modules/matplotlib/default.nix     | 33 ++++++-------------
 1 file changed, 10 insertions(+), 23 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 3d49760d3cd8..eed032805c76 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -19,13 +19,8 @@
   # native libraries
   ffmpeg-headless,
   freetype,
-  # By default, almost all tests fail due to the fact we use our version of
-  # freetype. We still use this argument to define the overridden
-  # derivation `matplotlib.passthru.tests.withoutOutdatedFreetype` - which
-  # builds matplotlib with the freetype version they default to, with which all
-  # tests should pass.
-  doCheck ? false,
   qhull,
+  libraqm,
 
   # propagates
   contourpy,
@@ -76,13 +71,13 @@ let
 in
 
 buildPythonPackage (finalAttrs: {
-  version = "3.10.9";
+  version = "3.11.0";
   pname = "matplotlib";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-/WZQjoxod9mOWGZUtgigRW241+ilRuseJgDv2VcwI1g=";
+    hash = "sha256-aMDHvgGzDcyjY4k09/WR33NAEjXL2/DRqxxx59t/i1c=";
   };
 
   env.XDG_RUNTIME_DIR = "/tmp";
@@ -99,10 +94,6 @@ buildPythonPackage (finalAttrs: {
         --replace-fail "/usr/bin/env python3" "/usr/bin/env pypy3"
     ''
     + ''
-      substituteInPlace pyproject.toml \
-        --replace-fail "meson-python>=0.13.1,<0.17.0" meson-python \
-        --replace-fail "setuptools_scm>=7,<10" setuptools_scm
-
       patchShebangs tools
     ''
     + lib.optionalString (stdenv.hostPlatform.isLinux && interactive) ''
@@ -118,6 +109,7 @@ buildPythonPackage (finalAttrs: {
     ffmpeg-headless
     freetype
     qhull
+    libraqm
   ]
   ++ lib.optionals enableGtk3 [
     cairo
@@ -159,6 +151,7 @@ buildPythonPackage (finalAttrs: {
   mesonFlags = lib.mapAttrsToList lib.mesonBool {
     system-freetype = true;
     system-qhull = true;
+    system-libraqm = true;
     # Otherwise GNU's `ar` binary fails to put symbols from libagg into the
     # matplotlib shared objects. See:
     # -https://github.com/matplotlib/matplotlib/issues/28260#issuecomment-2146243663
@@ -168,20 +161,14 @@ buildPythonPackage (finalAttrs: {
 
   passthru.tests = {
     inherit sage;
-    withOutdatedFreetype = matplotlib.override {
-      doCheck = true;
-      freetype = freetype.overrideAttrs (_: {
-        src = fetchurl {
-          url = "mirror://savannah/freetype/freetype-old/freetype-2.6.1.tar.gz";
-          hash = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
-        };
-        patches = [ ];
-      });
-    };
   };
 
   pythonImportsCheck = [ "matplotlib" ];
-  inherit doCheck;
+  # Running the tests requires a specific freetype version, so pixel-to-pixel
+  # comparisons will pass. Since matplotlib depends directly & indirectly on
+  # freetype, this would be too expensive to even test this (correctly) in
+  # `passthru.tests`.
+  doCheck = false;
   nativeCheckInputs = [ pytestCheckHook ];
   preCheck = ''
     # https://matplotlib.org/devdocs/devel/testing.html#obtain-the-reference-images

From 8bb465825d98ce00008d3411ea21c4bffa5d1060 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 12 Jun 2026 11:00:16 -0700
Subject: [PATCH 0636/1209] python3Packages.pikepdf: 10.7.1 -> 10.8.0

Diff: https://github.com/pikepdf/pikepdf/compare/v10.7.1...v10.8.0

Changelog: https://github.com/pikepdf/pikepdf/blob/v10.8.0/docs/releasenotes/version10.md
---
 pkgs/development/python-modules/pikepdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 4173d1cc9eda..ef7b972ce3e8 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "10.7.1";
+  version = "10.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-qXpGopfiIG9dimJjHZlbHhXrtliSbgj2tWGQhbQwP5Q=";
+    hash = "sha256-ih5QC6VVl7dGvamp3FRzahnpEDjdO8gGFNVX19Bu8LE=";
   };
 
   patches = [

From c9b84bea7611c54cf57768833a3b6a28775144e5 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 01:45:49 +0300
Subject: [PATCH 0637/1209] libfaketime: `strictDeps` &
 `enableParallelBuilding`

`nix store make-content-addressed` gives the same output
before and after this change.

The speedup from `enableParallelBuilding` is only
39s -> 36s on my machine, but why not?
---
 pkgs/by-name/li/libfaketime/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index d66ac6704ecb..cf5c047850da 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -72,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   __structuredAttrs = true;
+  structDeps = true;
+  enableParallelBuilding = true;
 
   meta = {
     description = "Report faked system time to programs without having to change the system-wide time";

From e2464bbe5958ac199df0e823dcf232cc8272151e Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 02:01:14 +0300
Subject: [PATCH 0638/1209] libfaketime: use `CFLAGS` instead of
 `NIX_CFLAGS_COMPILE`

pkgsLLVM.libfaketime wouldn't link both before or after this change,
but pkgsCross.loongarch64-linux.libfaketime would and gave the same output
after `nix store make-content-addressed` before and after this change.
---
 pkgs/by-name/li/libfaketime/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index cf5c047850da..ecdb04678b32 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     PREFIX = placeholder "out";
     LIBDIRNAME = "/lib";
-    NIX_CFLAGS_COMPILE = toString (
+    CFLAGS = toString (
       lib.optionals stdenv.cc.isClang [
         "-Wno-error=cast-function-type"
         "-Wno-error=format-truncation"

From e1b1a2cdccc95db57900409002a08e5bee979a6e Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 01:43:48 +0300
Subject: [PATCH 0639/1209] libfaketime: split `doc` & `man` outputs

output size changes:
- out: 232K -> 180K
- man: 0 -> 4K
- doc: 0 -> 48K
---
 pkgs/by-name/li/libfaketime/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index ecdb04678b32..36874a53f40c 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -26,6 +26,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = hashes.${finalAttrs.version};
   };
 
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+
   patches = [
     ./nix-store-date.patch
   ]

From cbf6b65968a11896b3a8c8b108bf9ed5bf6deba0 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 02:16:08 +0300
Subject: [PATCH 0640/1209] acl: use `finalAttrs`

This does not change the eval
---
 pkgs/development/libraries/acl/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index 9bba05fd90bf..477e69555871 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -11,12 +11,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "acl";
   version = "2.3.2";
 
   src = fetchurl {
-    url = "mirror://savannah/acl/acl-${version}.tar.gz";
+    url = "mirror://savannah/acl/acl-${finalAttrs.version}.tar.gz";
     hash = "sha256-XyvbrWKXB6p9hcYj+ZSqih0t7FWnPeUgW6wL9gWKL3w=";
   };
 
@@ -41,6 +41,6 @@ stdenv.mkDerivation rec {
     description = "Library and tools for manipulating access control lists";
     license = lib.licenses.gpl2Plus;
     teams = [ lib.teams.security-review ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "acl_project" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "acl_project" finalAttrs.version;
   };
-}
+})

From 7661bd9f8cee33b387bbb9f18cba6aeeea76a847 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 02:16:08 +0300
Subject: [PATCH 0641/1209] acl: `strictDeps`, `__structuredAttrs`,
 `enableParallelBuilding`

This does not change the output (modulo path)
---
 pkgs/development/libraries/acl/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index 477e69555871..3397e6e27a14 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -28,6 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
     "doc"
   ];
 
+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ gettext ];
   buildInputs = [ attr ];
 

From 23eb9d22438eb163f258eaae9f2f9a32f7659eba Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Sat, 13 Jun 2026 11:26:40 +0300
Subject: [PATCH 0642/1209] gccgo: fix build from
 minimal-bootstrap.gnugrep-static

gccgo is built by overriding gcc from stdenv stage3. At this stage of
stdenv, when minimal-bootstrap is used as the bootstrap seed, the grep
package is actually gnugrep-static from minimal-bootstrap. This package
was accidentally missing egrep and fgrep.

Now, the gcc configure system is capable of detecting that grep -E
works as an egrep substitute. Still, a few makefiles were using egrep
directly rather than grep -E. This ultimately broke the gccgo build in
a subtle way.
---
 pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
index 6083a70b2410..18e71d833461 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
@@ -79,7 +79,6 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
-    rm $out/bin/{egrep,fgrep}
 
     # Remove documentation not needed in the bootstrap chain.
     rm -rf $out/share

From 8260f81399d5956ecf53b4718c6f247770fbb167 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 13 Jun 2026 11:37:13 +0200
Subject: [PATCH 0643/1209] postgresql: remove pkgsStatic support

This breaks again and again - and upstream is not really going to
support it anyway. It never fully worked - and the important thing is to
be able to build `pkgsStatic.libpq` anyway, which works independently of
the server package.
---
 pkgs/servers/sql/postgresql/generic.nix | 113 ++++++++----------------
 1 file changed, 37 insertions(+), 76 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 5b4b355c80f4..f9f2da13af04 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -56,33 +56,19 @@ let
       bonjourSupport ? false,
 
       # Curl
-      curlSupport ?
-        lib.versionAtLeast version "18"
-        && lib.meta.availableOn stdenv.hostPlatform curl
-        # Building statically fails with:
-        # configure: error: library 'curl' does not provide curl_multi_init
-        # https://www.postgresql.org/message-id/487dacec-6d8d-46c0-a36f-d5b8c81a56f1%40technowledgy.de
-        && !stdenv.hostPlatform.isStatic,
+      curlSupport ? lib.versionAtLeast version "18" && lib.meta.availableOn stdenv.hostPlatform curl,
       curl,
 
       # GSSAPI
-      gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic,
+      gssSupport ? with stdenv.hostPlatform; !isWindows,
       libkrb5,
 
       # icu
-      # Building with icu in pkgsStatic gives tons of "undefined reference" errors like this:
-      #   /nix/store/452lkaak37d3mzzn3p9ak7aa3wzhdqaj-icu4c-74.2-x86_64-unknown-linux-musl/lib/libicuuc.a(chariter.ao):
-      #    (.data.rel.ro._ZTIN6icu_7417CharacterIteratorE[_ZTIN6icu_7417CharacterIteratorE]+0x0):
-      #    undefined reference to `vtable for __cxxabiv1::__si_class_type_info'
-      icuSupport ? !stdenv.hostPlatform.isStatic,
+      icuSupport ? true,
       icu,
 
       # JIT
-      jitSupport ?
-        stdenv.hostPlatform.canExecute stdenv.buildPlatform
-        # Building with JIT in pkgsStatic fails like this:
-        #   fatal error: 'stdio.h' file not found
-        && !stdenv.hostPlatform.isStatic,
+      jitSupport ? stdenv.hostPlatform.canExecute stdenv.buildPlatform,
       llvmPackages,
       nukeReferences,
       overrideCC,
@@ -100,21 +86,12 @@ let
       numactl,
 
       # PAM
-      pamSupport ?
-        lib.meta.availableOn stdenv.hostPlatform linux-pam
-        # Building with linux-pam in pkgsStatic gives a few "undefined reference" errors like this:
-        #   /nix/store/3s55icpsbc36sgn7sa8q3qq4z6al6rlr-linux-pam-static-x86_64-unknown-linux-musl-1.6.1/lib/libpam.a(pam_audit.o):
-        #     in function `pam_modutil_audit_write':(.text+0x571):
-        #     undefined reference to `audit_close'
-        && !stdenv.hostPlatform.isStatic,
+      pamSupport ? lib.meta.availableOn stdenv.hostPlatform linux-pam,
       linux-pam,
 
       # PL/Perl
       perlSupport ?
         lib.meta.availableOn stdenv.hostPlatform perl
-        # Building with perl in pkgsStatic gives this error:
-        #   configure: error: cannot build PL/Perl because libperl is not a shared library
-        && !stdenv.hostPlatform.isStatic
         # configure tries to call the perl executable for the version
         && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
       perl,
@@ -122,9 +99,6 @@ let
       # PL/Python
       pythonSupport ?
         lib.meta.availableOn stdenv.hostPlatform python3
-        # Building with python in pkgsStatic gives this error:
-        #  checking how to link an embedded Python application... configure: error: could not find shared library for Python
-        && !stdenv.hostPlatform.isStatic
         # configure tries to call the python executable
         && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
       python3,
@@ -132,8 +106,6 @@ let
       # PL/Tcl
       tclSupport ?
         lib.meta.availableOn stdenv.hostPlatform tcl
-        # tcl is broken in pkgsStatic
-        && !stdenv.hostPlatform.isStatic
         # configure fails with:
         #   configure: error: file 'tclConfig.sh' is required for Tcl
         && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
@@ -434,19 +406,6 @@ let
       + lib.optionalString (atLeast "18") ''
         substituteInPlace src/test/regress/parallel_schedule \
           --replace-fail numa ""
-      ''
-      # This check was introduced upstream to prevent calls to "exit" inside libpq.
-      # However, this doesn't work reliably with static linking, see this and following:
-      # https://postgr.es/m/flat/20210703001639.GB2374652%40rfd.leadboat.com#52584ca4bd3cb9dac376f3158c419f97
-      # Thus, disable the check entirely, as it would currently fail with this:
-      # > libpq.so.5.17:                  U atexit
-      # > libpq.so.5.17:                  U pthread_exit
-      # > libpq must not be calling any function which invokes exit
-      # Don't mind the fact that this checks libpq.**so** in pkgsStatic - that's correct, since PostgreSQL
-      # still needs a shared library internally.
-      + lib.optionalString (atLeast "15" && stdenv'.hostPlatform.isStatic) ''
-        substituteInPlace src/interfaces/libpq/Makefile \
-          --replace-fail "echo 'libpq must not be calling any function which invokes exit'; exit 1;" "echo;"
       '';
 
       postInstall = ''
@@ -472,8 +431,7 @@ let
         # because there is a realistic use-case for extensions to locate the /lib directory to
         # load other shared modules.
         remove-references-to -t "$dev" -t "$doc" -t "$man" "$out/bin/postgres"
-      ''
-      + lib.optionalString (!stdenv'.hostPlatform.isStatic) ''
+
         if [ -z "''${dontDisableStatic:-}" ]; then
           # Remove static libraries in case dynamic are available.
           for i in $lib/lib/*.a; do
@@ -484,8 +442,7 @@ let
             fi
           done
         fi
-      ''
-      + ''
+
         # The remaining static libraries are libpgcommon.a, libpgport.a and related.
         # Those are only used when building e.g. extensions, so go to $dev.
         moveToOutput "lib/*.a" "$dev"
@@ -530,18 +487,16 @@ let
       # Also see <nixpkgs>/doc/stdenv/platform-notes.chapter.md
       doCheck = false;
       doInstallCheck =
-        !(stdenv'.hostPlatform.isStatic)
-        &&
-          # Tests currently can't be run on darwin, because of a Nix bug:
-          # https://github.com/NixOS/nix/issues/12548
-          # https://git.lix.systems/lix-project/lix/issues/691
-          # The error appears as this in the initdb logs:
-          #   FATAL:  could not create shared memory segment: Cannot allocate memory
-          # Don't let yourself be fooled when trying to remove this condition: Running
-          # the tests works fine most of the time. But once the tests (or any package using
-          # postgresqlTestHook) fails on the same machine for a few times, enough IPC objects
-          # will be stuck around, and any future builds with the tests enabled *will* fail.
-          !(stdenv'.hostPlatform.isDarwin)
+        # Tests currently can't be run on darwin, because of a Nix bug:
+        # https://github.com/NixOS/nix/issues/12548
+        # https://git.lix.systems/lix-project/lix/issues/691
+        # The error appears as this in the initdb logs:
+        #   FATAL:  could not create shared memory segment: Cannot allocate memory
+        # Don't let yourself be fooled when trying to remove this condition: Running
+        # the tests works fine most of the time. But once the tests (or any package using
+        # postgresqlTestHook) fails on the same machine for a few times, enough IPC objects
+        # will be stuck around, and any future builds with the tests enabled *will* fail.
+        !(stdenv'.hostPlatform.isDarwin)
         &&
           # Regression tests currently fail in pkgsMusl because of a difference in EXPLAIN output.
           !(stdenv'.hostPlatform.isMusl)
@@ -624,20 +579,26 @@ let
         ];
         platforms = lib.platforms.unix;
 
-        # JIT support doesn't work with cross-compilation. It is attempted to build LLVM-bytecode
-        # (`%.bc` is the corresponding `make(1)`-rule) for each sub-directory in `backend/` for
-        # the JIT apparently, but with a $(CLANG) that can produce binaries for the build, not the
-        # host-platform.
-        #
-        # I managed to get a cross-build with JIT support working with
-        # `depsBuildBuild = [ llvmPackages.clang ] ++ buildInputs`, but considering that the
-        # resulting LLVM IR isn't platform-independent this doesn't give you much.
-        # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
-        # a query, postgres would coredump with `Illegal instruction`.
-        #
-        # Note: This is "host canExecute build" on purpose, since this is about the LLVM that is called
-        # to do JIT at **runtime**.
-        broken = jitSupport && !stdenv.hostPlatform.canExecute stdenv.buildPlatform;
+        broken =
+          # JIT support doesn't work with cross-compilation. It is attempted to build LLVM-bytecode
+          # (`%.bc` is the corresponding `make(1)`-rule) for each sub-directory in `backend/` for
+          # the JIT apparently, but with a $(CLANG) that can produce binaries for the build, not the
+          # host-platform.
+          #
+          # I managed to get a cross-build with JIT support working with
+          # `depsBuildBuild = [ llvmPackages.clang ] ++ buildInputs`, but considering that the
+          # resulting LLVM IR isn't platform-independent this doesn't give you much.
+          # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
+          # a query, postgres would coredump with `Illegal instruction`.
+          #
+          # Note: This is "host canExecute build" on purpose, since this is about the LLVM that is called
+          # to do JIT at **runtime**.
+          (jitSupport && !stdenv.hostPlatform.canExecute stdenv.buildPlatform)
+          # While PostgreSQL claims to support static builds, it does not do so in a way that
+          # would work properly and consistently in pkgsStatic. The server heavily depends on
+          # the ability to load shared modules at runtime, but dlopen() is stubbed out in static
+          # musl builds. The important part is, that the separate libpq package builds in pkgsStatic.
+          || stdenv.hostPlatform.isStatic;
       };
     });
 

From efeb755073b9b5f58a34d9a3b609d9f178c9affb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 13 Jun 2026 20:11:35 +0200
Subject: [PATCH 0644/1209] ci/owners: remove natsukium from remaining python
 ownership

---
 ci/OWNERS | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ci/OWNERS b/ci/OWNERS
index e08961b38210..e5d896e39688 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -192,10 +192,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/by-name/an/android*                     @NixOS/android
 
 # Python-related code and docs
-/doc/languages-frameworks/python.section.md   @mweinelt @natsukium
-/maintainers/scripts/update-python-libraries  @mweinelt @natsukium
-/pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
-/pkgs/development/interpreters/python         @mweinelt @natsukium
+/doc/languages-frameworks/python.section.md   @mweinelt
+/maintainers/scripts/update-python-libraries  @mweinelt
+/pkgs/by-name/up/update-python-libraries      @mweinelt
+/pkgs/development/interpreters/python         @mweinelt
 
 # CUDA
 /pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers

From f8981908fa0149134072cb0ede100e51358841be Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 13 Jun 2026 20:23:37 +0000
Subject: [PATCH 0645/1209] protobuf: 35.0 -> 35.1

Diff: https://github.com/protocolbuffers/protobuf/compare/v35.0...v35.1

Changelog:
https://github.com/protocolbuffers/protobuf/releases/tag/v35.1
---
 pkgs/development/libraries/protobuf/35.nix     | 4 ++--
 pkgs/development/python-modules/protobuf/7.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/protobuf/35.nix b/pkgs/development/libraries/protobuf/35.nix
index 0dba884f1ecf..c1addeb59840 100644
--- a/pkgs/development/libraries/protobuf/35.nix
+++ b/pkgs/development/libraries/protobuf/35.nix
@@ -2,8 +2,8 @@
 
 callPackage ./generic.nix (
   {
-    version = "35.0";
-    hash = "sha256-J0NA19W44CzgSjKv3A+1An6vDRTDjaWMhDzQGEOtrCk=";
+    version = "35.1";
+    hash = "sha256-nif9xjd+3ASR2pvvSXkzTEWoKi2oKLzV9gMQ3EevBVk=";
   }
   // args
 )
diff --git a/pkgs/development/python-modules/protobuf/7.nix b/pkgs/development/python-modules/protobuf/7.nix
index 3cb696c0110a..c0465363a84f 100644
--- a/pkgs/development/python-modules/protobuf/7.nix
+++ b/pkgs/development/python-modules/protobuf/7.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "protobuf";
-  version = "7.35.0";
+  version = "7.35.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-ou/YRgX0HlWfGIGwkStECZ0KKsm/RrNHSCPxD7OTsOY=";
+    hash = "sha256-zhFaJv4MOaLCmXPZFNMn5RamRVRkSJ/jzR5RobNU+Bo=";
   };
 
   build-system = [ setuptools ];

From 1dc665b0af91e936f86e659adf87317638974581 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 13 Jun 2026 20:25:14 +0000
Subject: [PATCH 0646/1209] python3Packages.protobuf: enable __structuredAttrs

---
 pkgs/development/python-modules/protobuf/7.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/protobuf/7.nix b/pkgs/development/python-modules/protobuf/7.nix
index c0465363a84f..203c3b9c118a 100644
--- a/pkgs/development/python-modules/protobuf/7.nix
+++ b/pkgs/development/python-modules/protobuf/7.nix
@@ -11,6 +11,7 @@ buildPythonPackage (finalAttrs: {
   pname = "protobuf";
   version = "7.35.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;

From e351b6fa2fa118886cd235823243ecc63a5204f3 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 13 Jun 2026 20:26:19 +0000
Subject: [PATCH 0647/1209] python3Packages.protobuf6: enable __structuredAttrs

---
 pkgs/development/python-modules/protobuf/6.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/protobuf/6.nix b/pkgs/development/python-modules/protobuf/6.nix
index 6c96954b0df7..8259f224f131 100644
--- a/pkgs/development/python-modules/protobuf/6.nix
+++ b/pkgs/development/python-modules/protobuf/6.nix
@@ -11,6 +11,7 @@ buildPythonPackage (finalAttrs: {
   pname = "protobuf";
   version = "6.33.6";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;

From 418b4595bbeea7930296197d57702f57b43e830b Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 13 Jun 2026 20:25:55 +0000
Subject: [PATCH 0648/1209] python3Packages.protobuf5: enable __structuredAttrs

---
 pkgs/development/python-modules/protobuf/5.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/protobuf/5.nix b/pkgs/development/python-modules/protobuf/5.nix
index 5e44c82d463f..dcfbf72e415c 100644
--- a/pkgs/development/python-modules/protobuf/5.nix
+++ b/pkgs/development/python-modules/protobuf/5.nix
@@ -10,6 +10,7 @@ buildPythonPackage rec {
   pname = "protobuf";
   version = "5.29.6";
   pyproject = true;
+  __structuredAttrs = true;
   # nixpkgs-update: no auto update
 
   src = fetchPypi {

From 756f27df972ea5db54acc73ec09f90b1a531f390 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Sat, 13 Jun 2026 16:55:05 -0700
Subject: [PATCH 0649/1209] aws-c-http: 0.10.4 -> 0.11.0

Diff: https://github.com/awslabs/aws-c-http/compare/v0.10.4...v0.11.0
---
 pkgs/by-name/aw/aws-c-http/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/aw/aws-c-http/package.nix b/pkgs/by-name/aw/aws-c-http/package.nix
index 01b333b01b35..9f0fd8c16f04 100644
--- a/pkgs/by-name/aw/aws-c-http/package.nix
+++ b/pkgs/by-name/aw/aws-c-http/package.nix
@@ -14,13 +14,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-http";
   # nixpkgs-update: no auto update
-  version = "0.10.4";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t9PoxOjgV9qLris+C18SaEwXodBGcgK591LZl0dajxU=";
+    hash = "sha256-SCdZfGIIHU6f0OArygZm0yY0wE6Hdx/JWvHZcK1DQOw=";
   };
 
   nativeBuildInputs = [

From 6db252617590ff61fd852e956ca4829081f7d93c Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Sat, 13 Jun 2026 16:56:19 -0700
Subject: [PATCH 0650/1209] aws-c-io: 0.22.0 -> 0.27.2

Diff: https://github.com/awslabs/aws-c-io/compare/v0.22.0...v0.27.2
---
 pkgs/by-name/aw/aws-c-io/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/aw/aws-c-io/package.nix b/pkgs/by-name/aw/aws-c-io/package.nix
index 590195761664..960d79c9a43d 100644
--- a/pkgs/by-name/aw/aws-c-io/package.nix
+++ b/pkgs/by-name/aw/aws-c-io/package.nix
@@ -12,13 +12,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-io";
   # nixpkgs-update: no auto update
-  version = "0.22.0";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-io";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NOEjXk4s/FV4CdmyXOr4Oh2y+pFNrUMP/Sy+X+fVQc4=";
+    hash = "sha256-0vzuSvJ/4you0YYnizjctKP5AcLm5sJieDOSCHwm1HM=";
   };
 
   nativeBuildInputs = [ cmake ];

From c0ec12aeaec4ce63f60ff9606d286d006c821695 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 13 Jun 2026 17:53:35 -0700
Subject: [PATCH 0651/1209] krb5: patch CVE-2026-11850

---
 pkgs/by-name/kr/krb5/CVE-2026-11850.patch | 33 +++++++++++++++++++++++
 pkgs/by-name/kr/krb5/package.nix          |  2 ++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/by-name/kr/krb5/CVE-2026-11850.patch

diff --git a/pkgs/by-name/kr/krb5/CVE-2026-11850.patch b/pkgs/by-name/kr/krb5/CVE-2026-11850.patch
new file mode 100644
index 000000000000..3c7dde29df3f
--- /dev/null
+++ b/pkgs/by-name/kr/krb5/CVE-2026-11850.patch
@@ -0,0 +1,33 @@
+From 2a5fd83d4436583f2ddc0e193269a4d800ee45c4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebasti=C3=A1n=20Alba?= <sebasjosue84@gmail.com>
+Date: Wed, 8 Apr 2026 18:32:25 -0400
+Subject: [PATCH] Prevent read overrun in libkdb_ldap
+
+In berval2tl_data(), reject inputs of length less than 2 to prevent an
+integer underflow and subsequent read overrun.  (The security impact
+is negligible as the attacker would have to control the KDB LDAP
+server.)
+
+[ghudson@mit.edu: wrote commit message]
+
+ticket: 9206 (new)
+tags: pullup
+target_version: 1.22-next
+---
+ plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+index 418d253d17..9aa68bacd7 100644
+--- a/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
++++ b/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+@@ -80,6 +80,9 @@ getstringtime(krb5_timestamp);
+ krb5_error_code
+ berval2tl_data(struct berval *in, krb5_tl_data **out)
+ {
++    if (in->bv_len < 2)
++        return EINVAL;
++
+     *out = (krb5_tl_data *) malloc (sizeof (krb5_tl_data));
+     if (*out == NULL)
+         return ENOMEM;
diff --git a/pkgs/by-name/kr/krb5/package.nix b/pkgs/by-name/kr/krb5/package.nix
index c4e35061d41a..4e97e9867190 100644
--- a/pkgs/by-name/kr/krb5/package.nix
+++ b/pkgs/by-name/kr/krb5/package.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
+    # https://github.com/krb5/krb5/pull/1505
+    ./CVE-2026-11850.patch
     # https://github.com/krb5/krb5/pull/1506
     ./CVE-2026-40355-and-CVE-2026-40356.patch
   ]

From 5f8fa250d5012bca29143c89c30a296e8002b7bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 14 Jun 2026 03:54:36 +0200
Subject: [PATCH 0652/1209] python314Packages.aws-sam-translator: 1.106.0 ->
 1.110.0

---
 .../aws-sam-translator/default.nix            | 32 ++++---------------
 1 file changed, 6 insertions(+), 26 deletions(-)

diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 33ced09ce46b..42a22dedbbaf 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -10,25 +10,22 @@
   pytest-rerunfailures,
   pytest-xdist,
   pytestCheckHook,
-  pythonAtLeast,
   pyyaml,
+  requests,
   setuptools,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.106.0";
+  version = "1.110.0";
   pyproject = true;
 
-  # https://github.com/aws/serverless-application-model/issues/3831
-  disabled = pythonAtLeast "3.14";
-
   src = fetchFromGitHub {
     owner = "aws";
     repo = "serverless-application-model";
     tag = "v${version}";
-    hash = "sha256-9KrBoa50lgZcqe/wzt05TsuUYbjRuQXgXTVHjDKBmr4=";
+    hash = "sha256-Zn+6cDyDZSsV9V+zAA8BOPs4aKl0j3dF92/azGYG+OI=";
   };
 
   postPatch = ''
@@ -36,6 +33,8 @@ buildPythonPackage rec {
     rm pytest.ini
   '';
 
+  pythonRelaxDeps = [ "pydantic" ];
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -52,6 +51,7 @@ buildPythonPackage rec {
     pytest-xdist
     pytestCheckHook
     pyyaml
+    requests
   ];
 
   preCheck = ''
@@ -66,26 +66,6 @@ buildPythonPackage rec {
     "slow"
   ];
 
-  disabledTests = [
-    # urllib3 2.0 compat
-    "test_plugin_accepts_different_sar_client"
-    "test_plugin_accepts_flags"
-    "test_plugin_accepts_parameters"
-    "test_plugin_default_values"
-    "test_plugin_invalid_configuration_raises_exception"
-    "test_plugin_must_setup_correct_name"
-    "test_must_process_applications"
-    "test_must_process_applications_validate"
-    "test_process_invalid_applications"
-    "test_process_invalid_applications_validate"
-    "test_resolve_intrinsics"
-    "test_sar_service_calls"
-    "test_sar_success_one_app"
-    "test_sar_throttling_doesnt_stop_processing"
-    "test_sleep_between_sar_checks"
-    "test_unexpected_sar_error_stops_processing"
-  ];
-
   __darwinAllowLocalNetworking = true;
 
   pythonImportsCheck = [ "samtranslator" ];

From 042fe921f5eb501460a87295349036a09edab9cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 14 Jun 2026 04:02:10 +0200
Subject: [PATCH 0653/1209] python314Packages.chalice: allow on 3.14

This was already possible since the 1.33.0 update.
https://redirect.github.com/aws/chalice/commit/bf4dce655ad97784ea09fb19484465fcf08c847d
---
 pkgs/development/python-modules/chalice/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/development/python-modules/chalice/default.nix b/pkgs/development/python-modules/chalice/default.nix
index dab8b5c075fb..c6aa4b4035a2 100644
--- a/pkgs/development/python-modules/chalice/default.nix
+++ b/pkgs/development/python-modules/chalice/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonAtLeast,
 
   # build-system
   setuptools,
@@ -28,8 +27,6 @@ buildPythonPackage (finalAttrs: {
   version = "1.33.0";
   pyproject = true;
 
-  disabled = pythonAtLeast "3.14";
-
   src = fetchFromGitHub {
     owner = "aws";
     repo = "chalice";
@@ -78,7 +75,6 @@ buildPythonPackage (finalAttrs: {
     "test_can_import_env_vars"
     "test_stack_trace_printed_on_error"
     # Don't build
-    "test_can_generate_pipeline_for_all"
     "test_build_wheel"
     # Tests require dist
     "test_setup_tar_gz_hyphens_in_name"

From c1b74a6831fe46c9a52e3265e7c328c5f61e9d5f Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Sun, 14 Jun 2026 05:45:41 +0000
Subject: [PATCH 0654/1209] gnupatch: enable strictDeps

part of <https://github.com/NixOS/nixpkgs/issues/178468>.

the output is bit-for-bit identical before and after this change
(tested both x86_64-linux `pkgs.gnupatch` and `pkgsMusl.gnupatch`).
---
 pkgs/tools/text/gnupatch/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index 99a801c4cc8e..68ebbedfbc23 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = stdenv.hostPlatform.libc != "musl";
   nativeCheckInputs = [ ed ];
 
+  strictDeps = true;
+
   meta = {
     description = "GNU Patch, a program to apply differences to files";
     mainProgram = "patch";

From f9f5c0662091ee07de5e6ba20aae4a36ef2718b5 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Sat, 6 Jun 2026 12:07:59 +0200
Subject: [PATCH 0655/1209] fretboard: fix darwin build

---
 pkgs/by-name/fr/fretboard/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/fr/fretboard/package.nix b/pkgs/by-name/fr/fretboard/package.nix
index 115e311419e8..a1c0e3a6707a 100644
--- a/pkgs/by-name/fr/fretboard/package.nix
+++ b/pkgs/by-name/fr/fretboard/package.nix
@@ -69,6 +69,5 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "fretboard";
     teams = [ lib.teams.gnome-circle ];
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin;
   };
 })

From 7f54ad693754c31d75e3e93d5f181a6f76dc98a1 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Mon, 15 Jun 2026 02:42:40 +0300
Subject: [PATCH 0656/1209] gnutar: `__structuredAttrs` &
 `enableParallelBuilding`

---
 pkgs/by-name/gn/gnutar/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gn/gnutar/package.nix b/pkgs/by-name/gn/gnutar/package.nix
index 51344245c45f..acf5f3233aeb 100644
--- a/pkgs/by-name/gn/gnutar/package.nix
+++ b/pkgs/by-name/gn/gnutar/package.nix
@@ -40,7 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
     "info"
   ];
 
+  __structuredAttrs = true;
   strictDeps = true;
+  enableParallelBuilding = true;
 
   nativeBuildInputs = [ autoreconfHook ] ++ lib.optional stdenv.hostPlatform.isCygwin gettext;
 

From f9823a9e198ac27fc99e6f0aadd531d6c759a4ce Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 15 Jun 2026 16:47:25 +0300
Subject: [PATCH 0657/1209] python3Packages.matplotlib: fix setuptools_scm
 constraint

Should have been kept in #530985
---
 pkgs/development/python-modules/matplotlib/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index eed032805c76..2f11fd9a0d65 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -94,6 +94,9 @@ buildPythonPackage (finalAttrs: {
         --replace-fail "/usr/bin/env python3" "/usr/bin/env pypy3"
     ''
     + ''
+      substituteInPlace pyproject.toml \
+        --replace-fail "setuptools_scm>=7,<10" setuptools_scm
+
       patchShebangs tools
     ''
     + lib.optionalString (stdenv.hostPlatform.isLinux && interactive) ''

From eb5dafe5479e70ac0195fdeabf57da842d2603bf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 00:28:40 +0200
Subject: [PATCH 0658/1209] python3Packages.httpcore2: 2.3.0 -> 2.4.0

https://github.com/pydantic/httpx2/blob/v2.4.0/src/httpcore2/CHANGELOG.md
---
 pkgs/development/python-modules/httpcore2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/httpcore2/default.nix b/pkgs/development/python-modules/httpcore2/default.nix
index cfbbf8113342..eddeeb5178fd 100644
--- a/pkgs/development/python-modules/httpcore2/default.nix
+++ b/pkgs/development/python-modules/httpcore2/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "httpcore2";
-  version = "2.3.0";
+  version = "2.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "httpx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cW6meHx6VBMz5r/lXCKKK7Sq4e2nk+n1A5YTNtR2kB4=";
+    hash = "sha256-T5As4cdZRHkWszzaDZX8G8Z35TkaBsB/oy92FtOhuBY=";
   };
 
   postPatch = ''

From 71bf5cc8cb35b23e1bc393533a5177898fabbfbd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 11:59:22 +0200
Subject: [PATCH 0659/1209] python3Packages.idna: 3.15 -> 3.18

https://github.com/kjd/idna/releases/tag/v3.18
---
 pkgs/development/python-modules/idna/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index c6c917852319..7278212bf772 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "3.15";
+  version = "3.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kjd";
     repo = "idna";
     tag = "v${version}";
-    hash = "sha256-z3Nd834inihGzquCAmejUQvRcM0Yn/VmMcWQP3oh4ak=";
+    hash = "sha256-9nLy/9PNuLSQJsf4Jes0uN695+LGjz2LXlfiZxxvGV4=";
   };
 
   build-system = [ flit-core ];

From 15ad0c06216db71aa97ba1ec1732711c7cad3a89 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 14:47:21 +0200
Subject: [PATCH 0660/1209] python3Packages.httpx2: 2.3.0 -> 2.4.0

https://github.com/pydantic/httpx2/blob/v2.4.0/src/httpx2/CHANGELOG.md
---
 pkgs/development/python-modules/httpx2/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/httpx2/default.nix b/pkgs/development/python-modules/httpx2/default.nix
index 9e73b584f276..f27315046788 100644
--- a/pkgs/development/python-modules/httpx2/default.nix
+++ b/pkgs/development/python-modules/httpx2/default.nix
@@ -29,7 +29,6 @@
   # tests
   chardet,
   pytestCheckHook,
-  pytest-httpbin,
   pytest-trio,
   trustme,
   uvicorn,
@@ -40,14 +39,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "httpx2";
-  version = "2.3.0";
+  version = "2.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "httpx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cW6meHx6VBMz5r/lXCKKK7Sq4e2nk+n1A5YTNtR2kB4=";
+    hash = "sha256-T5As4cdZRHkWszzaDZX8G8Z35TkaBsB/oy92FtOhuBY=";
   };
 
   postPatch = ''

From 28e20e77fc5109649ddd16d7ad5aa459dba93186 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:24:45 +0200
Subject: [PATCH 0661/1209] python3Packages.valkey: fix valkey 9.1 compat

---
 pkgs/development/python-modules/valkey/default.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/valkey/default.nix b/pkgs/development/python-modules/valkey/default.nix
index 5674542e9016..dcccacb7d569 100644
--- a/pkgs/development/python-modules/valkey/default.nix
+++ b/pkgs/development/python-modules/valkey/default.nix
@@ -40,11 +40,20 @@ buildPythonPackage rec {
   };
 
   patches = [
+    # valkey 9.0 compat
     (fetchpatch {
-      # valkey 9.0 compat
       url = "https://github.com/valkey-io/valkey-py/commit/c01505e547f614f278b882a016557b6ed652bb9f.patch";
       hash = "sha256-rvA65inIioqdc+QV4KaaUv1I/TMZUq0TWaFJcJiy8NU=";
     })
+    # valkey 9.1 compat
+    (fetchpatch {
+      url = "https://github.com/valkey-io/valkey-py/commit/df5c44903dc8e2dda733e5576324ba0ff8c4c6a0.patch";
+      hash = "sha256-0wsWuaOYWBgf6BjlJuciZYRbugYfchTU2khQX7rtRJg=";
+    })
+    (fetchpatch {
+      url = "https://github.com/valkey-io/valkey-py/commit/046c7fb9e8260c2d69d05141b1519903c4e40efe.patch";
+      hash = "sha256-/yN1y0hbmBR6o6ab4h0qkn/qhU6jASOIeqWhxUi5w/I=";
+    })
   ];
 
   build-system = [ setuptools ];

From 2b080788e2178808fbb42674fbef8daae9aedebe Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:33:57 +0200
Subject: [PATCH 0662/1209] python3Packages.matplotlib: relax setuptools-scm
 constraint

Per their upstream comment this is fine for downstream distributors, as
it only breaks editable installs for them.
---
 pkgs/development/python-modules/matplotlib/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index eed032805c76..20a63ca43387 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -95,6 +95,9 @@ buildPythonPackage (finalAttrs: {
     ''
     + ''
       patchShebangs tools
+
+      substituteInPlace pyproject.toml \
+        --replace-fail "setuptools_scm>=7,<10" "setuptools_scm"
     ''
     + lib.optionalString (stdenv.hostPlatform.isLinux && interactive) ''
       # fix paths to libraries in dlopen calls (headless detection)

From fc4407ec5ecd31d13c855ff181f1dbff2c272729 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:38:14 +0200
Subject: [PATCH 0663/1209] python3Packages.meson-python: 0.19.0 -> 0.20.0

https://github.com/mesonbuild/meson-python/blob/0.20.0/CHANGELOG.rst
---
 pkgs/development/python-modules/meson-python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 35e9e0c350b4..28f726541f1a 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "meson-python";
-  version = "0.19.0";
+  version = "0.20.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "meson_python";
-    hash = "sha256-mVnRmKpptX/P01SjRRjG95W3gac+0GVvTQFmAWDMJVM=";
+    hash = "sha256-bZcmrmzTfiLyEMdLNkswGApowgRC6X/wnzxWakFK9zg=";
   };
 
   build-system = [

From 186c27eb2fc154df133bd5502977291c14d23271 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:54:08 +0200
Subject: [PATCH 0664/1209] python3Packages.pdm-backend: 2.4.8 -> 2.4.9

https://github.com/pdm-project/pdm-backend/releases/tag/2.4.9
---
 pkgs/development/python-modules/pdm-backend/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pdm-backend/default.nix b/pkgs/development/python-modules/pdm-backend/default.nix
index 4170d421d632..e4bf513d4f55 100644
--- a/pkgs/development/python-modules/pdm-backend/default.nix
+++ b/pkgs/development/python-modules/pdm-backend/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pdm-backend";
-  version = "2.4.8";
+  version = "2.4.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdm-project";
     repo = "pdm-backend";
     tag = version;
-    hash = "sha256-zh+JP1sX+ra3Z6oVgxOabwMmD/bQjokdb0MelZ0k1KQ=";
+    hash = "sha256-082ZSfRUGUV8DX+vuJeOd+HOuAfnKfZPZ3Lyhx6TRlE=";
   };
 
   env.PDM_BUILD_SCM_VERSION = version;

From 81f9403c1e1adae1e175fa72f6701deb7d40feca Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:48:32 +0200
Subject: [PATCH 0665/1209] python3Packages.pytest-run-parallel: 0.8.2 -> 0.9.1

https://github.com/Quansight-Labs/pytest-run-parallel/releases/tag/v0.9.1
---
 .../python-modules/pytest-run-parallel/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-run-parallel/default.nix b/pkgs/development/python-modules/pytest-run-parallel/default.nix
index 7f7dfe9cad19..2ab2cd05f651 100644
--- a/pkgs/development/python-modules/pytest-run-parallel/default.nix
+++ b/pkgs/development/python-modules/pytest-run-parallel/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytest-run-parallel";
-  version = "0.8.2";
+  version = "0.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Quansight-Labs";
     repo = "pytest-run-parallel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/EoIemQvQFgo9Ic+ZcQJk7fC8S+OHOHaHODrsivarhY=";
+    hash = "sha256-8ndm/CKtWieNF3mx7Ni7nPO4psam3TAM9NJzdiiSpPQ=";
   };
 
   build-system = [ setuptools ];

From 81edfa0080b857e81a8d09ab18381df58aec4eb0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:49:19 +0200
Subject: [PATCH 0666/1209] python3Packages.pytest-describe: 3.1.0 -> 3.2.0

https://github.com/pytest-dev/pytest-describe/releases/tag/3.2.0
---
 pkgs/development/python-modules/pytest-describe/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-describe/default.nix b/pkgs/development/python-modules/pytest-describe/default.nix
index 3c88f2f6f66b..fcbfbd3f4be0 100644
--- a/pkgs/development/python-modules/pytest-describe/default.nix
+++ b/pkgs/development/python-modules/pytest-describe/default.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "pytest-describe";
-  version = "3.1.0";
+  version = "3.2.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -25,7 +25,7 @@ buildPythonPackage {
     owner = "pytest-dev";
     repo = "pytest-describe";
     tag = version;
-    hash = "sha256-ygrZwd1cO9arekdzqn5Axjz4i9Q0QKFA/OS6QSIvP9Y=";
+    hash = "sha256-nvTINE3QtV2pCKD/aixYDSO2ryW1uYDv55FLOMP7Vlc=";
   };
 
   postPatch = ''

From 19d19509aa7c338fcdeee3435dc04c3c07cfebdf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 16:35:55 +0200
Subject: [PATCH 0667/1209] python3Packaegs.aioresponses: fix aiohttp 3.14
 compat

---
 .../aioresponses/aiohttp-3.14-compat.patch    | 79 +++++++++++++++++++
 .../python-modules/aioresponses/default.nix   |  6 ++
 2 files changed, 85 insertions(+)
 create mode 100644 pkgs/development/python-modules/aioresponses/aiohttp-3.14-compat.patch

diff --git a/pkgs/development/python-modules/aioresponses/aiohttp-3.14-compat.patch b/pkgs/development/python-modules/aioresponses/aiohttp-3.14-compat.patch
new file mode 100644
index 000000000000..a60736062614
--- /dev/null
+++ b/pkgs/development/python-modules/aioresponses/aiohttp-3.14-compat.patch
@@ -0,0 +1,79 @@
+From 1a48e1f898035e3bedc981f06520842c55977706 Mon Sep 17 00:00:00 2001
+From: kleine-safie <k-guilherme@safie.jp>
+Date: Wed, 10 Jun 2026 11:05:30 +0900
+Subject: [PATCH] support for pause_reading
+
+---
+ aioresponses/compat.py     |  5 +++++
+ aioresponses/core.py       |  2 ++
+ tests/test_aioresponses.py | 11 ++++++++++-
+ tox.ini                    | 11 ++++++-----
+ 4 files changed, 23 insertions(+), 6 deletions(-)
+
+diff --git a/aioresponses/compat.py b/aioresponses/compat.py
+index 83fd47a..e95ecb2 100644
+--- a/aioresponses/compat.py
++++ b/aioresponses/compat.py
+@@ -2,6 +2,7 @@
+ import asyncio  # noqa: F401
+ from re import Pattern
+ from typing import Dict, Optional, Union  # noqa
++from unittest.mock import Mock
+ from urllib.parse import parse_qsl, urlencode
+ 
+ from aiohttp import __version__ as aiohttp_version, StreamReader
+@@ -17,6 +18,10 @@ def stream_reader_factory(  # noqa
+     loop: 'Optional[asyncio.AbstractEventLoop]' = None
+ ) -> StreamReader:
+     protocol = ResponseHandler(loop=loop)
++    # Satisfies BaseProtocol's flow control hooks that
++    # fire when a large payload exceeds the StreamReader limit.
++    protocol._parser = Mock()
++    protocol._parser.feed_data.return_value = ([], False, b'')
+     return StreamReader(protocol, limit=2 ** 16, loop=loop)
+ 
+ 
+diff --git a/aioresponses/core.py b/aioresponses/core.py
+index a904cf9..52640f3 100644
+--- a/aioresponses/core.py
++++ b/aioresponses/core.py
+@@ -182,6 +182,8 @@ def _build_response(self, url: 'Union[URL, str]',
+             headers=CIMultiDictProxy(self._prepare_request_headers(request_headers)),
+             real_url=url
+         )
++        if 'stream_writer' in inspect.signature(response_class).parameters:
++            kwargs['stream_writer'] = Mock(output_size=0)
+         kwargs['writer'] = None
+         kwargs['continue100'] = None
+         kwargs['timer'] = TimerNoop()
+diff --git a/tests/test_aioresponses.py b/tests/test_aioresponses.py
+index 68bec3f..45c0d87 100644
+--- a/tests/test_aioresponses.py
++++ b/tests/test_aioresponses.py
+@@ -4,9 +4,10 @@
+ from asyncio import CancelledError, TimeoutError
+ from random import uniform
+ from typing import Coroutine, Generator, Union
+-from unittest.mock import patch
++from unittest.mock import MagicMock, patch
+ 
+ from aiohttp import hdrs
++from aiohttp.base_protocol import BaseProtocol
+ from aiohttp import http
+ from aiohttp.client import ClientSession
+ from aiohttp.client_reqrep import ClientResponse
+@@ -312,6 +313,14 @@ async def test_streaming(self, m):
+         content = await resp.content.read()
+         self.assertEqual(content, b'Test')
+ 
++    @aioresponses()
++    async def test_streaming_large_body(self, m):
++        body = b'x' * (1024 * 1024)
++        m.get(self.url, body=body)
++        resp = await self.session.get(self.url)
++        content = await resp.content.read()
++        self.assertEqual(content, body)
++
+     @aioresponses()
+     async def test_streaming_up_to(self, m):
+         m.get(self.url, body='Test')
diff --git a/pkgs/development/python-modules/aioresponses/default.nix b/pkgs/development/python-modules/aioresponses/default.nix
index e3ec08c122ce..395f7387aef7 100644
--- a/pkgs/development/python-modules/aioresponses/default.nix
+++ b/pkgs/development/python-modules/aioresponses/default.nix
@@ -25,6 +25,12 @@ buildPythonPackage rec {
     hash = "sha256-uGHN/l3FjzuK+sewppc9XXsstgjdD2JT0WuO6Or23xE=";
   };
 
+  patches = [
+    # https://github.com/pnuckowski/aioresponses/issues/289
+    # https://github.com/pnuckowski/aioresponses/pull/292
+    ./aiohttp-3.14-compat.patch
+  ];
+
   postPatch = ''
     # https://github.com/pnuckowski/aioresponses/pull/278
     substituteInPlace aioresponses/core.py \

From eea62504755a60a7bed09378d3175a19c5b9ffbf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 17:45:35 +0200
Subject: [PATCH 0668/1209] python3Packages.sqlalchemy: 2.0.50 -> 2.0.51

https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_2_0_51
---
 pkgs/development/python-modules/sqlalchemy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 1e57fb444030..ea8d784e831f 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sqlalchemy";
-  version = "2.0.50";
+  version = "2.0.51";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     tag = "rel_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-pZgkQa+qXuXSSlBXba5qByXFqegaIB/XGgp7Q2Bsz9U=";
+    hash = "sha256-2t3NhfLiu/rLI2yvFPK9uQXGyzqNUj7ImDRx0EasdsI=";
   };
 
   postPatch = ''

From e858e80fb18c50f8cb8eaf750bbc2a2075207103 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 9 Jun 2026 10:05:48 +0200
Subject: [PATCH 0669/1209] wrapGAppsHook: only wrap $outBin by default

---
 doc/languages-frameworks/gnome.section.md     |  2 +-
 .../wrap-gapps-hook/wrap-gapps-hook.sh        | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/doc/languages-frameworks/gnome.section.md b/doc/languages-frameworks/gnome.section.md
index ecfda62b5700..7e9130218ca6 100644
--- a/doc/languages-frameworks/gnome.section.md
+++ b/doc/languages-frameworks/gnome.section.md
@@ -105,7 +105,7 @@ Given the requirements above, the package expression would become messy quickly:
 }
 ```
 
-Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that automate this. They work in conjunction with other setup hooks that populate environment variables, and will then wrap all executables in `bin` and `libexec` directories using said variables.
+Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that automate this. They work in conjunction with other setup hooks that populate environment variables, and will then wrap all executables in `bin` and `libexec` directories using said variables. If a package has multiple outputs, these hooks will work on `outputBin` by default, or on the outputs listed in `wrapGAppsInOutputs` if set.
 
 - [`wrapGAppsHook3`]{#ssec-gnome-hooks-wrapgappshook3} for GTK 3 apps. For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure.
 - [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4} for GTK 4 apps. Same as `wrapGAppsHook3` but replaces `gtk3` with `gtk4`.
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
index 92b7a5eee3e7..ef2c02dff02e 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -42,13 +42,32 @@ wrapGApp() {
     wrapProgram "$program" "${gappsWrapperArgs[@]}" "$@"
 }
 
+_wrapGAppsHookMayRunForOutput() {
+    local -r output="$1"
+    if [[ -v wrapGAppsInOutputs ]]; then
+        local allowedOutput
+        # Support both structuredAttrs on and off
+        local -a allowedOutputs
+        concatTo allowedOutputs wrapGAppsInOutputs
+        for allowedOutput in "${allowedOutputs[@]}"; do
+            [ "$allowedOutput" = "$output" ] && return 0
+        done
+    else
+        [ "$outputBin" = "$output" ] && return 0
+    fi
+    return 1
+ }
+
 declare -gA wrapGAppsHookHasRunForOutput
 
 # Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set.
+# $output is brought into scope via fixupPhase() in pkgs/stdenv/generic/setup.sh
 wrapGAppsHook() {
     # guard against running multiple times for the same output (e.g. due to propagation)
     [ "${wrapGAppsHookHasRunForOutput["$output"]:-}" = 1 ] && return 0
     wrapGAppsHookHasRunForOutput["$output"]=1
+    # guard against running for outputs we don't want to run it for
+    _wrapGAppsHookMayRunForOutput "$output" || return 0
 
     if [[ -z "${dontWrapGApps:-}" ]]; then
         local targetDirsThatExist targetDirsRealPath targetDirs targetDir

From 5767290bcd2e2c8d955006718324f26b8f688be5 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 9 Jun 2026 10:06:33 +0200
Subject: [PATCH 0670/1209] wrapGAppsHook: add tests for multiple outputs

---
 .../setup-hooks/wrap-gapps-hook/default.nix   | 189 +++++++++++++++++-
 1 file changed, 188 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
index 73c2782cfe07..7212578e7405 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@@ -76,7 +76,136 @@ makeSetupHook {
           ];
         };
 
-        # The wrapper for executable files should add path to dconf GIO module.
+        # Simple derivation containing a program and a daemon, but split over multiple outputs.
+        basic-multiple-outputs = stdenv.mkDerivation {
+          name = "basic-multiple-outputs";
+
+          src = sample-project;
+
+          outputs = [
+            "out"
+            "lib"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            # Wrapper will want to append this to XDG_DATA_DIRS, but should not cause a cyclic dependency;
+            # i.e. only "out" will be wrapped.
+            mkdir -p $out/share
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using a non-default output
+        # Executables in "bin" should be handled correctly automatically
+        basic-bin-output = stdenv.mkDerivation {
+          name = "basic-bin-output";
+
+          src = sample-project;
+
+          outputs = [
+            "bin"
+            "dev"
+            "lib"
+            "out"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            mkdir -p $bin
+            mv $out/bin $bin
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using a non-default output
+        basic-other-outputs = stdenv.mkDerivation {
+          name = "basic-other-outputs";
+
+          src = sample-project;
+
+          outputs = [
+            "dev"
+            "lib"
+            "out"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          wrapGAppsInOutputs = [
+            "dev"
+            "lib"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            mkdir -p $dev
+            mv $out/bin $dev
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using non-default outputs
+        # that are explicitly referenced via wrapGAppsInOutputs
+        basic-other-outputs-structuredattrs = stdenv.mkDerivation {
+          name = "basic-other-outputs-structuredAttrs";
+
+          __structuredAttrs = true;
+
+          src = sample-project;
+
+          outputs = [
+            "dev"
+            "lib"
+            "out"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          wrapGAppsInOutputs = [
+            "dev"
+            "lib"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            mkdir -p $dev
+            mv $out/bin $dev
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using non-default outputs
+        # that are explicitly referenced via wrapGAppsInOutputs, while structuredAttrs are enabled
+        # so that it is a proper array.
         basic-contains-dconf =
           let
             tested = basic;
@@ -92,6 +221,64 @@ makeSetupHook {
             ''
           );
 
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-multiple-outputs-contains-dconf =
+          let
+            tested = basic-multiple-outputs;
+          in
+          testLib.runTest "basic-multiple-outputs-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-bin-output-contains-dconf =
+          let
+            tested = basic-bin-output;
+          in
+          testLib.runTest "basic-bin-output-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-other-outputs-contains-dconf =
+          let
+            tested = basic-other-outputs;
+          in
+          testLib.runTest "basic-other-outputs-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.dev}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.lib}/libexec/bar" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-other-outputs-contains-dconf-structuredattrs =
+          let
+            tested = basic-other-outputs-structuredattrs;
+          in
+          testLib.runTest "basic-other-outputs-structuredattrs-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.dev}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.lib}/libexec/bar" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
         basic-contains-gdk-pixbuf =
           let
             tested = basic;

From 2ba83f987baf09304b58ff81c5c9a377883b41a3 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Mon, 15 Jun 2026 04:31:56 +0300
Subject: [PATCH 0671/1209] libfaketime: structDeps -> strictDeps

typo in c9b84bea7611c54cf57768833a3b6a28775144e5
---
 pkgs/by-name/li/libfaketime/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index 36874a53f40c..9500cdb60097 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   __structuredAttrs = true;
-  structDeps = true;
+  strictDeps = true;
   enableParallelBuilding = true;
 
   meta = {

From 6b2ed1f4cefa3e311d356ec3f99e1782986ebaab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 12 Jun 2026 12:57:40 -0700
Subject: [PATCH 0672/1209] python3Packages.idna: improve meta.changelog

---
 pkgs/development/python-modules/idna/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index 7278212bf772..dcd4408111e6 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/kjd/idna/";
-    changelog = "https://github.com/kjd/idna/releases/tag/${src.tag}";
+    changelog = "https://github.com/kjd/idna/blob/${src.tag}/HISTORY.md";
     description = "Internationalized Domain Names in Applications (IDNA)";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.dotlambda ];

From 54c816a0e5f59f0aae9931e2596e8721173aae1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 12 Jun 2026 13:02:29 -0700
Subject: [PATCH 0673/1209] python3Packages.idna: use finalAttrs

---
 pkgs/development/python-modules/idna/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index dcd4408111e6..a8bda9b6f28f 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -6,7 +6,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "idna";
   version = "3.18";
   pyproject = true;
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "kjd";
     repo = "idna";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-9nLy/9PNuLSQJsf4Jes0uN695+LGjz2LXlfiZxxvGV4=";
   };
 
@@ -26,9 +26,9 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/kjd/idna/";
-    changelog = "https://github.com/kjd/idna/blob/${src.tag}/HISTORY.md";
+    changelog = "https://github.com/kjd/idna/blob/${finalAttrs.src.tag}/HISTORY.md";
     description = "Internationalized Domain Names in Applications (IDNA)";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.dotlambda ];
   };
-}
+})

From 3e7b87d61c644490bd228becfe8c700e913e3379 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 18:06:03 +0200
Subject: [PATCH 0674/1209] cacert: 3.123 -> 3.125

---
 pkgs/by-name/ca/cacert/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index 8dd727f6ded3..df6b082a92bc 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.123";
+  version = "3.125";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-dxMO+RITdyhEVh+9OqMdQTslwqx/V2/qO8O7/375NIk=";
+    hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0=";
   };
 
   unpackPhase = ''

From 1ed75d980adb9547b81e0e2d651eb2b2f1736ef8 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Mon, 15 Jun 2026 02:23:19 -0600
Subject: [PATCH 0675/1209] linux-pam: 1.7.1 -> 1.7.2

https://github.com/linux-pam/linux-pam/releases/tag/v1.7.2
Diff: https://github.com/linux-pam/linux-pam/compare/v1.7.1...v1.7.2
---
 pkgs/by-name/li/linux-pam/package.nix | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/linux-pam/package.nix b/pkgs/by-name/li/linux-pam/package.nix
index 5e1fdfd4a7ce..0da213b857c0 100644
--- a/pkgs/by-name/li/linux-pam/package.nix
+++ b/pkgs/by-name/li/linux-pam/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPackages,
   fetchFromGitHub,
+  fetchpatch,
   flex,
   db4,
   gettext,
@@ -33,18 +34,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "linux-pam";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "linux-pam";
     repo = "linux-pam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kANcwxifQz2tYPSrSBSFiYNTm51Gr10L/zroCqm8ZHQ=";
-
+    hash = "sha256-V3XQqolinh+MqUefMDYJF9zP4fBJTHc7YKN+NEGjx1g=";
   };
 
   __structuredAttrs = true;
 
+  patches = [
+    (fetchpatch {
+      name = "secure-opendir-fix-error-handling.patch";
+      url = "https://github.com/linux-pam/linux-pam/commit/dd62bac17221911106de165607c6925ea54b18d1.patch?full_index=1";
+      hash = "sha256-ddgDYdVfdXfTaMFV1hO3RJX9w1NHmE7yi3PxsHOdpvY=";
+    })
+  ];
+
   # patching unix_chkpwd is required as the nix store entry does not have the necessary bits
   postPatch = ''
     substituteInPlace modules/module-meson.build \
@@ -104,6 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "nis" false)
     (lib.mesonBool "xtests" false)
     (lib.mesonBool "examples" false)
+    (lib.mesonOption "vendordir" "${placeholder "out"}/etc")
   ]
   # warning: slower execution due to debug makes VM tests fail!
   ++ lib.optional debugMode (lib.mesonBool "pam-debug" true);

From 1444d3fc386cb89bb716f06985984784bb521c45 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Thu, 4 Jun 2026 14:07:25 +0300
Subject: [PATCH 0676/1209] musescore: remove qt6.qtdeclarative patch

---
 pkgs/by-name/mu/musescore/package.nix | 37 +++++++--------------------
 1 file changed, 9 insertions(+), 28 deletions(-)

diff --git a/pkgs/by-name/mu/musescore/package.nix b/pkgs/by-name/mu/musescore/package.nix
index c974b2e79415..0fe03f6c388e 100644
--- a/pkgs/by-name/mu/musescore/package.nix
+++ b/pkgs/by-name/mu/musescore/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
 
   # nativeBuildInputs
   cmake,
@@ -35,24 +34,6 @@
   nixosTests,
 }:
 
-let
-  qt6' = qt6.overrideScope (
-    self: super: {
-      # Fix for: https://github.com/NixOS/nixpkgs/issues/526825
-      # reported upstream at: https://github.com/musescore/MuseScore/issues/33015
-      qtdeclarative = super.qtdeclarative.overrideAttrs (
-        new: old: {
-          patches = old.patches ++ [
-            (fetchpatch {
-              url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.patch";
-              hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
-            })
-          ];
-        }
-      );
-    }
-  );
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "musescore";
   version = "4.7.3";
@@ -114,8 +95,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    qt6'.qttools
-    qt6'.wrapQtAppsHook
+    qt6.qttools
+    qt6.wrapQtAppsHook
     ninja
     pkg-config
   ]
@@ -128,12 +109,12 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     flac
     freetype
-    qt6'.qt5compat
-    qt6'.qtbase
-    qt6'.qtdeclarative
-    qt6'.qtnetworkauth
-    qt6'.qtscxml
-    qt6'.qtsvg
+    qt6.qt5compat
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtnetworkauth
+    qt6.qtscxml
+    qt6.qtsvg
     lame
     libjack2
     libogg
@@ -150,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
-    qt6'.qtwayland
+    qt6.qtwayland
   ];
 
   # Put the default, `$prefix/lib` directory to look for ffmpeg shared objects,

From 0150e1894f23407a9766d9a3ac3bb5911b2c0639 Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Mon, 6 Apr 2026 16:30:05 +0300
Subject: [PATCH 0677/1209] minimal-bootstrap: Use minimal gcc wrapper

---
 .../linux/minimal-bootstrap/default.nix       | 13 ++-
 .../linux/minimal-bootstrap/gcc/latest.nix    | 19 ++++-
 .../linux/minimal-bootstrap/gcc/wrapper.nix   | 81 +++++++++++++++++++
 .../linux/minimal-bootstrap/gcc/wrapper.sh    | 51 ++++++++++++
 .../linux/minimal-bootstrap/gcc/wrappercxx.sh | 57 +++++++++++++
 .../linux/minimal-bootstrap/musl/static.nix   | 13 ++-
 .../linux/minimal-bootstrap/xz/static.nix     |  2 +-
 7 files changed, 225 insertions(+), 11 deletions(-)
 create mode 100644 pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.nix
 create mode 100644 pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.sh
 create mode 100644 pkgs/os-specific/linux/minimal-bootstrap/gcc/wrappercxx.sh

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index 5418c6507b4b..6afd5e5f6259 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -154,11 +154,19 @@ lib.makeScope
           gnutar = gnutar-latest;
         };
 
-        gcc-latest = callPackage ./gcc/latest.nix {
+        gcc-latest-unwrapped = callPackage ./gcc/latest.nix {
           gcc = gcc10;
           gnumake = gnumake-musl;
           gnutar = gnutar-latest;
         };
+        gcc-latest = callPackage ./gcc/wrapper.nix {
+          bash-build = bash;
+          gcc-unwrapped = gcc-latest-unwrapped;
+          targetPlatform = hostPlatform;
+          libc = musl;
+          libgcc = gcc-latest-unwrapped;
+          libstdcxx = gcc-latest-unwrapped;
+        };
 
         gnugrep = callPackage ./gnugrep {
           bash = bash_2_05;
@@ -294,6 +302,7 @@ lib.makeScope
         };
 
         musl-static = callPackage ./musl/static.nix {
+          libgcc = gcc-latest-unwrapped;
           gcc = gcc-latest;
           gnumake = gnumake-musl;
         };
@@ -455,7 +464,7 @@ lib.makeScope
         };
 
         glibc = callPackage ./glibc {
-          gcc = gcc-latest;
+          gcc = gcc-latest-unwrapped;
           gnumake = gnumake-musl;
           gnutar = gnutar-latest;
           gnugrep = gnugrep-static;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
index d003f164abad..8abf382e17d6 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
@@ -126,10 +126,12 @@ bash.runCommand "${pname}-${version}"
       --prefix=$out \
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
-      --with-native-system-header-dir=/include \
-      --with-sysroot=${musl} \
+      --with-native-system-header-dir=${musl}/include \
+      --with-sysroot=/ \
       --enable-languages=c,c++ \
       --enable-checking=release \
+      --enable-static \
+      --disable-shared \
       --disable-bootstrap \
       --disable-dependency-tracking \
       --disable-libsanitizer \
@@ -144,8 +146,7 @@ bash.runCommand "${pname}-${version}"
       --disable-multilib \
       --disable-nls \
       --disable-plugin \
-      --without-isl \
-      --disable-shared
+      --without-isl
 
     # Build
     make -j $NIX_BUILD_CORES
@@ -155,4 +156,14 @@ bash.runCommand "${pname}-${version}"
 
     # libstdc++ gdb pretty-printers + man pages are unused downstream.
     rm -rf $out/share/gcc-*/python $out/share/man $out/share/info
+
+    if [ -d "$out/lib64" ]; then
+      shopt -s dotglob
+      for lib in $out/lib64/*; do
+        mv --no-clobber "$lib" "$out/lib/"
+      done
+      shopt -u dotglob
+      rm -rf "$out/lib64"
+      ln -s lib "$out/lib64"
+    fi
   ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.nix
new file mode 100644
index 000000000000..69c0d0f93add
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.nix
@@ -0,0 +1,81 @@
+{
+  fetchurl,
+  lib,
+  gnutar,
+  xz,
+  bash-build,
+  gnused,
+  targetPlatform,
+  libc,
+  libgcc,
+  libstdcxx,
+  gcc-unwrapped,
+  binutils,
+  bash,
+}:
+let
+  pname = "gcc-wrapper";
+  extraFlags = "-static-libgcc ";
+  # only supports musl for now
+  dynamicLinkerGlob = "${libc}/lib/libc.so";
+in
+bash-build.runCommand "${pname}-${gcc-unwrapped.version}"
+  {
+    inherit pname;
+    version = gcc-unwrapped.version;
+    meta = gcc-unwrapped.meta;
+    nativeBuildInputs = [ gnused ];
+    passthru.unwrapped = gcc-unwrapped;
+  }
+  ''
+    if [[ -z '${dynamicLinkerGlob}' ]]; then
+      echo "Don't know the name of the dynamic linker for platform '${targetPlatform.config}', so guessing instead."
+      dynamicLinker="${libc}/lib/ld*.so.?"
+    else
+      dynamicLinker='${dynamicLinkerGlob}'
+    fi
+    dynamicLinker=($dynamicLinker)
+    case ''${#dynamicLinker[@]} in
+      0) echo "No dynamic linker found for platform '${targetPlatform.config}'.";;
+      1) echo "Using dynamic linker: '$dynamicLinker'";;
+      *) echo "Multiple dynamic linkers found for platform '${targetPlatform.config}'.";;
+    esac
+
+    mkdir -p "$out/bin"
+    for orig in ${gcc-unwrapped}/bin/*gcc ${gcc-unwrapped}/bin/*gcc-${gcc-unwrapped.version}; do
+      sed \
+        -e 's,@bash@,${lib.getExe bash},' \
+        -e "s,@gcc@,$orig," \
+        -e "s,@origname@,$(basename "$orig")," \
+        -e "s,@origdir@,${gcc-unwrapped}/libexec/gcc," \
+        -e "s,@dynlinker@,$dynamicLinker," \
+        -e 's,@libgcc@,${libgcc}/lib/gcc/${targetPlatform.config}/${libgcc.version},' \
+        -e 's,@libc@,${libc}/lib,' \
+        -e 's,@gccinc@,${gcc-unwrapped}/lib/gcc/${targetPlatform.config}/${libgcc.version}/include,' \
+        -e 's,@binutils@,${binutils}/bin,' \
+        -e 's,@extraflags@,${extraFlags},' \
+        '${./wrapper.sh}' > "$out/bin/$(basename "$orig")"
+        chmod +x "$out/bin/$(basename "$orig")"
+    done
+    for orig in ${gcc-unwrapped}/bin/*++; do
+      sed \
+        -e 's,@bash@,${lib.getExe bash},' \
+        -e "s,@gcc@,$orig," \
+        -e "s,@origname@,$(basename "$orig")," \
+        -e "s,@origdir@,${gcc-unwrapped}/libexec/gcc," \
+        -e "s,@dynlinker@,$dynamicLinker," \
+        -e 's,@libgcc@,${libgcc}/lib/gcc/${targetPlatform.config}/${libgcc.version},' \
+        -e 's,@libc@,${libc}/lib,' \
+        -e 's,@libstdcxx@,${libstdcxx}/lib,' \
+        -e 's,@libstdcxxinc@,${libstdcxx}/include/c++/${libstdcxx.version},' \
+        -e 's,@libstdcxxarchinc@,${libstdcxx}/include/c++/${libstdcxx.version}/${targetPlatform.config},' \
+        -e 's,@gccinc@,${gcc-unwrapped}/lib/gcc/${targetPlatform.config}/${libgcc.version}/include,' \
+        -e 's,@binutils@,${binutils}/bin,' \
+        -e 's,@extraflags@,${extraFlags},' \
+        '${./wrappercxx.sh}' > "$out/bin/$(basename "$orig")"
+        chmod +x "$out/bin/$(basename "$orig")"
+    done
+    for orig in ${gcc-unwrapped}/bin/*cpp ${gcc-unwrapped}/bin/*-ar ${gcc-unwrapped}/bin/*-nm ${gcc-unwrapped}/bin/*-ranlib; do
+      ln -s "$orig" "$out/bin/$(basename "$orig")"
+    done
+  ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.sh b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.sh
new file mode 100644
index 000000000000..45720ce02d4a
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.sh
@@ -0,0 +1,51 @@
+#!@bash@
+
+if [ 1 = "$#" ] && [ "x-v" = "x$1" ]; then
+  # HACK! should not pass -Wl if there are no input files, otherwise libtool breaks
+  exec -a "@origname@" @gcc@ -v
+fi
+
+# logic based on pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+# very hacky
+extraRpath=""
+prev=""
+for param in "$@"; do
+  case "$prev" in
+    -L | -B)
+      case "$param" in
+        "$NIX_STORE"/*)
+          extraRpath="$extraRpath -Wl,-rpath,${param}"
+          ;;
+        *)
+          ;;
+      esac
+      ;;
+    *)
+      case "$param" in
+        -L"$NIX_STORE"/* | -B"$NIX_STORE"/*)
+          extraRpath="$extraRpath -Wl,-rpath,${param:2}"
+          ;;
+        "$NIX_STORE"/*.so | "$NIX_STORE"/*.so.*)
+          extraRpath="$extraRpath -Wl,-rpath,${param%/*}"
+          ;;
+        *)
+          ;;
+      esac
+      ;;
+  esac
+  prev="$param"
+done
+
+# Order of -B is very particular. musl detection in gnulib requires that
+# libc/.. comes before libgcc, otherwise libc is assumed to be glibc.
+exec -a "@origname@" @gcc@ -Wl,-dynamic-linker=@dynlinker@ \
+  @extraflags@ \
+  $extraRpath \
+  -Wl,-rpath,@libc@,-rpath,@libgcc@ \
+  -B@libc@/.. \
+  -B@libgcc@ \
+  -B@libc@ \
+  -B@origdir@ \
+  -B@binutils@ \
+  -isystem @gccinc@ \
+  "$@"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrappercxx.sh b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrappercxx.sh
new file mode 100644
index 000000000000..c567b0313f08
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrappercxx.sh
@@ -0,0 +1,57 @@
+#!@bash@
+
+if [ 1 = "$#" ] && [ "x-v" = "x$1" ]; then
+  # HACK! should not pass -Wl if there are no input files, otherwise libtool breaks
+  exec -a "@origname@" @gcc@ -v
+fi
+
+# logic based on pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+# very hacky
+extraRpath=""
+prev=""
+for param in "$@"; do
+  case "$prev" in
+    -L | -B)
+      case "$param" in
+        "$NIX_STORE"*)
+          extraRpath="$extraRpath -Wl,-rpath,${param}"
+          ;;
+        *)
+          ;;
+      esac
+      ;;
+    *)
+      case "$param" in
+        -L"$NIX_STORE"/* | -B"$NIX_STORE"/*)
+          extraRpath="$extraRpath -Wl,-rpath,${param:2}"
+          ;;
+        "$NIX_STORE"/*.so | "$NIX_STORE"/*.so.*)
+          extraRpath="$extraRpath -Wl,-rpath,${param%/*}"
+          ;;
+        *)
+          ;;
+      esac
+      ;;
+  esac
+  prev="$param"
+done
+
+# Order of -B is very particular. musl detection in gnulib requires that
+# libc/.. comes before libgcc, otherwise libc is assumed to be glibc.
+# Also, libstdcxxinc uses #include_next directives that depend on
+# libc headers, so libstdcxx must come before libc.
+exec -a "@origname@" @gcc@ -Wl,-dynamic-linker=@dynlinker@ \
+  @extraflags@ \
+  $extraRpath \
+  -Wl,-rpath,@libc@,-rpath,@libgcc@,-rpath,@libstdcxx@ \
+  -I @libstdcxxarchinc@ \
+  -I @libstdcxxinc@ \
+  -B@libc@/.. \
+  -B@libc@ \
+  -B@libgcc@ \
+  -B@origdir@ \
+  -B@binutils@ \
+  -B@libstdcxx@ \
+  -isystem @gccinc@ \
+  "$@"
+
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/musl/static.nix
index e85e86d8de98..27bfc63aa75f 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/musl/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/static.nix
@@ -13,6 +13,7 @@
   gnutar,
   gzip,
   linux-headers,
+  libgcc,
 }:
 let
   inherit (import ./common.nix { inherit lib; }) pname meta;
@@ -22,6 +23,10 @@ let
     url = "https://musl.libc.org/releases/musl-${version}.tar.gz";
     hash = "sha256-1YX9O2E8ZhUfwySejtRPdwIMtebB5jWmFtP5+CRgUSo=";
   };
+
+  binutilsTargetPrefix = lib.optionalString (
+    hostPlatform.config != buildPlatform.config
+  ) "${hostPlatform.config}-";
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -77,23 +82,23 @@ bash.runCommand "${pname}-${version}"
       src/misc/wordexp.c
 
     # Configure
+    export CC="${binutilsTargetPrefix}gcc -B${libgcc}/lib/gcc/${hostPlatform.config}/${libgcc.version} -Wl,-rpath,${libgcc}/lib/gcc/${hostPlatform.config}/${libgcc.version}"
     bash ./configure \
       --prefix=$out \
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
-      --syslibdir=$out/lib \
-      --enable-wrapper
+      --syslibdir=$out/lib
 
     # Build
     make -j $NIX_BUILD_CORES
 
     # Install
     make -j $NIX_BUILD_CORES install
-    sed -i 's|/bin/sh|${lib.getExe bash}|' $out/bin/*
+    mkdir -p $out/bin
     ln -s ../lib/libc.so $out/bin/ldd
     ln -s $(ls -d ${linux-headers}/include/* | grep -v scsi\$) $out/include/
 
     # Strip
     # Ignore failures, because strip may fail on non-elf files.
-    find $out/{bin,lib} -type f -exec strip --strip-debug {} + || true
+    find $out/{bin,lib} -type f -exec ${binutilsTargetPrefix}strip --strip-debug {} + || true
   ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
index c663c4cf04f8..707cec7369e3 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
@@ -39,7 +39,7 @@ bash.runCommand "${pname}-${version}"
       gzip
     ];
 
-    disallowedReferences = [ musl ];
+    disallowedReferences = [ gcc ];
 
     passthru.tests.get-version =
       result:

From ef9a5555f45dfa4a2094bd06a2457934298afd6c Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 16 Jun 2026 21:01:22 +0100
Subject: [PATCH 0678/1209] iproute2: 7.0.0 -> 7.1.0

Changes: https://lore.kernel.org/netdev/20260615160636.412a064e@phoenix.local/
---
 pkgs/by-name/ip/iproute2/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index 9417763e3177..842ffb89bb0d 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-5iiQ97XeY8BaO/Mx3I3rTAFcM2AT80Gk7fRpaXl/L04=";
+    hash = "sha256-/Z+huVgJQXFXyoPdcpV+MmG9vOiWNTy5NvgK8LM6S1w=";
   };
 
   postPatch = ''

From bd5e2f2e4de12ba768c6031e59a54f9929921422 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 8 Jun 2026 15:39:11 +0200
Subject: [PATCH 0679/1209] xemu: re-enable structuredAttrs

Depends on https://github.com/NixOS/nixpkgs/pull/526688

The GApps wrapper would try to wrap executables in "debug" instead of "out",
this should be fixed with that PR.
---
 pkgs/by-name/xe/xemu/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/xe/xemu/package.nix b/pkgs/by-name/xe/xemu/package.nix
index b69437e9c3de..b70955b2f10d 100644
--- a/pkgs/by-name/xe/xemu/package.nix
+++ b/pkgs/by-name/xe/xemu/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
       find subprojects -type d -name .git -prune -execdir rm -r {} +
     '';
   };
-  __structuredAttrs = false;
+  __structuredAttrs = true;
   nativeBuildInputs = [
     meson
     cmake

From 36559eb1b96510b7225d59ae0870be654058e2e5 Mon Sep 17 00:00:00 2001
From: Artemis Tosini <artemis.tosini@obsidian.systems>
Date: Fri, 12 Jun 2026 16:01:52 -0400
Subject: [PATCH 0680/1209] deterministic-uname: add setup hook

Several packages were adding deterministic-uname to `nativeBuildInputs`,
but that is insufficient for its use. Add a setup hook to make its use
more obvious
---
 pkgs/by-name/de/deterministic-uname/package.nix   | 3 +++
 pkgs/by-name/de/deterministic-uname/setup-hook.sh | 8 ++++++++
 2 files changed, 11 insertions(+)
 create mode 100644 pkgs/by-name/de/deterministic-uname/setup-hook.sh

diff --git a/pkgs/by-name/de/deterministic-uname/package.nix b/pkgs/by-name/de/deterministic-uname/package.nix
index 771803f6b9b5..f83c4ef9c0d5 100644
--- a/pkgs/by-name/de/deterministic-uname/package.nix
+++ b/pkgs/by-name/de/deterministic-uname/package.nix
@@ -46,6 +46,9 @@ replaceVarsWith {
     modDirVersion = if modDirVersion != "" then modDirVersion else "unknown";
   };
 
+  # coreutils uname is in initialPath, so ordinarily appears in PATH before packages in nativeBuildInputs.
+  setupHook = ./setup-hook.sh;
+
   meta = {
     description = "Print certain system information (hardcoded with lib/system values)";
     mainProgram = "uname";
diff --git a/pkgs/by-name/de/deterministic-uname/setup-hook.sh b/pkgs/by-name/de/deterministic-uname/setup-hook.sh
new file mode 100644
index 000000000000..c66623749a73
--- /dev/null
+++ b/pkgs/by-name/de/deterministic-uname/setup-hook.sh
@@ -0,0 +1,8 @@
+# PATH is overwritten after package setup hooks are run,
+# so the variable change needs to be delayed until a phase.
+# An entry in prePhases is the earliest possible, useful
+# in case an unpack or patch hook attempts to run uname.
+unamePreHook() {
+  export PATH="@out@/bin:$PATH"
+}
+appendToVar prePhases unamePreHook

From 5b23ab1417428a453e539b5c2135cec6488c16ac Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 17 Jun 2026 04:16:29 +0200
Subject: [PATCH 0681/1209] libaio: pull src from codeberg

https://lore.kernel.org/distributions/ajH6hjJ9X6PcLET3@thunder.hadrons.org/T/#u
---
 pkgs/by-name/li/libaio/package.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/li/libaio/package.nix b/pkgs/by-name/li/libaio/package.nix
index 35de54c0d9da..d803c65219e9 100644
--- a/pkgs/by-name/li/libaio/package.nix
+++ b/pkgs/by-name/li/libaio/package.nix
@@ -1,16 +1,18 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromCodeberg,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   version = "0.3.113";
   pname = "libaio";
 
-  src = fetchurl {
-    url = "https://pagure.io/libaio/archive/libaio-${finalAttrs.version}/libaio-libaio-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-cWxwWXAyRzROsGa1TsvDyiE08BAzBxkubCt9q1+VKKs=";
+  src = fetchFromCodeberg {
+    owner = "jmoyer";
+    repo = "libaio";
+    tag = "libaio-${finalAttrs.version}";
+    hash = "sha256-8TofYbwsnenv5GuC6FjkUt9rBTULEb5nhknuxr2ckQg=";
   };
 
   postPatch = ''
@@ -33,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Library for asynchronous I/O in Linux";
     homepage = "https://lse.sourceforge.net/io/aio.html";
+    downloadPage = "https://codeberg.org/jmoyer/libaio";
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21;
     maintainers = [ ];

From 7049a93a44d73f6e3ac18feb3facd7f7bda29858 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Mon, 15 Jun 2026 21:53:39 +0200
Subject: [PATCH 0682/1209] gcc15: 15.2.0 -> 15.3.0

---
 .../gcc/patches/15/aarch64-sve-rtx.patch      | 87 -------------------
 .../compilers/gcc/patches/default.nix         |  3 -
 pkgs/development/compilers/gcc/versions.nix   |  4 +-
 3 files changed, 2 insertions(+), 92 deletions(-)
 delete mode 100644 pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch

diff --git a/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch b/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch
deleted file mode 100644
index 257c76d735da..000000000000
--- a/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-Without the change `libhwy-1.3.0` ICEs when built for aarch64-linux as:
-https://github.com/NixOS/nixpkgs/pull/320616#issuecomment-3764400891
-
-Upstream report: http://gcc.gnu.org/PR120718
-Upstream fix: https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00
-Fetched as:
-$ curl -L 'https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00' > aarch64-sve-rtx.patch
-
-From: Richard Sandiford <richard.sandiford@arm.com>
-Date: Thu, 14 Aug 2025 16:56:50 +0000 (+0100)
-Subject: Remove MODE_COMPOSITE_P test from simplify_gen_subreg [PR120718]
-X-Git-Url: https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00
-
-Remove MODE_COMPOSITE_P test from simplify_gen_subreg [PR120718]
-
-simplify_gen_subreg rejected subregs of literal constants if
-MODE_COMPOSITE_P.  This was added by the fix for PR96648 in
-g:c0f772894b6b3cd8ed5c5dd09d0c7917f51cf70f.  Jakub said:
-
-  As for the simplify_gen_subreg change, I think it would be desirable
-  to just avoid creating SUBREGs of constants on all targets and for all
-  constants, if simplify_immed_subreg simplified, fine, otherwise punt,
-  but as we are late in GCC11 development, the patch instead guards this
-  behavior on MODE_COMPOSITE_P (outermode) - i.e. only conversions to
-  powerpc{,64,64le} double double long double - and only for the cases where
-  simplify_immed_subreg was called.
-
-I'm not sure about relaxing the codes further, since subregs might
-be wanted for CONST, SYMBOL_REF and LABEL_REF.  But removing the
-MODE_COMPOSITE_P is needed to fix PR120718, where we get an ICE
-from generating a subreg of a V2SI const_vector.
-
-Unlike the trunk version, this backport does not remove the
-VOIDmode test; see PR121501.
-
-gcc/
-	PR rtl-optimization/120718
-	* simplify-rtx.cc (simplify_context::simplify_gen_subreg):
-	Remove MODE_COMPOSITE_P condition.
-
-gcc/testsuite/
-	PR rtl-optimization/120718
-	* gcc.target/aarch64/sve/acle/general/pr120718.c: New test.
----
-
-diff --git a/gcc/simplify-rtx.cc b/gcc/simplify-rtx.cc
-index 88d31a71c05a..8d4cbf1371a3 100644
---- a/gcc/simplify-rtx.cc
-+++ b/gcc/simplify-rtx.cc
-@@ -8317,14 +8317,11 @@ simplify_context::simplify_gen_subreg (machine_mode outermode, rtx op,
- 
-   if (GET_CODE (op) == SUBREG
-       || GET_CODE (op) == CONCAT
--      || GET_MODE (op) == VOIDmode)
--    return NULL_RTX;
--
--  if (MODE_COMPOSITE_P (outermode)
--      && (CONST_SCALAR_INT_P (op)
--	  || CONST_DOUBLE_AS_FLOAT_P (op)
--	  || CONST_FIXED_P (op)
--	  || GET_CODE (op) == CONST_VECTOR))
-+      || GET_MODE (op) == VOIDmode
-+      || CONST_SCALAR_INT_P (op)
-+      || CONST_DOUBLE_AS_FLOAT_P (op)
-+      || CONST_FIXED_P (op)
-+      || GET_CODE (op) == CONST_VECTOR)
-     return NULL_RTX;
- 
-   if (validate_subreg (outermode, innermode, op, byte))
-diff --git a/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c b/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c
-new file mode 100644
-index 000000000000..9ca0938e36bf
---- /dev/null
-+++ b/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c
-@@ -0,0 +1,12 @@
-+/* { dg-options "-O2" } */
-+
-+#include <arm_sve.h>
-+typedef int __attribute__((vector_size(8))) v2si;
-+typedef struct { int x; int y; } A;
-+void bar(A a);
-+void foo()
-+{
-+    A a;
-+    *(v2si *)&a = (v2si){0, (int)svcntd_pat(SV_ALL)};
-+    bar(a);
-+}
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index cc0b5b47e9b4..06981780da3f 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -112,9 +112,6 @@ optionals noSysDirs (
 # c++tools: Don't check --enable-default-pie.
 # --enable-default-pie breaks bootstrap gcc otherwise, because libiberty.a is not found
 ++ optional (is14 || is15) ./c++tools-dont-check-enable-default-pie.patch
-# http://gcc.gnu.org/PR120718 backport (will be inclkuded in 15.3.0) to
-# fix `highway-1.3.0` ICE on aarch64-linux.
-++ optional is15 ./15/aarch64-sve-rtx.patch
 
 ## 2. Patches relevant on specific platforms ####################################
 
diff --git a/pkgs/development/compilers/gcc/versions.nix b/pkgs/development/compilers/gcc/versions.nix
index ca6b2c91033d..6e49faf18628 100644
--- a/pkgs/development/compilers/gcc/versions.nix
+++ b/pkgs/development/compilers/gcc/versions.nix
@@ -1,7 +1,7 @@
 let
   majorMinorToVersionMap = {
     "16" = "16.1.0";
-    "15" = "15.2.0";
+    "15" = "15.3.0";
     "14" = "14.3.0";
     "13" = "13.4.0";
   };
@@ -15,7 +15,7 @@ let
       # 3 digits: releases (14.2.0)
       # 4 digits: snapshots (14.2.1.20250322)
       "16.1.0" = "sha256-UO+02Uwzl6/zsNYaWr10i03THZ0/Kre+BbFx02pRD3k=";
-      "15.2.0" = "sha256-Q4/ZloJrDIJIWinaA6ctcdbjVBqD7HAt9Ccfb+Al0k4=";
+      "15.3.0" = "sha256-+lnBvu+JlfJ8TXHB3yJ1hxiTFdPm+v8btDBuYbDFMOs=";
       "14.3.0" = "sha256-4Nx3KXYlYxrI5Q+pL//v6Jmk63AlktpcMu8E4ik6yjo=";
       "13.4.0" = "sha256-nEzm27BAVo/cVFWIrAPFy8lajb8MeqSQFwhDr7WcqPU=";
     }

From a237f34fe760618b117993a49018e4199ae66880 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Wed, 17 Jun 2026 08:23:59 +0200
Subject: [PATCH 0683/1209] gcc: fix download issue for new release

---
 pkgs/build-support/fetchurl/mirrors.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index f9f5b25557d2..759550a27b4c 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -54,6 +54,8 @@
 
   # GCC
   gcc = [
+    "https://gcc.gnu.org/pub/gcc/"
+    "https://sourceware.org/pub/gcc/"
     "https://mirror.koddos.net/gcc/"
     "https://bigsearcher.com/mirrors/gcc/"
     "ftp://ftp.nluug.nl/mirror/languages/gcc/"

From 745f12467cb3410993c1e708178c0082cea1cbea Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Mon, 6 Apr 2026 16:31:13 +0300
Subject: [PATCH 0684/1209] minimal-bootstrap: Fix tools in preparation for
 early cross-compilation

Various packages under minimal-bootstrap explicitly use the musl gcc
wrapper (especially the *-static packages).

In #494106, the desire is to allow these packages to run on a host
platform which may differ from the bootstrap seed platform. That host
platform may be a non-musl platform, and furthermore musl may not even
be available on the desired host architecture.

This change aims to make the packages more generic wrt libc. It is
extracted out of #494106.
---
 .../linux/minimal-bootstrap/bash/static.nix     | 13 ++++++++++---
 .../linux/minimal-bootstrap/binutils/static.nix |  7 ++-----
 .../linux/minimal-bootstrap/bison/default.nix   |  5 +----
 .../linux/minimal-bootstrap/bzip2/static.nix    | 17 +++++++++++------
 .../minimal-bootstrap/coreutils/static.nix      |  5 +----
 .../linux/minimal-bootstrap/default.nix         |  4 +++-
 .../minimal-bootstrap/diffutils/static.nix      |  8 +++-----
 .../minimal-bootstrap/findutils/static.nix      |  6 +-----
 .../linux/minimal-bootstrap/gawk/static.nix     |  6 +-----
 .../linux/minimal-bootstrap/gnugrep/static.nix  |  6 +-----
 .../linux/minimal-bootstrap/gnum4/default.nix   |  3 ---
 .../linux/minimal-bootstrap/gnumake/static.nix  |  5 +----
 .../linux/minimal-bootstrap/gnupatch/static.nix |  6 +-----
 .../linux/minimal-bootstrap/gnused/static.nix   |  6 +-----
 .../linux/minimal-bootstrap/gnutar/static.nix   |  6 +-----
 .../linux/minimal-bootstrap/gzip/static.nix     |  3 ---
 .../linux/minimal-bootstrap/patchelf/static.nix |  5 +----
 .../linux/minimal-bootstrap/python/default.nix  |  6 +-----
 .../linux/minimal-bootstrap/xz/static.nix       |  6 +-----
 .../linux/minimal-bootstrap/zlib/default.nix    |  3 ---
 20 files changed, 41 insertions(+), 85 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix
index 31ec4ebc5836..5418d73e352a 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix
@@ -4,8 +4,8 @@
   hostPlatform,
   fetchurl,
   bash,
+  gcc-buildbuild,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -25,6 +25,10 @@ let
     url = "mirror://gnu/bash/bash-${version}.tar.gz";
     sha256 = "sha256-DVzYaWX4aaJs9k9Lcb57lvkKO6iz104n6OnZ1VUPMbo=";
   };
+
+  binutilsTargetPrefix = lib.optionalString (
+    hostPlatform.config != buildPlatform.config
+  ) "${hostPlatform.config}-";
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -32,7 +36,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -56,6 +59,10 @@ bash.runCommand "${pname}-${version}"
     tar xf ${src}
     cd bash-${version}
 
+    export AR="${binutilsTargetPrefix}ar"
+    export STRIP="${binutilsTargetPrefix}strip"
+    export STRIPPROG="$STRIP"
+
     # Configure
     bash ./configure \
       --prefix=$out \
@@ -65,7 +72,7 @@ bash.runCommand "${pname}-${version}"
       --disable-dependency-tracking \
       --disable-nls \
       --enable-static-link \
-      CC=musl-gcc
+      CC_FOR_BUILD=${gcc-buildbuild}/bin/gcc
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
index 6461f6523c0b..e29e884a2dfd 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
@@ -4,8 +4,8 @@
   hostPlatform,
   fetchurl,
   bash,
+  gcc-buildbuild,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnupatch,
@@ -33,8 +33,6 @@ let
   ];
 
   configureFlags = [
-    "CC=musl-gcc"
-    "LDFLAGS=--static"
     "--prefix=${placeholder "out"}"
     "--build=${buildPlatform.config}"
     "--host=${hostPlatform.config}"
@@ -42,7 +40,6 @@ let
     "--disable-dependency-tracking"
     "--disable-nls"
 
-    "--with-sysroot=/"
     "--enable-deterministic-archives"
     # depends on bison
     "--disable-gprofng"
@@ -70,7 +67,7 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
+      gcc-buildbuild
       binutils
       gnumake
       gnupatch
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bison/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/bison/default.nix
index 80b488a800dd..fc588600d5d6 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/bison/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bison/default.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -32,7 +31,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -70,8 +68,7 @@ bash.runCommand "${pname}-${version}"
       --prefix=$out \
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
-      --disable-dependency-tracking \
-      CC=musl-gcc
+      --disable-dependency-tracking
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix
index 540f86112aa4..5a1b0187857f 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix
@@ -1,9 +1,10 @@
 {
   lib,
   fetchurl,
+  buildPlatform,
+  hostPlatform,
   bash,
   gcc,
-  musl,
   binutils,
   findutils,
   gnumake,
@@ -18,6 +19,10 @@ let
     url = "https://sourceware.org/pub/bzip2/bzip2-${version}.tar.gz";
     sha256 = "0s92986cv0p692icqlw1j42y9nld8zd83qwhzbqd61p1dqbh6nmb";
   };
+
+  binutilsTargetPrefix = lib.optionalString (
+    hostPlatform.config != buildPlatform.config
+  ) "${hostPlatform.config}-";
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -25,7 +30,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       findutils
       gnumake
@@ -72,9 +76,10 @@ bash.runCommand "${pname}-${version}"
     # Build
     make \
       -j $NIX_BUILD_CORES \
-      CC=musl-gcc \
-      CFLAGS=-static \
-      bzip2
+      bzip2 \
+      CC=${hostPlatform.config}-gcc \
+      AR=${binutilsTargetPrefix}ar \
+      RANLIB=${binutilsTargetPrefix}ranlib
 
     # Install
     mkdir -p $out/bin
@@ -84,5 +89,5 @@ bash.runCommand "${pname}-${version}"
 
     # Strip
     # Ignore failures, because strip may fail on non-elf files.
-    strip --strip-debug $out/bin/bzip2 || true
+    ${binutilsTargetPrefix}strip --strip-debug $out/bin/bzip2 || true
   ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
index 2291a5dedba3..6c92f12bf58b 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -36,8 +35,7 @@ let
     # libstdbuf.so fails in static builds
     "--enable-no-install-program=stdbuf"
     "--enable-single-binary=symlinks"
-    "CC=musl-gcc"
-    "CFLAGS=\"-static -I${linux-headers}/include\""
+    "CFLAGS=\"-I${linux-headers}/include\""
   ];
 in
 bash.runCommand "${pname}-${version}"
@@ -46,7 +44,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index 6afd5e5f6259..ac31f89dfa66 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -48,6 +48,7 @@ lib.makeScope
         };
 
         bash-static = callPackage ./bash/static.nix {
+          gcc-buildbuild = gcc-latest;
           gcc = gcc-latest;
           gnumake = gnumake-musl;
           gnutar = gnutar-latest;
@@ -60,6 +61,7 @@ lib.makeScope
         };
 
         binutils-static = callPackage ./binutils/static.nix {
+          gcc-buildbuild = gcc-latest;
           gcc = gcc-latest;
           gnumake = gnumake-musl;
           gnutar = gnutar-latest;
@@ -435,7 +437,7 @@ lib.makeScope
               echo ${gcc46.tests.get-version}
               echo ${gcc46-cxx.tests.hello-world}
               echo ${gcc10.tests.hello-world}
-              echo ${gcc-latest.tests.hello-world}
+              echo ${gcc-latest-unwrapped.tests.hello-world}
             ''
             + (lib.strings.optionalString (hostPlatform.libc == "glibc") ''
               echo ${gcc-glibc.tests.hello-world}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix
index f46805411c61..3ab214a9b179 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -31,7 +30,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -64,15 +62,15 @@ bash.runCommand "${pname}-${version}"
     cd diffutils-${version}
 
     # Configure
+    # Manually set strcasecmp_works, because we might be cross-compiling
     bash ./configure \
       --prefix=$out \
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
       --disable-nls \
-      CC=musl-gcc \
-      CFLAGS=-static \
-      ac_cv_path_PR_PROGRAM=pr
+      ac_cv_path_PR_PROGRAM=pr \
+      gl_cv_func_strcasecmp_works=y
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
index c6b1c6e2ba0c..b183888ce033 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -31,7 +30,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -70,9 +68,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
-      --disable-nls \
-      CC=musl-gcc \
-      CFLAGS=-static
+      --disable-nls
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
index c6175308d59d..d35bb47674d6 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -32,7 +31,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -66,9 +64,7 @@ bash.runCommand "${pname}-${version}"
       --disable-extensions \
       --disable-mpfr \
       --disable-nls \
-      --disable-pma \
-      CC=musl-gcc \
-      CFLAGS=-static
+      --disable-pma
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
index 18e71d833461..7680ce122fa4 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -31,7 +30,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -70,9 +68,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
-      --disable-nls \
-      CC=musl-gcc \
-      CFLAGS=-static
+      --disable-nls
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnum4/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnum4/default.nix
index 71ff15627feb..1f3edd005952 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnum4/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnum4/default.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -32,7 +31,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -71,7 +69,6 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
-      CC=musl-gcc \
       CFLAGS=-I${linux-headers}/include
 
     # Build
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix
index d24f0e6d12ce..65369e28fb64 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnupatch,
@@ -42,7 +41,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnupatch
@@ -80,8 +78,7 @@ bash.runCommand "${pname}-${version}"
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
       --disable-nls \
-      CC=musl-gcc \
-      CFLAGS="-static -std=gnu17"
+      CFLAGS="-std=gnu17"
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix
index ee25341e0b3b..287776101e8f 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -31,7 +30,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -69,9 +67,7 @@ bash.runCommand "${pname}-${version}"
       --prefix=$out \
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
-      --disable-dependency-tracking \
-      CC=musl-gcc \
-      CFLAGS=-static
+      --disable-dependency-tracking
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
index 8ebb1791e55c..90346ee634ba 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -32,7 +31,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -62,9 +60,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
-      --disable-nls \
-      CC=musl-gcc \
-      CFLAGS=-static
+      --disable-nls
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix
index 07eba0ef2fe4..fb6f5ea5ba41 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -32,7 +31,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -62,9 +60,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
-      --disable-nls \
-      CC=musl-gcc \
-      CFLAGS=-static
+      --disable-nls
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix
index f449fdcd3609..76d1ef9474a3 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -31,7 +30,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -69,7 +67,6 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
-      CC=musl-gcc \
       CFLAGS=-static
 
     # Build
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
index 1bec275f7b2a..622dc2846468 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -31,7 +30,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -71,8 +69,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
-      CC=musl-gcc \
-      CXXFLAGS="-static -g0 -O2 -DNDEBUG -ffile-prefix-map=${gcc}=. -fmacro-prefix-map=${gcc}=."
+      CXXFLAGS="-g0 -O2 -DNDEBUG -ffile-prefix-map=${gcc}=. -fmacro-prefix-map=${gcc}=."
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
index bc12245fd9db..ff04626a6336 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
@@ -5,7 +5,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnupatch,
@@ -42,7 +41,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnupatch
@@ -80,11 +78,9 @@ bash.runCommand "${pname}-${version}"
     ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
 
     # Configure
-    export CC=musl-gcc
     export C_INCLUDE_PATH="${zlib}/include"
     export LIBRARY_PATH="${zlib}/lib"
-    export LDFLAGS="-Wl,-rpath,${zlib}/lib -L${zlib}/lib"
-    export LD_LIBRARY_PATH="$LIBRARY_PATH"
+    export LDFLAGS="-L${zlib}/lib"
     bash ./configure \
       --prefix=$out \
       --build=${buildPlatform.config} \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
index 707cec7369e3..cc224fdaeab9 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
@@ -12,7 +12,6 @@
   gawk,
   gnutar,
   gzip,
-  musl,
 }:
 let
   pname = "xz";
@@ -30,7 +29,6 @@ bash.runCommand "${pname}-${version}"
     nativeBuildInputs = [
       binutils
       gcc
-      musl
       gnumake
       gnused
       gnugrep
@@ -66,10 +64,8 @@ bash.runCommand "${pname}-${version}"
     cd xz-${version}
 
     # Configure
-    export CC=musl-gcc
     export CFLAGS="-g0 -O2 -DNDEBUG"
     export CXXFLAGS="$CFLAGS"
-    export LDFLAGS=-static
     bash ./configure \
       --prefix=$out \
       --build=${buildPlatform.config} \
@@ -87,7 +83,7 @@ bash.runCommand "${pname}-${version}"
       --disable-assembler
 
     # Build
-    make -j $NIX_BUILD_CORES LDFLAGS=-all-static
+    make -j $NIX_BUILD_CORES
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/zlib/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/zlib/default.nix
index 845f49a48157..79a87e210934 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/zlib/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/zlib/default.nix
@@ -3,7 +3,6 @@
   fetchurl,
   bash,
   gcc,
-  musl,
   binutils,
   gnumake,
   gnused,
@@ -26,7 +25,6 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       gcc
-      musl
       binutils
       gnumake
       gnused
@@ -49,7 +47,6 @@ bash.runCommand "${pname}-${version}"
     cd zlib-${version}
 
     # Configure
-    export CC=musl-gcc
     bash ./configure --prefix=$out
 
     # Build

From cf51da6e32eb92b61d5caea177c1325de9a1a99f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 17 Jun 2026 08:02:25 -0700
Subject: [PATCH 0685/1209] libxkbfile: 1.1.3 -> 1.2.0

---
 pkgs/by-name/li/libxkbfile/package.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libxkbfile/package.nix b/pkgs/by-name/li/libxkbfile/package.nix
index 93cd9028b379..4dd6270b4793 100644
--- a/pkgs/by-name/li/libxkbfile/package.nix
+++ b/pkgs/by-name/li/libxkbfile/package.nix
@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchurl,
+  meson,
+  ninja,
   pkg-config,
   xorgproto,
   libx11,
@@ -10,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxkbfile";
-  version = "1.1.3";
+  version = "1.2.0";
 
   outputs = [
     "out"
@@ -19,12 +21,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libxkbfile-${finalAttrs.version}.tar.xz";
-    hash = "sha256-qbY+6pl6u57mqLT7tRWDHIQfRxr4RaCd5EOygAOHS+w=";
+    hash = "sha256-f3GITl+vVvsOgj84SFmc+bWpr85RyQmCuutk9jUjPr8=";
   };
 
   strictDeps = true;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
 
   buildInputs = [
     xorgproto

From 9c39764facdce1cf61dac6d73bbcb09e45a48afa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 17 Jun 2026 07:59:37 -0700
Subject: [PATCH 0686/1209] libxkbcommon: 1.13.1 -> 1.13.2

Diff: https://github.com/xkbcommon/libxkbcommon/compare/xkbcommon-1.13.1...xkbcommon-1.13.2

Changelog: https://github.com/xkbcommon/libxkbcommon/blob/xkbcommon-1.13.2/NEWS.md
---
 .../li/libxkbcommon_8/disable-x11com.patch    | 23 -------------------
 pkgs/by-name/li/libxkbcommon_8/package.nix    | 17 +++++++-------
 2 files changed, 9 insertions(+), 31 deletions(-)
 delete mode 100644 pkgs/by-name/li/libxkbcommon_8/disable-x11com.patch

diff --git a/pkgs/by-name/li/libxkbcommon_8/disable-x11com.patch b/pkgs/by-name/li/libxkbcommon_8/disable-x11com.patch
deleted file mode 100644
index c0a8b7ac43af..000000000000
--- a/pkgs/by-name/li/libxkbcommon_8/disable-x11com.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-On nixpkgs /tmp/.X11-unix is not compatible with Xvfb requirement and the
-test fails.
---- a/meson.build
-+++ b/meson.build
-@@ -1229,18 +1229,6 @@ if get_option('enable-x11')
-         env: test_env,
-         is_parallel : false,
-     )
--    test(
--        'x11comp',
--        executable(
--            'test-x11comp',
--            'test/x11comp.c',
--            'test/utils-text.c',
--            'test/utils-text.h',
--            dependencies: x11_xvfb_test_dep
--        ),
--        env: test_env,
--        is_parallel : false,
--    )
- endif
- if get_option('enable-xkbregistry')
-     test(
diff --git a/pkgs/by-name/li/libxkbcommon_8/package.nix b/pkgs/by-name/li/libxkbcommon_8/package.nix
index caed48e59c02..7c96341eb86c 100644
--- a/pkgs/by-name/li/libxkbcommon_8/package.nix
+++ b/pkgs/by-name/li/libxkbcommon_8/package.nix
@@ -11,6 +11,8 @@
   libxcb,
   libxml2,
   python3,
+  setxkbmap,
+  xkbcomp,
   libx11,
   # To enable the "interactive-wayland" subcommand of xkbcli. This is the
   # wayland equivalent of `xev` on X11.
@@ -24,20 +26,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxkbcommon";
-  version = "1.13.1";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "xkbcommon";
     repo = "libxkbcommon";
     tag = "xkbcommon-${finalAttrs.version}";
-    hash = "sha256-wUsxsM0xXTg7nbvFMXrrnHherOepj0YI77eferjRgJA=";
+    hash = "sha256-JdS4+HPHDUUOUq5TUX2F5DicHif8wD3cPvMocWhD4S4=";
   };
 
-  patches = [
-    # Disable one Xvfb test as it fails for permission checks.
-    ./disable-x11com.patch
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -64,7 +61,11 @@ stdenv.mkDerivation (finalAttrs: {
     wayland
     wayland-protocols
   ];
-  nativeCheckInputs = [ python3 ];
+  nativeCheckInputs = [
+    python3
+    setxkbmap
+    xkbcomp
+  ];
 
   mesonFlags = [
     "-Dxkb-config-root=${xkeyboard_config}/etc/X11/xkb"

From 3103c5d052abbda54914f9ecd9b55e9d75daebfe Mon Sep 17 00:00:00 2001
From: Nathan Gill <n@ngill.net>
Date: Mon, 15 Jun 2026 22:36:11 +0100
Subject: [PATCH 0687/1209] cdparanoia-iii: add maintainer `olduser101`

---
 pkgs/by-name/cd/cdparanoia-iii/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/cd/cdparanoia-iii/package.nix b/pkgs/by-name/cd/cdparanoia-iii/package.nix
index 39d5bfb97b32..644e2450431f 100644
--- a/pkgs/by-name/cd/cdparanoia-iii/package.nix
+++ b/pkgs/by-name/cd/cdparanoia-iii/package.nix
@@ -171,6 +171,9 @@ stdenv.mkDerivation (finalAttrs: {
       gpl2Plus
       lgpl21Plus
     ];
+    maintainers = with lib.maintainers; [
+      olduser101
+    ];
     platforms = lib.platforms.unix;
     mainProgram = "cdparanoia";
   };

From 50e805c3dff2bf2ec625179a9e7ebf7f2cd17547 Mon Sep 17 00:00:00 2001
From: Nathan Gill <n@ngill.net>
Date: Mon, 15 Jun 2026 22:39:32 +0100
Subject: [PATCH 0688/1209] cdparanoia-iii: fix build on darwin

freebsd patches conflict with those applied for darwin, so
disable the freebsd patches on darwin targets.
---
 pkgs/by-name/cd/cdparanoia-iii/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cd/cdparanoia-iii/package.nix b/pkgs/by-name/cd/cdparanoia-iii/package.nix
index 644e2450431f..813adc115078 100644
--- a/pkgs/by-name/cd/cdparanoia-iii/package.nix
+++ b/pkgs/by-name/cd/cdparanoia-iii/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
       })
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch
-    ++ [
+    ++ lib.optional (!stdenv.hostPlatform.isDarwin) [
       (fetchpatch {
         url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_low__interface.h";
         hash = "sha256-bXrcRFCbU7/7/N+J8VGKGSxIB1m8XwoAlc/KTnt9wN0=";

From a960983be330dfaff54f72c4fd50b1b47eafbcec Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Jun 2026 12:47:07 -0700
Subject: [PATCH 0689/1209] gccNGPackages_15: 15.2.0 -> 15.3.0

Assisted-by: Claude Code (claude-opus-4-8)
---
 pkgs/development/compilers/gcc/ng/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/gcc/ng/default.nix b/pkgs/development/compilers/gcc/ng/default.nix
index c849367aa1fc..4eb9ca23b9b5 100644
--- a/pkgs/development/compilers/gcc/ng/default.nix
+++ b/pkgs/development/compilers/gcc/ng/default.nix
@@ -14,7 +14,7 @@
 }@packageSetArgs:
 let
   versions = {
-    "15.2.0".officialRelease.sha256 = "sha256-Q4/ZloJrDIJIWinaA6ctcdbjVBqD7HAt9Ccfb+Al0k4=";
+    "15.3.0".officialRelease.sha256 = "sha256-+lnBvu+JlfJ8TXHB3yJ1hxiTFdPm+v8btDBuYbDFMOs=";
   }
   // gccVersions;
 

From 3d7e51d3f6291dd409a474661ca56025f68ed2f2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 17 Jun 2026 21:51:16 +0100
Subject: [PATCH 0690/1209] lttng-ust: 2.15.0 -> 2.15.1

Changes: https://lore.kernel.org/lkml/e5fe9c15-f9b0-4d00-8fa7-3562759b4ca6@efficios.com/
---
 pkgs/by-name/lt/lttng-ust/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lt/lttng-ust/package.nix b/pkgs/by-name/lt/lttng-ust/package.nix
index 164510c209ce..9749f6c938e1 100644
--- a/pkgs/by-name/lt/lttng-ust/package.nix
+++ b/pkgs/by-name/lt/lttng-ust/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lttng-ust";
-  version = "2.15.0";
+  version = "2.15.1";
 
   src = fetchFromGitHub {
     owner = "lttng";
     repo = "lttng-ust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LOZo/sVb9eG39Gg1PBs2FoLHTeOD5us9wW4kUwNo8o0=";
+    hash = "sha256-AWo205IPGKpEyz5RlscHfdfCTV0zOWPHOGk4ImAJbcQ=";
   };
 
   outputs = [

From c214e8a812e8ea8dfebdf7006b8cdd7b0796c1e4 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 14 Jun 2026 06:42:55 -0400
Subject: [PATCH 0691/1209] ffmpeg-headless: disable cuda-llvm support on
 Darwin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After https://github.com/NixOS/nixpkgs/pull/518519, Clang is unwrapped
when cuda-llvm support is enabled when building ffmpeg. This causes
ffmpeg-headless to fail to build on Darwin because its `configure`
script cannot find dependencies due to using an unwrapped compiler.
Since Cuda isn’t supported on Darwin anyway, disabling cuda-llvm has the
effect of using a wrapped Clang on Darwin again.
---
 pkgs/development/libraries/ffmpeg/generic.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index a366393f6f79..dbf12cd3e722 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -59,7 +59,7 @@
   withChromaprint ? withFullDeps, # Audio fingerprinting
   withCodec2 ? withFullDeps, # codec2 en/decoding
   withCuda ? withFullDeps && withNvcodec,
-  withCudaLLVM ? withHeadlessDeps,
+  withCudaLLVM ? withHeadlessDeps && !stdenv.hostPlatform.isDarwin, # Cuda isn’t supported on Darwin
   withCudaNVCC ? withFullDeps && withUnfree && config.cudaSupport,
   withCuvid ? withHeadlessDeps && withNvcodec,
   withDav1d ? withHeadlessDeps, # AV1 decoder (focused on speed and correctness)

From 70d5331f424b8ac532d312099c9a9246a63455b9 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 18 Jun 2026 06:42:50 +0200
Subject: [PATCH 0692/1209] nodejs_24: 24.16.0 -> 24.17.0

---
 pkgs/development/web/nodejs/v24.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 914ab1479370..ae766cfeb5db 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "24.16.0";
-  sha256 = "2ff84a6de70b6165290111b0fc656ded1ad207a799816fe720cc7c31232df30f";
+  version = "24.17.0";
+  sha256 = "a7ab562ed2369a29c68b72fa00e3103bcdfe37063dff799c6acc8e404e275fcd";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -56,13 +56,6 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
-
-      # Patch for nghttp2 1.69 support
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/4a32c00fb8dbe55c3bcf9ef43343968c9fe449e6.diff?full_index=1";
-        hash = "sha256-pex8ruwa4b/vWvfGA+nyN3JJP8NOturmwAQe4Rkd6nU=";
-        excludes = [ "tools/nix/*" ];
-      })
     ]
     ++ gypPatches
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [

From c1ea0a5d4706b8e2090bf2776ab07d0bdf822f59 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Thu, 18 Jun 2026 01:51:45 -0700
Subject: [PATCH 0693/1209] util-linux: 2.42.1 -> 2.42.2

https://www.kernel.org/pub/linux/utils/util-linux/v2.42/v2.42.2-ReleaseNotes

Fix some CVEs in mount(8) and a UAF in libblkid.
---
 pkgs/by-name/ut/util-linux/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index 3c26f7b0d780..f11d004bb0cf 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -43,11 +43,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "util-linux" + lib.optionalString isMinimal "-minimal";
-  version = "2.42.1";
+  version = "2.42.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor finalAttrs.version}/util-linux-${finalAttrs.version}.tar.xz";
-    hash = "sha256-gukVjrEqmwtWnYThaH/tndGP6JzNjvWsNCchinwNf38=";
+    hash = "sha256-A6BdOt+WAu8Sjy2gW4SzIFzmDDUeVzfANw90AAZ5zoo=";
   };
 
   # Note: fetchpatch/fetchpatch2 cause infinite recursion with util-linuxMinimal.

From a0728be44a8b34886b0708c6713f37f787927137 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 18 Jun 2026 15:08:28 +0200
Subject: [PATCH 0694/1209] llhttp: 9.4.1 -> 9.4.2

---
 pkgs/by-name/ll/llhttp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ll/llhttp/package.nix b/pkgs/by-name/ll/llhttp/package.nix
index 6f9115c07dc4..4487a4518360 100644
--- a/pkgs/by-name/ll/llhttp/package.nix
+++ b/pkgs/by-name/ll/llhttp/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "llhttp";
-  version = "9.4.1";
+  version = "9.4.2";
 
   src = fetchFromGitHub {
     owner = "nodejs";
     repo = "llhttp";
     tag = "release/v${finalAttrs.version}";
-    hash = "sha256-eQoOsJ3lIIGSIfC4atkbUqCAYzCzs5kzTihYaI4jqz0=";
+    hash = "sha256-LS8HS8CnXJ3X8WlIvtxBLc0h1wLL/HmTqZWHlvBjTEo=";
   };
 
   outputs = [

From 054629adb9e8f2dc44865b8cb1f1cafbdc4b2ae6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 18 Jun 2026 16:15:41 +0300
Subject: [PATCH 0695/1209] pipewire: 1.6.6 -> 1.6.7

Diff: https://gitlab.freedesktop.org/pipewire/pipewire/-/compare/1.6.6...1.6.7

Changelog: https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/1.6.7
---
 pkgs/by-name/pi/pipewire/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index cd01b173b031..c2ec4a841043 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -88,7 +88,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pipewire";
-  version = "1.6.6";
+  version = "1.6.7";
 
   outputs = [
     "out"
@@ -104,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     tag = finalAttrs.version;
-    hash = "sha256-pyZozhJomFT4QkJv/NKkXpbknmVxjv8hCxZV6RcIHmE=";
+    hash = "sha256-DSW9ho+NLikW/stlxvHLhRguMZy/4b7VEcC938ObJmQ=";
   };
 
   patches = [

From 335cd65a8a96d2e8b41b6651de91ec26f6144513 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 18 Jun 2026 09:46:30 -0700
Subject: [PATCH 0696/1209] lilv: add meta.changelog

---
 pkgs/by-name/li/lilv/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/li/lilv/package.nix b/pkgs/by-name/li/lilv/package.nix
index ebdff4c26be8..c09fa4a379b8 100644
--- a/pkgs/by-name/li/lilv/package.nix
+++ b/pkgs/by-name/li/lilv/package.nix
@@ -76,6 +76,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "http://drobilla.net/software/lilv";
+    changelog = "https://gitlab.com/lv2/lilv/-/blob/v${version}/NEWS";
     description = "C library to make the use of LV2 plugins";
     license = lib.licenses.mit;
     maintainers = [ ];

From d3215831d267b1ad78132be43294e591a80916e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 18 Jun 2026 14:38:56 -0700
Subject: [PATCH 0697/1209] python3Packages.clang: rename from libclang

The project name (e.g. on PyPI) is clang. The project called libclang
can be found at https://github.com/sighingnow/libclang instead.
---
 pkgs/by-name/ed/edgetx/package.nix                   |  2 +-
 pkgs/by-name/mu/mupdf/package.nix                    |  2 +-
 .../python-modules/{libclang => clang}/default.nix   |  2 +-
 pkgs/development/python-modules/hawkmoth/default.nix |  8 ++++----
 pkgs/development/python-modules/pymupdf/default.nix  |  4 ++--
 .../python-modules/pywebtransport/default.nix        |  5 ++---
 pkgs/development/python-modules/tensorflow/bin.nix   |  4 ++--
 pkgs/top-level/python-aliases.nix                    |  1 +
 pkgs/top-level/python-packages.nix                   | 12 ++++++++----
 9 files changed, 22 insertions(+), 18 deletions(-)
 rename pkgs/development/python-modules/{libclang => clang}/default.nix (98%)

diff --git a/pkgs/by-name/ed/edgetx/package.nix b/pkgs/by-name/ed/edgetx/package.nix
index 5205b6d8a56c..4d38926996d1 100644
--- a/pkgs/by-name/ed/edgetx/package.nix
+++ b/pkgs/by-name/ed/edgetx/package.nix
@@ -34,7 +34,7 @@ let
       pillow
       lz4
       jinja2
-      libclang
+      clang
     ]
   );
 
diff --git a/pkgs/by-name/mu/mupdf/package.nix b/pkgs/by-name/mu/mupdf/package.nix
index 341a839549ca..b2a097ef2b8f 100644
--- a/pkgs/by-name/mu/mupdf/package.nix
+++ b/pkgs/by-name/mu/mupdf/package.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
   ++ lib.optionals (enableCxx || enablePython) [
     (python3.pythonOnBuildForHost.withPackages (ps: [
       ps.setuptools
-      ps.libclang
+      ps.clang
     ]))
   ]
   ++ lib.optionals enablePython [
diff --git a/pkgs/development/python-modules/libclang/default.nix b/pkgs/development/python-modules/clang/default.nix
similarity index 98%
rename from pkgs/development/python-modules/libclang/default.nix
rename to pkgs/development/python-modules/clang/default.nix
index 4657515963e7..1f6e2103034f 100644
--- a/pkgs/development/python-modules/libclang/default.nix
+++ b/pkgs/development/python-modules/clang/default.nix
@@ -25,7 +25,7 @@ let
   '';
 in
 buildPythonPackage {
-  pname = "libclang";
+  pname = "clang";
   pyproject = true;
 
   inherit (libclang) version src;
diff --git a/pkgs/development/python-modules/hawkmoth/default.nix b/pkgs/development/python-modules/hawkmoth/default.nix
index aedd7da24c45..782d88abbf56 100644
--- a/pkgs/development/python-modules/hawkmoth/default.nix
+++ b/pkgs/development/python-modules/hawkmoth/default.nix
@@ -3,9 +3,9 @@
   buildPythonPackage,
   fetchFromGitHub,
   hatchling,
-  libclang,
-  sphinx,
   clang,
+  sphinx,
+  llvmPackages,
   pytestCheckHook,
   strictyaml,
 }:
@@ -25,13 +25,13 @@ buildPythonPackage rec {
   build-system = [ hatchling ];
 
   dependencies = [
-    libclang
+    clang
     sphinx
   ];
   propagatedBuildInputs = [ clang ];
 
   nativeCheckInputs = [
-    clang
+    llvmPackages.clang
     pytestCheckHook
     strictyaml
   ];
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index a087c6442d91..a879125bd8e7 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -7,7 +7,7 @@
   toPythonModule,
 
   # build-system
-  libclang,
+  clang,
   pipcl,
   psutil,
   setuptools,
@@ -75,7 +75,7 @@ buildPythonPackage (finalAttrs: {
   '';
 
   build-system = [
-    libclang
+    clang
     pipcl
     swig
     setuptools
diff --git a/pkgs/development/python-modules/pywebtransport/default.nix b/pkgs/development/python-modules/pywebtransport/default.nix
index c8116561b720..d1e93433fe5e 100644
--- a/pkgs/development/python-modules/pywebtransport/default.nix
+++ b/pkgs/development/python-modules/pywebtransport/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   clang,
   fetchFromGitHub,
-  libclang,
   llvmPackages,
   msgpack,
   pkg-config,
@@ -42,13 +41,13 @@ buildPythonPackage (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    clang
+    llvmPackages.clang
     llvmPackages.libclang.lib
     pkg-config
   ];
 
   env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-  env.LD_LIBRARY_PATH = "${llvmPackages.libclang.lib}/lib:${lib.getLib libclang}/lib";
+  env.LD_LIBRARY_PATH = "${llvmPackages.libclang.lib}/lib:${lib.getLib clang}/lib";
 
   prePatch = ''
     # maturin can't find the file
diff --git a/pkgs/development/python-modules/tensorflow/bin.nix b/pkgs/development/python-modules/tensorflow/bin.nix
index da07cc04b6ad..4edddcbf0d99 100644
--- a/pkgs/development/python-modules/tensorflow/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/bin.nix
@@ -19,7 +19,7 @@
   google-pasta,
   grpcio,
   h5py,
-  libclang,
+  clang,
   numpy,
   opt-einsum,
   packaging,
@@ -95,7 +95,7 @@ buildPythonPackage (finalAttrs: {
     google-pasta
     grpcio
     h5py
-    libclang
+    clang
     ml-dtypes
     numpy
     opt-einsum
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 39c48cbcf876..c51cd3bf8929 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -321,6 +321,7 @@ mapAliases {
   ledger-agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
   ledger_agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
   libarcus = throw "'libarcus' has been removed, as it was unmaintained in nixpkgs"; # Added 2026-05-22
+  libclang = clang; # added 2026-06-18
   libgpiod = gpiod; # added 2026-03-30
   libpyfoscam = throw "libpyfoscam was removed because Home Assistant switched to libpyfoscamcgi"; # added 2025-07-03
   line_profiler = throw "'line_profiler' has been renamed to/replaced by 'line-profiler'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b46df1489f11..539f123d5921 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2793,7 +2793,11 @@ self: super: with self; {
 
   ckcc-protocol = callPackage ../development/python-modules/ckcc-protocol { };
 
-  ckzg = callPackage ../development/python-modules/ckzg { };
+  ckzg = callPackage ../development/python-modules/ckzg {
+    inherit (pkgs) clang;
+  };
+
+  clang = callPackage ../development/python-modules/clang { };
 
   clarabel = callPackage ../development/python-modules/clarabel { };
 
@@ -8828,8 +8832,6 @@ self: super: with self; {
 
   libbs = callPackage ../development/python-modules/libbs { };
 
-  libclang = callPackage ../development/python-modules/libclang { };
-
   libcloud = callPackage ../development/python-modules/libcloud { };
 
   libcomps = lib.pipe pkgs.libcomps [
@@ -14786,7 +14788,9 @@ self: super: with self; {
     callPackage ../development/python-modules/pyobjc-framework-libdispatch
       { };
 
-  pyobjus = callPackage ../development/python-modules/pyobjus { };
+  pyobjus = callPackage ../development/python-modules/pyobjus {
+    inherit (pkgs) clang;
+  };
 
   pyocd = callPackage ../development/python-modules/pyocd { };
 

From 90160343a11674115ca07e06e35adb8dfea863ba Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 19 Jun 2026 06:14:57 +0100
Subject: [PATCH 0698/1209] fluidsynth: 2.5.4 -> 2.5.5

Changes: https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.5
---
 pkgs/by-name/fl/fluidsynth/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fl/fluidsynth/package.nix b/pkgs/by-name/fl/fluidsynth/package.nix
index 3bb34d87c60d..d292b8ac7a60 100644
--- a/pkgs/by-name/fl/fluidsynth/package.nix
+++ b/pkgs/by-name/fl/fluidsynth/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uL9K2Bc5PA6qm/QVFvEUDyGBst9L/sNP0+HculCWCZk=";
+    hash = "sha256-WEzOYHtPIUkPZu3v4dWcCh3dOJUyG1xRxDuoSXqiGbk=";
     fetchSubmodules = true;
   };
 

From 2d80d64878e8182e26891b0db275d34abaf33521 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 4 Jun 2026 21:59:28 +0100
Subject: [PATCH 0699/1209] bash: 5.3p9 -> 5.3p15

---
 pkgs/shells/bash/bash-5.3-patches.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/shells/bash/bash-5.3-patches.nix b/pkgs/shells/bash/bash-5.3-patches.nix
index 28055cc582aa..4c16a6791d68 100644
--- a/pkgs/shells/bash/bash-5.3-patches.nix
+++ b/pkgs/shells/bash/bash-5.3-patches.nix
@@ -10,4 +10,10 @@ patch: [
   (patch "007" "16dj7vx971q4zbagb46nya7mc6530vr5h86nzmy3qid1zyznp5y0")
   (patch "008" "1d1zclczgh6j8kjv9ibycn155n1z783188n399khg2gvrcixfz09")
   (patch "009" "132gy991ayjmr2rynx077rhzr749101y047043zb432bibkhzqzf")
+  (patch "010" "0s95wzk3zf8hh58jhz6imhqwj3183z905w7rpwc0qc7awb6g2xng")
+  (patch "011" "0cbmpv5nvmk4gzm0nmsvvm1c7ixkqmlx5mrywhxiv8x2bs7xz602")
+  (patch "012" "0ws5fnk7rpy6jiji3lws7fja0n5lgzki8i214gqxmbpbkfrpj4yp")
+  (patch "013" "007jg69286wam4lqd6ab5gs6zl4k3r29fill251by93yjvd9qbq4")
+  (patch "014" "0v398i0s7i5qrz85nfhdkxwcd6baagcclgbqb3ihg1fk06s60hxx")
+  (patch "015" "0vpl2h85i3gifnymc5f050mgxckyka9pwsgdgrvgc9zwwbp9rdsm")
 ]

From b73c4eaf76f8461f8c12dcbfcfa8039852dafaa2 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Fri, 19 Jun 2026 14:06:46 +0200
Subject: [PATCH 0700/1209] iproute2: stop substitutung pname

---
 pkgs/by-name/ip/iproute2/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index 842ffb89bb0d..2ad8fa7c8a26 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   version = "7.1.0";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
+    url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${version}.tar.xz";
     hash = "sha256-/Z+huVgJQXFXyoPdcpV+MmG9vOiWNTy5NvgK8LM6S1w=";
   };
 

From 821cc48c4f849313896a1d310c0e69a99474ea83 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 19 Jun 2026 16:58:34 +0200
Subject: [PATCH 0701/1209] jsoncpp: 1.9.7 -> 1.9.8

changelog: https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.8

diff: https://github.com/open-source-parsers/jsoncpp/compare/1.9.7...1.9.8
---
 pkgs/by-name/js/jsoncpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/js/jsoncpp/package.nix b/pkgs/by-name/js/jsoncpp/package.nix
index dc3d94b78260..b5f4373d5bd1 100644
--- a/pkgs/by-name/js/jsoncpp/package.nix
+++ b/pkgs/by-name/js/jsoncpp/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jsoncpp";
-  version = "1.9.7";
+  version = "1.9.8";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "open-source-parsers";
     repo = "jsoncpp";
     rev = finalAttrs.version;
-    sha256 = "sha256-rf8d2UNTVEZhuiyChK2XnUbfGDvsfXnKADhaSp8qBwQ=";
+    sha256 = "sha256-5cH9G4/TVCM5HX6QSk3P4m5+cwuK4x8hP9FohBcmjik=";
   };
 
   /*

From dd01bdc65ee19e5527de0031ac1ec5a152cac837 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 19 Jun 2026 18:56:20 +0200
Subject: [PATCH 0702/1209] appstream: 1.1.2 -> 1.1.3

---
 pkgs/development/libraries/appstream/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/appstream/default.nix b/pkgs/development/libraries/appstream/default.nix
index 61e1d7792264..095a87c4d853 100644
--- a/pkgs/development/libraries/appstream/default.nix
+++ b/pkgs/development/libraries/appstream/default.nix
@@ -12,8 +12,9 @@
   cmake,
   gettext,
   xmlto,
-  docbook-xsl-nons,
+  docbook-xsl-ns,
   docbook_xml_dtd_45,
+  libblake3,
   libxslt,
   libstemmer,
   glib,
@@ -42,7 +43,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "appstream";
-  version = "1.1.2";
+  version = "1.1.3";
 
   outputs = [
     "out"
@@ -54,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ximion";
     repo = "appstream";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-tvdWWdL6PthffAZZnNZ3+17/eJdZFx8xFkqm7IvyPWE=";
+    hash = "sha256-z9HmTYOjglki+ID7GPMf3jGLOAkxLqJd4+GsIR3W3u4=";
   };
 
   patches = [
@@ -81,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     gettext
     libxslt
     xmlto
-    docbook-xsl-nons
+    docbook-xsl-ns
     docbook_xml_dtd_45
     glib
     itstool
@@ -99,6 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    libblake3
     libstemmer
     glib
     xapian

From 133740a5aa533ea09b916c9981410d2de8896c53 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 17 Jun 2026 12:59:05 +0200
Subject: [PATCH 0703/1209] libnice: fix build for musl

Backported the FreeBSD fix as well to get the musl one to apply
cleanly.  Dependencies don't all build for FreeBSD but it wasn't hard
to get that to work so I have fixes in the pipeline.

Fixes: 40092a228d3a ("libnice: 0.1.22 -> 0.1.23")
---
 pkgs/by-name/li/libnice/musl.patch  | 178 ++++++++++++++++++++++++++++
 pkgs/by-name/li/libnice/package.nix |  10 ++
 2 files changed, 188 insertions(+)
 create mode 100644 pkgs/by-name/li/libnice/musl.patch

diff --git a/pkgs/by-name/li/libnice/musl.patch b/pkgs/by-name/li/libnice/musl.patch
new file mode 100644
index 000000000000..bf5c2a890bbd
--- /dev/null
+++ b/pkgs/by-name/li/libnice/musl.patch
@@ -0,0 +1,178 @@
+From a7310137cf09e382e2642e39d4ade88942d564c3 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Fri, 19 Jun 2026 17:21:47 +0200
+Subject: [PATCH 1/3] tests: treat Glibc-style sendmmsg as default case
+
+As requested.
+
+Link: https://gitlab.freedesktop.org/libnice/libnice/-/merge_requests/353#note_3526962
+Signed-off-by: Alyssa Ross <hi@alyssa.is>
+---
+ tests/instrument-send.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/tests/instrument-send.c b/tests/instrument-send.c
+index 3f79de87..65576dea 100644
+--- a/tests/instrument-send.c
++++ b/tests/instrument-send.c
+@@ -190,23 +190,23 @@ sendmsg (int sockfd, const struct msghdr *msg, int flags)
+   }
+ }
+ 
+-#ifndef __FreeBSD__
+-int
+-sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+-#else
++#ifdef __FreeBSD__
+ ssize_t
+ sendmmsg (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)
++#else
++int
++sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+ #endif
+ {
+   if (should_inject_ewouldblock ()) {
+     errno = EWOULDBLOCK;
+     return -1;
+   } else {
+-#ifndef __FreeBSD__
+-    int ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)) (
++#ifdef __FreeBSD__
++    ssize_t ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+ #else
+-    ssize_t ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)) (
++    int ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+ #endif
+     if (ret != -1) {
+-- 
+GitLab
+
+
+From 145c542b442f4deb89e1cc8bb92e1ca02456f918 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Mon, 15 Jun 2026 17:54:12 +0200
+Subject: [PATCH 2/3] tests: check sendmmsg prototype in Meson
+
+Checking the actual prototype we have rather than using hardcoded libc
+checks improves portability by being compatible with libcs that aren't
+explictly handled, but use the same prototype as a known libc.  For
+example, uClibc-ng uses the same prototype as FreeBSD, but wouldn't
+have been caught be the __FreeBSD__ check.
+---
+ tests/instrument-send.c |  4 ++--
+ tests/meson.build       | 18 +++++++++++++++++-
+ 2 files changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/tests/instrument-send.c b/tests/instrument-send.c
+index 65576dea..9903619a 100644
+--- a/tests/instrument-send.c
++++ b/tests/instrument-send.c
+@@ -190,7 +190,7 @@ sendmsg (int sockfd, const struct msghdr *msg, int flags)
+   }
+ }
+ 
+-#ifdef __FreeBSD__
++#if defined(HAVE_FREEBSD_STYLE_SENDMMSG)
+ ssize_t
+ sendmmsg (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)
+ #else
+@@ -202,7 +202,7 @@ sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+     errno = EWOULDBLOCK;
+     return -1;
+   } else {
+-#ifdef __FreeBSD__
++#if defined(HAVE_FREEBSD_STYLE_SENDMMSG)
+     ssize_t ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+ #else
+diff --git a/tests/meson.build b/tests/meson.build
+index 7a4ce651..29888c29 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -102,9 +102,25 @@ if gst_dep.found() and not static_build
+     ]
+     gst_env = environment()
+     dl_dep = cc.find_library('dl')
++
++    instrument_send_lib_c_args = ['-DG_LOG_DOMAIN="libnice-instrument-send"']
++    if cc.compiles('''
++      #include <sys/socket.h>
++      static int (*f) (int, struct mmsghdr *, unsigned int, int) = &sendmmsg;
++    ''', args: ['-D_GNU_SOURCE', '-Werror=incompatible-pointer-types'], name: 'Glibc-style sendmmsg')
++      # We consider this the default.
++    elif cc.compiles('''
++      #include <sys/socket.h>
++      static ssize_t (*f) (int, struct mmsghdr *, size_t, int) = &sendmmsg;
++    ''', args: ['-D_GNU_SOURCE', '-Werror=incompatible-pointer-types'], name: 'FreeBSD-style sendmmsg')
++      instrument_send_lib_c_args += ['-DHAVE_FREEBSD_STYLE_SENDMMSG']
++    else
++      error('sendmmsg not present or has unknown prototype')
++    endif
++
+     instrument_send_lib = shared_library('instrument-send',
+       'instrument-send.c',
+-      c_args: '-DG_LOG_DOMAIN="libnice-instrument-send"',
++      c_args: instrument_send_lib_c_args,
+       dependencies: [dl_dep, gio_deps],
+     )
+     gst_env.append('LD_PRELOAD', instrument_send_lib.full_path())
+-- 
+GitLab
+
+
+From 4565af6fe9fe01164b072710ad18e537608d3a40 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Wed, 17 Jun 2026 11:53:11 +0200
+Subject: [PATCH 3/3] tests: support NetBSD/musl-style sendmmsg
+
+Fixes compilation for these platforms.
+---
+ tests/instrument-send.c | 6 ++++++
+ tests/meson.build       | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/tests/instrument-send.c b/tests/instrument-send.c
+index 9903619a..20c02b30 100644
+--- a/tests/instrument-send.c
++++ b/tests/instrument-send.c
+@@ -193,6 +193,9 @@ sendmsg (int sockfd, const struct msghdr *msg, int flags)
+ #if defined(HAVE_FREEBSD_STYLE_SENDMMSG)
+ ssize_t
+ sendmmsg (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)
++#elif defined(HAVE_NETBSD_STYLE_SENDMMSG)
++int
++sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, unsigned int flags)
+ #else
+ int
+ sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+@@ -205,6 +208,9 @@ sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+ #if defined(HAVE_FREEBSD_STYLE_SENDMMSG)
+     ssize_t ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
++#elif defined(HAVE_NETBSD_STYLE_SENDMMSG)
++    int ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, unsigned int flags)) (
++        dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+ #else
+     int ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+diff --git a/tests/meson.build b/tests/meson.build
+index 29888c29..3827dc2b 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -114,6 +114,11 @@ if gst_dep.found() and not static_build
+       static ssize_t (*f) (int, struct mmsghdr *, size_t, int) = &sendmmsg;
+     ''', args: ['-D_GNU_SOURCE', '-Werror=incompatible-pointer-types'], name: 'FreeBSD-style sendmmsg')
+       instrument_send_lib_c_args += ['-DHAVE_FREEBSD_STYLE_SENDMMSG']
++    elif cc.compiles('''
++      #include <sys/socket.h>
++      static int (*f) (int, struct mmsghdr *, unsigned int, unsigned int) = &sendmmsg;
++    ''', args: ['-D_GNU_SOURCE', '-Werror=incompatible-pointer-types'], name: 'NetBSD-style sendmmsg')
++      instrument_send_lib_c_args += ['-DHAVE_NETBSD_STYLE_SENDMMSG']
+     else
+       error('sendmmsg not present or has unknown prototype')
+     endif
+-- 
+GitLab
+
diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 93c4e7de9df1..da06d966edbc 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -37,6 +38,15 @@ stdenv.mkDerivation (finalAttrs: {
     # Bumps the gupnp_igd_dep version requested to 1.6
     # https://gitlab.freedesktop.org/libnice/libnice/-/merge_requests/255
     ./gupnp-igd-bump.patch
+
+    (fetchpatch {
+      name = "freebsd.patch";
+      url = "https://gitlab.freedesktop.org/libnice/libnice/-/commit/479f0813a571ff035bf00de679db452a0441125b.patch";
+      hash = "sha256-rr8pAb8TjU85jYWUjsMMKkLxxXVE3B+IjfAyOw9suo0=";
+    })
+
+    # https://gitlab.freedesktop.org/libnice/libnice/-/merge_requests/353
+    ./musl.patch
   ];
 
   nativeBuildInputs = [

From 455a02410fb6cd8e926ba92e31309ef07359959f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 10:13:01 -0700
Subject: [PATCH 0704/1209] python3Packages.rich-toolkit: 0.17.1 -> 0.20.1

Diff: https://github.com/patrick91/rich-toolkit/compare/0.17.1...0.20.1

Changelog: https://github.com/patrick91/rich-toolkit/blob/0.20.1/CHANGELOG.md
---
 .../python-modules/rich-toolkit/default.nix     | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/rich-toolkit/default.nix b/pkgs/development/python-modules/rich-toolkit/default.nix
index bac82024c583..dfb682351eef 100644
--- a/pkgs/development/python-modules/rich-toolkit/default.nix
+++ b/pkgs/development/python-modules/rich-toolkit/default.nix
@@ -17,18 +17,23 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "rich-toolkit";
-  version = "0.17.1";
+  version = "0.20.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "patrick91";
     repo = "rich-toolkit";
-    tag = version;
-    hash = "sha256-69x760lnMdwrNFUL1g9PBlTRGz34Ur2CHWbJq7PqBmk=";
+    tag = finalAttrs.version;
+    hash = "sha256-XYSksCMCCxO6wzsEEJ6X340iT32hU5n/EikKLZ2m7A0=";
   };
 
+  postPatch = ''
+    # the commit updating the version happens only after tagging
+    sed -i 's/version = ".*"/version = "${finalAttrs.version}"/' pyproject.toml
+  '';
+
   build-system = [ hatchling ];
 
   dependencies = [
@@ -46,10 +51,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "rich_toolkit" ];
 
   meta = {
-    changelog = "https://github.com/patrick91/rich-toolkit/releases/tag/${src.tag}";
+    changelog = "https://github.com/patrick91/rich-toolkit/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Rich toolkit for building command-line applications";
     homepage = "https://github.com/patrick91/rich-toolkit/";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})

From 41a95eb3f6755878a34335981edf975c455a41db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 10:25:29 -0700
Subject: [PATCH 0705/1209] python3Packages.flask-cors: 6.0.2 -> 6.0.5

Diff: https://github.com/corydolphin/flask-cors/compare/6.0.2...6.0.5

Changelog: https://github.com/corydolphin/flask-cors/releases/tag/6.0.5
---
 pkgs/development/python-modules/flask-cors/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flask-cors/default.nix b/pkgs/development/python-modules/flask-cors/default.nix
index 0f8510073034..986c2f838a2d 100644
--- a/pkgs/development/python-modules/flask-cors/default.nix
+++ b/pkgs/development/python-modules/flask-cors/default.nix
@@ -6,6 +6,7 @@
   werkzeug,
   pytestCheckHook,
   setuptools,
+  setuptools-scm,
 
   # for passthru.tests
   aiobotocore,
@@ -14,18 +15,19 @@
 
 buildPythonPackage rec {
   pname = "flask-cors";
-  version = "6.0.2";
+  version = "6.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "corydolphin";
     repo = "flask-cors";
     tag = version;
-    hash = "sha256-9WlD5Qd0WiBDrVHf5nT1qAK2gtYavlPnY7qFkiAgxws=";
+    hash = "sha256-fngKJm7/7BMcWPPFncTCWw2sL1UJ0t4ICpXr95yNpbg=";
   };
 
   build-system = [
     setuptools
+    setuptools-scm
   ];
 
   dependencies = [
@@ -33,6 +35,8 @@ buildPythonPackage rec {
     werkzeug
   ];
 
+  pythonImportsCheck = [ "flask_cors" ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];

From 658e3cbf1bdc3abad3ae543918ccc0a0f39016d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 10:31:07 -0700
Subject: [PATCH 0706/1209] python3Packages.flask-cors: use finalAttrs

---
 pkgs/development/python-modules/flask-cors/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/flask-cors/default.nix b/pkgs/development/python-modules/flask-cors/default.nix
index 986c2f838a2d..16f9c4d18f50 100644
--- a/pkgs/development/python-modules/flask-cors/default.nix
+++ b/pkgs/development/python-modules/flask-cors/default.nix
@@ -13,7 +13,7 @@
   moto,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "flask-cors";
   version = "6.0.5";
   pyproject = true;
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "corydolphin";
     repo = "flask-cors";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-fngKJm7/7BMcWPPFncTCWw2sL1UJ0t4ICpXr95yNpbg=";
   };
 
@@ -48,8 +48,8 @@ buildPythonPackage rec {
   meta = {
     description = "Flask extension adding a decorator for CORS support";
     homepage = "https://github.com/corydolphin/flask-cors";
-    changelog = "https://github.com/corydolphin/flask-cors/releases/tag/${src.tag}";
+    changelog = "https://github.com/corydolphin/flask-cors/releases/tag/${finalAttrs.src.tag}";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ nickcao ];
   };
-}
+})

From 7a2e21ee2066c92b963159f45f7e8e06b5fbce6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 11:12:01 -0700
Subject: [PATCH 0707/1209] lvm2: 2.03.39 -> 2.03.41

Changelog: https://gitlab.com/lvmteam/lvm2/-/blob/v2_03_41/WHATS_NEW
---
 pkgs/os-specific/linux/lvm2/2_03.nix   | 4 ++--
 pkgs/os-specific/linux/lvm2/common.nix | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index c288d56dcc03..83397f3b492e 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.39";
-  hash = "sha256-I7yQZ+KP4NN7PMRB8oZbngIs48Ykur4ikYuN2QwDHug=";
+  version = "2.03.41";
+  hash = "sha256-1YARuEXfjsE4FsoT6mw51Ms9A4zS19OHrN9Wga19Zjc=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 2e4de4038f9a..83b6502405c8 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -231,6 +231,9 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
+    changelog = "https://gitlab.com/lvmteam/lvm2/-/blob/v${
+      lib.replaceString "." "_" version
+    }/WHATS_NEW";
     homepage = "http://sourceware.org/lvm2/";
     description = "Tools to support Logical Volume Management (LVM) on Linux";
     platforms = lib.platforms.linux;

From 3f1f18f34a96880bc6775778b9e5fbbcb3a15549 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 19 Jun 2026 20:22:15 +0200
Subject: [PATCH 0708/1209] python3Packages.matplotlib: fix build

This had ended up duplicated, and failed the second time.  Bad merge?
---
 pkgs/development/python-modules/matplotlib/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index c7fb77d7912e..2f11fd9a0d65 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -98,9 +98,6 @@ buildPythonPackage (finalAttrs: {
         --replace-fail "setuptools_scm>=7,<10" setuptools_scm
 
       patchShebangs tools
-
-      substituteInPlace pyproject.toml \
-        --replace-fail "setuptools_scm>=7,<10" "setuptools_scm"
     ''
     + lib.optionalString (stdenv.hostPlatform.isLinux && interactive) ''
       # fix paths to libraries in dlopen calls (headless detection)

From 5d359cdd4d964fe5388449b13d246e4844dd7529 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 19 Jun 2026 20:24:46 +0200
Subject: [PATCH 0709/1209] matplotlib: remove unused inputs

Fixes: c4a9aae5c700 ("python3Packages.matplotlib: 3.10.9 -> 3.11.0")
---
 pkgs/development/python-modules/matplotlib/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index c7fb77d7912e..9fea9767f130 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -13,8 +13,6 @@
   setuptools-scm,
   pytestCheckHook,
   python,
-  matplotlib,
-  fetchurl,
 
   # native libraries
   ffmpeg-headless,

From 2c176d05ca6242f24dcf7d98fdbda3a928b734fc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 12:03:01 -0700
Subject: [PATCH 0710/1209] maturin: 1.13.3 -> 1.14.1

Diff: https://github.com/PyO3/maturin/compare/v1.13.3...v1.14.1

Changelog: https://github.com/PyO3/maturin/blob/v1.14.1/Changelog.md
---
 pkgs/by-name/ma/maturin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 2fe364f2bfa3..fae97effb3b9 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "maturin";
-  version = "1.13.3";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xVR/R/aQ6Kvx7w/X9gedjJLzlxz+5nhnwjxsiyKcg0A=";
+    hash = "sha256-sqcNRN8oAZ2AK5gHr3ipb035VOiB+zDA10wTtiaeUBM=";
   };
 
-  cargoHash = "sha256-awdc2SLEfMP4cLG+RvQbeYPn1o9Ft7sqOnRy8iQqjB0=";
+  cargoHash = "sha256-pD8/S7GsFFeAjc8U4fQ9ZTu+o3mKyPagMPKKRI40n4w=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv

From eeef7c42f3ba64323534533a657f9479c91176b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 13:23:09 -0700
Subject: [PATCH 0711/1209] mercurial: 7.1.2 -> 7.2.2

Changelog: https://wiki.mercurial-scm.org/Release7.2
---
 pkgs/by-name/me/mercurial/package.nix | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/me/mercurial/package.nix b/pkgs/by-name/me/mercurial/package.nix
index 3ac5b2529b12..badad6378c51 100644
--- a/pkgs/by-name/me/mercurial/package.nix
+++ b/pkgs/by-name/me/mercurial/package.nix
@@ -40,11 +40,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "7.1.2";
+    version = "7.2.2";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-zie5pHZ88upJa1FGi65RL6am6vCJHkn4lh3GlLTcgco=";
+      hash = "sha256-8uyOfu7wUAWRcG03RVXwzrEYgiBo51+jsyvgfdIYT2w=";
     };
 
     pyproject = false;
@@ -56,7 +56,7 @@ let
         rustPlatform.fetchCargoVendor {
           inherit src;
           name = "mercurial-${version}";
-          hash = "sha256-REMgZ1TiVTDbvT8TCd4EeHfYT/xMJfC4E6weLJFT6Rw=";
+          hash = "sha256-OGsHK3Bh47V4n+7HYpVp/jymCz1QY45rkWlAW0Hob7g=";
           sourceRoot = "mercurial-${version}/rust";
         }
       else
@@ -180,12 +180,6 @@ let
                 ""
               }
           done
-
-          # https://bz.mercurial-scm.org/show_bug.cgi?id=6887
-          # Adding setuptools to the python path is not enough for the distutils
-          # module to be found, so we patch usage directly:
-          substituteInPlace tests/hghave.py \
-            --replace-fail "distutils" "setuptools._distutils"
         '';
 
         # This runs Mercurial _a lot_ of times.

From 7a49c1337a521afc89d76115826542e230df8dcd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 19 Jun 2026 22:22:59 +0000
Subject: [PATCH 0712/1209] ldns: 1.9.0 -> 1.9.2

---
 pkgs/by-name/ld/ldns/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ld/ldns/package.nix b/pkgs/by-name/ld/ldns/package.nix
index 4078cdfd5372..f40ea684be96 100644
--- a/pkgs/by-name/ld/ldns/package.nix
+++ b/pkgs/by-name/ld/ldns/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ldns";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/ldns/ldns-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-q67tKFj76oSk65gz4Z59IzgMwPPZtlSLlivkInb/3LM=";
+    sha256 = "sha256-tST6IZlLboNCAM64wn8bhL2lmC/jVwbwWBlsB525TV0=";
   };
 
   postPatch = ''

From 1c97950f52ad01ae1dc4e8bee8bf80fd9add4999 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 18 Jun 2026 02:32:25 +0200
Subject: [PATCH 0713/1209] python3Packages.anyio: 4.13.0 -> 4.14.0

https://github.com/agronholm/anyio/blob/4.14.0/docs/versionhistory.rst
---
 pkgs/development/python-modules/anyio/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 822bc7b0b484..2337ee8f6c8b 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -20,6 +20,7 @@
   hypothesis,
   psutil,
   pytest-mock,
+  pytest-timeout,
   pytest-xdist,
   pytestCheckHook,
   trustme,
@@ -31,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "4.13.0";
+  version = "4.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "agronholm";
     repo = "anyio";
     tag = version;
-    hash = "sha256-W2uR1VwI9u4QIPmbcYp8jDatEdya97NaJwAABlaRHzM=";
+    hash = "sha256-g+2d/j3ke+RjwIYq0JyFfYxg80QXrura9Dsx7cQyMIQ=";
   };
 
   build-system = [ setuptools-scm ];
@@ -59,6 +60,7 @@ buildPythonPackage rec {
     hypothesis
     psutil
     pytest-mock
+    pytest-timeout
     pytest-xdist
     pytestCheckHook
     trustme
@@ -98,6 +100,9 @@ buildPythonPackage rec {
     "test_run_in_custom_limiter"
     "test_cancel_from_shielded_scope"
     "test_start_task_soon_cancel_later"
+
+    # fails to monkeypatch __file__.__main__
+    "test_entrypoint_main_module"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # PermissionError: [Errno 1] Operation not permitted: '/dev/console'

From 238a80f814c524fc0314df3790f7d9ef369ad950 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 17:39:38 -0700
Subject: [PATCH 0714/1209] python3Packages.lxml: 6.1.0 -> 6.1.1

Diff: https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1

Changelog: https://github.com/lxml/lxml/blob/lxml-6.1.1/CHANGES.txt
---
 pkgs/development/python-modules/lxml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index d3dd5022478f..5b618d00be02 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "6.1.0";
+  version = "6.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lxml";
     repo = "lxml";
     tag = "lxml-${version}";
-    hash = "sha256-crFUn1TmxdHXr3ULDKsRy4Y4PR/itaycsWiSDb+pbeg=";
+    hash = "sha256-SRJaegK4PxgK0rdILVp3J92VnjPmExiD2AuMLoGQIbA=";
   };
 
   build-system = [

From 0114e63fb6dc1f7d74811f1e357d231519f09442 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 17:42:07 -0700
Subject: [PATCH 0715/1209] python3Packages.lxml: use finalAttrs

---
 pkgs/development/python-modules/lxml/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index 5b618d00be02..997fe6504a78 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -16,7 +16,7 @@
   xcodebuild,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "lxml";
   version = "6.1.1";
   pyproject = true;
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "lxml";
     repo = "lxml";
-    tag = "lxml-${version}";
+    tag = "lxml-${finalAttrs.version}";
     hash = "sha256-SRJaegK4PxgK0rdILVp3J92VnjPmExiD2AuMLoGQIbA=";
   };
 
@@ -58,10 +58,10 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/lxml/lxml/blob/lxml-${version}/CHANGES.txt";
+    changelog = "https://github.com/lxml/lxml/blob/${finalAttrs.src.tag}/CHANGES.txt";
     description = "Pythonic binding for the libxml2 and libxslt libraries";
     homepage = "https://lxml.de";
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})

From ff85c2b93b8e5cea4a224c58a422dd61c6ab7dd8 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sat, 20 Jun 2026 05:15:15 +0300
Subject: [PATCH 0716/1209] zix: 0.6.2 -> 0.8.2

---
 pkgs/by-name/zi/zix/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/zi/zix/package.nix b/pkgs/by-name/zi/zix/package.nix
index c7e17d2305f9..1d4e08f50193 100644
--- a/pkgs/by-name/zi/zix/package.nix
+++ b/pkgs/by-name/zi/zix/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zix";
-  version = "0.6.2";
+  version = "0.8.2";
 
   src = fetchFromGitLab {
     owner = "drobilla";
     repo = "zix";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1fdW014QKvTYHaEmDsivUVPzF/vZgnW3Srk6edp6G1o=";
+    hash = "sha256-EfljHq73FA5llX2nnr6pn75nB/FbKnWvr3/Phl5716M=";
   };
 
   nativeBuildInputs = [

From 523a4dc4187ec7edacf15820e2468553eb210a38 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sat, 20 Jun 2026 05:16:07 +0300
Subject: [PATCH 0717/1209] zix: adopt

---
 pkgs/by-name/zi/zix/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/zi/zix/package.nix b/pkgs/by-name/zi/zix/package.nix
index 1d4e08f50193..c783afbb6270 100644
--- a/pkgs/by-name/zi/zix/package.nix
+++ b/pkgs/by-name/zi/zix/package.nix
@@ -37,6 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://gitlab.com/drobilla/zix/-/blob/${finalAttrs.src.rev}/NEWS";
     license = lib.licenses.isc;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ qweered ];
   };
 })

From 81fbb6a0c335167b648da56d2093b777c107fd29 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sat, 20 Jun 2026 05:16:54 +0300
Subject: [PATCH 0718/1209] zix: modernize

---
 pkgs/by-name/zi/zix/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/zi/zix/package.nix b/pkgs/by-name/zi/zix/package.nix
index c783afbb6270..5f9b4b22f4cd 100644
--- a/pkgs/by-name/zi/zix/package.nix
+++ b/pkgs/by-name/zi/zix/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitLab {
     owner = "drobilla";
     repo = "zix";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-EfljHq73FA5llX2nnr6pn75nB/FbKnWvr3/Phl5716M=";
   };
 

From e197a90da72ddba320fbbbdddbd202e674a7d9a1 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Sat, 20 Jun 2026 02:42:31 -0600
Subject: [PATCH 0719/1209] python3Packages.mock: switch to pyproject

---
 pkgs/development/python-modules/mock/default.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/mock/default.nix b/pkgs/development/python-modules/mock/default.nix
index 23aff9befea6..9cf7a46fc8ea 100644
--- a/pkgs/development/python-modules/mock/default.nix
+++ b/pkgs/development/python-modules/mock/default.nix
@@ -3,18 +3,21 @@
   buildPythonPackage,
   fetchPypi,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "mock";
   version = "5.2.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-TkYOgYYptLFz8y0IvzDTr4Ejr7uOBLtXB6H9R5nlA/A=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "mock" ];
@@ -22,8 +25,8 @@ buildPythonPackage rec {
   meta = {
     description = "Rolling backport of unittest.mock for all Pythons";
     homepage = "https://github.com/testing-cabal/mock";
-    changelog = "https://github.com/testing-cabal/mock/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/testing-cabal/mock/blob/${finalAttrs.version}/CHANGELOG.rst";
     license = lib.licenses.bsd2;
     maintainers = [ ];
   };
-}
+})

From bc52944a1e2cf3c595d74423168b120cc320decb Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 20 Jun 2026 10:08:42 +0100
Subject: [PATCH 0720/1209] libgbm: 26.0.3 -> 26.1.3

---
 pkgs/development/libraries/mesa/gbm.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/gbm.nix b/pkgs/development/libraries/mesa/gbm.nix
index e4f36f7f1779..6f9b56157253 100644
--- a/pkgs/development/libraries/mesa/gbm.nix
+++ b/pkgs/development/libraries/mesa/gbm.nix
@@ -20,14 +20,14 @@ stdenv.mkDerivation rec {
 
   # We don't use the versions from common.nix, because libgbm is a world rebuild,
   # so the updates need to happen separately on staging.
-  version = "26.0.3";
+  version = "26.1.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-CTOnJKsx9hDtLhDnuJSGc/lBQ2ZcDm3/Iie7awusGho=";
+    hash = "sha256-W2Ud9wmiIuDYMnFj8sK2SGAI1WayMCtdj7/7od/1Ql4=";
   };
 
   mesonAutoFeatures = "disabled";

From 24a18b8315a0f3cc0654c92c51c8da89671ec0bf Mon Sep 17 00:00:00 2001
From: Michael Wang <michael_wzq@icloud.com>
Date: Sat, 20 Jun 2026 19:58:06 +1000
Subject: [PATCH 0721/1209] libultrahdr: fix i686-linux build and unrestrict
 meta.platforms https://github.com/NixOS/nixpkgs/issues/532626

---
 pkgs/by-name/li/libultrahdr/package.nix       |  41 ++---
 .../remove-platform-and-detection-logic.patch | 142 ++++++++++++++++++
 2 files changed, 156 insertions(+), 27 deletions(-)
 create mode 100644 pkgs/by-name/li/libultrahdr/remove-platform-and-detection-logic.patch

diff --git a/pkgs/by-name/li/libultrahdr/package.nix b/pkgs/by-name/li/libultrahdr/package.nix
index c3ef856b8fbf..f63521ee4742 100644
--- a/pkgs/by-name/li/libultrahdr/package.nix
+++ b/pkgs/by-name/li/libultrahdr/package.nix
@@ -40,6 +40,13 @@ stdenv.mkDerivation (finalAttrs: {
     (replaceVars ./gtest.patch {
       GTEST_INCLUDE_DIRS = "${lib.getDev gtest}/include";
     })
+
+    # Remove platform and architecture detection logic
+    # Also drop arch-specific compile and optimization flags to ensure
+    # packaging friendliness.
+    # Based on https://github.com/google/libultrahdr/pull/383
+    # modified to target 1.4.0 instead of main
+    ./remove-platform-and-detection-logic.patch
   ];
 
   # CMake incorrect absolute include/lib paths: https://github.com/NixOS/nixpkgs/issues/144170
@@ -53,6 +60,12 @@ stdenv.mkDerivation (finalAttrs: {
         'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
   '';
 
+  # use sse2 for floating point math to fix tests
+  env = lib.optionalAttrs stdenv.hostPlatform.isi686 {
+    CFLAGS = "-mfpmath=sse -msse2";
+    CXXFLAGS = "-mfpmath=sse -msse2";
+  };
+
   cmakeFlags = [
     (lib.cmakeBool "UHDR_BUILD_TESTS" true)
     # Build disables install target in cross-compilation mode so
@@ -102,33 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       yzx9
     ];
-    # CMake script rejects non-approved platform targets
-    # https://github.com/google/libultrahdr/pull/383 would get rid of that
-    platforms =
-      let
-        # Values from the "Detect system" section in /CMakeLists.txt
-        # https://github.com/google/libultrahdr/blob/d52a0d13814ca399fc8a07e23de1d2c63f0e8404/CMakeLists.txt#L34
-        oss = [
-          "linux"
-          "windows"
-          "darwin"
-        ];
-        archs = [
-          "i686"
-          "x86_64"
-          "aarch64"
-          "armv7l"
-          "riscv64"
-          "riscv32"
-          "loongarch64"
-        ];
-      in
-      lib.lists.intersectLists lib.platforms.all (
-        lib.lists.crossLists (arch: os: "${arch}-${os}") [
-          archs
-          oss
-        ]
-      );
+    platforms = lib.platforms.all;
     license = with lib.licenses; [
       asl20
     ];
diff --git a/pkgs/by-name/li/libultrahdr/remove-platform-and-detection-logic.patch b/pkgs/by-name/li/libultrahdr/remove-platform-and-detection-logic.patch
new file mode 100644
index 000000000000..5c3521be65a6
--- /dev/null
+++ b/pkgs/by-name/li/libultrahdr/remove-platform-and-detection-logic.patch
@@ -0,0 +1,142 @@
+From e2daed8da97d8857dcec2fd68d2f6f3326170f67 Mon Sep 17 00:00:00 2001
+From: Kleis Auke Wolthuizen <github@kleisauke.nl>
+Date: Wed, 10 Dec 2025 15:01:28 +0100
+Subject: [PATCH] Remove platform and architecture detection logic
+
+Also drop arch-specific compile and optimization flags to ensure
+packaging friendliness.
+---
+ CMakeLists.txt      | 104 +++-----------------------------------------
+ cmake/package.cmake |   3 --
+ 2 files changed, 5 insertions(+), 102 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 51283356..07ed9100 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -25,44 +25,6 @@ project(libuhdr
+         LANGUAGES C CXX
+         DESCRIPTION "Library for encoding and decoding ultrahdr images")
+ 
+-###########################################################
+-# Detect system
+-###########################################################
+-if(${CMAKE_SYSTEM_NAME} MATCHES "Linux")
+-elseif(${CMAKE_SYSTEM_NAME} MATCHES "Emscripten")
+-elseif(${CMAKE_SYSTEM_NAME} MATCHES "Android")
+-elseif(WIN32)
+-elseif(APPLE)
+-else()
+-  message(FATAL_ERROR "Platform ${CMAKE_SYSTEM_NAME} not recognized")
+-endif()
+-
+-if(CMAKE_SYSTEM_PROCESSOR MATCHES "amd64.*|x86_64.*|AMD64.*")
+-  if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+-    set(ARCH "amd64")
+-  else()
+-    set(ARCH "i386")
+-  endif()
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "i686.*|i386.*|x86.*")
+-  set(ARCH "i386")
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(aarch64.*|AARCH64.*|arm64.*|ARM64.*)")
+-  if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+-    set(ARCH "aarch64")
+-  else()
+-    set(ARCH "arm")
+-  endif()
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm.*|ARM.*)")
+-  set(ARCH "arm")
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^riscv64")
+-  set(ARCH "riscv64")
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^riscv32")
+-  set(ARCH "riscv32")
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^loongarch64")
+-  set(ARCH "loong64")
+-else()
+-  message(FATAL_ERROR "Architecture: ${CMAKE_SYSTEM_PROCESSOR} not recognized")
+-endif()
+-
+ ###########################################################
+ # Directories
+ ###########################################################
+@@ -287,45 +228,9 @@ elseif(EMSCRIPTEN)
+                            or try 'cmake -DUHDR_BUILD_DEPS=1'")
+     endif()
+   endif()
+-else()
+-  add_compile_options(-ffunction-sections)
+-  add_compile_options(-fdata-sections)
+-  add_compile_options(-fomit-frame-pointer)
+-  add_compile_options(-ffp-contract=fast)
+-  if(ARCH STREQUAL "i386")
+-    add_compile_options(-m32)
+-    add_compile_options(-march=i386)
+-    add_compile_options(-mtune=generic)
+-  elseif(ARCH STREQUAL "amd64")
+-    add_compile_options(-m64)
+-    add_compile_options(-march=x86-64)
+-    add_compile_options(-mtune=generic)
+-  elseif(ARCH STREQUAL "arm")
+-    add_compile_options(-march=armv7-a)
+-    add_compile_options(-marm)
+-    if(NOT ANDROID_ABI)
+-      add_compile_options(-mfloat-abi=hard)
+-    endif()
+-    add_compile_options(-mfpu=neon-vfpv3)
+-    add_compile_options(-fno-lax-vector-conversions)
+-  elseif(ARCH STREQUAL "aarch64")
+-    add_compile_options(-march=armv8-a)
+-    add_compile_options(-fno-lax-vector-conversions)
+-  elseif(ARCH STREQUAL "riscv64")
+-    add_compile_options(-march=rv64gc)
+-    add_compile_options(-mabi=lp64d)
+-  elseif(ARCH STREQUAL "riscv32")
+-    add_compile_options(-march=rv32gc)
+-    add_compile_options(-mabi=ilp32d)
+-  elseif(ARCH STREQUAL "loong64")
+-    add_compile_options(-march=loongarch64)
+-    add_compile_options(-mabi=lp64d)
+-  endif()
+-
+-  if(UHDR_ENABLE_WERROR)
+-    CheckCompilerOption("-Werror" SUPPORTS_WERROR)
+-    set(UHDR_WERROR_FLAGS "-Werror")
+-  endif()
++elseif(UHDR_ENABLE_WERROR)
++  CheckCompilerOption("-Werror" SUPPORTS_WERROR)
++  set(UHDR_WERROR_FLAGS "-Werror")
+ endif()
+ 
+ ###########################################################
+@@ -585,7 +490,8 @@ set_property(DIRECTORY PROPERTY ADDITIONAL_MAKE_CLEAN_FILES
+ ###########################################################
+ file(GLOB UHDR_CORE_SRCS_LIST "${SOURCE_DIR}/src/*.cpp")
+ if(UHDR_ENABLE_INTRINSICS)
+-  if(ARCH STREQUAL "arm" OR ARCH STREQUAL "aarch64")
++  string(TOLOWER ${CMAKE_SYSTEM_PROCESSOR} CMAKE_SYSTEM_PROCESSOR_LC)
++  if(CMAKE_SYSTEM_PROCESSOR_LC STREQUAL "aarch64" OR CMAKE_SYSTEM_PROCESSOR_LC MATCHES "^arm")
+     file(GLOB UHDR_CORE_NEON_SRCS_LIST "${SOURCE_DIR}/src/dsp/arm/*.cpp")
+     list(APPEND UHDR_CORE_SRCS_LIST ${UHDR_CORE_NEON_SRCS_LIST})
+   endif()
+diff --git a/cmake/package.cmake b/cmake/package.cmake
+index 2e3649aa..5a416c22 100644
+--- a/cmake/package.cmake
++++ b/cmake/package.cmake
+@@ -29,9 +29,7 @@ if("${CMAKE_SYSTEM_NAME}" STREQUAL "")
+   message(FATAL_ERROR "Failed to determine CPACK_SYSTEM_NAME. Is CMAKE_SYSTEM_NAME set?" )
+ endif()
+ string(TOLOWER "${CMAKE_SYSTEM_NAME}" CPACK_SYSTEM_NAME)
+-set(CPACK_PACKAGE_ARCHITECTURE ${ARCH})
+ set(CPACK_PACKAGE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${CPACK_SYSTEM_NAME}")
+-set(CPACK_PACKAGE_FILE_NAME "${CPACK_PACKAGE_FILE_NAME}-${CPACK_PACKAGE_ARCHITECTURE}")
+ set(CPACK_RESOURCE_FILE_LICENSE ${CMAKE_SOURCE_DIR}/LICENSE)
+ set(CPACK_PACKAGING_INSTALL_PREFIX ${CMAKE_INSTALL_PREFIX})
+ 
+@@ -46,7 +44,6 @@ elseif(UNIX)
+     set(CPACK_DEBIAN_PACKAGE_HOMEPAGE ${CPACK_PACKAGE_HOMEPAGE_URL})
+   elseif(EXISTS "/etc/redhat-release")
+     set(CPACK_GENERATOR "RPM")
+-    set(CPACK_RPM_PACKAGE_ARCHITECTURE ${CPACK_PACKAGE_ARCHITECTURE})
+     set(CPACK_RPM_PACKAGE_RELEASE 1)
+     set(CPACK_RPM_PACKAGE_LICENSE "Apache 2.0")
+     set(CPACK_RPM_PACKAGE_URL ${CPACK_PACKAGE_HOMEPAGE_URL})

From 1bdde03f71cfc428d5ff7324cfb8be06076e2471 Mon Sep 17 00:00:00 2001
From: Michael Wang <michael_wzq@icloud.com>
Date: Sat, 20 Jun 2026 18:40:22 +1000
Subject: [PATCH 0722/1209] libultrahdr: fix tests on big-endian
 https://github.com/google/libultrahdr/pull/396

---
 pkgs/by-name/li/libultrahdr/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/li/libultrahdr/package.nix b/pkgs/by-name/li/libultrahdr/package.nix
index f63521ee4742..c4328f72fcfb 100644
--- a/pkgs/by-name/li/libultrahdr/package.nix
+++ b/pkgs/by-name/li/libultrahdr/package.nix
@@ -47,6 +47,13 @@ stdenv.mkDerivation (finalAttrs: {
     # Based on https://github.com/google/libultrahdr/pull/383
     # modified to target 1.4.0 instead of main
     ./remove-platform-and-detection-logic.patch
+
+    # fix tests on big-endian
+    # https://github.com/google/libultrahdr/pull/396
+    (fetchpatch {
+      url = "https://github.com/google/libultrahdr/commit/13a058f452d846e43d4691f6885eeeaa8b0ea8d0.patch";
+      hash = "sha256-2ZVvBMz8wQLEThuXdRJbbx5m2ouRZpxVWoH88RLmit4=";
+    })
   ];
 
   # CMake incorrect absolute include/lib paths: https://github.com/NixOS/nixpkgs/issues/144170

From 16c27918569370f5ceeb1ca2512f925a2298e2fb Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:05:55 +0200
Subject: [PATCH 0723/1209] poppler: 25.10.0 -> 26.06.0

changelog: changelog: https://poppler.freedesktop.org/releases.html

diff: diff: https://gitlab.freedesktop.org/poppler/poppler/-/compare/poppler-25.10.0...poppler-26.06.0
---
 .../development/libraries/poppler/default.nix | 26 +++++++++++--------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 686d4a3715e3..0b1b6a76df2f 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -55,13 +55,13 @@ let
     domain = "gitlab.freedesktop.org";
     owner = "poppler";
     repo = "test";
-    rev = "9d5011815a14c157ba25bb160187842fb81579a5";
-    hash = "sha256-sA5f235IJpzzzHqpwHM3zCZC2Yh0ztA6PZa84j/6tfY=";
+    rev = "f0068e9c530017ad811d1f28b95f9b7f59264e37";
+    hash = "sha256-Xf8duSh0r1o09b5BKB7mBvzrMfXYlzTuTOuK2ZCeItc=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "poppler-${suffix}";
-  version = "25.10.0"; # beware: updates often break cups-filters build, check scribus too!
+  version = "26.06.0"; # beware: updates often break cups-filters build, check scribus too!
 
   outputs = [
     "out"
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://poppler.freedesktop.org/poppler-${finalAttrs.version}.tar.xz";
-    hash = "sha256-a16btk2rsVeHoU2xZ1KRx6+vk4dDjMk6T7f2rsTub+A=";
+    hash = "sha256-TLTlo9yMte7HUciiPIuhn2H5be3AzQfSruawyOLPa6Q=";
   };
 
   nativeBuildInputs = [
@@ -129,18 +129,22 @@ stdenv.mkDerivation (finalAttrs: {
     (mkFlag qt5Support "QT5")
     (mkFlag qt6Support "QT6")
     (mkFlag gpgmeSupport "GPGME")
-  ]
-  ++ lib.optionals finalAttrs.finalPackage.doCheck [
-    "-DTESTDATADIR=${testData}"
   ];
   disallowedReferences = lib.optional finalAttrs.finalPackage.doCheck testData;
 
   dontWrapQtApps = true;
 
-  # Workaround #54606
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    sed -i -e '1i cmake_policy(SET CMP0025 NEW)' CMakeLists.txt
-  '';
+  preConfigure =
+    lib.optionalString finalAttrs.finalPackage.doCheck ''
+      # The test data directory needs to be writable during the test phase.
+      mkdir -p $TMPDIR/testdata
+      cp -r --no-preserve=mode ${testData}/* $TMPDIR/testdata
+      cmakeFlagsArray+=(-DTESTDATADIR=$TMPDIR/testdata)
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # Workaround #54606
+      sed -i -e '1i cmake_policy(SET CMP0025 NEW)' CMakeLists.txt
+    '';
 
   # Work around gpgme trying to write to $HOME during qt5 and qt6 tests:
   preCheck = lib.optionalString gpgmeSupport ''

From 75f331ec360b55cb4793836ff1ded77b58fcd98c Mon Sep 17 00:00:00 2001
From: glevy <glevy@crans.org>
Date: Fri, 8 May 2026 09:29:06 +0000
Subject: [PATCH 0724/1209] python3Packages.joserfc: 1.6.1 -> 1.6.9

Changelog : https://github.com/authlib/joserfc/compare/1.6.1...1.6.9
---
 pkgs/development/python-modules/joserfc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/joserfc/default.nix b/pkgs/development/python-modules/joserfc/default.nix
index 16fd842083c6..89874d9e571e 100644
--- a/pkgs/development/python-modules/joserfc/default.nix
+++ b/pkgs/development/python-modules/joserfc/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "joserfc";
-  version = "1.6.1";
+  version = "1.6.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "authlib";
     repo = "joserfc";
     tag = version;
-    hash = "sha256-druh7ybcQBjTxUFMVLUwknw/aa/fyrUdS4ftS/ftYeA=";
+    hash = "sha256-Ge1r34GVmpJ9h5GtRkPd0mkV7HuLf7D31ikuPAnpkuY=";
   };
 
   build-system = [ setuptools ];

From ed76de3e2ad32f63857414d9e8f2318774e2833a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Sat, 20 Jun 2026 00:42:53 +0000
Subject: [PATCH 0725/1209] libjxl, jpegli: Fix file conflicts when installed
 together. Fixes #533459

Done by moving the benchmarks and library files to separate outputs
so one can reference only `.bin` in `systemPackages`,
avoiding the overlapping names:

    bin/benchmark_xl
    lib/libjxl_cms.so
    lib/libjxl_threads.so
    lib/libjxl_extras_codec.a

For jpegli, a `dev` output also needed to be added to remove a cyclic
reference (from `out` to `bin`):
With a `bin` output newly present, the nixpkgs `multiple-outputs` hook
emits `nix-support/propagated-build-inputs` (which lists the `bin` output)
as development metadata. Without a `dev` output this lands in `out`,
creating an `out -> bin -> out` reference cycle (`bin` links the runtime
libs in `out`).
Example of what was in `bin`'s `nix-support/propagated-build-inputs`:

    /nix/store/99f61f783cd29k1gmr7hrxjnb4v584jn-jpegli-0-unstable-2026-04-30-bin /nix/store/320lmb4fnd2x5alv9hlpdlgz73aj8f26-jpegli-0-unstable-2026-04-30

Creating `dev` moves `nix-support` there, breaking the cycle
and matching the `libjxl` output layout.

Assisted-By: Claude Opus 4.8 in Zoo Code
---
 pkgs/by-name/jp/jpegli/package.nix |  9 +++++++++
 pkgs/by-name/li/libjxl/package.nix | 30 ++++++++++++++++++------------
 2 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/jp/jpegli/package.nix b/pkgs/by-name/jp/jpegli/package.nix
index 68ed1766c073..86bf75f0c426 100644
--- a/pkgs/by-name/jp/jpegli/package.nix
+++ b/pkgs/by-name/jp/jpegli/package.nix
@@ -31,7 +31,10 @@ stdenv.mkDerivation {
 
   outputs = [
     "out"
+    "bin"
+    "dev"
     "man"
+    "benchmark"
   ];
 
   strictDeps = true;
@@ -70,6 +73,12 @@ stdenv.mkDerivation {
     (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
   ];
 
+  # Move `benchmark_xl` into a separate output to avoid a file collision
+  # with the `benchmark_xl` binary provided by `libjxl`.
+  postInstall = ''
+    moveToOutput "bin/benchmark_xl" "$benchmark"
+  '';
+
   doCheck = true;
 
   passthru = {
diff --git a/pkgs/by-name/li/libjxl/package.nix b/pkgs/by-name/li/libjxl/package.nix
index ce50b109a961..93fceb3f3095 100644
--- a/pkgs/by-name/li/libjxl/package.nix
+++ b/pkgs/by-name/li/libjxl/package.nix
@@ -35,7 +35,9 @@ stdenv.mkDerivation rec {
 
   outputs = [
     "out"
+    "bin"
     "dev"
+    "benchmark"
   ];
 
   src = fetchFromGitHub {
@@ -150,18 +152,22 @@ stdenv.mkDerivation rec {
       --replace 'sh$' 'sh( -e$|$)'
   '';
 
-  postInstall =
-    lib.optionalString enablePlugins ''
-      GDK_PIXBUF_MODULEDIR="$out/${gdk-pixbuf.moduleDir}" \
-      GDK_PIXBUF_MODULE_FILE="$out/${loadersPath}" \
-        gdk-pixbuf-query-loaders --update-cache
-    ''
-    # Cross-compiled gdk-pixbuf doesn't support thumbnailers
-    + lib.optionalString (enablePlugins && stdenv.hostPlatform == stdenv.buildPlatform) ''
-      mkdir -p "$out/bin"
-      makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-jxl" \
-        --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
-    '';
+  # Move `benchmark_xl` into a separate output to avoid a file collision
+  # with the `benchmark_xl` binary provided by `jpegli`.
+  postInstall = ''
+    moveToOutput "bin/benchmark_xl" "$benchmark"
+  ''
+  + lib.optionalString enablePlugins ''
+    GDK_PIXBUF_MODULEDIR="$out/${gdk-pixbuf.moduleDir}" \
+    GDK_PIXBUF_MODULE_FILE="$out/${loadersPath}" \
+      gdk-pixbuf-query-loaders --update-cache
+  ''
+  # Cross-compiled gdk-pixbuf doesn't support thumbnailers
+  + lib.optionalString (enablePlugins && stdenv.hostPlatform == stdenv.buildPlatform) ''
+    mkdir -p "$out/bin"
+    makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-jxl" \
+      --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
+  '';
 
   env = lib.optionalAttrs stdenv.hostPlatform.isAarch32 {
     CXXFLAGS = "-mfp16-format=ieee";

From ecae36f1728d97f9a17cb10ea1cc1fabfb8276fe Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Sun, 21 Jun 2026 00:41:07 +0200
Subject: [PATCH 0726/1209] jq: 1.8.1 -> 1.8.2

Changelogs: https://github.com/jqlang/jq/releases/tag/jq-1.8.2
Should be backported (22 CVEs)
---
 pkgs/by-name/jq/jq/CVE-2026-32316.patch | 49 --------------
 pkgs/by-name/jq/jq/CVE-2026-33947.patch | 66 -------------------
 pkgs/by-name/jq/jq/CVE-2026-33948.patch | 45 -------------
 pkgs/by-name/jq/jq/CVE-2026-39979.patch | 27 --------
 pkgs/by-name/jq/jq/CVE-2026-40164.patch | 87 -------------------------
 pkgs/by-name/jq/jq/musl.patch           | 31 ---------
 pkgs/by-name/jq/jq/package.nix          | 14 +---
 7 files changed, 3 insertions(+), 316 deletions(-)
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-32316.patch
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-33947.patch
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-33948.patch
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-39979.patch
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-40164.patch
 delete mode 100644 pkgs/by-name/jq/jq/musl.patch

diff --git a/pkgs/by-name/jq/jq/CVE-2026-32316.patch b/pkgs/by-name/jq/jq/CVE-2026-32316.patch
deleted file mode 100644
index 29d08c9adcd7..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-32316.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From e47e56d226519635768e6aab2f38f0ab037c09e5 Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Thu, 12 Mar 2026 20:28:43 +0900
-Subject: [PATCH] Fix heap buffer overflow in `jvp_string_append` and
- `jvp_string_copy_replace_bad`
-
-In `jvp_string_append`, the allocation size `(currlen + len) * 2` could
-overflow `uint32_t` when `currlen + len` exceeds `INT_MAX`, causing a small
-allocation followed by a large `memcpy`.
-
-In `jvp_string_copy_replace_bad`, the output buffer size calculation
-`length * 3 + 1` could overflow `uint32_t`, again resulting in a small
-allocation followed by a large write.
-
-Add overflow checks to both functions to return an error for strings
-that would exceed `INT_MAX` in length. Fixes CVE-2026-32316.
----
- src/jv.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/src/jv.c b/src/jv.c
-index 722a539391..2a62b48419 100644
---- a/src/jv.c
-+++ b/src/jv.c
-@@ -1114,7 +1114,12 @@ static jv jvp_string_copy_replace_bad(const char* data, uint32_t length) {
-   const char* end = data + length;
-   const char* i = data;
- 
--  uint32_t maxlength = length * 3 + 1; // worst case: all bad bytes, each becomes a 3-byte U+FFFD
-+  // worst case: all bad bytes, each becomes a 3-byte U+FFFD
-+  uint64_t maxlength = (uint64_t)length * 3 + 1;
-+  if (maxlength >= INT_MAX) {
-+    return jv_invalid_with_msg(jv_string("String too long"));
-+  }
-+
-   jvp_string* s = jvp_string_alloc(maxlength);
-   char* out = s->data;
-   int c = 0;
-@@ -1174,6 +1179,10 @@ static uint32_t jvp_string_remaining_space(jvp_string* s) {
- static jv jvp_string_append(jv string, const char* data, uint32_t len) {
-   jvp_string* s = jvp_string_ptr(string);
-   uint32_t currlen = jvp_string_length(s);
-+  if ((uint64_t)currlen + len >= INT_MAX) {
-+    jv_free(string);
-+    return jv_invalid_with_msg(jv_string("String too long"));
-+  }
- 
-   if (jvp_refcnt_unshared(string.u.ptr) &&
-       jvp_string_remaining_space(s) >= len) {
diff --git a/pkgs/by-name/jq/jq/CVE-2026-33947.patch b/pkgs/by-name/jq/jq/CVE-2026-33947.patch
deleted file mode 100644
index 9f31fd82b057..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-33947.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From fb59f1491058d58bdc3e8dd28f1773d1ac690a1f Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Mon, 13 Apr 2026 11:23:40 +0900
-Subject: [PATCH] Limit path depth to prevent stack overflow
-
-Deeply nested path arrays can cause unbounded recursion in
-`jv_setpath`, `jv_getpath`, and `jv_delpaths`, leading to
-stack overflow. Add a depth limit of 10000 to match the
-existing `tojson` depth limit. This fixes CVE-2026-33947.
----
- src/jv_aux.c  | 21 +++++++++++++++++++++
- 2 files changed, 46 insertions(+)
-
-diff --git a/src/jv_aux.c b/src/jv_aux.c
-index 018f380b10..fd5ff96684 100644
---- a/src/jv_aux.c
-+++ b/src/jv_aux.c
-@@ -365,6 +365,10 @@ static jv jv_dels(jv t, jv keys) {
-   return t;
- }
- 
-+#ifndef MAX_PATH_DEPTH
-+#define MAX_PATH_DEPTH (10000)
-+#endif
-+
- jv jv_setpath(jv root, jv path, jv value) {
-   if (jv_get_kind(path) != JV_KIND_ARRAY) {
-     jv_free(value);
-@@ -372,6 +376,12 @@ jv jv_setpath(jv root, jv path, jv value) {
-     jv_free(path);
-     return jv_invalid_with_msg(jv_string("Path must be specified as an array"));
-   }
-+  if (jv_array_length(jv_copy(path)) > MAX_PATH_DEPTH) {
-+    jv_free(value);
-+    jv_free(root);
-+    jv_free(path);
-+    return jv_invalid_with_msg(jv_string("Path too deep"));
-+  }
-   if (!jv_is_valid(root)){
-     jv_free(value);
-     jv_free(path);
-@@ -424,6 +434,11 @@ jv jv_getpath(jv root, jv path) {
-     jv_free(path);
-     return jv_invalid_with_msg(jv_string("Path must be specified as an array"));
-   }
-+  if (jv_array_length(jv_copy(path)) > MAX_PATH_DEPTH) {
-+    jv_free(root);
-+    jv_free(path);
-+    return jv_invalid_with_msg(jv_string("Path too deep"));
-+  }
-   if (!jv_is_valid(root)) {
-     jv_free(path);
-     return root;
-@@ -502,6 +517,12 @@ jv jv_delpaths(jv object, jv paths) {
-       jv_free(elem);
-       return err;
-     }
-+    if (jv_array_length(jv_copy(elem)) > MAX_PATH_DEPTH) {
-+      jv_free(object);
-+      jv_free(paths);
-+      jv_free(elem);
-+      return jv_invalid_with_msg(jv_string("Path too deep"));
-+    }
-     jv_free(elem);
-   }
-   if (jv_array_length(jv_copy(paths)) == 0) {
diff --git a/pkgs/by-name/jq/jq/CVE-2026-33948.patch b/pkgs/by-name/jq/jq/CVE-2026-33948.patch
deleted file mode 100644
index 5b6497e1469d..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-33948.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Mon, 13 Apr 2026 08:46:11 +0900
-Subject: [PATCH] Fix NUL truncation in the JSON parser
-
-This fixes CVE-2026-33948.
----
- src/util.c   | 8 +-------
- tests/shtest | 6 ++++++
- 2 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/src/util.c b/src/util.c
-index fdfdb96d88..80d65fc808 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -312,13 +312,7 @@ static int jq_util_input_read_more(jq_util_input_state *state) {
-       if (p != NULL)
-         state->current_line++;
- 
--      if (p == NULL && state->parser != NULL) {
--        /*
--         * There should be no NULs in JSON texts (but JSON text
--         * sequences are another story).
--         */
--        state->buf_valid_len = strlen(state->buf);
--      } else if (p == NULL && feof(state->current_input)) {
-+      if (p == NULL && feof(state->current_input)) {
-         size_t i;
- 
-         /*
-diff --git a/tests/shtest b/tests/shtest
-index cb88745277..370f7b7c69 100755
---- a/tests/shtest
-+++ b/tests/shtest
-@@ -880,4 +880,10 @@ $JQ -nf $d/prog.jq 2> $d/out && {
- }
- diff $d/out $d/expected
- 
-+# CVE-2026-33948: No NUL truncation in the JSON parser
-+if printf '{}\x00{}' | $JQ >/dev/null 2> /dev/null; then
-+  printf 'Error expected but jq exited successfully\n' 1>&2
-+  exit 1
-+fi
-+
- exit 0
diff --git a/pkgs/by-name/jq/jq/CVE-2026-39979.patch b/pkgs/by-name/jq/jq/CVE-2026-39979.patch
deleted file mode 100644
index cc0c3d17f77f..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-39979.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 2f09060afab23fe9390cce7cb860b10416e1bf5f Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Mon, 13 Apr 2026 11:04:52 +0900
-Subject: [PATCH] Fix out-of-bounds read in jv_parse_sized()
-
-This fixes CVE-2026-39979.
-
-Co-authored-by: Mattias Wadman <mattias.wadman@gmail.com>
----
- src/jv_parse.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/jv_parse.c b/src/jv_parse.c
-index aa2054cc09..56847b5eaa 100644
---- a/src/jv_parse.c
-+++ b/src/jv_parse.c
-@@ -893,8 +893,9 @@ jv jv_parse_sized_custom_flags(const char* string, int length, int flags) {
- 
-   if (!jv_is_valid(value) && jv_invalid_has_msg(jv_copy(value))) {
-     jv msg = jv_invalid_get_msg(value);
--    value = jv_invalid_with_msg(jv_string_fmt("%s (while parsing '%s')",
-+    value = jv_invalid_with_msg(jv_string_fmt("%s (while parsing '%.*s')",
-                                               jv_string_value(msg),
-+                                              length,
-                                               string));
-     jv_free(msg);
-   }
diff --git a/pkgs/by-name/jq/jq/CVE-2026-40164.patch b/pkgs/by-name/jq/jq/CVE-2026-40164.patch
deleted file mode 100644
index 483316f64b4b..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-40164.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Mon, 13 Apr 2026 08:53:26 +0900
-Subject: [PATCH] Randomize hash seed to mitigate hash collision DoS attacks
-
-The hash function used a fixed seed, allowing attackers to craft colliding keys
-and cause O(n^2) object parsing performance. Initialize the seed from a random
-source at process startup to prevent the attack. This fixes CVE-2026-40164.
-
-Co-authored-by: Asaf Meizner <asafmeizner@gmail.com>
----
- configure.ac |  2 ++
- src/jv.c     | 34 ++++++++++++++++++++++++++++++++--
- 2 files changed, 34 insertions(+), 2 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 5dac42655a..f7067a4341 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -149,6 +149,8 @@ AC_CHECK_MEMBER([struct tm.tm_gmtoff], [AC_DEFINE([HAVE_TM_TM_GMT_OFF],1,[Define
- AC_CHECK_MEMBER([struct tm.__tm_gmtoff], [AC_DEFINE([HAVE_TM___TM_GMT_OFF],1,[Define to 1 if the system has the __tm_gmt_off field in struct tm])],
-                 [], [[#include <time.h>]])
- AC_FIND_FUNC([setlocale], [c], [#include <locale.h>], [0,0])
-+AC_FIND_FUNC([arc4random], [c], [#include <stdlib.h>], [])
-+AC_FIND_FUNC([getentropy], [c], [#include <unistd.h>], [0, 0])
- 
- dnl Figure out if we have the pthread functions we actually need
- AC_FIND_FUNC_NO_LIBS([pthread_key_create], [], [#include <pthread.h>], [NULL, NULL])
-diff --git a/src/jv.c b/src/jv.c
-index 2a62b48419..607ac174f7 100644
---- a/src/jv.c
-+++ b/src/jv.c
-@@ -40,6 +40,10 @@
- #include <limits.h>
- #include <math.h>
- #include <float.h>
-+#include <time.h>
-+#include <unistd.h>
-+#include <fcntl.h>
-+#include <pthread.h>
- 
- #include "jv_alloc.h"
- #include "jv.h"
-@@ -1206,7 +1210,33 @@ static jv jvp_string_append(jv string, const char* data, uint32_t len) {
-   }
- }
- 
--static const uint32_t HASH_SEED = 0x432A9843;
-+static uint32_t hash_seed;
-+static pthread_once_t hash_seed_once = PTHREAD_ONCE_INIT;
-+
-+static void jvp_hash_seed_init(void) {
-+  uint32_t seed;
-+#if defined(HAVE_ARC4RANDOM)
-+  seed = arc4random();
-+#elif defined(HAVE_GETENTROPY)
-+  if (getentropy(&seed, sizeof(seed)) != 0)
-+    seed = (uint32_t)getpid() ^ (uint32_t)time(NULL);
-+#else
-+  int fd = open("/dev/urandom", O_RDONLY);
-+  if (fd >= 0) {
-+    if (read(fd, &seed, sizeof(seed)) != 4)
-+      seed = (uint32_t)getpid() ^ (uint32_t)time(NULL);
-+    close(fd);
-+  } else {
-+    seed = (uint32_t)getpid() ^ (uint32_t)time(NULL);
-+  }
-+#endif
-+  hash_seed = seed;
-+}
-+
-+static uint32_t jvp_hash_seed(void) {
-+  pthread_once(&hash_seed_once, jvp_hash_seed_init);
-+  return hash_seed;
-+}
- 
- static uint32_t rotl32 (uint32_t x, int8_t r){
-   return (x << r) | (x >> (32 - r));
-@@ -1225,7 +1255,7 @@ static uint32_t jvp_string_hash(jv jstr) {
-   int len = (int)jvp_string_length(str);
-   const int nblocks = len / 4;
- 
--  uint32_t h1 = HASH_SEED;
-+  uint32_t h1 = jvp_hash_seed();
- 
-   const uint32_t c1 = 0xcc9e2d51;
-   const uint32_t c2 = 0x1b873593;
diff --git a/pkgs/by-name/jq/jq/musl.patch b/pkgs/by-name/jq/jq/musl.patch
deleted file mode 100644
index 3632899882e7..000000000000
--- a/pkgs/by-name/jq/jq/musl.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 63e9449a8142ce30c83fcd7e9396e5de9843774e Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Thu, 3 Jul 2025 11:00:13 +0200
-Subject: [PATCH] jq.test: drop non-portable %F test
-
-%F is a non-portable GNU extension, not supported by all strptime
-implementations (for example musl's).
-
-Link: https://github.com/jqlang/jq/pull/3365
----
- tests/jq.test | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/tests/jq.test b/tests/jq.test
-index 4ecf72f..6bfb6f8 100644
---- a/tests/jq.test
-+++ b/tests/jq.test
-@@ -1848,10 +1848,6 @@ try ["OK", strflocaltime({})] catch ["KO", .]
- "2015-03-05T23:51:47Z"
- [[2015,2,5,23,51,47,4,63],1425599507]
- 
--[strptime("%FT%T")|(.,mktime)]
--"2025-06-07T08:09:10"
--[[2025,5,7,8,9,10,6,157],1749283750]
--
- # Check day-of-week and day of year computations
- # (should trip an assert if this fails)
- last(range(365 * 67)|("1970-03-01T01:02:03Z"|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime) + (86400 * .)|strftime("%Y-%m-%dT%H:%M:%SZ")|strptime("%Y-%m-%dT%H:%M:%SZ"))
--- 
-2.49.0
-
diff --git a/pkgs/by-name/jq/jq/package.nix b/pkgs/by-name/jq/jq/package.nix
index 70b6bb169fce..edf9b16ec356 100644
--- a/pkgs/by-name/jq/jq/package.nix
+++ b/pkgs/by-name/jq/jq/package.nix
@@ -14,12 +14,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jq";
-  version = "1.8.1";
+  version = "1.8.2";
 
   # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
   src = fetchurl {
     url = "https://github.com/jqlang/jq/releases/download/jq-${finalAttrs.version}/jq-${finalAttrs.version}.tar.gz";
-    hash = "sha256-K+ZOcSnOyxHVkGKQ66EK9pT7nj5/n8IIoxHcM8qDfrA=";
+    hash = "sha256-cbjW6PX+gfbG0NEQ44kiUfbOdu0JWr0xXibm4Rk6868=";
   };
 
   outputs = [
@@ -30,15 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     "out"
   ];
 
-  patches = [
-    ./musl.patch
-    ./CVE-2026-32316.patch
-    ./CVE-2026-33947.patch
-    ./CVE-2026-33948.patch
-    ./CVE-2026-39979.patch
-    ./CVE-2026-40164.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.is32bit [
+  patches = lib.optionals stdenv.hostPlatform.is32bit [
     # needed because epoch conversion test here is right at the end of 32 bit integer space
     # See also: https://github.com/jqlang/jq/blob/859a8073ee8a21f2133154eea7c2bd5e0d60837f/tests/optional.test#L15-L18
     # "-D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64" would be preferrable, but breaks with dynamic linking,

From 6a56b38c1324b2a4cb755210ea9caa77fca88035 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 21 Jun 2026 09:48:15 +0200
Subject: [PATCH 0727/1209] python3Packages.fasthtml: 0.12.48 -> 0.13.3

.starlette upgrade in 83ece5c3a1e broke compatibility:
https://hydra.nixos.org/build/331250021/nixlog/6/tail

Upstream fixes that v0.13.0 and updating past 0.13.3 would need resolving
 - fastcore>=1.12.41 not satisfied by version 1.12.39
(which isn't great approach for stable 26.05 which motivates this commit)
https://github.com/AnswerDotAI/fasthtml/releases
---
 pkgs/development/python-modules/fasthtml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fasthtml/default.nix b/pkgs/development/python-modules/fasthtml/default.nix
index 3f47dd2ce5a7..12b9b77c0435 100644
--- a/pkgs/development/python-modules/fasthtml/default.nix
+++ b/pkgs/development/python-modules/fasthtml/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fasthtml";
-  version = "0.12.48";
+  version = "0.13.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AnswerDotAI";
     repo = "fasthtml";
     tag = finalAttrs.version;
-    hash = "sha256-lMAuIw4sMkS3XSG/0Bs0iQPSjMusbmjUKv0w4cINwas=";
+    hash = "sha256-PS5HGegC6pG/bJAGrKDsRYguBnNS9EDrZIjWvjErO4M=";
   };
 
   build-system = [

From 9482fd756772c8c9cc1b4c6844a73f2ed1e5f083 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:06:33 +0200
Subject: [PATCH 0728/1209] scribus: 1.7.2 -> 1.7.3

changelog: https://wiki.scribus.net/canvas/ChangeLog

Co-authored-by: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
---
 pkgs/by-name/sc/scribus/package.nix | 31 +++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sc/scribus/package.nix b/pkgs/by-name/sc/scribus/package.nix
index ea6dbf56309e..d8a55eb8e7d3 100644
--- a/pkgs/by-name/sc/scribus/package.nix
+++ b/pkgs/by-name/sc/scribus/package.nix
@@ -3,6 +3,7 @@
   cairo,
   cmake,
   cups,
+  fetchpatch,
   fetchurl,
   fontconfig,
   freetype,
@@ -39,11 +40,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "scribus";
 
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/scribus/scribus-devel/scribus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-nY4RzGusLNlsVTnvvXGSIv9/cOHBhZcogNn7MFHhONA=";
+    hash = "sha256-iC7lXKRJfALE4F8wrMaJ6h9IXC6AI8nrKT9RwsW+Bq0=";
   };
 
   nativeBuildInputs = [
@@ -96,6 +97,32 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [ (lib.cmakeBool "WANT_GRAPHICSMAGICK" true) ];
 
+  patches = [
+    (fetchpatch {
+      name = "fix-build-with-poppler-26.05.0.patch";
+      url = "https://github.com/scribusproject/scribus/commit/14a287fc1db2a44abfe1743260554447b31b4adf.patch";
+      hash = "sha256-bhxnyL5zWVCjkfkW67CPykLW/uqDP+n3djnRKGMyhjw=";
+    })
+    (fetchpatch {
+      # required for the next patch to apply cleanly
+      url = "https://github.com/scribusproject/scribus/commit/3aed8aa40d01d1affd2b55b107b48878d4b06eab.patch";
+      includes = [ "scribus/plugins/import/pdf/importpdf.cpp" ];
+      hash = "sha256-tiGXGW8CnG0Tj5YaimngelvNvO3CCSa5eXc3bSKJD54=";
+    })
+    (fetchpatch {
+      name = "fix-build-with-poppler-26.06.0.patch";
+      url = "https://github.com/scribusproject/scribus/commit/2b9405a00a96a09e0183190ddc9f83d44963d4e0.patch";
+      hash = "sha256-4v+Ba+JODwNg4YLmwpFeBfIxk1j+RcZdtznPFeQ+H+w=";
+    })
+  ];
+
+  postPatch = ''
+    # revert non-whitespace changes made by the second patch, i.e.,
+    # https://github.com/scribusproject/scribus/commit/3aed8aa40d01d1affd2b55b107b48878d4b06eab
+    substituteInPlace scribus/plugins/import/pdf/importpdf.cpp \
+      --replace-fail 'QSizeF()' '"Custom"'
+  '';
+
   preFixup = ''
     qtWrapperArgs+=(
       --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}"

From a638725eb90eabc13107a8f651c6f5625c83009e Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:06:58 +0200
Subject: [PATCH 0729/1209] inkscape: fix build with poppler 26.06.0

---
 .../graphics/inkscape/default.nix             |   8 +
 .../inkscape/fix-build-poppler-26.06.0.patch  | 487 ++++++++++++++++++
 2 files changed, 495 insertions(+)
 create mode 100644 pkgs/applications/graphics/inkscape/fix-build-poppler-26.06.0.patch

diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 7a5b12418a12..ccea323f700b 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -103,6 +103,14 @@ stdenv.mkDerivation (finalAttrs: {
       # Fix path to ps2pdf binary
       inherit ghostscript;
     })
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/7919
+    (fetchpatch {
+      name = "fix-build-poppler-26.05.0";
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/98828255aa0c1212329236b3ff4ac7f41efb4a67.patch";
+      hash = "sha256-ujUl0SxZyb/TyJRmq1ETNn5W8lDDNn3JqHQQQPU5klA=";
+    })
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/7968
+    ./fix-build-poppler-26.06.0.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/graphics/inkscape/fix-build-poppler-26.06.0.patch b/pkgs/applications/graphics/inkscape/fix-build-poppler-26.06.0.patch
new file mode 100644
index 000000000000..e9af942188db
--- /dev/null
+++ b/pkgs/applications/graphics/inkscape/fix-build-poppler-26.06.0.patch
@@ -0,0 +1,487 @@
+From 35a470d9cbff50467cc700bc17ab2c4e8f5cf0bc Mon Sep 17 00:00:00 2001
+From: KrIr17 <elendil.krir17@gmail.com>
+Date: Mon, 8 Jun 2026 20:16:32 +0200
+Subject: [PATCH] Fix Building with Poppler 26.06.0
+
+- pdfparser: Some `const PDFRectangle *` to `const PDFRectangle &` [1]
+- pdfparser: Some `const GfxColor *` to `const GfxColor &` [2]
+- pdf-utils: Add a `getRect(const PDFRectangle &)` alongside `getRect(const
+  PDFRectangle *)`
+- poppler-cairo-font-engine: `getKey()` now returns std::string and not
+  char[], so change `strcmp` to `std::string(...).compare(...)` [3]
+- poppler-utils: `obj->dictGetKey()` etc. were removed; use
+  `obj->dict()->getKey()` instead (these have also existed in poppler
+  since the beginning, so shouldn't break any old poppler) [4,5]
+- svg-builder: `convertGfxColor` now takes `const GfxColor &` as input.
+  A convenience function taking `const GfxColor *` (for older poppler)
+  now calls the new one after confirming `color` is a valid pointer
+- svg-builder: `_addStopToGradient` now  takes `const GfxColor &` as
+  input. This was used only in `convertGfxColor` and therefore doesn't
+  need a helper function for compatibility
+- testfiles pdf-utils-test: `<poppler/*.h>` to `<*.h>` (see e3eb1210)
+- testfiles pdf-utils-test: Some `const PDFRectangle *`
+  to `const PDFRectangle &` [1]
+
+Fixes https://gitlab.com/inkscape/inkscape/-/work_items/6210
+
+Upstream Commits:
+
+[1] https://gitlab.freedesktop.org/poppler/poppler/-/commit/d50a4510
+[2] https://gitlab.freedesktop.org/poppler/poppler/-/commit/0f94f530
+[3] https://gitlab.freedesktop.org/poppler/poppler/-/commit/a3de7f8a
+[4] https://gitlab.freedesktop.org/poppler/poppler/-/commit/bb13b0f5
+[5] https://gitlab.freedesktop.org/poppler/poppler/-/commit/8ae0f8e7
+---
+ src/extension/internal/pdfinput/pdf-input.cpp | 14 +++++-
+ .../internal/pdfinput/pdf-parser.cpp          | 45 ++++++++++---------
+ src/extension/internal/pdfinput/pdf-parser.h  |  4 +-
+ src/extension/internal/pdfinput/pdf-utils.cpp |  5 +++
+ src/extension/internal/pdfinput/pdf-utils.h   |  1 +
+ .../pdfinput/poppler-cairo-font-engine.cpp    |  2 +-
+ .../pdfinput/poppler-transition-api.h         | 16 +++++++
+ .../internal/pdfinput/poppler-utils.cpp       | 20 +++++----
+ .../internal/pdfinput/svg-builder.cpp         | 36 +++++++++------
+ src/extension/internal/pdfinput/svg-builder.h |  3 +-
+ testfiles/src/pdf-utils-test.cpp              |  7 +--
+ 11 files changed, 100 insertions(+), 53 deletions(-)
+
+diff --git a/src/extension/internal/pdfinput/pdf-input.cpp b/src/extension/internal/pdfinput/pdf-input.cpp
+index aa4285b01d..dc5394c3d8 100644
+--- a/src/extension/internal/pdfinput/pdf-input.cpp
++++ b/src/extension/internal/pdfinput/pdf-input.cpp
+@@ -820,7 +820,11 @@ PdfInput::add_builder_page(std::shared_ptr<PDFDoc>pdf_doc, SvgBuilder *builder,
+     }
+ 
+     // Apply crop settings
++#if POPPLER_CHECK_VERSION(26, 2, 0)
++    std::optional<PDFRectangle> clipToBox;
++#else
+     _POPPLER_CONST PDFRectangle *clipToBox = nullptr;
++#endif
+ 
+     if (crop_to == "media-box") {
+         clipToBox = page->getMediaBox();
+@@ -834,8 +838,16 @@ PdfInput::add_builder_page(std::shared_ptr<PDFDoc>pdf_doc, SvgBuilder *builder,
+         clipToBox = page->getArtBox();
+     }
+ 
++    std::optional<PDFRectangle> cropBox;
++#if POPPLER_CHECK_VERSION(26, 2, 0)
++    cropBox = clipToBox;
++#else
++    if (clipToBox) {
++        cropBox = *clipToBox;
++    }
++#endif
+     // Create parser  (extension/internal/pdfinput/pdf-parser.h)
+-    auto pdf_parser = PdfParser(pdf_doc, builder, page, clipToBox);
++    auto pdf_parser = PdfParser(pdf_doc, builder, page, cropBox);
+ 
+     // Set up approximation precision for parser. Used for converting Mesh Gradients into tiles.
+     if ( color_delta <= 0.0 ) {
+diff --git a/src/extension/internal/pdfinput/pdf-parser.cpp b/src/extension/internal/pdfinput/pdf-parser.cpp
+index b336c48ce3..86fc51b1f2 100644
+--- a/src/extension/internal/pdfinput/pdf-parser.cpp
++++ b/src/extension/internal/pdfinput/pdf-parser.cpp
+@@ -43,6 +43,7 @@
+ #include <poppler/GlobalParams.h>
+ #include <poppler/Lexer.h>
+ #include <poppler/Object.h>
++#include <poppler/OptionalContent.h>
+ #include <poppler/OutputDev.h>
+ #include <poppler/PDFDoc.h>
+ #include <poppler/Page.h>
+@@ -264,7 +265,7 @@ GfxPatch blankPatch()
+ //------------------------------------------------------------------------
+ 
+ PdfParser::PdfParser(std::shared_ptr<PDFDoc> pdf_doc, Inkscape::Extension::Internal::SvgBuilder *builderA, Page *page,
+-                     _POPPLER_CONST PDFRectangle *cropBox)
++                     const std::optional<PDFRectangle> &cropBox)
+     : _pdf_doc(pdf_doc)
+     , xref(pdf_doc->getXRef())
+     , builder(builderA)
+@@ -307,8 +308,8 @@ PdfParser::PdfParser(std::shared_ptr<PDFDoc> pdf_doc, Inkscape::Extension::Inter
+     builder->setMargins(getRect(page->getTrimBox()) * scale,
+                         getRect(page->getArtBox()) * scale,
+                         getRect(page->getBleedBox()) * scale);
+-    if (cropBox && getRect(cropBox) != page_box) {
+-        builder->cropPage(getRect(cropBox) * scale);
++     if (cropBox && getRect(*cropBox) != page_box) {
++         builder->cropPage(getRect(*cropBox) * scale);
+     }
+ 
+     saveState();
+@@ -331,7 +332,7 @@ PdfParser::PdfParser(XRef *xrefA, Inkscape::Extension::Internal::SvgBuilder *bui
+     , printCommands(false)
+     , res(new GfxResources(xref, resDict, nullptr))
+     , // start the resource stack
+-    state(new GfxState(72, 72, box, 0, false))
++    state(new _POPPLER_GFX_STATE(72, 72, *box, 0, false))
+     , fontChanged(gFalse)
+     , clip(clipNone)
+     , ignoreUndef(0)
+@@ -964,7 +965,7 @@ void PdfParser::opSetFillGray(Object args[], int /*numArgs*/)
+   state->setFillPattern(nullptr);
+   state->setFillColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(std::make_unique<GfxDeviceGrayColorSpace>()));
+   color.c[0] = dblToCol(args[0].getNum());
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -976,7 +977,7 @@ void PdfParser::opSetStrokeGray(Object args[], int /*numArgs*/)
+   state->setStrokePattern(nullptr);
+   state->setStrokeColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(std::make_unique<GfxDeviceGrayColorSpace>()));
+   color.c[0] = dblToCol(args[0].getNum());
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -991,7 +992,7 @@ void PdfParser::opSetFillCMYKColor(Object args[], int /*numArgs*/)
+   for (i = 0; i < 4; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1005,7 +1006,7 @@ void PdfParser::opSetStrokeCMYKColor(Object args[], int /*numArgs*/)
+   for (int i = 0; i < 4; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1019,7 +1020,7 @@ void PdfParser::opSetFillRGBColor(Object args[], int /*numArgs*/)
+   for (int i = 0; i < 3; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1032,7 +1033,7 @@ void PdfParser::opSetStrokeRGBColor(Object args[], int /*numArgs*/) {
+   for (int i = 0; i < 3; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1048,7 +1049,7 @@ void PdfParser::opSetFillColorSpace(Object args[], int numArgs)
+     GfxColor color;
+     colorSpace->getDefaultColor(&color);
+     state->setFillColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(colorSpace));
+-    state->setFillColor(&color);
++    state->_POPPLER_SET_FILL_COLOR(color);
+     builder->updateStyle(state);
+   } else {
+     error(errSyntaxError, getPos(), "Bad color space (fill)");
+@@ -1069,7 +1070,7 @@ void PdfParser::opSetStrokeColorSpace(Object args[], int numArgs)
+     GfxColor color;
+     colorSpace->getDefaultColor(&color);
+     state->setStrokeColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(colorSpace));
+-    state->setStrokeColor(&color);
++    state->_POPPLER_SET_STROKE_COLOR(color);
+     builder->updateStyle(state);
+   } else {
+     error(errSyntaxError, getPos(), "Bad color space (stroke)");
+@@ -1089,7 +1090,7 @@ void PdfParser::opSetFillColor(Object args[], int numArgs) {
+   for (i = 0; i < numArgs; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1106,7 +1107,7 @@ void PdfParser::opSetStrokeColor(Object args[], int numArgs) {
+   for (i = 0; i < numArgs; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1127,7 +1128,7 @@ void PdfParser::opSetFillColorN(Object args[], int numArgs) {
+ 	  color.c[i] = dblToCol(args[i].getNum());
+ 	}
+       }
+-      state->setFillColor(&color);
++      state->_POPPLER_SET_FILL_COLOR(color);
+       builder->updateStyle(state);
+     }
+     if (auto pattern = lookupPattern(&(args[numArgs - 1]), state)) {
+@@ -1146,7 +1147,7 @@ void PdfParser::opSetFillColorN(Object args[], int numArgs) {
+ 	color.c[i] = dblToCol(args[i].getNum());
+       }
+     }
+-    state->setFillColor(&color);
++    state->_POPPLER_SET_FILL_COLOR(color);
+     builder->updateStyle(state);
+   }
+ }
+@@ -1170,7 +1171,7 @@ void PdfParser::opSetStrokeColorN(Object args[], int numArgs) {
+ 	  color.c[i] = dblToCol(args[i].getNum());
+ 	}
+       }
+-      state->setStrokeColor(&color);
++      state->_POPPLER_SET_STROKE_COLOR(color);
+       builder->updateStyle(state);
+     }
+     if (auto pattern = lookupPattern(&(args[numArgs - 1]), state)) {
+@@ -1189,7 +1190,7 @@ void PdfParser::opSetStrokeColorN(Object args[], int numArgs) {
+ 	color.c[i] = dblToCol(args[i].getNum());
+       }
+     }
+-    state->setStrokeColor(&color);
++    state->_POPPLER_SET_STROKE_COLOR(color);
+     builder->updateStyle(state);
+   }
+ }
+@@ -1673,7 +1674,7 @@ void PdfParser::doFunctionShFill1(GfxFunctionShading *shading,
+ 
+     // use the center color
+     shading->getColor(xM, yM, &fillColor);
+-    state->setFillColor(&fillColor);
++    state->_POPPLER_SET_FILL_COLOR(fillColor);
+ 
+     // fill the rectangle
+     state->moveTo(x0 * matrix[0] + y0 * matrix[2] + matrix[4],
+@@ -1799,7 +1800,7 @@ void PdfParser::gouraudFillTriangle(double x0, double y0, GfxColor *color0,
+     }
+   }
+   if (i == nComps || depth == maxDepths[pdfGouraudTriangleShading-1]) {
+-    state->setFillColor(color0);
++    state->_POPPLER_SET_FILL_COLOR(*color0);
+     state->moveTo(x0, y0);
+     state->lineTo(x1, y1);
+     state->lineTo(x2, y2);
+@@ -1877,7 +1878,7 @@ void PdfParser::fillPatch(_POPPLER_CONST GfxPatch *patch, int nComps, int depth)
+     color.c[i] = GfxColorComp(patch->color[0][0].c[i]);
+   }
+   if (i == nComps || depth == maxDepths[pdfPatchMeshShading-1]) {
+-    state->setFillColor(&color);
++    state->_POPPLER_SET_FILL_COLOR(color);
+     state->moveTo(patch->x[0][0], patch->y[0][0]);
+     state->curveTo(patch->x[0][1], patch->y[0][1],
+                   patch->x[0][2], patch->y[0][2],
+diff --git a/src/extension/internal/pdfinput/pdf-parser.h b/src/extension/internal/pdfinput/pdf-parser.h
+index 098ff26e26..29dd259167 100644
+--- a/src/extension/internal/pdfinput/pdf-parser.h
++++ b/src/extension/internal/pdfinput/pdf-parser.h
+@@ -113,8 +113,8 @@ struct OpHistoryEntry {
+ class PdfParser {
+ public:
+ 
+-  // Constructor for regular output.
+-    PdfParser(std::shared_ptr<PDFDoc> pdf_doc, SvgBuilder *builderA, Page *page, _POPPLER_CONST PDFRectangle *cropBox);
++    // Constructor for regular output.
++    PdfParser(std::shared_ptr<PDFDoc> pdf_doc, SvgBuilder *builderA, Page *page, const std::optional<PDFRectangle> &cropBox);
+     // Constructor for a sub-page object.
+     PdfParser(XRef *xrefA, SvgBuilder *builderA, Dict *resDict, _POPPLER_CONST PDFRectangle *box);
+ 
+diff --git a/src/extension/internal/pdfinput/pdf-utils.cpp b/src/extension/internal/pdfinput/pdf-utils.cpp
+index 22e5df62c8..3aa6c02d3c 100644
+--- a/src/extension/internal/pdfinput/pdf-utils.cpp
++++ b/src/extension/internal/pdfinput/pdf-utils.cpp
+@@ -133,6 +133,11 @@ Geom::Rect getRect(_POPPLER_CONST PDFRectangle *box)
+     return Geom::Rect(box->x1, box->y1, box->x2, box->y2);
+ }
+ 
++Geom::Rect getRect(const PDFRectangle &box)
++{
++    return Geom::Rect(box.x1, box.y1, box.x2, box.y2);
++}
++
+ Geom::PathVector getPathV(GfxPath *path) 
+ {
+     if (!path) {
+diff --git a/src/extension/internal/pdfinput/pdf-utils.h b/src/extension/internal/pdfinput/pdf-utils.h
+index d259a8c2f7..30e9b5bf86 100644
+--- a/src/extension/internal/pdfinput/pdf-utils.h
++++ b/src/extension/internal/pdfinput/pdf-utils.h
+@@ -59,6 +59,7 @@ private:
+ };
+ 
+ Geom::Rect getRect(_POPPLER_CONST PDFRectangle *box);
++Geom::Rect getRect(_POPPLER_CONST PDFRectangle &box);
+ Geom::PathVector getPathV(GfxPath *gPath);
+ 
+ #endif /* PDF_UTILS_H */
+diff --git a/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp b/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp
+index 19ebd26693..39ce22af38 100644
+--- a/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp
++++ b/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp
+@@ -713,7 +713,7 @@ CairoType3Font *CairoType3Font::create(GfxFont *gfxFont, PDFDoc *doc, CairoFontE
+         codeToGID[i] = 0;
+         if (charProcs && (name = enc[i])) {
+             for (int j = 0; j < charProcs->getLength(); j++) {
+-                if (strcmp(name, charProcs->getKey(j)) == 0) {
++                if (std::string(charProcs->getKey(j)).compare(name) == 0) {
+                     codeToGID[i] = j;
+                 }
+             }
+diff --git a/src/extension/internal/pdfinput/poppler-transition-api.h b/src/extension/internal/pdfinput/poppler-transition-api.h
+index d69829d512..23550a3068 100644
+--- a/src/extension/internal/pdfinput/poppler-transition-api.h
++++ b/src/extension/internal/pdfinput/poppler-transition-api.h
+@@ -15,6 +15,22 @@
+ #include <glib/poppler-features.h>
+ #include <UTF.h>
+ 
++#if POPPLER_CHECK_VERSION(26, 6, 0)
++#define _POPPLER_GET_GRAY(color, gray) getGray(color, gray)
++#define _POPPLER_GET_RGB(color, rgb) getRGB(color, rgb)
++#define _POPPLER_GET_CMYK(color, cmyk) getCMYK(color, cmyk)
++#define _POPPLER_SET_FILL_COLOR(color) setFillColor(color)
++#define _POPPLER_SET_STROKE_COLOR(color) setStrokeColor(color)
++#define _POPPLER_GFX_STATE(h, v, Rect, rotateA, upsideDown) GfxState(h, v, Rect, rotateA, upsideDown)
++#else
++#define _POPPLER_GET_GRAY(color, gray) getGray(&color, gray)
++#define _POPPLER_GET_RGB(color, rgb) getRGB(&color, rgb)
++#define _POPPLER_GET_CMYK(color, cmyk) getCMYK(&color, cmyk)
++#define _POPPLER_SET_FILL_COLOR(color) setFillColor(&color)
++#define _POPPLER_SET_STROKE_COLOR(color) setStrokeColor(&color)
++#define _POPPLER_GFX_STATE(h, v, Rect, rotateA, upsideDown) GfxState(h, v, &Rect, rotateA, upsideDown)
++#endif
++
+ #if POPPLER_CHECK_VERSION(26, 2, 0)
+ #define _POPPLER_WMODE GfxFont::WritingMode
+ #define _POPPLER_WMODE_HORIZONTAL GfxFont::WritingMode::Horizontal
+diff --git a/src/extension/internal/pdfinput/poppler-utils.cpp b/src/extension/internal/pdfinput/poppler-utils.cpp
+index 2338dbe2d9..66dcf85e1d 100644
+--- a/src/extension/internal/pdfinput/poppler-utils.cpp
++++ b/src/extension/internal/pdfinput/poppler-utils.cpp
+@@ -196,15 +196,17 @@ void InkFontDict::hashFontObject1(const Object *obj, FNVHash *h)
+                 hashFontObject1(&obj2, h);
+             }
+             break;
+-        case objDict:
+-            h->hash('d');
+-            n = obj->dictGetLength();
+-            h->hash((char *)&n, sizeof(int));
+-            for (i = 0; i < n; ++i) {
+-                p = obj->dictGetKey(i);
+-                h->hash(p, (int)strlen(p));
+-                const Object &obj2 = obj->dictGetValNF(i);
+-                hashFontObject1(&obj2, h);
++        case objDict: {
++                h->hash('d');
++                auto objdict = obj->getDict();
++                n = objdict->getLength();
++                h->hash((char *)&n, sizeof(int));
++                for (i = 0; i < n; ++i) {
++                    auto p = std::string(objdict->getKey(i));
++                    h->hash(p.c_str(), p.length());
++                    const Object &obj2 = objdict->getValNF(i);
++                    hashFontObject1(&obj2, h);
++                }
+             }
+             break;
+         case objStream:
+diff --git a/src/extension/internal/pdfinput/svg-builder.cpp b/src/extension/internal/pdfinput/svg-builder.cpp
+index 3dfdfbbed4..bf7ccf1a8b 100644
+--- a/src/extension/internal/pdfinput/svg-builder.cpp
++++ b/src/extension/internal/pdfinput/svg-builder.cpp
+@@ -392,7 +392,15 @@ static std::string svgConvertGfxRGB(GfxRGB *color)
+     return svgConvertRGBToText(r, g, b);
+ }
+ 
+-std::string SvgBuilder::convertGfxColor(const GfxColor *color, GfxColorSpace *space)
++// for poppler < 26.06.0
++std::string SvgBuilder::convertGfxColor(const GfxColor *color, GfxColorSpace *space) {
++    if (!color) {
++        return "";
++    }
++    return convertGfxColor(*color, space);
++}
++
++std::string SvgBuilder::convertGfxColor(const GfxColor &color, GfxColorSpace *space)
+ {
+     std::string icc = "";
+     switch (space->getMode()) {
+@@ -419,7 +427,7 @@ std::string SvgBuilder::convertGfxColor(const GfxColor *color, GfxColorSpace *sp
+         Inkscape::CSSOStringStream icc_color;
+         icc_color << rgb_color << " icc-color(" << icc;
+         for (int i = 0; i < space->getNComps(); ++i) {
+-            icc_color << ", " << colToDbl((*color).c[i]);
++            icc_color << ", " << colToDbl((color).c[i]);
+         }
+         icc_color << ");";
+         return icc_color.str();
+@@ -1204,7 +1212,7 @@ gchar *SvgBuilder::_createGradient(GfxShading *shading, const Geom::Affine pat_m
+ /**
+  * \brief Adds a stop with the given properties to the gradient's representation
+  */
+-void SvgBuilder::_addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor *color, GfxColorSpace *space,
++void SvgBuilder::_addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor &color, GfxColorSpace *space,
+                                     double opacity)
+ {
+     Inkscape::XML::Node *stop = _xml_doc->createElement("svg:stop");
+@@ -1255,8 +1263,8 @@ bool SvgBuilder::_addGradientStops(Inkscape::XML::Node *gradient, GfxShading *sh
+         if (!svgGetShadingColor(shading, 0.0, &stop1) || !svgGetShadingColor(shading, 1.0, &stop2)) {
+             return false;
+         } else {
+-            _addStopToGradient(gradient, 0.0, &stop1, space, 1.0);
+-            _addStopToGradient(gradient, 1.0, &stop2, space, 1.0);
++            _addStopToGradient(gradient, 0.0, stop1, space, 1.0);
++            _addStopToGradient(gradient, 1.0, stop2, space, 1.0);
+         }
+     } else if (type == _POPPLER_FUNCTION_TYPE_STITCHING) {
+         auto stitchingFunc = static_cast<_POPPLER_CONST StitchingFunction*>(func);
+@@ -1269,7 +1277,7 @@ bool SvgBuilder::_addGradientStops(Inkscape::XML::Node *gradient, GfxShading *sh
+         // Add stops from all the stitched functions
+         GfxColor prev_color, color;
+         svgGetShadingColor(shading, bounds[0], &prev_color);
+-        _addStopToGradient(gradient, bounds[0], &prev_color, space, 1.0);
++        _addStopToGradient(gradient, bounds[0], prev_color, space, 1.0);
+         for ( int i = 0 ; i < num_funcs ; i++ ) {
+             svgGetShadingColor(shading, bounds[i + 1], &color);
+             // Add stops
+@@ -1279,14 +1287,14 @@ bool SvgBuilder::_addGradientStops(Inkscape::XML::Node *gradient, GfxShading *sh
+                     expE = (bounds[i + 1] - bounds[i])/expE;    // approximate exponential as a single straight line at x=1
+                     if (encode[2*i] == 0) {    // normal sequence
+                         auto offset = (bounds[i + 1] - expE) / max_bound;
+-                        _addStopToGradient(gradient, offset, &prev_color, space, 1.0);
++                        _addStopToGradient(gradient, offset, prev_color, space, 1.0);
+                     } else {                   // reflected sequence
+                         auto offset = (bounds[i] + expE) / max_bound;
+-                        _addStopToGradient(gradient, offset, &color, space, 1.0);
++                        _addStopToGradient(gradient, offset, color, space, 1.0);
+                     }
+                 }
+             }
+-            _addStopToGradient(gradient, bounds[i + 1] / max_bound, &color, space, 1.0);
++            _addStopToGradient(gradient, bounds[i + 1] / max_bound, color, space, 1.0);
+             prev_color = color;
+         }
+     } else { // Unsupported function type
+diff --git a/src/extension/internal/pdfinput/svg-builder.h b/src/extension/internal/pdfinput/svg-builder.h
+index c4b217f58e..348f3a2ce3 100644
+--- a/src/extension/internal/pdfinput/svg-builder.h
++++ b/src/extension/internal/pdfinput/svg-builder.h
+@@ -186,7 +186,7 @@ private:
+     // Pattern creation
+     gchar *_createPattern(GfxPattern *pattern, GfxState *state, bool is_stroke=false);
+     gchar *_createGradient(GfxShading *shading, const Geom::Affine pat_matrix, bool for_shading = false);
+-    void _addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor *color, GfxColorSpace *space,
++    void _addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor &color, GfxColorSpace *space,
+                             double opacity);
+     bool _addGradientStops(Inkscape::XML::Node *gradient, GfxShading *shading,
+                            _POPPLER_CONST Function *func);
+@@ -239,6 +239,7 @@ private:
+     static bool _attrEqual(Inkscape::XML::Node *a, Inkscape::XML::Node *b, char const *attr);
+ 
+     // Colors
++    std::string convertGfxColor(const GfxColor &color, GfxColorSpace *space);
+     std::string convertGfxColor(const GfxColor *color, GfxColorSpace *space);
+     std::string _getColorProfile(cmsHPROFILE hp);
+ 

From a2e1ce512230df392b976cb54941c11a722fc645 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:08:00 +0200
Subject: [PATCH 0730/1209] libreoffice: fix build with poppler 26.06.0

---
 .../office/libreoffice/default.nix            | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 75880b33f528..74eeadee0ef3 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -397,6 +397,34 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Don't detect Qt paths from qmake, so our patched-in onese are used
     ./dont-detect-qt-paths-from-qmake.patch
+
+    # Fix build with Poppler 26.02
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.02.0.patch";
+      hash = "sha256-IInhSoqTemDITB+AtkvVa9eGbodTbUGSpMMpC9N/mmg=";
+    })
+    # Fix build with Poppler 26.04
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.04.0.patch";
+      hash = "sha256-I9owj/NTCTi6ISszuasH410NLlhunPn/Ig22tenu8tw=";
+    })
+    # Fix build with Poppler 26.05
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.05.0.patch";
+      hash = "sha256-7wdiciTf/LrTk0MibBBYGliWRCvK1rtTGESgH7db1I4=";
+    })
+    # Fix build with Poppler 26.06
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-3/fix_build_with_poppler_26.06.0.patch";
+      hash = "sha256-j66IsrzaqQ55MRVzhlw25guuoDtxx1D4XeJsBhgWP2c=";
+    })
+  ]
+  ++ lib.optionals (variant != "fresh") [
+    # Fix build with Poppler 26.01
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.01.0.patch";
+      hash = "sha256-5JTTvJFIV5MG0Gz7y46wAr3q9tWdSVoZ9TJQlMJVqBc=";
+    })
   ]
   ++ lib.optionals (variant != "collabora" && variant != "collabora-coda") [
     # Revert part of https://github.com/LibreOffice/core/commit/6f60670877208612b5ea320b3677480ef6508abb that broke zlib linking

From 356c27549af413b6a5cf842a9b133d09868ad980 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:08:40 +0200
Subject: [PATCH 0731/1209] kdePackages.calligra: fix build with poppler
 26.04.0

---
 pkgs/kde/gear/calligra/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/kde/gear/calligra/default.nix b/pkgs/kde/gear/calligra/default.nix
index 4e816b99551e..cbd17e8fc688 100644
--- a/pkgs/kde/gear/calligra/default.nix
+++ b/pkgs/kde/gear/calligra/default.nix
@@ -1,6 +1,7 @@
 {
   mkKdeDerivation,
   lib,
+  fetchpatch,
   boost,
   eigen,
   gsl,
@@ -26,6 +27,14 @@
 mkKdeDerivation {
   pname = "calligra";
 
+  patches = [
+    # Fix build with Poppler 26.04
+    (fetchpatch {
+      url = "https://invent.kde.org/office/calligra/-/commit/e9aae90db47ca87d639b8f2b17ec75c1b6093e27.patch";
+      hash = "sha256-V21Bw0xV/E4a9v8Yrt0vZ3AU1LJFHul1k92u+nsp85I=";
+    })
+  ];
+
   extraBuildInputs = [
     boost
     eigen

From a18a24775c6999cc49a766ebf5f04bcdb7953e1c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jun 2026 09:31:25 -0700
Subject: [PATCH 0732/1209] python3Packages.pyturbojpeg: 2.2.0 -> 2.3.0

Diff: https://github.com/lilohuang/PyTurboJPEG/compare/v2.2.0...v2.3.0

Changelog: https://github.com/lilohuang/PyTurboJPEG/releases/tag/v2.3.0
---
 pkgs/development/python-modules/pyturbojpeg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyturbojpeg/default.nix b/pkgs/development/python-modules/pyturbojpeg/default.nix
index 05d24e31f8d4..f6aa0ba577f3 100644
--- a/pkgs/development/python-modules/pyturbojpeg/default.nix
+++ b/pkgs/development/python-modules/pyturbojpeg/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyturbojpeg";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lilohuang";
     repo = "PyTurboJPEG";
     tag = "v${version}";
-    hash = "sha256-Sue8S/2/dY3aF7fihHuqpHXotcXcijcqAXGCJn8Z5VE=";
+    hash = "sha256-rMn5NmiwKhyj4U9kyyRf9ZheVnETpixZoL/AVlBlImQ=";
   };
 
   patches = [

From c6adddfbc2c8de7336cbf9f2b6e3daf5433600cd Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:36:03 +0000
Subject: [PATCH 0733/1209] lib/systems/flake-systems: drop `x86_64-darwin`

---
 flake.nix                     | 30 +++++++++++++++++++-----------
 lib/systems/flake-systems.nix |  1 -
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/flake.nix b/flake.nix
index b8e348845bc8..6c3321e8c7fe 100644
--- a/flake.nix
+++ b/flake.nix
@@ -220,17 +220,25 @@
         evaluation. Evaluating the attribute value tends to require a significant
         amount of computation, even considering lazy evaluation.
       */
-      legacyPackages = forAllSystems (
-        system:
-        (import ./. {
-          inherit system;
-          overlays = import ./pkgs/top-level/impure-overlays.nix ++ [
-            (final: prev: {
-              lib = prev.lib.extend libVersionInfoOverlay;
-            })
-          ];
-        })
-      );
+      legacyPackages =
+        let
+          # We include `x86_64-darwin` here to ensure that users get a
+          # good error message for the 26.11 deprecation of the platform,
+          # while excluding it from `lib.systems.flakeExposed` so that we
+          # don’t break `nix flake check` for downstream users.
+          forAllSystems' = lib.genAttrs (lib.systems.flakeExposed ++ [ "x86_64-darwin" ]);
+        in
+        forAllSystems' (
+          system:
+          (import ./. {
+            inherit system;
+            overlays = import ./pkgs/top-level/impure-overlays.nix ++ [
+              (final: prev: {
+                lib = prev.lib.extend libVersionInfoOverlay;
+              })
+            ];
+          })
+        );
 
       /**
         Optional modules that can be imported into a NixOS configuration.
diff --git a/lib/systems/flake-systems.nix b/lib/systems/flake-systems.nix
index 851dc1af7181..1589ff23baa4 100644
--- a/lib/systems/flake-systems.nix
+++ b/lib/systems/flake-systems.nix
@@ -11,7 +11,6 @@
   "x86_64-linux"
   # Tier 2
   "aarch64-linux"
-  "x86_64-darwin"
   # Tier 3
   "armv6l-linux"
   "armv7l-linux"

From 45dd7d3fb24b79355670982f665d1da7778135d8 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 02:25:26 +0000
Subject: [PATCH 0734/1209] release: stop building for `x86_64-darwin`

---
 doc/preface.chapter.md                        |  2 +-
 doc/using/platform-support.chapter.md         |  5 +-
 .../nixpkgs-basic-release-checks.nix          |  6 +-
 pkgs/top-level/release-haskell.nix            |  5 +-
 pkgs/top-level/release-supported-systems.json |  3 +-
 pkgs/top-level/release.nix                    | 88 +++----------------
 6 files changed, 18 insertions(+), 91 deletions(-)

diff --git a/doc/preface.chapter.md b/doc/preface.chapter.md
index a4ff07bf5a63..30722e9fcdaa 100644
--- a/doc/preface.chapter.md
+++ b/doc/preface.chapter.md
@@ -42,7 +42,7 @@ shows the status of tests for the `nixpkgs-unstable` channel.
 
 The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
 which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
+`x86_64-linux`, `aarch64-linux`, and `aarch64-darwin`.
 The binaries are made available via a [binary cache](https://cache.nixos.org).
 
 The current Nix expressions of the channels are available in the
diff --git a/doc/using/platform-support.chapter.md b/doc/using/platform-support.chapter.md
index d5a985c90d35..061c1b128d42 100644
--- a/doc/using/platform-support.chapter.md
+++ b/doc/using/platform-support.chapter.md
@@ -29,8 +29,7 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 | `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
 | `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
 | `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌\*                     |
-| `x86_64-apple-darwin`                 | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌\*                     |
+| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌                       |
 | `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
 | `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None | ❌             | ❌             | ❌                  | ✔️                      |
 | `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
@@ -45,5 +44,3 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 | `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
 | `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
 | `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-
-\* - Cross compiling is only supported on Darwin hosts.
diff --git a/pkgs/top-level/nixpkgs-basic-release-checks.nix b/pkgs/top-level/nixpkgs-basic-release-checks.nix
index 1c7e60655985..b12f121f2ae8 100644
--- a/pkgs/top-level/nixpkgs-basic-release-checks.nix
+++ b/pkgs/top-level/nixpkgs-basic-release-checks.nix
@@ -56,7 +56,7 @@ pkgs.runCommand "nixpkgs-release-checks"
           set -x
           nix-env -f $src \
               --show-trace --argstr system "$platform" \
-              --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+              --arg config '{ allowAliases = false; }' \
               --option lint-url-literals fatal \
               -qa --drv-path --system-filter \* --system \
               "''${opts[@]}" 2> eval-warnings.log > packages1
@@ -72,7 +72,7 @@ pkgs.runCommand "nixpkgs-release-checks"
 
         nix-env -f $src2 \
             --show-trace --argstr system "$platform" \
-            --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+            --arg config '{ allowAliases = false; }' \
             --option lint-url-literals fatal \
             -qa --drv-path --system-filter \* --system \
             "''${opts[@]}" > packages2
@@ -95,7 +95,7 @@ pkgs.runCommand "nixpkgs-release-checks"
 
         nix-env -f $src \
             --show-trace --argstr system "$platform" \
-            --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+            --arg config '{ allowAliases = false; }' \
             --option lint-url-literals fatal \
             -qa --drv-path --system-filter \* --system --meta --xml \
             "''${opts[@]}" > /dev/null
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 6ed29a18e494..847843a8e307 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -192,7 +192,7 @@ let
   #   -> [a]  -- list of elements from which to remove
   #   -> [a]
   #
-  # > removeMany ["aarch64-linux" "x86_64-darwin"] ["aarch64-linux" "x86_64-darwin" "x86_64-linux"]
+  # > removeMany ["aarch64-linux" "aarch64-darwin"] ["aarch64-linux" "aarch64-darwin" "x86_64-linux"]
   # ["x86_64-linux"]
   removeMany = itemsToRemove: list: lib.foldr lib.remove list itemsToRemove;
 
@@ -373,7 +373,6 @@ let
             "aarch64-linux"
 
             # musl only supports linux, not darwin.
-            "x86_64-darwin"
             "aarch64-darwin"
           ]
           {
@@ -401,7 +400,6 @@ let
             "aarch64-linux" # times out on Hydra
 
             # Static doesn't work on darwin
-            "x86_64-darwin"
             "aarch64-darwin"
           ]
           {
@@ -500,7 +498,6 @@ let
               # Testing cross from x86_64-linux
               "aarch64-darwin"
               "aarch64-linux"
-              "x86_64-darwin"
             ]
             {
               haskellPackages = {
diff --git a/pkgs/top-level/release-supported-systems.json b/pkgs/top-level/release-supported-systems.json
index 44c18f1abf0e..8746d3955ce6 100644
--- a/pkgs/top-level/release-supported-systems.json
+++ b/pkgs/top-level/release-supported-systems.json
@@ -1,6 +1,5 @@
 [
   "aarch64-linux",
   "aarch64-darwin",
-  "x86_64-linux",
-  "x86_64-darwin"
+  "x86_64-linux"
 ]
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index c8b59f37e0ae..65c5490592e9 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -26,7 +26,6 @@
     "aarch64-unknown-linux-gnu"
     "aarch64-unknown-linux-musl"
     "i686-unknown-linux-gnu"
-    "x86_64-apple-darwin"
     "x86_64-unknown-linux-gnu"
     "x86_64-unknown-linux-musl"
     # we can uncomment that once our bootstrap tarballs are fixed
@@ -90,10 +89,7 @@ let
 
   inherit (release-lib.lib.attrsets) unionOfDisjoint;
 
-  supportDarwin = genAttrs [
-    "x86_64"
-    "aarch64"
-  ] (arch: elem "${arch}-darwin" supportedSystems);
+  supportDarwin = elem "aarch64-darwin" supportedSystems;
 
   nonPackageJobs = {
     tarball = import ./make-tarball.nix {
@@ -112,7 +108,7 @@ let
     metrics = import ./metrics.nix { inherit pkgs nixpkgs; };
 
     darwin-tested =
-      if supportDarwin.x86_64 || supportDarwin.aarch64 then
+      if supportDarwin then
         pkgs.releaseTools.aggregate {
           name = "nixpkgs-darwin-${jobs.tarball.version}";
           meta.description = "Release-critical builds for the Nixpkgs darwin channel";
@@ -120,49 +116,7 @@ let
             jobs.tarball
             jobs.release-checks
           ]
-          ++ optionals supportDarwin.x86_64 [
-            jobs.cabal2nix.x86_64-darwin
-            jobs.ghc.x86_64-darwin
-            jobs.git.x86_64-darwin
-            jobs.go.x86_64-darwin
-            jobs.mariadb.x86_64-darwin
-            jobs.nix.x86_64-darwin
-            jobs.nixpkgs-review.x86_64-darwin
-            jobs.nix-info.x86_64-darwin
-            jobs.nix-info-tested.x86_64-darwin
-            jobs.openssh.x86_64-darwin
-            jobs.openssl.x86_64-darwin
-            jobs.pandoc.x86_64-darwin
-            jobs.postgresql.x86_64-darwin
-            jobs.python3.x86_64-darwin
-            jobs.ruby.x86_64-darwin
-            jobs.rustc.x86_64-darwin
-            # blocking ofBorg CI 2020-02-28
-            # jobs.stack.x86_64-darwin
-            jobs.stdenv.x86_64-darwin
-            jobs.vim.x86_64-darwin
-            jobs.cachix.x86_64-darwin
-            jobs.darwin.linux-builder.x86_64-darwin
-
-            # UI apps
-            # jobs.firefox-unwrapped.x86_64-darwin
-            jobs.qt5.qtmultimedia.x86_64-darwin
-            jobs.inkscape.x86_64-darwin
-            jobs.gimp2.x86_64-darwin # FIXME replace with gimp once https://github.com/NixOS/nixpkgs/issues/411189 is resoved
-            jobs.emacs.x86_64-darwin
-            jobs.wireshark.x86_64-darwin
-
-            # Tests
-            /*
-              jobs.tests.cc-wrapper.default.x86_64-darwin
-              jobs.tests.cc-wrapper.llvmPackages.clang.x86_64-darwin
-              jobs.tests.cc-wrapper.llvmPackages.libcxx.x86_64-darwin
-              jobs.tests.stdenv-inputs.x86_64-darwin
-              jobs.tests.macOSSierraShared.x86_64-darwin
-              jobs.tests.stdenv.hooks.patch-shebangs.x86_64-darwin
-            */
-          ]
-          ++ optionals supportDarwin.aarch64 [
+          ++ optionals supportDarwin [
             jobs.cabal2nix.aarch64-darwin
             jobs.ghc.aarch64-darwin
             jobs.git.aarch64-darwin
@@ -251,33 +205,7 @@ let
         */
       ]
       ++ collect isDerivation jobs.stdenvBootstrapTools
-      ++ optionals supportDarwin.x86_64 [
-        jobs.stdenv.x86_64-darwin
-        jobs.cargo.x86_64-darwin
-        jobs.cachix.x86_64-darwin
-        jobs.devenv.x86_64-darwin
-        jobs.go.x86_64-darwin
-        jobs.python3.x86_64-darwin
-        jobs.nixpkgs-review.x86_64-darwin
-        jobs.nix.x86_64-darwin
-        jobs.nix-info.x86_64-darwin
-        jobs.nix-info-tested.x86_64-darwin
-        jobs.git.x86_64-darwin
-        jobs.mariadb.x86_64-darwin
-        jobs.vim.x86_64-darwin
-        jobs.inkscape.x86_64-darwin
-        jobs.qt5.qtmultimedia.x86_64-darwin
-        jobs.darwin.linux-builder.x86_64-darwin
-        /*
-          jobs.tests.cc-wrapper.default.x86_64-darwin
-          jobs.tests.cc-wrapper.llvmPackages.clang.x86_64-darwin
-          jobs.tests.cc-wrapper.llvmPackages.libcxx.x86_64-darwin
-          jobs.tests.stdenv-inputs.x86_64-darwin
-          jobs.tests.macOSSierraShared.x86_64-darwin
-          jobs.tests.stdenv.hooks.patch-shebangs.x86_64-darwin
-        */
-      ]
-      ++ optionals supportDarwin.aarch64 [
+      ++ optionals supportDarwin [
         jobs.stdenv.aarch64-darwin
         jobs.cargo.aarch64-darwin
         jobs.cachix.aarch64-darwin
@@ -294,7 +222,13 @@ let
         jobs.inkscape.aarch64-darwin
         jobs.qt5.qtmultimedia.aarch64-darwin
         jobs.darwin.linux-builder.aarch64-darwin
-        # consider adding tests, as suggested above for x86_64-darwin
+        /*
+          jobs.tests.cc-wrapper.default.aarch64-darwin
+          jobs.tests.cc-wrapper.llvmPackages.clang.aarch64-darwin
+          jobs.tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin
+          jobs.tests.stdenv-inputs.aarch64-darwin
+          jobs.tests.stdenv.hooks.patch-shebangs.aarch64-darwin
+        */
       ];
     };
 

From 90796a20f3161359ee63f4bd17b9d0b2f95285b7 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 02:25:26 +0000
Subject: [PATCH 0735/1209] top-level: add error for `x86_64-darwin`
 deprecation

---
 doc/redirects.json                   |  3 ++
 doc/release-notes/rl-2611.section.md | 11 +++++
 pkgs/top-level/config.nix            | 18 ++++----
 pkgs/top-level/default.nix           | 62 +++++++++++++++-------------
 4 files changed, 56 insertions(+), 38 deletions(-)

diff --git a/doc/redirects.json b/doc/redirects.json
index d21aa2dde8d0..51839e8ee9b0 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -1091,6 +1091,9 @@
   "x86_64-darwin-26.05": [
     "release-notes.html#x86_64-darwin-26.05"
   ],
+  "x86_64-darwin-26.11": [
+    "release-notes.html#x86_64-darwin-26.11"
+  ],
   "zip-files": [
     "index.html#zip-files"
   ],
diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 2d03b3d265fd..93531d9caa96 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -10,6 +10,17 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- []{#x86_64-darwin-26.11}
+
+  Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
+  We will no longer build packages for the platform or support building them from source.
+
+  The Nixpkgs 26.05 stable branch will still maintain platform support and binaries will be built until it goes out of support at the end of 2026.
+  Users of `x86_64-darwin` will receive an error message explaining how to switch to 26.05.
+
+  By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
+  We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
+
 - Paths under `/etc/xdg/` from packages in `environment.systemPackages` are no longer linked into the global `/etc/` by default. Modules depending on such directories must declare them explicitly using `environment.pathsToLink`.
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index f2066315efb5..d6cbb036465b 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -454,18 +454,18 @@ let
     };
 
     allowDeprecatedx86_64Darwin = mkOption {
-      # `force` does nothing; it’s reserved for forward compatibility
-      # with 26.11. We hide it from the documentation to avoid a
-      # footgun, as it will make the error in 26.11 less useful.
-      type = types.either types.bool (types.enum [ "force" ]) // {
-        inherit (types.bool) description descriptionClass;
-      };
+      # `true` does nothing; it silenced the warning in 26.05.
+      type = types.either types.bool (types.enum [ "force" ]);
       default = false;
       description = ''
-        Silence the warning for the upcoming deprecation of the
-        `x86_64-darwin` platform in Nixpkgs 26.11.
+        Set to `"force"` to allow evaluating for the `x86_64-darwin`
+        platform despite its deprecation in Nixpkgs 26.11.
 
-        See the [release notes](#x86_64-darwin-26.05) for more
+        This is not expected to function, and Hydra will not build
+        binaries for the platform. It is provided only as an escape
+        hatch for custom setups, and comes with no support.
+
+        See the [release notes](#x86_64-darwin-26.11) for more
         information.
       '';
     };
diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index 443496f650fb..a6bbbdf680b4 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -18,25 +18,6 @@
   or dot-files.
 */
 
-let
-  # We hoist this above the closure so that the same thunk is shared
-  # between multiple imports of Nixpkgs. This ensures that commands
-  # like `nix eval nixpkgs#legacyPackages.x86_64-darwin.pkgsStatic.hello`
-  # print only one warning, which would otherwise be spammy in common
-  # scenarios that instantiate many copies of Nixpkgs.
-  #
-  # Unfortunately, flakes’ handling of transitive dependencies mean
-  # that it’s still likely users will see multiple warnings, but
-  # there’s nothing we can do about that within the constraints of the
-  # Nix language.
-  x86_64DarwinDeprecationWarning =
-    pristineLib.warn
-      "Nixpkgs 26.05 will be the last release to support x86_64-darwin; see https://nixos.org/manual/nixpkgs/unstable/release-notes#x86_64-darwin-26.05"
-      (x: x);
-
-  pristineLib = import ../../lib;
-in
-
 {
   # The system packages will be built on. See the manual for the
   # subtle division of labor between these two `*System`s and the three
@@ -74,6 +55,8 @@ let # Rename the function arguments
 
 in
 let
+  pristineLib = import ../../lib;
+
   lib =
     if __allowFileset then
       pristineLib
@@ -93,7 +76,33 @@ let
         }
       );
 
-  inherit (lib) throwIfNot;
+  inherit (lib) throwIfNot throwIf;
+
+  x86_64DarwinDeprecationMessage = ''
+    Nixpkgs 26.11 has dropped support for x86_64-darwin.
+
+    The 26.05 stable branch still supports x86_64-darwin, and will
+    receive security fixes until the end of 2026. If you use channels,
+    you can switch to 26.05 as follows:
+
+        $ sudo nix-channel --add https://nixos.org/channels/nixpkgs-26.05-darwin nixpkgs
+        $ sudo nix-channel --update
+
+    If this doesn’t work, you may need to run:
+
+        # Lack of sudo is deliberate:
+        $ nix-channel --remove nixpkgs
+
+    If you use flakes, switch your flake input:
+
+        inputs.nixpkgs = {
+          url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
+        };
+
+    See the release notes for more information and alternatives:
+
+      https://nixos.org/manual/nixpkgs/unstable/release-notes#x86_64-darwin-26.11
+  '';
 
   checked =
     (throwIfNot (lib.isList overlays) "The overlays argument to nixpkgs must be a list.")
@@ -101,15 +110,10 @@ let
       (throwIfNot (lib.isList crossOverlays) "The crossOverlays argument to nixpkgs must be a list.")
       (throwIfNot (lib.all lib.isFunction crossOverlays) "All crossOverlays passed to nixpkgs must be functions.")
       (
-        if
-          (
-            ((localSystem.isDarwin && localSystem.isx86) || (crossSystem.isDarwin && crossSystem.isx86))
-            && config.allowDeprecatedx86_64Darwin == false
-          )
-        then
-          x86_64DarwinDeprecationWarning
-        else
-          x: x
+        throwIf (
+          ((localSystem.isDarwin && localSystem.isx86) || (crossSystem.isDarwin && crossSystem.isx86))
+          && config.allowDeprecatedx86_64Darwin != "force"
+        ) x86_64DarwinDeprecationMessage
       );
 
   localSystem = lib.systems.elaborate args.localSystem;

From 0e8006c9ab1c7551e82d2395d7b8805efba1d748 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:10:14 +0000
Subject: [PATCH 0736/1209] pkgsx86_64Darwin: drop

---
 pkgs/top-level/aliases.nix  |  1 +
 pkgs/top-level/variants.nix | 22 ----------------------
 2 files changed, 1 insertion(+), 22 deletions(-)

diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 19b65f801709..3b394b927c5a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1793,6 +1793,7 @@ mapAliases {
   pingvin-share = throw "'pingvin-share' has been removed as it was broken and archived upstream"; # Added 2025-11-08
   pipecontrol = throw "'pipecontrol' has been removed due to outdated KF5 dependencies."; # Added 2026-05-01
   piper-train = throw "piper-train is now part of the piper package using the `withTrain` override"; # Added 2025-09-03
+  pkgsx86_64Darwin = throw "pkgsx86_64Darwin has been removed, as support for the platform has been dropped; see https://nixos.org/manual/nixpkgs/unstable/release-notes#x86_64-darwin-26.11"; # Added 2026-06-21
   plandex = throw "plandex has been removed, as it is not maintained anymore"; # Added 2026-05-18
   plandex-server = throw "plandex has been removed, as it is not maintained anymore"; # Added 2026-05-18
   plant-it = throw "plant-it backend was discontinued in september 2025"; # Added 2026-01-30
diff --git a/pkgs/top-level/variants.nix b/pkgs/top-level/variants.nix
index fb6a38029c96..5652c62986a9 100644
--- a/pkgs/top-level/variants.nix
+++ b/pkgs/top-level/variants.nix
@@ -81,28 +81,6 @@ self: super: {
     else
       throw "Musl libc only supports 64-bit Linux systems, and i686-linux.";
 
-  # x86_64-darwin packages for aarch64-darwin users to use with Rosetta for incompatible packages
-  pkgsx86_64Darwin =
-    if stdenv.hostPlatform.isDarwin then
-      nixpkgsFun {
-        overlays = [
-          (self': super': {
-            pkgsx86_64Darwin = super';
-          })
-        ]
-        ++ overlays;
-        localSystem = {
-          config = lib.systems.parse.tripleFromSystem (
-            stdenv.hostPlatform.parsed
-            // {
-              cpu = lib.systems.parse.cpuTypes.x86_64;
-            }
-          );
-        };
-      }
-    else
-      throw "x86_64 Darwin package set can only be used on Darwin systems.";
-
   # Full package set with rocm on cuda off
   # Mostly useful for asserting pkgs.pkgsRocm.torchWithRocm == pkgs.torchWithRocm and similar
   pkgsRocm = nixpkgsFun {

From 9770319c3e2acb0446f93f734decc3d2fc5e3970 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:13:46 +0000
Subject: [PATCH 0737/1209] release-lib: drop support for `x86_64-darwin`

---
 pkgs/top-level/release-lib.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/top-level/release-lib.nix b/pkgs/top-level/release-lib.nix
index 6bbcc48ee651..ec22e346a7ec 100644
--- a/pkgs/top-level/release-lib.nix
+++ b/pkgs/top-level/release-lib.nix
@@ -65,7 +65,6 @@ let
       pkgs_aarch64_darwin = packageSet' { system = "aarch64-darwin"; };
       pkgs_armv6l_linux = packageSet' { system = "armv6l-linux"; };
       pkgs_armv7l_linux = packageSet' { system = "armv7l-linux"; };
-      pkgs_x86_64_darwin = packageSet' { system = "x86_64-darwin"; };
       pkgs_x86_64_freebsd = packageSet' { system = "x86_64-freebsd"; };
       pkgs_i686_freebsd = packageSet' { system = "i686-freebsd"; };
       pkgs_i686_cygwin = packageSet' { system = "i686-cygwin"; };
@@ -87,8 +86,6 @@ let
       pkgs_armv6l_linux
     else if system == "armv7l-linux" then
       pkgs_armv7l_linux
-    else if system == "x86_64-darwin" then
-      pkgs_x86_64_darwin
     else if system == "x86_64-freebsd" then
       pkgs_x86_64_freebsd
     else if system == "i686-freebsd" then

From 41341de6697fee9b3a29676b90919631dbda197b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:04:56 +0000
Subject: [PATCH 0738/1209] lib/systems/examples: drop `x86_64-darwin`

---
 lib/systems/examples.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 055f727d53c9..ab062f82bce3 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -332,12 +332,6 @@ rec {
     platform = { };
   };
 
-  x86_64-darwin = {
-    config = "x86_64-apple-darwin";
-    xcodePlatform = "MacOSX";
-    platform = { };
-  };
-
   #
   # UEFI
   #

From bd83232593676314c15ae321c888ded2cc0da0b9 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:36:03 +0000
Subject: [PATCH 0739/1209] lib/systems/doubles: drop `x86_64-darwin`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This ensures that `lib.platforms.darwin` doesn’t include
`x86_64-darwin` and that the unsupported platform check will trigger
even once the bespoke deprecation error is removed. It doesn’t break
`lib.systems.elaborate "x86_64-darwin"`.
---
 doc/stdenv/cross-compilation.chapter.md | 2 +-
 lib/systems/doubles.nix                 | 1 -
 lib/tests/systems.nix                   | 2 --
 3 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/doc/stdenv/cross-compilation.chapter.md b/doc/stdenv/cross-compilation.chapter.md
index 18f3b2344607..ea707ceba677 100644
--- a/doc/stdenv/cross-compilation.chapter.md
+++ b/doc/stdenv/cross-compilation.chapter.md
@@ -50,7 +50,7 @@ The exact schema these fields follow is a bit ill-defined due to a long and conv
 
 `system`
 
-: This is a two-component shorthand for the platform. Examples of this would be "x86_64-darwin" and "i686-linux"; see `lib.systems.doubles` for more. The first component corresponds to the CPU architecture of the platform and the second to the operating system of the platform (`[cpu]-[os]`). This format has built-in support in Nix, such as the `builtins.currentSystem` impure string.
+: This is a two-component shorthand for the platform. Examples of this would be "aarch64-darwin" and "i686-linux"; see `lib.systems.doubles` for more. The first component corresponds to the CPU architecture of the platform and the second to the operating system of the platform (`[cpu]-[os]`). This format has built-in support in Nix, such as the `builtins.currentSystem` impure string.
 
 `config`
 
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index d3e184320fbd..6c7457930e09 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -19,7 +19,6 @@ let
     "x86_64-cygwin"
 
     # Darwin
-    "x86_64-darwin"
     "aarch64-darwin"
 
     # FreeBSD
diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
index e2b9093511c6..a27861b09253 100644
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@@ -127,7 +127,6 @@ lib.runTests (
     ];
     testx86_64 = mseteq x86_64 [
       "x86_64-linux"
-      "x86_64-darwin"
       "x86_64-freebsd"
       "x86_64-genode"
       "x86_64-redox"
@@ -145,7 +144,6 @@ lib.runTests (
       "x86_64-cygwin"
     ];
     testdarwin = mseteq darwin [
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
     testfreebsd = mseteq freebsd [

From 1ddb57c89f2dfa1ce43ec0f1e0cd98771be2c966 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jun 2026 13:47:00 -0700
Subject: [PATCH 0740/1209] imagemagick: 7.1.2-25 -> 7.1.2-26

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-25...7.1.2-26

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
---
 pkgs/by-name/im/imagemagick/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/imagemagick/package.nix b/pkgs/by-name/im/imagemagick/package.nix
index 896fd1c6d0b2..80b5314f5a31 100644
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -89,13 +89,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-25";
+  version = "7.1.2-26";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-7z1oIKXZcumsESLrFRvU6z0M8JVsogG7yDWwF62jPwo=";
+    hash = "sha256-Nl4C5XLwwQviy+GsLgNfbq+Ed6gWsI/ozB3BzM8bkV8=";
   };
 
   outputs = [

From f335cf68bc16f9c97e48290538bd1aa75d01edf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jun 2026 14:17:09 -0700
Subject: [PATCH 0741/1209] python3Packages.grpc-google-iam-v1: 3.31.3 ->
 0.14.4

Diff: https://github.com/googleapis/google-cloud-python/compare/grpc-google-iam-v1-v3.31.3...grpc-google-iam-v1-v0.14.4

Changelog: https://github.com/googleapis/google-cloud-python/blob/grpc-google-iam-v1-v0.14.4/packages/grpc-google-iam-v1/CHANGELOG.md
---
 .../python-modules/grpc-google-iam-v1/default.nix    | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
index 871ed0c66ead..51a51e67e3a7 100644
--- a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
+++ b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  gitUpdater,
   googleapis-common-protos,
   grpcio,
   pytestCheckHook,
@@ -10,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "grpc-google-iam-v1";
-  version = "3.31.3";
+  version = "0.14.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
-    tag = "google-cloud-build-v${version}";
-    hash = "sha256-qQ+8X6I8lt4OTgbvODsbdab2dYUk0wxWsbaVT2T651U=";
+    tag = "grpc-google-iam-v1-v${version}";
+    hash = "sha256-i2t8qtF2czaP9vgGOUN9AjQ3XhLkk8g05FtXUdk/Vng=";
   };
 
   sourceRoot = "${src.name}/packages/grpc-google-iam-v1";
@@ -42,6 +43,11 @@ buildPythonPackage rec {
     "-Wignore::DeprecationWarning"
   ];
 
+  passthru = {
+    skipBulkUpdate = true; # chooses tag for a different project
+    updateScript = gitUpdater { rev-prefix = "grpc-google-iam-v1-v"; };
+  };
+
   meta = {
     description = "GRPC library for the google-iam-v1 service";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/grpc-google-iam-v1";

From 1363f8e04535d27233fc0e54a76366733fcbd733 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 14 Jun 2026 06:42:55 -0400
Subject: [PATCH 0742/1209] giflib: suppress missing symbol error on Darwin

giflib fails to build due to a missing symbol in libutil.dylib. The
included patch is based on the discussion in the upstream bug.
---
 ...ess-undefined-symbol-error-on-Darwin.patch | 25 +++++++++++++++++++
 pkgs/by-name/gi/giflib/package.nix            |  3 +++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/by-name/gi/giflib/0001-Suppress-undefined-symbol-error-on-Darwin.patch

diff --git a/pkgs/by-name/gi/giflib/0001-Suppress-undefined-symbol-error-on-Darwin.patch b/pkgs/by-name/gi/giflib/0001-Suppress-undefined-symbol-error-on-Darwin.patch
new file mode 100644
index 000000000000..461f4d06512a
--- /dev/null
+++ b/pkgs/by-name/gi/giflib/0001-Suppress-undefined-symbol-error-on-Darwin.patch
@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Sun, 14 Jun 2026 10:49:22 -0400
+Subject: [PATCH] Suppress undefined symbol error on Darwin
+
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index f347162..720bffa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -133,7 +133,7 @@ libgif.a: $(OBJECTS) $(HEADERS)
+ 
+ $(LIBUTILSO): $(UOBJECTS) $(UHEADERS)
+ ifeq ($(UNAME), Darwin)
+-	$(CC) $(CFLAGS) -dynamiclib -current_version $(LIBVER) $(UOBJECTS) -o $(LIBUTILSO)
++	$(CC) $(CFLAGS) -dynamiclib -current_version $(LIBVER) $(UOBJECTS) -Wl,-U,_GifErrorString -o $(LIBUTILSO)
+ else
+ 	$(CC) $(CFLAGS) $(CPPLAGS) -shared $(LDFLAGS) -Wl,-soname -Wl,$(LIBUTILSOMAJOR) -o $(LIBUTILSO) $(UOBJECTS)
+ endif
+-- 
+2.54.0
+
diff --git a/pkgs/by-name/gi/giflib/package.nix b/pkgs/by-name/gi/giflib/package.nix
index b2142aa2869f..1fa7deb61a00 100644
--- a/pkgs/by-name/gi/giflib/package.nix
+++ b/pkgs/by-name/gi/giflib/package.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
+    # Fix missing symbol error on Darwin when linking libutil.dylib.
+    # Based on discussion in https://sourceforge.net/p/giflib/bugs/189/.
+    ./0001-Suppress-undefined-symbol-error-on-Darwin.patch
   ]
   ++ lib.optionals stdenv.hostPlatform.isMinGW [
     # Build dll libraries.

From e499a5c28d6ced698b485fea96b0e264f0a92ca3 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 1 Apr 2026 13:22:06 +0200
Subject: [PATCH 0743/1209] libnice: 0.1.22 -> 0.1.23

---
 pkgs/by-name/li/libnice/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 6d2361b25d2e..99b58d0dc778 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libnice";
-  version = "0.1.22";
+  version = "0.1.23";
 
   outputs = [
     "bin"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz";
-    hash = "sha256-pfckzwnq5QxBp1FxQdidpKYeyerKMtpKAHP67VQXrX4=";
+    hash = "sha256-YY/E6N45O3GbFkHB2O7AGCbU050VrekmedIhx/Xk5w0=";
   };
 
   patches = [

From e65353450301b26d8bd129b87c0736ac5672266f Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 1 Apr 2026 13:21:21 +0200
Subject: [PATCH 0744/1209] gstreamer: use odd-unstable versioning

---
 pkgs/development/libraries/gstreamer/bad/default.nix         | 2 +-
 pkgs/development/libraries/gstreamer/base/default.nix        | 2 +-
 pkgs/development/libraries/gstreamer/core/default.nix        | 2 +-
 pkgs/development/libraries/gstreamer/devtools/default.nix    | 2 +-
 pkgs/development/libraries/gstreamer/ges/default.nix         | 2 +-
 pkgs/development/libraries/gstreamer/good/default.nix        | 2 +-
 pkgs/development/libraries/gstreamer/libav/default.nix       | 2 +-
 pkgs/development/libraries/gstreamer/rtsp-server/default.nix | 2 +-
 pkgs/development/libraries/gstreamer/ugly/default.nix        | 2 +-
 pkgs/development/libraries/gstreamer/vaapi/default.nix       | 2 +-
 pkgs/development/python-modules/gst-python/default.nix       | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 1b704e101443..f45bd1dddddb 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -416,7 +416,7 @@ stdenv.mkDerivation (finalAttrs: {
       };
     };
 
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 6b1b2671e381..99142f3f8f56 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -190,7 +190,7 @@ stdenv.mkDerivation (finalAttrs: {
     glEnabled = enableGl;
     waylandEnabled = enableWayland;
 
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 05409199e303..604d89f9f0aa 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -144,7 +144,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     };
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index d9c788cfdd59..0c81bee90b9c 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     updateScript =
       let
-        updateSource = directoryListingUpdater { };
+        updateSource = directoryListingUpdater { odd-unstable = true; };
 
         updateLockfile = {
           command = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 743c0e475e9a..2a93586cb97a 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 9c531daf1486..81d5a78a3062 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -292,7 +292,7 @@ stdenv.mkDerivation (finalAttrs: {
       };
     };
 
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 05319b971754..788682a76fcd 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 182433745fd4..7e03e3981e6a 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index 3f225da93ed1..287d203fb2ba 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -104,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
       };
     };
 
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 903be8f1e245..1ad79efdda09 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -104,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 797f0a320a9d..ab053e13b806 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -96,7 +96,7 @@ buildPythonPackage rec {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {

From 8e7dcb86111d57a6ab93f57c965c07dd2582ee13 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Mon, 27 Apr 2026 15:43:12 +0200
Subject: [PATCH 0745/1209] orc: 0.4.41 -> 0.4.42

---
 pkgs/by-name/or/orc/package.nix | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/or/orc/package.nix b/pkgs/by-name/or/orc/package.nix
index ff7b71fbb4a8..4373c742ec9c 100644
--- a/pkgs/by-name/or/orc/package.nix
+++ b/pkgs/by-name/or/orc/package.nix
@@ -4,10 +4,10 @@
   fetchurl,
   meson,
   ninja,
-  file,
-  docbook-xsl-nons,
-  gtk-doc ? null,
-  buildDevDoc ? gtk-doc != null,
+  # FIXME: hotdoc errors out due to issues discovering libclang paths
+  # See https://github.com/NixOS/nixpkgs/issues/514723
+  hotdoc,
+  buildDevDoc ? false,
 
   # for passthru.tests
   gnuradio,
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "orc";
-  version = "0.4.41";
+  version = "0.4.42";
 
   outputs = [
     "out"
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/orc/orc-${finalAttrs.version}.tar.xz";
-    hash = "sha256-yxv9T2VSic05vARkLVl76d5UJ2I/CGHB/BnAjZhGf6I=";
+    hash = "sha256-fskSq1mvPMl4dMRWpWqK4e7FIMOF7ER+ihArK9EiyQw=";
   };
 
   postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) ''
@@ -38,7 +38,10 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   mesonFlags = [
-    (lib.mesonEnable "gtk_doc" buildDevDoc)
+    (lib.mesonEnable "examples" false)
+    (lib.mesonEnable "benchmarks" false)
+    (lib.mesonEnable "tests" finalAttrs.finalPackage.doCheck)
+    (lib.mesonEnable "hotdoc" buildDevDoc)
   ];
 
   nativeBuildInputs = [
@@ -46,9 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
   ]
   ++ lib.optionals buildDevDoc [
-    gtk-doc
-    file
-    docbook-xsl-nons
+    hotdoc
   ];
 
   # https://gitlab.freedesktop.org/gstreamer/orc/-/issues/41
@@ -77,6 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
       bsd2
     ];
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })

From d6af1a2833913c6fb32ff50df10e71aea8b139ba Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 1 Apr 2026 13:26:14 +0200
Subject: [PATCH 0746/1209] gstreamer: 1.26.11 -> 1.28.4

---
 pkgs/development/libraries/gstreamer/bad/default.nix     | 9 +++++++--
 pkgs/development/libraries/gstreamer/base/default.nix    | 4 ++--
 pkgs/development/libraries/gstreamer/core/default.nix    | 4 ++--
 .../development/libraries/gstreamer/devtools/default.nix | 6 +++---
 pkgs/development/libraries/gstreamer/ges/default.nix     | 4 ++--
 pkgs/development/libraries/gstreamer/good/default.nix    | 4 ++--
 pkgs/development/libraries/gstreamer/libav/default.nix   | 4 ++--
 .../libraries/gstreamer/rtsp-server/default.nix          | 4 ++--
 pkgs/development/libraries/gstreamer/ugly/default.nix    | 4 ++--
 9 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index f45bd1dddddb..6f1333d287db 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -115,7 +115,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-bad";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -124,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EQ+4J5Xw5Wmx4nsSq5aZ01x3YuH/TblTNdasjRRCrz0=";
+    hash = "sha256-MytzIPMMYPLVlBRG0DudBeN4HywlYb776IcYvXd/Dkc=";
   };
 
   patches = [
@@ -311,6 +311,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dwasapi=disabled" # not packaged in nixpkgs as of writing / no Windows support
     "-Dwasapi2=disabled" # not packaged in nixpkgs as of writing / no Windows support
     "-Dwpe=disabled" # required `wpe-webkit` library not packaged in nixpkgs as of writing
+    "-Dwpe2=disabled"
     "-Dgs=disabled" # depends on `google-cloud-cpp`
     "-Donnx=disabled" # depends on `libonnxruntime` not packaged in nixpkgs as of writing
     "-Dopenaptx=enabled" # since gstreamer-1.20.1 `libfreeaptx` is supported for circumventing the dubious license conflict with `libopenaptx`
@@ -326,6 +327,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "webrtcdsp" webrtcAudioProcessingSupport)
     (lib.mesonEnable "isac" webrtcAudioProcessingSupport)
   ]
+  ++ lib.mapAttrsToList lib.mesonEnable {
+    mpeghdec = false; # mpeghdec not packaged
+    tflite = false;
+  }
   ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
     "-Ddoc=disabled" # needs gstcuda to be enabled which is Linux-only
   ]
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 99142f3f8f56..ad2ce3e6f46b 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/FD4hdQfXQQHzgh27HI12ee4LUjbL0vHLF8kSkrHkmM=";
+    hash = "sha256-qJiv1XZhcrAEnmeBVY4GiQmL+HudgrhGxlLlccAdYNg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 604d89f9f0aa..bb44c1bf6de6 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -40,7 +40,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "bin"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LgvRktBDjqYGpvdqlcjhZUIWdlb/7Cwrw6r27gg3+/Y=";
+    hash = "sha256-9a3H6PRIwQJgs7JaoQHJ1UBnTI2aVMK3eobQTys7UN0=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index 0c81bee90b9c..aa976bd07f21 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-devtools";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Vl9IU4jJSYr+v3gAQYPN/xATEhEoZBqlbtql6pRBK+I=";
+    hash = "sha256-EdTxGIY506l2IDkGW7t7LDCbeo7Mb6Su0SJFVovwDbM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
       cargoRoot
       ;
     name = "gst-devtools-${finalAttrs.version}";
-    hash = "sha256-sqN1IBkbrT3pQqUQKU2pr8G1t4kNMKk0NR7NH7dTvAE=";
+    hash = "sha256-5VYzDwAMyVN2HR/sS8rCwTR7UW/tt60AS7wZMjx+w74=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 2a93586cb97a..52a76936bf25 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-editing-services";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-editing-services/gst-editing-services-${finalAttrs.version}.tar.xz";
-    hash = "sha256-o26HkAtErBYIYS8tYW/AMvnX2SAyfE0jGv+2/pNJcU0=";
+    hash = "sha256-b361Xlhxjd5bWGn2Ge2Q6/Owz6A3bBacG4P8dzgRkUo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 81d5a78a3062..a1f1eddc95e6 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -78,7 +78,7 @@ assert raspiCameraSupport -> hostSupportsRaspiCamera;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-good";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${finalAttrs.version}.tar.xz";
-    hash = "sha256-AB3rCHbV10PNNEir90onrew/2FABL8sbAJlIYb1sEUU=";
+    hash = "sha256-yCXqc3xZzqDkoMQdojiARf9d0y0WIiCsk6eoLuSgTmE=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 788682a76fcd..8d80eb36ec34 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-libav";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz";
-    hash = "sha256-m7PSaB7w3pLRsanZVRhiNu4i5k83Lbm/wNIuLQ3xmGU=";
+    hash = "sha256-vRel3yh0p6WLy697lAIjN5rZYTYk246teD2wPnS7kEs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 7e03e3981e6a..7ae3face595a 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-rtsp-server";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-rtsp-server/gst-rtsp-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-th1DBNjOqqoboTn7HOk18E8ac9fhgkPAoFsvsEMFQG8=";
+    hash = "sha256-v7Z4BUK/DUAnNiMq6ubFoblDxEV3W/QDBby4bKcHBaA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index 287d203fb2ba..feb1fbaaeaa9 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-ugly";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${finalAttrs.version}.tar.xz";
-    hash = "sha256-v5yfcu43SCXP1DhowoW8sBcA3yWEBp51169FX+SCRPg=";
+    hash = "sha256-VIbNFFxa9DJZ/TfKylnQSOKmfdsHCC6o9Q7w8CqF+KU=";
   };
 
   nativeBuildInputs = [

From 95d2a3227bcc8a589ad2a908dc1f94b605fc8cca Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 14:47:48 +0300
Subject: [PATCH 0747/1209] python3Packages.numpy: make numpy.pc more visible

This change also enables scipy to find numpy via pkg-config, and not
only via `scipy.passthru.buildConfig.properties.numpy-include-dir`, and
thus enables free threading via f2py. See:

https://github.com/scipy/scipy/commit/7fd20c742b74264e7c75e86292b7b8748a63d53c#diff-b39b7bda5a39c101be8d9e0b3b6d4da335b6daf7385c2a43463125b0a1f33778

Arguably, this makes the `numpy.passthru.coreIncludeDir` definition
redundant, but we will keep it for backwards compatibility.
---
 pkgs/development/python-modules/numpy/2.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 1a5eaecaa010..6849c82285c0 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -113,6 +113,14 @@ buildPythonPackage (finalAttrs: {
     typing-extensions
   ];
 
+  # Enables any dependent package to easily find numpy.pc via standard
+  # pkg-config call. The `$out/include` symlink matches what's written in the
+  # numpy.pc file.
+  postInstall = ''
+    ln -s $out/${python.sitePackages}/numpy/_core/lib/pkgconfig $out/lib/pkgconfig
+    ln -s ${placeholder "out"}/${finalAttrs.passthru.coreIncludeInnerDir} $out/include
+  '';
+
   preCheck = ''
     pushd $out
     # For numpy-config executable to be available during tests
@@ -192,7 +200,11 @@ buildPythonPackage (finalAttrs: {
       name = "site.cfg";
       text = lib.generators.toINI { } finalAttrs.finalPackage.buildConfig;
     };
-    coreIncludeDir = "${finalAttrs.finalPackage}/${python.sitePackages}/numpy/_core/include";
+    # Need to be defined with two variables for postInstall to use `placeholder
+    # "out"` where here we have to use `${finalAttrs.finalPackage}`, that would
+    # cause infinite recursion if used in postInstall too.
+    coreIncludeInnerDir = "${python.sitePackages}/numpy/_core/include";
+    coreIncludeDir = "${finalAttrs.finalPackage}/${finalAttrs.finalPackage.passthru.coreIncludeInnerDir}";
     tests = {
       inherit sage;
     };

From 6f7e99b2f4e303804f4153b43be2e4cd706b04b3 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 26 May 2026 17:36:13 +0300
Subject: [PATCH 0748/1209] python3Packages.scipy: 1.17.1 -> 1.18.0

Diff: https://github.com/scipy/scipy/compare/v1.17.1...v1.18.0

Changelog: https://github.com/scipy/scipy/releases/tag/v1.18.0
---
 .../python-modules/scipy/default.nix          | 31 +++++--------------
 1 file changed, 8 insertions(+), 23 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index cdecd986e4ef..914b8ce07842 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -27,7 +27,7 @@
   pybind11,
   pooch,
   xsimd,
-  boost189,
+  boost191,
   qhull,
 
   # dependencies
@@ -44,41 +44,26 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "scipy";
-  version = "1.17.1";
+  version = "1.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipy";
     repo = "scipy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lFmqdbCf7pcosdZ7RFMv+8H9+ztMJbDS5g5fQs8Nws8=";
+    hash = "sha256-qVTFWYZ9krhZNYLyuZTfiS7UYmMZL40GFqod84l+VHI=";
     fetchSubmodules = true;
   };
 
   patches = [
     # Helps with cross compilation, see https://github.com/scipy/scipy/pull/18167
     (fetchpatch {
-      url = "https://github.com/scipy/scipy/commit/dd50ac9d98dbb70625333a23e3a90e493228e3be.patch";
-      hash = "sha256-Vf6/hhwu6X5s8KWhq8bUZKtSkdVu/GtEpGtj8Olxe7s=";
-      excludes = [ "doc/source/dev/contributor/meson_advanced.rst" ];
+      url = "https://github.com/scipy/scipy/commit/33696c545b74d6fda6f6f39e818d26c2b7631498.patch";
+      hash = "sha256-R5rgSz/9+T2+fpDFTfZQLTvdISTGUAuHEBAWT39x9LQ=";
+      excludes = [ "doc/source/building/cross_compilation.rst" ];
     })
   ];
-  # A NOTE regarding the Numpy version relaxing: Both Numpy versions 1.x &
-  # 2.x are supported. However upstream wants to always build with Numpy 2,
-  # and with it to still be able to run with a Numpy 1 or 2. We insist to
-  # perform this substitution even though python3.pkgs.numpy is of version 2
-  # nowadays, because our ecosystem unfortunately doesn't allow easily
-  # separating runtime and build-system dependencies. See also:
-  #
-  # https://discourse.nixos.org/t/several-comments-about-priorities-and-new-policies-in-the-python-ecosystem/51790
-  #
-  # Being able to build (& run) with Numpy 1 helps for python environments
-  # that override globally the `numpy` attribute to point to `numpy_1`.
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "numpy>=2.0.0,<2.7" numpy
-  ''
-  + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
+  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin) ''
     substituteInPlace scipy/meson.build \
       --replace-fail "r = run_command('xcrun', '-sdk', 'macosx', '--show-sdk-version', check: true)" ""
     substituteInPlace scipy/meson.build \
@@ -101,7 +86,7 @@ buildPythonPackage (finalAttrs: {
     pybind11
     pooch
     xsimd
-    boost189
+    boost191
     qhull
   ];
 

From 5f39a670cb848d150588636b0d5cdd0a069c808e Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 13:09:33 +0300
Subject: [PATCH 0749/1209] python3Packages.numpy: 2.4.6 -> 2.5.0

Diff: https://github.com/numpy/numpy/compare/v2.4.6...v2.5.0

Changelog: https://github.com/numpy/numpy/releases/tag/v2.5.0
---
 pkgs/development/python-modules/numpy/2.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 6849c82285c0..92536065a492 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -34,7 +34,7 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 buildPythonPackage (finalAttrs: {
   pname = "numpy";
-  version = "2.4.6";
+  version = "2.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -42,7 +42,7 @@ buildPythonPackage (finalAttrs: {
     repo = "numpy";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-jHi3cYiSwFRm3G0Dl4dL6yACSP4lAUECotVI+4KXMg8=";
+    hash = "sha256-RiC1dLoDamK5B2VzHBL0V//K/Vix25q11wNGcl3Witk=";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [
@@ -86,11 +86,7 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
 
-  # we default openblas to build with 64 threads
-  # if a machine has more than 64 threads, it will segfault
-  # see https://github.com/OpenMathLib/OpenBLAS/issues/2993
   preConfigure = ''
-    sed -i 's/-faltivec//' numpy/distutils/system_info.py
     export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
   '';
 

From edf956849141a27628a419babff611c89dbe3325 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 6 Jan 2026 15:30:46 +0200
Subject: [PATCH 0750/1209] python3Packages.numpy: assert blas & lapack use
 compatible integer size

Allow them to be both 32bit or both 64 bit.
---
 pkgs/development/python-modules/numpy/2.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 92536065a492..be54cb4d312e 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -30,7 +30,8 @@
   typing-extensions,
 }:
 
-assert (!blas.isILP64) && (!lapack.isILP64);
+# Verify these are compatible
+assert blas.isILP64 == lapack.isILP64;
 
 buildPythonPackage (finalAttrs: {
   pname = "numpy";
@@ -62,7 +63,11 @@ buildPythonPackage (finalAttrs: {
       --replace-fail '/bin/true' '${lib.getExe' coreutils "true"}'
   '';
 
-  mesonFlags = lib.optionals (!stdenv.hostPlatform.isLoongArch64) [
+  mesonFlags = [
+    # See https://numpy.org/devdocs/building/blas_lapack.html
+    "-Duse-ilp64=${if blas.isILP64 then "true" else "false"}"
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isLoongArch64) [
     # This is required to support CPUs with feature-sets earlier than x86-64-v2
     # (before 2009). This will still build optimizations for newer features, but
     # allow for importing with older machines. See:

From e148ed0b557c47ae10c1b5fd53f9680f4133df4f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 18:20:56 +0000
Subject: [PATCH 0751/1209] libfabric: 2.5.1 -> 2.6.0

---
 pkgs/by-name/li/libfabric/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libfabric/package.nix b/pkgs/by-name/li/libfabric/package.nix
index 2bd139469e2c..c826fff3ad34 100644
--- a/pkgs/by-name/li/libfabric/package.nix
+++ b/pkgs/by-name/li/libfabric/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libfabric";
-  version = "2.5.1";
+  version = "2.6.0";
 
   enableParallelBuilding = true;
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ofiwg";
     repo = "libfabric";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-d8ZdHMo3ErwBtLtUiLetjR+wu6H9bj3jnGZDYX544Jc=";
+    sha256 = "sha256-/zQnXfEveIGCpPZ3lgrOLnXSS7m8U2spVjkqsXuaL0o=";
   };
 
   outputs = [

From 327c5bcd4a618cc1cc4cb91a89a240dc3a43853f Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 21:38:44 +0300
Subject: [PATCH 0752/1209] python3Packages.polars: use finalAttrs

---
 .../python-modules/polars/default.nix         | 26 +++++++++----------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index 41ff1ff2918e..14722a3a0896 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -36,32 +36,30 @@
     assert builtins.elem "--disable-initial-exec-tls" jemalloc'.configureFlags;
     jemalloc',
 
-  polars,
   python,
 }:
 
 let
-  version = "1.40.1";
 
   # Hide symbols to prevent accidental use
   rust-jemalloc-sys = throw "polars: use polarsMemoryAllocator over rust-jemalloc-sys";
   jemalloc = throw "polars: use polarsMemoryAllocator over jemalloc";
 in
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "polars";
-  inherit version;
+  version = "1.40.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pola-rs";
     repo = "polars";
-    tag = "py-${version}";
+    tag = "py-${finalAttrs.version}";
     hash = "sha256-QlrEYwoYPALELK3UGBC/92vCBIzFrigJAwU8qxn7Pys=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-rmCJ5SY5okvkgfd63yPDO2YOksqAWgKa9nqxTqP7Grw=";
   };
 
@@ -128,7 +126,7 @@ buildPythonPackage rec {
         nativeBuildInputs = [
           (python.withPackages (ps: [
             ps.pyarrow
-            polars
+            finalAttrs.finalPackage
           ]))
         ];
       }
@@ -145,7 +143,7 @@ buildPythonPackage rec {
         nativeBuildInputs = [
           (python.withPackages (ps: [
             ps.pyarrow
-            polars
+            finalAttrs.finalPackage
           ]))
         ];
         failureHook = ''
@@ -159,13 +157,13 @@ buildPythonPackage rec {
         EOF
       '';
   passthru.tests.pytest = stdenv.mkDerivation {
-    pname = "${polars.pname}-pytest";
+    pname = "${finalAttrs.pname}-pytest";
 
-    inherit (polars) version src;
+    inherit (finalAttrs) version src;
 
     requiredSystemFeatures = [ "big-parallel" ];
 
-    sourceRoot = "${src.name}/py-polars";
+    sourceRoot = "${finalAttrs.src.name}/py-polars";
     postPatch = ''
       for f in * ; do
         [[ "$f" == "tests" ]] || \
@@ -183,7 +181,7 @@ buildPythonPackage rec {
     checkPhase = "pytestCheckPhase";
     nativeBuildInputs = [
       (python.withPackages (ps: [
-        polars
+        finalAttrs.finalPackage
         ps.aiosqlite
         ps.altair
         ps.boto3
@@ -292,7 +290,7 @@ buildPythonPackage rec {
   meta = {
     description = "Dataframes powered by a multithreaded, vectorized query engine, written in Rust";
     homepage = "https://github.com/pola-rs/polars";
-    changelog = "https://github.com/pola-rs/polars/releases/tag/py-${version}";
+    changelog = "https://github.com/pola-rs/polars/releases/tag/py-${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       happysalada
@@ -301,4 +299,4 @@ buildPythonPackage rec {
     mainProgram = "polars";
     platforms = lib.platforms.all;
   };
-}
+})

From 854971a587e0d09fd53ea0745f6837b7651477f2 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 21:58:57 +0300
Subject: [PATCH 0753/1209] python3Packages.polars: 1.40.1 -> 1.41.2

Diff: https://github.com/pola-rs/polars/compare/py-1.40.1...py-1.41.2

Changelog: https://github.com/pola-rs/polars/releases/tag/py-1.41.2
---
 pkgs/development/python-modules/polars/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index 14722a3a0896..3d1fdfb9c674 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -48,19 +48,19 @@ in
 
 buildPythonPackage (finalAttrs: {
   pname = "polars";
-  version = "1.40.1";
+  version = "1.41.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pola-rs";
     repo = "polars";
     tag = "py-${finalAttrs.version}";
-    hash = "sha256-QlrEYwoYPALELK3UGBC/92vCBIzFrigJAwU8qxn7Pys=";
+    hash = "sha256-Wys56Tj75+7sNNwi3U5a62Wwkddep/W1MjtAHOuDdwc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-rmCJ5SY5okvkgfd63yPDO2YOksqAWgKa9nqxTqP7Grw=";
+    hash = "sha256-tmc8n0TVaXmc4C8XXTgPVsTRs0C/V+88f6T1vOamt00=";
   };
 
   requiredSystemFeatures = [ "big-parallel" ];
@@ -215,7 +215,6 @@ buildPythonPackage (finalAttrs: {
     ];
     nativeCheckInputs = [
       pytestCheckHook
-      pytest-codspeed
       pytest-cov-stub
       pytest-xdist
       pytest-benchmark

From 7ac506e79fd11a772a8326c4cd40478508bb032e Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 22 Jun 2026 22:15:23 +0200
Subject: [PATCH 0754/1209] valgrind: backport x86_64-unknown-linux-musl fix

Fixes: 4f72341536ca ("valgrind: 3.26.0 -> 3.27.0")
---
 pkgs/by-name/va/valgrind/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index 4d09b6c7acd8..25bc383f0ecb 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -30,6 +30,11 @@ stdenv.mkDerivation rec {
       url = "https://bugsfiles.kde.org/attachment.cgi?id=186451";
       hash = "sha256-IGmyHwwGoy00hcz3XxQSDcwcU8zHLBJ9dfqTvWDQ520=";
     })
+    (fetchpatch {
+      name = "reallocarray-test-musl.patch";
+      url = "https://sourceware.org/git/?p=valgrind.git;a=patch;h=991961ece87e4cdc0771a05c956c55baa437bb07";
+      hash = "sha256-U16384rLXMhLE5Em9z8FKYbshPlnq8l9ejC2+epL7M4=";
+    })
 
     # Fix build on armv7l.
     # see also https://bugs.kde.org/show_bug.cgi?id=454346

From ce5d29c0b708cfa69eeb63c625e419c54f2f7281 Mon Sep 17 00:00:00 2001
From: Artemis Tosini <artemis.tosini@obsidian.systems>
Date: Mon, 22 Jun 2026 14:40:33 -0400
Subject: [PATCH 0755/1209] fontconfig: Fix cross building

The fontconfig autotools build attempts to check for va_copy with a
test program. This doesn't work cross, but we can hardcode the result.

It may be best to use meson in the future.
---
 pkgs/development/libraries/fontconfig/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 9e4c1fb36057..515e31901db1 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -67,11 +67,12 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}"
+    "ac_cv_va_copy=C99"
   ];
 
   enableParallelBuilding = true;
 
-  doCheck = true;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   installFlags = [
     # Don't try to write to /var/cache/fontconfig at install time.

From 1db0dc7c1bb5513b987682782b3c474451c6fe53 Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Mon, 22 Jun 2026 22:38:49 +0200
Subject: [PATCH 0756/1209] ffmpeg_8: 8.1.1 -> 8.1.2

---
 pkgs/development/libraries/ffmpeg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index acfedac85f4d..d5f1e1922186 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -30,8 +30,8 @@ let
     hash = "sha256-GDN0+tJY8Nap9UkNUfzqT9cGV1IVCuy5Du/64G+8QdE=";
   };
   v8 = {
-    version = "8.1.1";
-    hash = "sha256-WPGfjTZjsgpR5QiANRWF4g6LF2ejGzFQUrLjhzw9cfQ=";
+    version = "8.1.2";
+    hash = "sha256-wJ3c8VVo/tK84K7bKYs/UWcln4mSO+tf/w5NLNjKhiI=";
   };
 in
 

From b0983d5f06aede186c051e938b31d01b141afaa7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jun 2026 09:02:04 -0700
Subject: [PATCH 0757/1209] python3Packages.mistune: 3.2.1 -> 3.3.2

Diff: https://github.com/lepture/mistune/compare/v3.2.1...v3.3.2

Changelog: https://github.com/lepture/mistune/blob/v3.3.2/docs/changes.rst
---
 pkgs/development/python-modules/mistune/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mistune/default.nix b/pkgs/development/python-modules/mistune/default.nix
index 8cdfa4023ded..99f3922ee0fa 100644
--- a/pkgs/development/python-modules/mistune/default.nix
+++ b/pkgs/development/python-modules/mistune/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mistune";
-  version = "3.2.1";
+  version = "3.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "mistune";
     tag = "v${version}";
-    hash = "sha256-8AEEh/SWAk/Esq0jAoZGLw1FIQUw6C5Xq8CgnI2fjv0=";
+    hash = "sha256-uyOJFtDvVn0Y3VypphOXsSW3pX5XVCcfQ7dtFiL/5qY=";
   };
 
   build-system = [ setuptools ];

From ccc474fdb4007ac2788533b50ec26740d47e9a56 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Wed, 27 May 2026 00:22:46 +0200
Subject: [PATCH 0758/1209] systemd: v260.2 -> v261

---
 ...e-usr-share-zoneinfo-to-etc-zoneinfo.patch | 20 ++++++++---------
 ...e-NSCD-when-DNSSEC-validation-is-dis.patch |  8 +++----
 pkgs/os-specific/linux/systemd/default.nix    | 22 +++++++++----------
 pkgs/top-level/all-packages.nix               |  2 ++
 4 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/0002-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0002-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index a9ec66f9dd3d..5d993d1493d7 100644
--- a/pkgs/os-specific/linux/systemd/0002-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -35,10 +35,10 @@ index 3a13e04a27..4fd58068a1 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 5dd00af952..b97a41f6ac 100644
+index eb74de32c2..6906462b36 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1443,7 +1443,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1456,7 +1456,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 5dd00af952..b97a41f6ac 100644
          if (!f)
                  return -errno;
  
-@@ -1488,7 +1488,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1501,7 +1501,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
  
          assert(ret);
  
@@ -56,7 +56,7 @@ index 5dd00af952..b97a41f6ac 100644
          if (!f)
                  return -errno;
  
-@@ -1603,7 +1603,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1616,7 +1616,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 5dd00af952..b97a41f6ac 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1675,7 +1675,7 @@ int get_timezone(char **ret) {
+@@ -1688,7 +1688,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* Return EINVAL if not a symlink */
  
@@ -75,10 +75,10 @@ index 5dd00af952..b97a41f6ac 100644
                  return -EINVAL;
          if (!timezone_is_valid(e, LOG_DEBUG))
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index ae1899593c..20d3071114 100644
+index e922abdd63..986a9e25d1 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -584,7 +584,7 @@ static int prompt_timezone(int rfd, sd_varlink **mute_console_link) {
+@@ -601,7 +601,7 @@ static int prompt_timezone(int rfd, sd_varlink **mute_console_link) {
  
  static int process_timezone(int rfd, sd_varlink **mute_console_link) {
          _cleanup_close_ int pfd = -EBADF;
@@ -87,7 +87,7 @@ index ae1899593c..20d3071114 100644
          const char *e;
          int r;
  
-@@ -630,12 +630,9 @@ static int process_timezone(int rfd, sd_varlink **mute_console_link) {
+@@ -647,12 +647,9 @@ static int process_timezone(int rfd, sd_varlink **mute_console_link) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -103,10 +103,10 @@ index ae1899593c..20d3071114 100644
                  return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
  
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 84e94e845a..8e1f1a6ea2 100644
+index 7f7ceac318..5f3faa7bf4 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1856,8 +1856,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1757,8 +1757,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
diff --git a/pkgs/os-specific/linux/systemd/0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
index bf6ebeebe59a..0724cd661fd5 100644
--- a/pkgs/os-specific/linux/systemd/0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+++ b/pkgs/os-specific/linux/systemd/0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -13,13 +13,13 @@ directly.
  1 file changed, 11 insertions(+)
 
 diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
-index 96d0dd5c2b..ee7cc4bd17 100644
+index 5e0d13023a..1bfe0b1e6f 100644
 --- a/src/timesync/timesyncd.c
 +++ b/src/timesync/timesyncd.c
-@@ -25,6 +25,11 @@
+@@ -22,6 +22,11 @@
+ #include "timesyncd-bus.h"
  #include "timesyncd-conf.h"
  #include "timesyncd-manager.h"
- #include "user-util.h"
 +#include "env-util.h"
 +
 +struct traced_file;
@@ -28,7 +28,7 @@ index 96d0dd5c2b..ee7cc4bd17 100644
  
  static int advance_tstamp(int fd, usec_t epoch) {
          assert(fd >= 0);
-@@ -204,6 +209,12 @@ static int run(int argc, char *argv[]) {
+@@ -169,6 +174,12 @@ static int run(int argc, char *argv[]) {
          if (r < 0)
                  return log_error_errno(r, "Failed to parse fallback server strings: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 4d91ed2e72a5..c46ba6792a86 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -35,7 +35,6 @@
   lz4,
   openssl,
   libgcrypt,
-  libgpg-error,
   libidn2,
   curl,
   zlib,
@@ -106,6 +105,7 @@
   withHostnamed ? true,
   withHwdb ? true,
   withImportd ? true,
+  withImds ? true,
   withKmod ? true,
   withLibBPF ?
     lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
@@ -142,6 +142,7 @@
   withRemote ? true,
   withResolved ? true,
   withShellCompletions ? true,
+  withSysinstall ? true,
   withSysusers ? true,
   withSysupdate ? true,
   withTimedated ? true,
@@ -190,7 +191,7 @@ assert withRepart -> withCryptsetup;
 assert withBootloader -> withEfi;
 
 let
-  wantCurl = withRemote || withImportd;
+  wantCurl = withRemote || withImportd || withImds;
 
   # Use the command below to update `releaseTimestamp` on every (major) version
   # change. More details in the commentary at mesonFlags.
@@ -201,13 +202,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "260.2";
+  version = "261";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-NXmmSV7/9WIW6C8wjdOwaerCy4v7Zcrd8+XDzcS8rEk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6IB1ZEQqQ0impwBhCaLZAEgMVkVFU61JDVlGotxNzGQ=";
   };
 
   # PATCH POLICY
@@ -308,11 +309,7 @@ stdenv.mkDerivation (finalAttrs: {
         jinja2
       ]
       ++ lib.optional withEfi ps.pyelftools
-      # pefile is only required to trigger a check in meson to actually build
-      # ukify. This module should never appear in the runtime closure of ukify.
-      # Instead the pefile from buildInputs should be used.
-      # Remove this when it's fixed upstream: https://github.com/systemd/systemd/pull/41959
-      ++ lib.optional withUkify ps.pefile
+      ++ lib.optional (withUkify && finalAttrs.finalPackage.doCheck) ps.pefile
     ))
   ]
   ++ lib.optionals withLibBPF [
@@ -331,7 +328,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   ++ lib.optionals withGcrypt [
     libgcrypt
-    libgpg-error
   ]
   ++ lib.optionals withOpenSSL [ openssl ]
   ++ lib.optional withTests glib
@@ -347,7 +343,7 @@ stdenv.mkDerivation (finalAttrs: {
     zstd
   ]
   ++ lib.optional withCoredump elfutils
-  ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
+  ++ lib.optional withCryptsetup cryptsetup
   ++ lib.optional withKexectools kexec-tools
   ++ lib.optional withKmod kmod
   ++ lib.optional withLibidn2 libidn2
@@ -498,6 +494,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "apparmor" withApparmor)
     (lib.mesonEnable "gcrypt" withGcrypt)
     (lib.mesonEnable "importd" withImportd)
+    (lib.mesonEnable "imds" withImds)
     (lib.mesonEnable "homed" withHomed)
     (lib.mesonEnable "polkit" withPolkit)
     (lib.mesonEnable "elfutils" withCoredump)
@@ -539,6 +536,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "coredump" withCoredump)
     (lib.mesonBool "firstboot" withFirstboot)
     (lib.mesonBool "resolve" withResolved)
+    (lib.mesonBool "sysinstall" withSysinstall)
     (lib.mesonBool "sysusers" withSysusers)
     (lib.mesonBool "efi" withEfi)
     (lib.mesonBool "utmp" withUtmp)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4368ded8af14..c3c268a911ff 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8319,6 +8319,7 @@ with pkgs;
     withHomed = false;
     withHwdb = false;
     withImportd = false;
+    withImds = false;
     withLibBPF = false;
     withLibidn2 = false;
     withLocaled = false;
@@ -8335,6 +8336,7 @@ with pkgs;
     withRemote = false;
     withResolved = false;
     withShellCompletions = false;
+    withSysinstall = false;
     withSysupdate = false;
     withSysusers = false;
     withTimedated = false;

From f9831ac04ca1fbb5e3608ea11dd81c49e64f2348 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 22 Jun 2026 14:43:42 +0200
Subject: [PATCH 0759/1209] python3Packages.pytest-django: 4.11.1 -> 4.12.0

Changelog: https://github.com/pytest-dev/pytest-django/blob/v4.12.0/docs/changelog.rst
---
 pkgs/development/python-modules/pytest-django/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-django/default.nix b/pkgs/development/python-modules/pytest-django/default.nix
index cc41563099e5..fc5cb01cf15d 100644
--- a/pkgs/development/python-modules/pytest-django/default.nix
+++ b/pkgs/development/python-modules/pytest-django/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytest-django";
-  version = "4.11.1";
+  version = "4.12.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "pytest_django";
     inherit (finalAttrs) version;
-    hash = "sha256-qUkUGh7hA8sOeiDxRR01X4P15KXQe91Nz90f0P8ieZE=";
+    hash = "sha256-35TsgZqDyJecj23hPZzfvnbowh05Rzz+K0DJ/Jvjx1g=";
   };
 
   build-system = [

From b6c4b911f063a11f3f45124582c08cc4c91d8677 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Tue, 23 Jun 2026 13:20:54 +0200
Subject: [PATCH 0760/1209] systemd: disable repart-factory-reset test since it
 its broken upstream

---
 pkgs/os-specific/linux/systemd/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index c46ba6792a86..39ce581ae5b7 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -778,7 +778,7 @@ stdenv.mkDerivation (finalAttrs: {
           systemd-repart-basic
           systemd-repart-create-root
           systemd-repart-encrypt-tpm2
-          systemd-repart-factory-reset
+          # systemd-repart-factory-reset # broken upstream
           ;
       }
       // {

From 7c2629ab708ac947d30e14c30a0b85e949870d9b Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Tue, 23 Jun 2026 13:21:21 +0200
Subject: [PATCH 0761/1209] nixos/test-instrumentation: disable minimum uptime
 for tests

---
 nixos/modules/testing/test-instrumentation.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index 4d20b20090b4..de2cb3d2afc8 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -78,6 +78,8 @@ let
     # Allow very slow start
     DefaultTimeoutStartSec = 300;
     DefaultDeviceTimeoutSec = 300;
+    # Don't enforce a minimum uptime before shutting down.
+    MinimumUptimeSec = 0;
   };
 
 in

From f4caa95ddef0d1e67621f20a82f28ed639dc6f6c Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Tue, 23 Jun 2026 16:12:55 +0200
Subject: [PATCH 0762/1209] lttng-ust: fix musl crashes

Caught by the tests.  I've linked to my submitted upstream patch, but
I'm not confident enough in it to apply it here without upstream
review, so for now just build with an increased stack size across the
board.  We can remove it if upstream does something to address the
stack size issue.

Fixes: 6d8c12b2b36e ("lttng-ust: 2.14.0 -> 2.15.0")
---
 pkgs/by-name/lt/lttng-ust/package.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/lt/lttng-ust/package.nix b/pkgs/by-name/lt/lttng-ust/package.nix
index 9749f6c938e1..9f359b838cb9 100644
--- a/pkgs/by-name/lt/lttng-ust/package.nix
+++ b/pkgs/by-name/lt/lttng-ust/package.nix
@@ -67,7 +67,15 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs .
   '';
 
-  configureFlags = [ "--disable-examples" ];
+  configureFlags = [
+    "--disable-examples"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isMusl [
+    # lttng-ust puts a single array on the stack that's the size of
+    # musl's whole default stack.
+    # https://review.lttng.org/c/lttng-ust/+/18160
+    "CFLAGS=-Wl,-z,stack-size=2097152"
+  ];
 
   doCheck = true;
 

From c565d77c0c78191ce8158266869ce30e7ca42a0a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 15 Jun 2026 18:42:43 +0200
Subject: [PATCH 0763/1209] cdparanoia: fix build for FreeBSD

---
 pkgs/by-name/cd/cdparanoia-iii/freebsd.patch | 45 ++++++++++++++++++++
 pkgs/by-name/cd/cdparanoia-iii/package.nix   |  1 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/by-name/cd/cdparanoia-iii/freebsd.patch

diff --git a/pkgs/by-name/cd/cdparanoia-iii/freebsd.patch b/pkgs/by-name/cd/cdparanoia-iii/freebsd.patch
new file mode 100644
index 000000000000..a66482a91e5a
--- /dev/null
+++ b/pkgs/by-name/cd/cdparanoia-iii/freebsd.patch
@@ -0,0 +1,45 @@
+From 368ea1fcdf4e8f9a5de4e7ade590242292ccb8fa Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Mon, 15 Jun 2026 18:40:07 +0200
+Subject: [PATCH] Fix designated initializers in memcpy arguments
+
+On FreeBSD, memcpy is a macro, and the lack of parentheses causes a
+compilation failure.
+---
+ interface/scsi_interface.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/interface/scsi_interface.c b/interface/scsi_interface.c
+index adbb9bf..7805559 100644
+--- a/interface/scsi_interface.c
++++ b/interface/scsi_interface.c
+@@ -674,7 +674,7 @@ static int scsi_read_toc (cdrom_drive *d){
+   }
+ 
+   for (i = first; i <= last; i++){
+-    memcpy(cmd, (char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}, 10);
++    memcpy(cmd, ((char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}), 10);
+     cmd[1]=d->lun<<5;
+     cmd[6]=i;
+     
+@@ -695,7 +695,7 @@ static int scsi_read_toc (cdrom_drive *d){
+     }
+   }
+ 
+-  memcpy(cmd, (char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}, 10);
++  memcpy(cmd, ((char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}), 10);
+   cmd[1]=d->lun<<5;
+   cmd[6]=0xAA;
+     
+@@ -745,7 +745,7 @@ static int scsi_read_toc2 (cdrom_drive *d){
+   }
+ 
+   for (i = 0; i < tracks; i++){
+-    memcpy(cmd, (char[]){ 0xe5, 0, 0, 0, 0, 0, 0, 0, 0, 0}, 10);
++    memcpy(cmd, ((char[]){ 0xe5, 0, 0, 0, 0, 0, 0, 0, 0, 0}), 10);
+     cmd[5]=i+1;
+     cmd[8]=255;
+     
+-- 
+2.54.0
+
diff --git a/pkgs/by-name/cd/cdparanoia-iii/package.nix b/pkgs/by-name/cd/cdparanoia-iii/package.nix
index 813adc115078..de38e46763c3 100644
--- a/pkgs/by-name/cd/cdparanoia-iii/package.nix
+++ b/pkgs/by-name/cd/cdparanoia-iii/package.nix
@@ -62,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://salsa.debian.org/optical-media-team/cdparanoia/-/raw/f7bab3024c5576da1fdb7497abbd6abc8959a98c/debian/patches/04-endian.patch";
         hash = "sha256-krfprwls0L3hsNfoj2j69J5k1RTKEQtzE0fLYG9EJKo=";
       })
+      ./freebsd.patch
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch
     ++ lib.optional (!stdenv.hostPlatform.isDarwin) [

From 5fa3ac888c021700145f7f7dec8cfcf2dc9c2029 Mon Sep 17 00:00:00 2001
From: Sergey <merdedok@gmail.com>
Date: Tue, 23 Jun 2026 16:24:52 +0000
Subject: [PATCH 0764/1209] duckdb: 1.5.3 -> 1.5.4

---
 pkgs/by-name/du/duckdb/versions.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index aa83cd89b603..0f1ac213431c 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,6 +1,6 @@
 {
-  "version": "1.5.3",
-  "rev": "14eca11bd9d4a0de2ea0f078be588a9c1c5b279c",
-  "hash": "sha256-k7mtYXHS8IcBAuOCJ/09lPYLxF3RMODIeDaz3tKmQAA=",
-  "python_hash": "sha256-r0jfYIyBHN5z4QKKxS/yjnkGjUy/yg9Kt/O6adBbH7Q="
+  "version": "1.5.4",
+  "rev": "08e34c447bae34eaee3723cac61f2878b6bdf787",
+  "hash": "sha256-6xpKZKfH5/nwE2nU5kcpgITKFm3ilb1PYf9QEk+bKoM=",
+  "python_hash": "sha256-2TgMuaeAehJ5rvpfA57KTmHtTZnvfa/nl/Y9ASCwVs0="
 }

From ef24f13fc07c44bf13a0cd16f61aabdb166bddcc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 18:13:04 +0000
Subject: [PATCH 0765/1209] libarchive: 3.8.7 -> 3.8.8

---
 pkgs/by-name/li/libarchive/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix
index 8f9f756a2ee9..fe81d018859c 100644
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@@ -32,13 +32,13 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
-  version = "3.8.7";
+  version = "3.8.8";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-LpD+lE+0PZi/3nYDVPXhBQL9A7mvqelOzRLskVtg9Y0=";
+    hash = "sha256-l8xh+z6lP7VnxMIf9tfoSByerjwN6Z4dE3JNA9zS3LM=";
   };
 
   outputs = [

From df1af8eb905cc5e929b62b3b2b6e35d5fb2107ae Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Mon, 27 Apr 2026 15:45:34 +0200
Subject: [PATCH 0766/1209] python3Packages.gst-python: 1.26.11 -> 1.28.4

---
 .../python-modules/gst-python/default.nix     | 15 ++++++-------
 .../gst-python/fix-test-plugin-imports.patch  | 22 +++++++++++++++++++
 2 files changed, 29 insertions(+), 8 deletions(-)
 create mode 100644 pkgs/development/python-modules/gst-python/fix-test-plugin-imports.patch

diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index ab053e13b806..45c25c2550a6 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.26.11";
+  version = "1.28.4";
 
   pyproject = false;
 
@@ -32,14 +32,13 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-python/gst-python-${version}.tar.xz";
-    hash = "sha256-ETFrp2m1bSbYsUZMcZipkkyurkgTT321kXH68ac9xDY=";
+    hash = "sha256-xOs4JyC0RD+4AaU0GN/wvUzXR4cW1c7Uk1BKZ1tNCf0=";
   };
 
-  # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4322
-  postPatch = ''
-    substituteInPlace testsuite/meson.build \
-      --replace-fail "['gstinit', 'test_gst_init.py']," ""
-  '';
+  patches = [
+    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9918#note_3530752
+    ./fix-test-plugin-imports.patch
+  ];
 
   # Python 2.x is not supported.
   disabled = !isPy3k;
@@ -103,6 +102,6 @@ buildPythonPackage rec {
     homepage = "https://gstreamer.freedesktop.org";
     description = "Python bindings for GStreamer";
     license = lib.licenses.lgpl2Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 }
diff --git a/pkgs/development/python-modules/gst-python/fix-test-plugin-imports.patch b/pkgs/development/python-modules/gst-python/fix-test-plugin-imports.patch
new file mode 100644
index 000000000000..a08142a85a03
--- /dev/null
+++ b/pkgs/development/python-modules/gst-python/fix-test-plugin-imports.patch
@@ -0,0 +1,22 @@
+diff --git a/subprojects/gst-python/testsuite/test_plugin.py b/subprojects/gst-python/testsuite/test_plugin.py
+index 3ab299d54c..4ed1e85c82 100644
+--- a/testsuite/test_plugin.py
++++ b/testsuite/test_plugin.py
+@@ -18,14 +18,14 @@
+ # License along with this library; if not, write to the Free Software
+ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301  USA
+ 
+-from gi.repository import Gst
+-import gi
+-from common import TestCase, unittest
+ import overrides_hack
+ overrides_hack
+ 
++from common import TestCase, unittest
+ 
++import gi
+ gi.require_version("Gst", "1.0")
++from gi.repository import Gst
+ 
+ 
+ class TestPlugin(TestCase):

From 59c13e1be6d4a4ab2f2fe0a36ad7848c63178e10 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 29 Apr 2026 14:29:59 +0200
Subject: [PATCH 0767/1209] gstreamer: enable strictDeps/structuredAttrs

---
 pkgs/development/libraries/gstreamer/bad/default.nix     | 9 ++++++---
 pkgs/development/libraries/gstreamer/base/default.nix    | 1 +
 pkgs/development/libraries/gstreamer/core/default.nix    | 1 +
 .../development/libraries/gstreamer/devtools/default.nix | 5 +++++
 pkgs/development/libraries/gstreamer/ges/default.nix     | 5 +++++
 pkgs/development/libraries/gstreamer/good/default.nix    | 3 +++
 .../libraries/gstreamer/icamerasrc/default.nix           | 7 ++++++-
 pkgs/development/libraries/gstreamer/libav/default.nix   | 5 +++++
 .../libraries/gstreamer/rtsp-server/default.nix          | 5 +++++
 pkgs/development/libraries/gstreamer/ugly/default.nix    | 5 +++++
 pkgs/development/libraries/gstreamer/vaapi/default.nix   | 7 +++++--
 11 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 6f1333d287db..a29f2edff208 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -134,6 +134,12 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  # Argument list too long
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
@@ -390,9 +396,6 @@ stdenv.mkDerivation (finalAttrs: {
       ]
   );
 
-  # Argument list too long
-  strictDeps = true;
-
   postPatch = ''
     patchShebangs \
       scripts/extract-release-date-from-doap-file.py
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index ad2ce3e6f46b..a2a478c76ff2 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -64,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-qJiv1XZhcrAEnmeBVY4GiQmL+HudgrhGxlLlccAdYNg=";
   };
 
+  __structuredAttrs = true;
   strictDeps = true;
   depsBuildBuild = [
     pkg-config
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index bb44c1bf6de6..d50923558017 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  __structuredAttrs = true;
   strictDeps = true;
   nativeBuildInputs = [
     meson
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index aa976bd07f21..e856bd59b233 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -49,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-5VYzDwAMyVN2HR/sS8rCwTR7UW/tt60AS7wZMjx+w74=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   depsBuildBuild = [
     pkg-config
   ];
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 52a76936bf25..e41fa069923b 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -35,6 +35,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-b361Xlhxjd5bWGn2Ge2Q6/Owz6A3bBacG4P8dzgRkUo=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index a1f1eddc95e6..4a689f5d82c7 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -97,6 +97,9 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
   strictDeps = true;
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
index 35801332a7da..9bd3f34d49da 100644
--- a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
+++ b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
@@ -34,6 +34,11 @@ stdenv.mkDerivation {
     export STRIP_VIRTUAL_CHANNEL_CAMHAL=ON
   '';
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   buildInputs = [
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
@@ -46,7 +51,7 @@ stdenv.mkDerivation {
     apple-sdk_gstreamer
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error"
     # gstcameradeinterlace.cpp:55:10: fatal error: gst/video/video.h: No such file or directory
     "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0"
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 8d80eb36ec34..ecff969ca150 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-vRel3yh0p6WLy697lAIjN5rZYTYk246teD2wPnS7kEs=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 7ae3face595a..b71da6b03adb 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-v7Z4BUK/DUAnNiMq6ubFoblDxEV3W/QDBby4bKcHBaA=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index feb1fbaaeaa9..279dbb12b173 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -39,6 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-VIbNFFxa9DJZ/TfKylnQSOKmfdsHCC6o9Q7w8CqF+KU=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 1ad79efdda09..e5796cc6a9e8 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -48,6 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-8S+TAnPHodPg1/hblP+dE3nRYqzMky6Mo9OJk+0n/Kw=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
@@ -87,8 +92,6 @@ stdenv.mkDerivation (finalAttrs: {
     apple-sdk_gstreamer
   ];
 
-  strictDeps = true;
-
   mesonFlags = [
     "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
     (lib.mesonEnable "doc" enableDocumentation)

From 9fab97bbb3e5aebc164e49dd6aa241c4c81ec5c4 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 24 Jun 2026 09:14:58 +0200
Subject: [PATCH 0768/1209] nodejs_24: 24.17.0 -> 24.18.0

---
 pkgs/development/web/nodejs/v24.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index ae766cfeb5db..359e20891269 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "24.17.0";
-  sha256 = "a7ab562ed2369a29c68b72fa00e3103bcdfe37063dff799c6acc8e404e275fcd";
+  version = "24.18.0";
+  sha256 = "e94afde24db08e0c564ee7110a2d5aab51ee0059382c9fd8233c54eec47b28f9";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then

From 2ce8cee0973ed577b01d688ae41c3a5eee280e5c Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 24 Jun 2026 17:30:55 -0700
Subject: [PATCH 0769/1209] spirv-llvm-translator: add version for new LLVM 22

---
 pkgs/by-name/sp/spirv-llvm-translator/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/sp/spirv-llvm-translator/package.nix b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
index ce8f31de261d..a32d9481ee9c 100644
--- a/pkgs/by-name/sp/spirv-llvm-translator/package.nix
+++ b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
@@ -16,6 +16,11 @@ let
   llvmMajor = lib.versions.major llvm.version;
 
   versions = {
+    "22" = rec {
+      version = "22.1.3";
+      rev = "v${version}";
+      hash = "sha256-u/OytBH9LgAyGF9PX+5lmAbGPQ7iVv52w8mwQ+6fi/s=";
+    };
     "21" = rec {
       version = "21.1.0";
       rev = "v${version}";

From 3605cd7b4275c84e56f9ce67c20dcc969f9d226d Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 24 Jun 2026 17:33:43 -0700
Subject: [PATCH 0770/1209] spirv-headers: backport patch for SPIRV translator
 w/ LLVM 22

spirv-llvm-translator needs new definitions to compile with LLVM 22,
and there isn't a release containing this patch yet, so we must
backport it.

Additionally, switch spirv-llvm-translator to use `srcOnly` instead
of `.src` so that the new patch is picked up.
---
 pkgs/by-name/sp/spirv-headers/package.nix         | 6 ++++++
 pkgs/by-name/sp/spirv-llvm-translator/package.nix | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/sp/spirv-headers/package.nix b/pkgs/by-name/sp/spirv-headers/package.nix
index 3f4c75ed5962..ddb49d7af092 100644
--- a/pkgs/by-name/sp/spirv-headers/package.nix
+++ b/pkgs/by-name/sp/spirv-headers/package.nix
@@ -24,6 +24,12 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/1a22b167081842915a1c78a0b5b5a353a23284aa.diff";
       hash = "sha256-XUHfPHnk7bWK4vnozfW/84vaZN+rbFJUZSa6Og8GUAU=";
     })
+    # Backport new predicated load/store instructions, needed by spirv-llvm-translator
+    # Not in any tagged releases yet, should exist in the next release after 1.4.350.1.
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/b8a32968473ce852a809b9de5f04f02a5a9dfa78.patch";
+      hash = "sha256-59jmN28ifEhAxySXCpuGZ62jo1WVsRPnVosK8X4yrjM=";
+    })
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sp/spirv-llvm-translator/package.nix b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
index a32d9481ee9c..b86f3424f750 100644
--- a/pkgs/by-name/sp/spirv-llvm-translator/package.nix
+++ b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  srcOnly,
   fetchFromGitHub,
   fetchpatch,
   cmake,
@@ -84,7 +85,7 @@ stdenv.mkDerivation {
     "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
     # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
-    "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}"
+    "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${srcOnly spirv-headers}"
   ]
   ++ lib.optional (
     lib.toInt llvmMajor >= 19

From 4da4d4bc7bcb17ec91c2ab318ec8175bdf942ae6 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 24 Jun 2026 17:36:15 -0700
Subject: [PATCH 0771/1209] llvmPackages_22.libclc: prepare_builtins was
 removed in LLVM 22.1

Or more specifically, in:
https://github.com/llvm/llvm-project/commit/f07988ff3ec8b8b838f5c6ce9e1ec519e16432a9
---
 pkgs/development/compilers/llvm/common/libclc/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/llvm/common/libclc/default.nix b/pkgs/development/compilers/llvm/common/libclc/default.nix
index 62a8dff18ec3..69350a9d3834 100644
--- a/pkgs/development/compilers/llvm/common/libclc/default.nix
+++ b/pkgs/development/compilers/llvm/common/libclc/default.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [ llvm ];
   strictDeps = true;
 
-  postInstall = ''
+  postInstall = lib.optionalString (lib.versionOlder finalAttrs.version "22.1") ''
     install -Dt $dev/bin prepare_builtins
   '';
 

From c3d7e253bfdf5ce05f35bd8f4e8d2933ee977301 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:01 +0200
Subject: [PATCH 0772/1209] ocamlPackages.merlin: init at 5.8-505 for OCaml 5.5

---
 pkgs/development/tools/ocaml/merlin/4.x.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/tools/ocaml/merlin/4.x.nix b/pkgs/development/tools/ocaml/merlin/4.x.nix
index dbb685cf3d5b..5358e4aed773 100644
--- a/pkgs/development/tools/ocaml/merlin/4.x.nix
+++ b/pkgs/development/tools/ocaml/merlin/4.x.nix
@@ -34,6 +34,7 @@
       "5.3.0" = "5.6-503";
       "5.4.0" = "5.7.1-504";
       "5.4.1" = "5.7.1-504";
+      "5.5.0" = "5.8-505";
     }
     ."${ocaml.version}",
 }:
@@ -54,6 +55,7 @@ let
     "5.6-503" = "sha256-sNytCSqq96I/ZauaCJ6HYb1mXMcjV5CeCsbCGC9PwtQ=";
     "5.6-504" = "sha256-gtZIpBgNbVqjoIMhjii/GX9OnxR4hN6TArtoEa2Yt38=";
     "5.7.1-504" = "sha256-E5sHPPkUs4tyXFT3W4tkL2VMNJjQpLqM+oMf8CqJcNU=";
+    "5.8-505" = "sha256-VkLN6EhqhKrZj6XFkLcOjcxgdNf72zubjEayxbQvZTs=";
   };
 
 in

From 3a9a3fcc5aa7f43eba75da66cb17567323a6bba9 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:05 +0200
Subject: [PATCH 0773/1209] ocamlPackages.lsp: init at 1.27.0 for OCaml 5.5

---
 pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix | 9 ++++++++-
 pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix     | 4 +++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
index 1c6bd1dcab7a..de8d03343690 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
@@ -9,7 +9,9 @@
   lib,
   ocaml,
   version ?
-    if lib.versionAtLeast ocaml.version "5.4" then
+    if lib.versionAtLeast ocaml.version "5.5" then
+      "1.27.0"
+    else if lib.versionAtLeast ocaml.version "5.4" then
       "1.26.0"
     else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"
@@ -28,6 +30,11 @@
 let
   params =
     {
+      "1.27.0" = {
+        name = "lsp";
+        minimalOCamlVersion = "5.3";
+        sha256 = "sha256-BDrNaSP4pcuq2RVFI1cKsTlzuu72mOK1VTIT3WN5JxU=";
+      };
       "1.26.0" = {
         name = "lsp";
         minimalOCamlVersion = "5.3";
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
index 55ebec5fba50..660c4ff90b7a 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
@@ -25,7 +25,9 @@
   ocamlformat-rpc-lib,
   ocaml,
   version ?
-    if lib.versionAtLeast ocaml.version "5.4" then
+    if lib.versionAtLeast ocaml.version "5.5" then
+      "1.27.0"
+    else if lib.versionAtLeast ocaml.version "5.4" then
       "1.26.0"
     else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"

From eaa1851d424fd344072bf62cce4fd9abc2f12390 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:08 +0200
Subject: [PATCH 0774/1209] =?UTF-8?q?ocamlPackages.batteries:=20update=20f?=
 =?UTF-8?q?or=20OCaml=20=E2=89=A5=205.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/ocaml-modules/batteries/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/ocaml-modules/batteries/default.nix b/pkgs/development/ocaml-modules/batteries/default.nix
index 707c855b4944..6e30c7f50d09 100644
--- a/pkgs/development/ocaml-modules/batteries/default.nix
+++ b/pkgs/development/ocaml-modules/batteries/default.nix
@@ -3,20 +3,19 @@
   fetchFromGitHub,
   buildDunePackage,
   ocaml,
+  fetchpatch,
   ounit,
   qtest,
   qcheck,
   num,
   camlp-streams,
-  doCheck ? lib.versionAtLeast ocaml.version "4.08",
+  doCheck ? true,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "batteries";
   version = "3.10.0";
 
-  minimalOCamlVersion = "4.05";
-
   src = fetchFromGitHub {
     owner = "ocaml-batteries-team";
     repo = "batteries-included";
@@ -24,6 +23,11 @@ buildDunePackage (finalAttrs: {
     hash = "sha256-cD0O4kEDE58yCYnUuS83O1CJNHJuCGVhvKJSKQeQGkc=";
   };
 
+  patches = lib.optional (lib.versionAtLeast ocaml.version "5.5") (fetchpatch {
+    url = "https://github.com/ocaml-batteries-team/batteries-included/commit/f6e091266599aea93c8a94115cf08f50e88c5dd0.patch";
+    hash = "sha256-6CUcq24x4fnumduK4BJ5cVQ5DHPbVLyLUxl57q2JVtw=";
+  });
+
   nativeCheckInputs = [ qtest ];
   checkInputs = [
     ounit

From 61ae2648aa9c5a8afa131e115c6257c25522ac80 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:11 +0200
Subject: [PATCH 0775/1209] =?UTF-8?q?ocamlPackages.accessor=5Fcore:=20mark?=
 =?UTF-8?q?=20as=20broken=20with=20OCaml=20=E2=89=A5=205.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/ocaml-modules/janestreet/0.17.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/ocaml-modules/janestreet/0.17.nix b/pkgs/development/ocaml-modules/janestreet/0.17.nix
index 1250dfe2b447..dc1d5018bbcc 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.17.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.17.nix
@@ -60,6 +60,7 @@ with self;
     pname = "accessor_core";
     hash = "sha256-ku83ZfLtVI8FvQhrKcnJmhmoNlYcVMKx1tor5N8Nq7M=";
     meta.description = "Accessors for Core types, for use with the Accessor library";
+    meta.broken = lib.versionAtLeast ocaml.version "5.5";
     propagatedBuildInputs = [
       accessor_base
       core_kernel

From 463b1ae1c65ee7436eee40f4bfdd69b1d34bca21 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:13 +0200
Subject: [PATCH 0776/1209] =?UTF-8?q?ocamlPackages.ppx=5Fimport:=20mark=20?=
 =?UTF-8?q?as=20broken=20with=20OCaml=20=E2=89=A5=205.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/ocaml-modules/ppx_import/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/ocaml-modules/ppx_import/default.nix b/pkgs/development/ocaml-modules/ppx_import/default.nix
index fdd59a094f5e..185154a4ec7b 100644
--- a/pkgs/development/ocaml-modules/ppx_import/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_import/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchurl,
+  ocaml,
   buildDunePackage,
   ounit,
   ppx_deriving,
@@ -53,5 +54,6 @@ buildDunePackage {
     description = "Syntax extension for importing declarations from interface files";
     license = lib.licenses.mit;
     homepage = "https://github.com/ocaml-ppx/ppx_import";
+    broken = lib.versionAtLeast ocaml.version "5.5";
   };
 }

From 9fc9431347481b81764e019d6ab4b93130a17c76 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:16 +0200
Subject: [PATCH 0777/1209] =?UTF-8?q?frama-c:=20mark=20as=20broken=20with?=
 =?UTF-8?q?=20OCaml=20=E2=89=A5=205.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/fr/frama-c/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/fr/frama-c/package.nix b/pkgs/by-name/fr/frama-c/package.nix
index bb9229a8803a..e5e751dbe005 100644
--- a/pkgs/by-name/fr/frama-c/package.nix
+++ b/pkgs/by-name/fr/frama-c/package.nix
@@ -134,6 +134,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.unix;
     mainProgram = "frama-c";
-    broken = !lib.versionAtLeast ocamlPackages.ocaml.version "4.14";
+    broken =
+      !lib.versionAtLeast ocamlPackages.ocaml.version "4.14"
+      || lib.versionAtLeast ocamlPackages.ocaml.version "5.5";
   };
 })

From 5103b5b35b10b44256ac6398ea7a4f5b2e4f32fd Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 10:17:32 +0200
Subject: [PATCH 0778/1209] ocamlPackages.camlp4: fix eval for unsupported
 OCaml versions

---
 .../tools/ocaml/camlp4/default.nix            | 291 +++++++++---------
 1 file changed, 147 insertions(+), 144 deletions(-)

diff --git a/pkgs/development/tools/ocaml/camlp4/default.nix b/pkgs/development/tools/ocaml/camlp4/default.nix
index 9b28e342de4c..caea5a20711d 100644
--- a/pkgs/development/tools/ocaml/camlp4/default.nix
+++ b/pkgs/development/tools/ocaml/camlp4/default.nix
@@ -9,150 +9,153 @@
   findlib,
 }:
 
-if lib.versionAtLeast ocaml.version "5.5" then
-  throw "camlp4 is not available for OCaml ${ocaml.version}"
-else
-
-  let
-    param =
-      {
-        "4.02" = {
-          version = "4.02+6";
-          sha256 = "06yl4q0qazl7g25b0axd1gdkfd4qpqzs1gr5fkvmkrcbz113h1hj";
-        };
-        "4.03" = {
-          version = "4.03+1";
-          sha256 = "1f2ndch6f1m4fgnxsjb94qbpwjnjgdlya6pard44y6n0dqxi1wsq";
-        };
-        "4.04" = {
-          version = "4.04+1";
-          sha256 = "1ad7rygqjxrc1im95gw9lp8q83nhdaf383f2808f1p63yl42xm7k";
-        };
-        "4.05" = {
-          version = "4.05+1";
-          sha256 = "0wm795hpwvwpib9c9z6p8kw2fh7p7b2hml6g15z8zry3y7w738sv";
-        };
-        "4.06" = {
-          version = "4.06+1";
-          sha256 = "0fazfw2l7wdmbwnqc22xby5n4ri1wz27lw9pfzhsbcdrighykysf";
-        };
-        "4.07" = {
-          version = "4.07+1";
-          sha256 = "0cxl4hkqcvspvkx4f2k83217rh6051fll9i2yz7cw6m3bq57mdvl";
-        };
-        "4.08" = {
-          version = "4.08+1";
-          sha256 = "0qplawvxwai25bi27niw2cgz2al01kcnkj8wxwhxslpi21z6pyx1";
-        };
-        "4.09" = {
-          version = "4.09+1";
-          sha256 = "1gr33x6xs1rs0bpyq4vzyfxd6vn47jfkg8imi81db2r0cbs0kxx1";
-        };
-        "4.10" = {
-          version = "4.10+1";
-          sha256 = "093bc1c28wid5li0jwglnd4p3csxw09fmbs9ffybq2z41a5mgay6";
-        };
-        "4.11" = {
-          version = "4.11+1";
-          sha256 = "0sn7f6im940qh0ixmx1k738xrwwdvy9g7r19bv5218jb6mh0g068";
-        };
-        "4.12" = {
-          version = "4.12+1";
-          sha256 = "1cfk5ppnd511vzsr9gc0grxbafmh0m3m897aij198rppzxps5kyz";
-        };
-        "4.13" = {
-          version = "4.13+1";
-          sha256 = "0fzxa1zdhk74mlxpin7p90flks6sp4gkc0mfclmj9zak15rii55n";
-        };
-        "4.14" = {
-          version = "4.14+1";
-          sha256 = "sha256-cPN3GioZT/Zt6uzbjGUPEGVJcPQdsAnCkU/AQoPfvuo=";
-        };
-        "5.0" = {
-          version = "5.0";
-          sha256 = "sha256-oZptFNPUEAq5YlcqAoDWfLghGMF9AN7E7hUN55SAX+4=";
-        };
-        "5.1" = {
-          version = "5.1";
-          sha256 = "sha256-Ubedjg3BeHA0bJbEalQN9eEk5+LRAI/er+8mWfVYchg=";
-        };
-        "5.2" = {
-          version = "5.2";
-          sha256 = "sha256-lzbc9xsgeYlbVf71O+PWYS14QivAH1aPdnvWhe0HHME=";
-        };
-        "5.3" = {
-          version = "5.3";
-          sha256 = "sha256-V/kKhTP9U4jWDFuQKuB7BS3XICg1lq/2Avj7UJR55+k=";
-        };
-        "5.4" = {
-          version = "5.4";
-          sha256 = "sha256-7FsKEr0cRVF4LIOvROWMyXBefRTBaS66ZqwtP2VLefM=";
-        };
-      }
-      .${ocaml.meta.branch};
-  in
-
-  stdenv.mkDerivation rec {
-    pname = "camlp4";
-    inherit (param) version;
-
-    src = fetchzip {
-      url = "https://github.com/ocaml/camlp4/archive/${version}.tar.gz";
-      inherit (param) sha256;
+let
+  params = {
+    "4.02" = {
+      version = "4.02+6";
+      sha256 = "06yl4q0qazl7g25b0axd1gdkfd4qpqzs1gr5fkvmkrcbz113h1hj";
     };
-
-    strictDeps = true;
-
-    nativeBuildInputs = [
-      which
-      ocaml
-      ocamlbuild
-    ]
-    ++ lib.optionals (lib.versionAtLeast ocaml.version "5.0") [
-      findlib
-    ];
-
-    buildInputs = lib.optionals (lib.versionAtLeast ocaml.version "5.0") [
-      camlp-streams
-      ocamlbuild
-    ];
-
-    # build fails otherwise
-    enableParallelBuilding = false;
-
-    dontAddPrefix = true;
-
-    preConfigure = ''
-      # increase stack space for spacetime variant of the compiler
-      # https://github.com/ocaml/ocaml/issues/7435
-      # but disallowed by darwin sandbox
-      ulimit -s unlimited || true
-
-      configureFlagsArray=(
-        --bindir=$out/bin
-        --libdir=$out/lib/ocaml/${ocaml.version}/site-lib
-        --pkgdir=$out/lib/ocaml/${ocaml.version}/site-lib
-      )
-    '';
-
-    postConfigure = ''
-      substituteInPlace camlp4/META.in \
-      --replace +camlp4 $out/lib/ocaml/${ocaml.version}/site-lib/camlp4
-    '';
-
-    makeFlags = [ "all" ];
-
-    installTargets = [
-      "install"
-      "install-META"
-    ];
-
-    dontStrip = true;
-
-    meta = {
-      description = "Software system for writing extensible parsers for programming languages";
-      homepage = "https://github.com/ocaml/camlp4";
-      platforms = ocaml.meta.platforms or [ ];
-      license = lib.licenses.WITH lib.licenses.lgpl2Only lib.licenses.ocamlLgplLinkingException;
+    "4.03" = {
+      version = "4.03+1";
+      sha256 = "1f2ndch6f1m4fgnxsjb94qbpwjnjgdlya6pard44y6n0dqxi1wsq";
     };
+    "4.04" = {
+      version = "4.04+1";
+      sha256 = "1ad7rygqjxrc1im95gw9lp8q83nhdaf383f2808f1p63yl42xm7k";
+    };
+    "4.05" = {
+      version = "4.05+1";
+      sha256 = "0wm795hpwvwpib9c9z6p8kw2fh7p7b2hml6g15z8zry3y7w738sv";
+    };
+    "4.06" = {
+      version = "4.06+1";
+      sha256 = "0fazfw2l7wdmbwnqc22xby5n4ri1wz27lw9pfzhsbcdrighykysf";
+    };
+    "4.07" = {
+      version = "4.07+1";
+      sha256 = "0cxl4hkqcvspvkx4f2k83217rh6051fll9i2yz7cw6m3bq57mdvl";
+    };
+    "4.08" = {
+      version = "4.08+1";
+      sha256 = "0qplawvxwai25bi27niw2cgz2al01kcnkj8wxwhxslpi21z6pyx1";
+    };
+    "4.09" = {
+      version = "4.09+1";
+      sha256 = "1gr33x6xs1rs0bpyq4vzyfxd6vn47jfkg8imi81db2r0cbs0kxx1";
+    };
+    "4.10" = {
+      version = "4.10+1";
+      sha256 = "093bc1c28wid5li0jwglnd4p3csxw09fmbs9ffybq2z41a5mgay6";
+    };
+    "4.11" = {
+      version = "4.11+1";
+      sha256 = "0sn7f6im940qh0ixmx1k738xrwwdvy9g7r19bv5218jb6mh0g068";
+    };
+    "4.12" = {
+      version = "4.12+1";
+      sha256 = "1cfk5ppnd511vzsr9gc0grxbafmh0m3m897aij198rppzxps5kyz";
+    };
+    "4.13" = {
+      version = "4.13+1";
+      sha256 = "0fzxa1zdhk74mlxpin7p90flks6sp4gkc0mfclmj9zak15rii55n";
+    };
+    "4.14" = {
+      version = "4.14+1";
+      sha256 = "sha256-cPN3GioZT/Zt6uzbjGUPEGVJcPQdsAnCkU/AQoPfvuo=";
+    };
+    "5.0" = {
+      version = "5.0";
+      sha256 = "sha256-oZptFNPUEAq5YlcqAoDWfLghGMF9AN7E7hUN55SAX+4=";
+    };
+    "5.1" = {
+      version = "5.1";
+      sha256 = "sha256-Ubedjg3BeHA0bJbEalQN9eEk5+LRAI/er+8mWfVYchg=";
+    };
+    "5.2" = {
+      version = "5.2";
+      sha256 = "sha256-lzbc9xsgeYlbVf71O+PWYS14QivAH1aPdnvWhe0HHME=";
+    };
+    "5.3" = {
+      version = "5.3";
+      sha256 = "sha256-V/kKhTP9U4jWDFuQKuB7BS3XICg1lq/2Avj7UJR55+k=";
+    };
+    "5.4" = {
+      version = "5.4";
+      sha256 = "sha256-7FsKEr0cRVF4LIOvROWMyXBefRTBaS66ZqwtP2VLefM=";
+    };
+  };
+  param = {
+    # Dummy version to let the `meta` attribute set evaluate
+    version = "";
+    sha256 = lib.fakeSha256;
   }
+  // (params.${ocaml.meta.branch} or {
+  }
+  );
+in
+
+stdenv.mkDerivation rec {
+  pname = "camlp4";
+  inherit (param) version;
+
+  src = fetchzip {
+    url = "https://github.com/ocaml/camlp4/archive/${version}.tar.gz";
+    inherit (param) sha256;
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    which
+    ocaml
+    ocamlbuild
+  ]
+  ++ lib.optionals (lib.versionAtLeast ocaml.version "5.0") [
+    findlib
+  ];
+
+  buildInputs = lib.optionals (lib.versionAtLeast ocaml.version "5.0") [
+    camlp-streams
+    ocamlbuild
+  ];
+
+  # build fails otherwise
+  enableParallelBuilding = false;
+
+  dontAddPrefix = true;
+
+  preConfigure = ''
+    # increase stack space for spacetime variant of the compiler
+    # https://github.com/ocaml/ocaml/issues/7435
+    # but disallowed by darwin sandbox
+    ulimit -s unlimited || true
+
+    configureFlagsArray=(
+      --bindir=$out/bin
+      --libdir=$out/lib/ocaml/${ocaml.version}/site-lib
+      --pkgdir=$out/lib/ocaml/${ocaml.version}/site-lib
+    )
+  '';
+
+  postConfigure = ''
+    substituteInPlace camlp4/META.in \
+    --replace +camlp4 $out/lib/ocaml/${ocaml.version}/site-lib/camlp4
+  '';
+
+  makeFlags = [ "all" ];
+
+  installTargets = [
+    "install"
+    "install-META"
+  ];
+
+  dontStrip = true;
+
+  meta = {
+    description = "Software system for writing extensible parsers for programming languages";
+    homepage = "https://github.com/ocaml/camlp4";
+    platforms = ocaml.meta.platforms;
+    license = lib.licenses.WITH lib.licenses.lgpl2Only lib.licenses.ocamlLgplLinkingException;
+    broken = !(params ? ${ocaml.meta.branch});
+  };
+}

From 844b1a9267f1994ea1a11ee99f7bb62e630f6850 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:21 +0200
Subject: [PATCH 0779/1209] ocamlPackages_5_5.ocaml: init at 5.5.0

---
 pkgs/development/compilers/ocaml/5.5.nix | 6 ++++++
 pkgs/top-level/ocaml-packages.nix        | 4 +++-
 2 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/compilers/ocaml/5.5.nix

diff --git a/pkgs/development/compilers/ocaml/5.5.nix b/pkgs/development/compilers/ocaml/5.5.nix
new file mode 100644
index 000000000000..8ed4b494db7c
--- /dev/null
+++ b/pkgs/development/compilers/ocaml/5.5.nix
@@ -0,0 +1,6 @@
+import ./generic.nix {
+  major_version = "5";
+  minor_version = "5";
+  patch_version = "0";
+  sha256 = "sha256-/MauZl0exR1SUQ6qx4NKhqmAa/WiWLt8ynhzP8zwFbo=";
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 71cfe7da5118..e9ab2b42c35c 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2400,7 +2400,9 @@ rec {
 
   ocamlPackages_5_4 = mkOcamlPackages (callPackage ../development/compilers/ocaml/5.4.nix { });
 
-  ocamlPackages_latest = ocamlPackages_5_4;
+  ocamlPackages_5_5 = mkOcamlPackages (callPackage ../development/compilers/ocaml/5.5.nix { });
+
+  ocamlPackages_latest = ocamlPackages_5_5;
 
   ocamlPackages = ocamlPackages_5_4;
 

From 940ca9b84b0a7b066ee8179dce01fbe03367ab46 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 24 Jun 2026 07:24:23 -0400
Subject: [PATCH 0780/1209] curlMinimal: 8.20.0 -> 8.21.0

https://github.com/curl/curl/releases/tag/curl-8_21_0

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 .../curlMinimal/fix-wakeup-consumption.patch  | 32 -------------------
 pkgs/by-name/cu/curlMinimal/package.nix       | 11 ++-----
 2 files changed, 2 insertions(+), 41 deletions(-)
 delete mode 100644 pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch

diff --git a/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch b/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
deleted file mode 100644
index 0bc04b60bb87..000000000000
--- a/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 2a2104f3cff44bb28bb570a093be52bbeeed8f23 Mon Sep 17 00:00:00 2001
-From: Stefan Eissing <stefan@eissing.org>
-Date: Mon, 11 May 2026 14:56:04 +0200
-Subject: [PATCH] event: fix wakeup consumption
-
-The events on a multi wakeup socketpair were only consumed via
-curl_multi_poll()/curl_multi_wait() but not in event based processing on
-a curl_multi_socket() call. That led to busy loops as reported in
-
-Fixes #21547
-Reported-by: Earnestly on github
-Closes #21549
----
- lib/multi.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/lib/multi.c b/lib/multi.c
-index be32740a7097..5e84133f13fd 100644
---- a/lib/multi.c
-+++ b/lib/multi.c
-@@ -2703,6 +2703,11 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
-   Curl_uint32_bset_remove(&multi->dirty, data->mid);
- 
-   if(data == multi->admin) {
-+#ifdef ENABLE_WAKEUP
-+    /* Consume any pending wakeup signals before processing.
-+     * This is necessary for event based processing. See #21547 */
-+    (void)Curl_wakeup_consume(multi->wakeup_pair, TRUE);
-+#endif
- #ifdef USE_RESOLV_THREADED
-     Curl_async_thrdd_multi_process(multi);
- #endif
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index a25ea809c62b..832ffbbd04b6 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -84,7 +84,7 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.20.0";
+  version = "8.21.0";
 
   src = fetchurl {
     urls = [
@@ -93,16 +93,9 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-Y/4twUi6DOromSLvg49+XJRicsLni3xZ+rS3nTziuJY=";
+    hash = "sha256-qhtmpw6s6D3GJFCHRWRsCK5WHeUSq0A63/uTrIf8cuY=";
   };
 
-  patches = [
-    # https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
-    # According to <https://curl.se/mail/distros-2026-05/0000.html>, this fixes
-    # a performance regression, causing high CPU usage
-    ./fix-wakeup-consumption.patch
-  ];
-
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''

From ce113a1be55206fbb91c1969cb82f615d4dfc7ff Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 24 Jun 2026 22:46:44 -0400
Subject: [PATCH 0781/1209] Revert "python3Packages.pycapnp: backport patch for
 py314 compat"

This reverts commit 9518afa893a183c0154b8597d6f5cd587dc1b5a1.

Patch already included in 2.2.3 which causes applying the patch to fail
---
 pkgs/development/python-modules/pycapnp/default.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/development/python-modules/pycapnp/default.nix b/pkgs/development/python-modules/pycapnp/default.nix
index c5c58935f5d4..d60a1b28d4b3 100644
--- a/pkgs/development/python-modules/pycapnp/default.nix
+++ b/pkgs/development/python-modules/pycapnp/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   replaceVars,
   fetchFromGitHub,
-  fetchpatch,
   setuptools,
   wheel,
   capnproto,
@@ -36,12 +35,6 @@ buildPythonPackage rec {
     # other than the builtin schemas (based on quick GitHub code search), so I don't
     # think it's worthwhile.
     (replaceVars ./include-paths.patch { inherit capnproto; })
-
-    (fetchpatch {
-      url = "https://github.com/capnproto/pycapnp/commit/aa90ab6844df4718f02e2ca4974858d5ab0b079c.patch";
-      name = "python314-compat.patch";
-      hash = "sha256-pscOdgPotLZsW0XWyRTJigIDl3uWOizA1W0gQGZHSyg=";
-    })
   ];
 
   build-system = [

From 200ea92beda611794cfea33cfe23b314fab66d00 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 24 Jun 2026 21:55:37 -0400
Subject: [PATCH 0782/1209] lix: revert performance patch for curl

curl 8.21.0 contains
https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
which breaks lix for some reason. Revert this single change just for lix
as a workaround

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 .../tools/package-management/lix/common-lix.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index d5277055efd2..fdd550e8c8d1 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -39,6 +39,7 @@ assert lib.assertMsg (
   darwin,
   doxygen,
   editline,
+  fetchpatch2,
   flex,
   git,
   gtest,
@@ -127,16 +128,24 @@ let
         substitute $inputPath $out --replace-fail @deps@ "$(cat ${deps})"
       '';
 
-  # https://github.com/NixOS/nixpkgs/pull/525953 backported a performance patch
-  # that /somehow/ breaks Lix unit tests.
-  # FIXME revert when the patch is gone in curl drv
+  # curl 8.21.0 /somehow/ breaks Lix unit tests.
+  # See https://github.com/NixOS/nixpkgs/issues/534713
+  # FIXME remove once fixed
   curl-fixed = curl.overrideAttrs (
     {
       patches ? [ ],
       ...
     }:
     {
-      patches = lib.filter (patch: !lib.strings.hasSuffix "fix-wakeup-consumption.patch" patch) patches;
+      patches = patches ++ [
+        # See https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
+        (fetchpatch2 {
+          name = "fix-wakeup-consumption-revert.patch";
+          url = "https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23.patch";
+          hash = "sha256-dkwr1ZaR7XB408JxeIKhuHxJrlwf3J01jL6lnOLXo1I=";
+          revert = true;
+        })
+      ];
     }
   );
 in

From 64274e3429a380ed40d984556ec33db0534a9db0 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Thu, 25 Jun 2026 13:41:03 -0400
Subject: [PATCH 0783/1209] expat: 2.8.1 -> 2.8.2

blog: https://blog.hartwork.org/posts/expat-2-8-2-released/
changelog: https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes
diff: https://github.com/libexpat/libexpat/compare/R_2_8_1...R_2_8_2

Fixes: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403,
       CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407,
       CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411,
       CVE-2026-56412
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index 78ff9e9253b0..72459e1c2ac6 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.8.1";
+  version = "2.8.2";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-ELGV7ngWCpCDiBgKj+NgPU6aEvR1X79fOBayOp11DaA=";
+    hash = "sha256-OtibhYjmZEvU5JmBSA1IshKJ7rvNTwoaSvscKfmbarQ=";
   };
 
   strictDeps = true;

From 2c9c1c82efe822bf5b15512bb1cb1b0b3a9fd8e1 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Thu, 25 Jun 2026 21:19:36 +0200
Subject: [PATCH 0784/1209] libressl: fix static build

I broke the static build when I introduced the check that guards against
executable stack. It iterates the .so files in the build output, but for
a static build, there are none, so the glob fails. Fix this by skipping
the check for static builds.
---
 pkgs/by-name/li/libressl/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 4bf139efc381..7d00a05424d7 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -64,7 +64,7 @@ let
         export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
         export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
       ''
-      + lib.optionalString stdenv.hostPlatform.isElf ''
+      + lib.optionalString (stdenv.hostPlatform.isElf && buildShared) ''
         # Bail if any shared object has executable stack enabled. This can
         # happen when an object produced from an assmbly file in libcrypto is
         # missing a .note.GNU-stack section. An executable stack is dangerous

From 2a567867307bdff584db00ba93b9a6d320ad136b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 25 Jun 2026 22:47:06 +0100
Subject: [PATCH 0785/1209] socat: 1.8.1.1 -> 1.8.1.2

Changes: http://www.dest-unreach.org/socat/CHANGES
---
 pkgs/by-name/so/socat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/so/socat/package.nix b/pkgs/by-name/so/socat/package.nix
index 40f1308046a3..e4e6a23e58ed 100644
--- a/pkgs/by-name/so/socat/package.nix
+++ b/pkgs/by-name/so/socat/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "socat";
-  version = "1.8.1.1";
+  version = "1.8.1.2";
 
   src = fetchurl {
     url = "http://www.dest-unreach.org/socat/download/socat-${version}.tar.bz2";
-    hash = "sha256-Xrxja39CcFP5iAZpZSFlOmFMfgZGSRA1PL9U4jJ63Bs=";
+    hash = "sha256-Dht+rAxuPW+k1Vtjx/zd8D9KLqpZ+pOx8w3Cxz1Cqg0=";
   };
 
   postPatch = ''

From 0db12fb6e4d5be16ef13c0c5fed739739af703c4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 00:31:38 +0000
Subject: [PATCH 0786/1209] uthash: 2.3.0 -> 2.4.0

---
 pkgs/by-name/ut/uthash/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/uthash/package.nix b/pkgs/by-name/ut/uthash/package.nix
index 03576564438c..60296d2114d7 100644
--- a/pkgs/by-name/ut/uthash/package.nix
+++ b/pkgs/by-name/ut/uthash/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uthash";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "troydhanson";
     repo = "uthash";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-F0M5ENT3bMn3dD16Oaq9mBFYOWzVliVWupAIrLc2nkQ=";
+    sha256 = "sha256-pEuBQVQSszuL7dIPZYSAyrr3tf6BTc/NWMBoFESCYkw=";
   };
 
   doCheck = true;

From 6eb243853e0700bf5d4df5f69ea4f3edd735544f Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 26 Jun 2026 06:04:49 +0200
Subject: [PATCH 0787/1209] ocamlPackages.camlp4: init at 5.5+1 for OCaml 5.5

---
 pkgs/development/tools/ocaml/camlp4/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/tools/ocaml/camlp4/default.nix b/pkgs/development/tools/ocaml/camlp4/default.nix
index caea5a20711d..ae434dbddeb7 100644
--- a/pkgs/development/tools/ocaml/camlp4/default.nix
+++ b/pkgs/development/tools/ocaml/camlp4/default.nix
@@ -83,6 +83,10 @@ let
       version = "5.4";
       sha256 = "sha256-7FsKEr0cRVF4LIOvROWMyXBefRTBaS66ZqwtP2VLefM=";
     };
+    "5.5" = {
+      version = "5.5+1";
+      sha256 = "sha256-ERzTg6CFXm1Z0/NSXP5MwM0H/fSpN/4D2ISFcJa1qSI=";
+    };
   };
   param = {
     # Dummy version to let the `meta` attribute set evaluate

From 17a4d7bc6a1c51a7792c3ad6c3688fd966a8c498 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:22:25 +0000
Subject: [PATCH 0788/1209] stdenv/darwin: drop `x86_64-darwin` bootstrap tools

---
 .../bootstrap-files/x86_64-apple-darwin.nix   | 22 -------------------
 pkgs/stdenv/darwin/default.nix                |  2 +-
 2 files changed, 1 insertion(+), 23 deletions(-)
 delete mode 100644 pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix

diff --git a/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix b/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix
deleted file mode 100644
index 1f4bf0b7cf1f..000000000000
--- a/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
-# $ ./refresh-tarballs.bash --targets=x86_64-apple-darwin
-#
-# Metadata:
-# - nixpkgs revision: d8657587c0c1ce2191b4b489299c386b5b7148c6
-# - hydra build: https://hydra.nixos.org/job/nixpkgs/trunk/stdenvBootstrapTools.x86_64-apple-darwin.build/latest
-# - resolved hydra build: https://hydra.nixos.org/build/290554343
-# - instantiated derivation: /nix/store/38sk9c8s4zyhjrifcr9cd3a8d9hyi4zj-stdenv-bootstrap-tools.drv
-# - output directory: /nix/store/y617yisg19x2pj34hzxg9zcm3wlsfj29-stdenv-bootstrap-tools
-# - build time: Thu, 20 Feb 2025 12:38:34 +0000
-{
-  bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d8657587c0c1ce2191b4b489299c386b5b7148c6/bootstrap-tools.tar.xz";
-    hash = "sha256-gtkeaUaV8ZXY8JxEkyd7ZeB75MESpsBPjaux0B2c0lE=";
-  };
-  unpack = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d8657587c0c1ce2191b4b489299c386b5b7148c6/unpack.nar.xz";
-    hash = "sha256-vgfZGKo6I565ORLZ/AGKh6SUpgLhgaanFuhYk897+zw=";
-    name = "unpack";
-    unpack = true;
-  };
-}
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 7bb4082bd6f7..f98c8ce0a53d 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -18,7 +18,7 @@
     if localSystem.isAarch64 then
       import ./bootstrap-files/aarch64-apple-darwin.nix
     else
-      import ./bootstrap-files/x86_64-apple-darwin.nix
+      throw "Unsupported platform for the Darwin stdenv"
   ),
 }:
 

From b4a2fd42de3ad1015fd166cd85b438d09c2d42d2 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:23:31 +0000
Subject: [PATCH 0789/1209] nixos/nixpkgs: replace `x86_64-darwin` in test

---
 nixos/modules/misc/nixpkgs/test.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/misc/nixpkgs/test.nix b/nixos/modules/misc/nixpkgs/test.nix
index 1d4eff6a72cd..96c461cf795b 100644
--- a/nixos/modules/misc/nixpkgs/test.nix
+++ b/nixos/modules/misc/nixpkgs/test.nix
@@ -36,7 +36,7 @@ let
     nixpkgs.hostPlatform = "aarch64-linux";
     nixpkgs.buildPlatform = "aarch64-darwin";
     nixpkgs.system = "x86_64-linux";
-    nixpkgs.localSystem.system = "x86_64-darwin";
+    nixpkgs.localSystem.system = "x86_64-freebsd";
     nixpkgs.crossSystem.system = "i686-linux";
     imports = [
       {

From c11129861a4d2816f76fe1e277c9a90662186ba5 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:59:08 +0000
Subject: [PATCH 0790/1209] nixos/testing: drop `x86_64-darwin` support

---
 nixos/lib/testing/nodes.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/lib/testing/nodes.nix b/nixos/lib/testing/nodes.nix
index f83f268c88b3..6a90990b1829 100644
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@@ -27,7 +27,6 @@ let
     else
       let
         hostToGuest = {
-          "x86_64-darwin" = "x86_64-linux";
           "aarch64-darwin" = "aarch64-linux";
         };
 

From 77b50cc00fe8bc9d219824508b1b2cb6c720447b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:57:38 +0000
Subject: [PATCH 0791/1209] nixos/lib/qemu-common: drop `x86_64-darwin` support

---
 nixos/lib/qemu-common.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/nixos/lib/qemu-common.nix b/nixos/lib/qemu-common.nix
index 9ff482b83f3a..346d3ffcef5a 100644
--- a/nixos/lib/qemu-common.nix
+++ b/nixos/lib/qemu-common.nix
@@ -46,15 +46,10 @@ rec {
         powerpc64-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
         riscv32-linux = "${qemuPkg}/bin/qemu-system-riscv32 -machine virt";
         riscv64-linux = "${qemuPkg}/bin/qemu-system-riscv64 -machine virt";
-        x86_64-darwin = "${qemuPkg}/bin/qemu-system-x86_64 -machine accel=${accel "kvm"} -cpu max";
       };
       otherHostGuestMatrix = {
         aarch64-darwin = {
           aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -machine virt,gic-version=2,accel=${accel "hvf"} -cpu max";
-          inherit (otherHostGuestMatrix.x86_64-darwin) x86_64-linux;
-        };
-        x86_64-darwin = {
-          x86_64-linux = "${qemuPkg}/bin/qemu-system-x86_64 -machine type=q35,accel=${accel "hvf"} -cpu max";
         };
       };
 

From ac9d740544ddd0b60d18e97394d3cf172120abaf Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:58:06 +0000
Subject: [PATCH 0792/1209] nixos/qemu-vm: replace `x86_64-darwin` in example

---
 nixos/modules/virtualisation/qemu-vm.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 8d2817c23bf0..d99a491b8579 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -740,7 +740,7 @@ in
       default = pkgs;
       defaultText = literalExpression "pkgs";
       example = literalExpression ''
-        import pkgs.path { system = "x86_64-darwin"; }
+        import pkgs.path { system = "aarch64-darwin"; }
       '';
       description = ''
         Package set to use for the host-specific packages of the VM runner.

From 4c84757778f06303649662c0eac4c5d8a8e3ca0a Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 06:01:41 +0000
Subject: [PATCH 0793/1209] nixos/tests/installer: drop `x86_64-darwin` support

---
 nixos/tests/installer.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 76b3b62c0389..e3d184c42a15 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -677,7 +677,6 @@ let
         # non-EFI tests can only run on x86
         platforms = mkIf (!isEfi) [
           "x86_64-linux"
-          "x86_64-darwin"
           "i686-linux"
         ];
         inherit broken;

From ca72a42fcb1c2b96ae0cf8f2a5d767a81db87e9f Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 09:46:51 +0000
Subject: [PATCH 0794/1209] release-haskell: drop `x86_64-darwin` mention in
 comment

---
 pkgs/top-level/release-haskell.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 847843a8e307..686d09922259 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -204,11 +204,11 @@ let
   #   -> AttrSet
   #
   # > attrSet = {
-  #     foo = ["aarch64-linux" "x86_64-darwin" "x86_64-linux"];
+  #     foo = ["aarch64-linux" "aarch64-darwin" "x86_64-linux"];
   #     bar.baz = ["aarch64-linux" "x86_64-linux"];
-  #     bar.quux = ["aarch64-linux" "x86_64-darwin"];
+  #     bar.quux = ["aarch64-linux" "aarch64-darwin"];
   #   }
-  # > removePlatforms ["aarch64-linux" "x86_64-darwin"] attrSet
+  # > removePlatforms ["aarch64-linux" "aarch64-darwin"] attrSet
   # {
   #   foo = ["x86_64-linux"];
   #   bar = {

From e6c5b18fba4b00bdd52c1006387c77a21432e284 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 06:00:18 +0000
Subject: [PATCH 0795/1209] maintainers/scripts/haskell/hydra-report: drop
 `x86_64-darwin` support

---
 maintainers/scripts/haskell/hydra-report.hs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/maintainers/scripts/haskell/hydra-report.hs b/maintainers/scripts/haskell/hydra-report.hs
index 263d0aa50e6e..5ef28baa41e0 100755
--- a/maintainers/scripts/haskell/hydra-report.hs
+++ b/maintainers/scripts/haskell/hydra-report.hs
@@ -272,7 +272,7 @@ instance FromJSON JobMaintainers where
 -- @@
 --  fromList
 --    [ ("arion.aarch64-linux", ["rob22"])
---    , ("conduit.x86_64-darwin", ["snoyb", "webber"])
+--    , ("conduit.aarch64-darwin", ["snoyb", "webber"])
 --    ]
 -- @@
 type MaintainerMap = Map JobName (NonEmpty Text)
@@ -404,15 +404,13 @@ platformIcon :: Platform -> Text
 platformIcon (Platform x) = case x of
    "x86_64-linux" -> "🐧"
    "aarch64-linux" -> "📱"
-   "x86_64-darwin" -> "🍎"
-   "aarch64-darwin" -> "🍏"
+   "aarch64-darwin" -> "🍎"
    _ -> x
 
 platformIsOS :: OS -> Platform -> Bool
 platformIsOS os (Platform x) = case (os, x) of
    (Linux, "x86_64-linux") -> True
    (Linux, "aarch64-linux") -> True
-   (Darwin, "x86_64-darwin") -> True
    (Darwin, "aarch64-darwin") -> True
    _ -> False
 

From a4f45c476d7270d51e64d1e8b4d1f56886456f6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 00:28:26 -0700
Subject: [PATCH 0796/1209] python3Packages.libtfr: use setuptools_80

Otherwise it fails to build with

    ModuleNotFoundError: No module named 'pkg_resources'
---
 pkgs/development/python-modules/libtfr/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/libtfr/default.nix b/pkgs/development/python-modules/libtfr/default.nix
index 4a66aa6b71ea..cbc89c8da6e0 100644
--- a/pkgs/development/python-modules/libtfr/default.nix
+++ b/pkgs/development/python-modules/libtfr/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
 
   # build-system
-  setuptools,
+  setuptools_80,
   pkg-config,
   cython,
   pkgconfig,
@@ -38,7 +38,7 @@ buildPythonPackage rec {
   ];
 
   build-system = [
-    setuptools
+    setuptools_80
   ];
 
   dependencies = [

From 37be0a2dedace2a185db8ae448dd848aedbfadde Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 26 Jun 2026 10:12:41 +0100
Subject: [PATCH 0797/1209] Revert "gccNGPackages_15: 15.2.0 -> 15.3.0"

This reverts commit a960983be330dfaff54f72c4fd50b1b47eafbcec.
---
 pkgs/development/compilers/gcc/ng/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/gcc/ng/default.nix b/pkgs/development/compilers/gcc/ng/default.nix
index 4eb9ca23b9b5..c849367aa1fc 100644
--- a/pkgs/development/compilers/gcc/ng/default.nix
+++ b/pkgs/development/compilers/gcc/ng/default.nix
@@ -14,7 +14,7 @@
 }@packageSetArgs:
 let
   versions = {
-    "15.3.0".officialRelease.sha256 = "sha256-+lnBvu+JlfJ8TXHB3yJ1hxiTFdPm+v8btDBuYbDFMOs=";
+    "15.2.0".officialRelease.sha256 = "sha256-Q4/ZloJrDIJIWinaA6ctcdbjVBqD7HAt9Ccfb+Al0k4=";
   }
   // gccVersions;
 

From 035141be98cd7f4d904535ce60ffcbeb360ccf32 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 26 Jun 2026 10:12:41 +0100
Subject: [PATCH 0798/1209] Revert "gcc: fix download issue for new release"

This reverts commit a237f34fe760618b117993a49018e4199ae66880.
---
 pkgs/build-support/fetchurl/mirrors.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index cf30c54fe8c3..5d7ebc7cd87b 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -54,8 +54,6 @@
 
   # GCC
   gcc = [
-    "https://gcc.gnu.org/pub/gcc/"
-    "https://sourceware.org/pub/gcc/"
     "https://mirror.koddos.net/gcc/"
     "https://bigsearcher.com/mirrors/gcc/"
     "ftp://ftp.nluug.nl/mirror/languages/gcc/"

From f7f32bfe216eed051f6cf13322d0e4c83b0b3623 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 26 Jun 2026 10:12:41 +0100
Subject: [PATCH 0799/1209] Revert "gcc15: 15.2.0 -> 15.3.0"

Broke `aarch64-linux` and Darwin. Reverting pending fixes.

This reverts commit 7049a93a44d73f6e3ac18feb3facd7f7bda29858.
---
 .../gcc/patches/15/aarch64-sve-rtx.patch      | 87 +++++++++++++++++++
 .../compilers/gcc/patches/default.nix         |  3 +
 pkgs/development/compilers/gcc/versions.nix   |  4 +-
 3 files changed, 92 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch

diff --git a/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch b/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch
new file mode 100644
index 000000000000..257c76d735da
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch
@@ -0,0 +1,87 @@
+Without the change `libhwy-1.3.0` ICEs when built for aarch64-linux as:
+https://github.com/NixOS/nixpkgs/pull/320616#issuecomment-3764400891
+
+Upstream report: http://gcc.gnu.org/PR120718
+Upstream fix: https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00
+Fetched as:
+$ curl -L 'https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00' > aarch64-sve-rtx.patch
+
+From: Richard Sandiford <richard.sandiford@arm.com>
+Date: Thu, 14 Aug 2025 16:56:50 +0000 (+0100)
+Subject: Remove MODE_COMPOSITE_P test from simplify_gen_subreg [PR120718]
+X-Git-Url: https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00
+
+Remove MODE_COMPOSITE_P test from simplify_gen_subreg [PR120718]
+
+simplify_gen_subreg rejected subregs of literal constants if
+MODE_COMPOSITE_P.  This was added by the fix for PR96648 in
+g:c0f772894b6b3cd8ed5c5dd09d0c7917f51cf70f.  Jakub said:
+
+  As for the simplify_gen_subreg change, I think it would be desirable
+  to just avoid creating SUBREGs of constants on all targets and for all
+  constants, if simplify_immed_subreg simplified, fine, otherwise punt,
+  but as we are late in GCC11 development, the patch instead guards this
+  behavior on MODE_COMPOSITE_P (outermode) - i.e. only conversions to
+  powerpc{,64,64le} double double long double - and only for the cases where
+  simplify_immed_subreg was called.
+
+I'm not sure about relaxing the codes further, since subregs might
+be wanted for CONST, SYMBOL_REF and LABEL_REF.  But removing the
+MODE_COMPOSITE_P is needed to fix PR120718, where we get an ICE
+from generating a subreg of a V2SI const_vector.
+
+Unlike the trunk version, this backport does not remove the
+VOIDmode test; see PR121501.
+
+gcc/
+	PR rtl-optimization/120718
+	* simplify-rtx.cc (simplify_context::simplify_gen_subreg):
+	Remove MODE_COMPOSITE_P condition.
+
+gcc/testsuite/
+	PR rtl-optimization/120718
+	* gcc.target/aarch64/sve/acle/general/pr120718.c: New test.
+---
+
+diff --git a/gcc/simplify-rtx.cc b/gcc/simplify-rtx.cc
+index 88d31a71c05a..8d4cbf1371a3 100644
+--- a/gcc/simplify-rtx.cc
++++ b/gcc/simplify-rtx.cc
+@@ -8317,14 +8317,11 @@ simplify_context::simplify_gen_subreg (machine_mode outermode, rtx op,
+ 
+   if (GET_CODE (op) == SUBREG
+       || GET_CODE (op) == CONCAT
+-      || GET_MODE (op) == VOIDmode)
+-    return NULL_RTX;
+-
+-  if (MODE_COMPOSITE_P (outermode)
+-      && (CONST_SCALAR_INT_P (op)
+-	  || CONST_DOUBLE_AS_FLOAT_P (op)
+-	  || CONST_FIXED_P (op)
+-	  || GET_CODE (op) == CONST_VECTOR))
++      || GET_MODE (op) == VOIDmode
++      || CONST_SCALAR_INT_P (op)
++      || CONST_DOUBLE_AS_FLOAT_P (op)
++      || CONST_FIXED_P (op)
++      || GET_CODE (op) == CONST_VECTOR)
+     return NULL_RTX;
+ 
+   if (validate_subreg (outermode, innermode, op, byte))
+diff --git a/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c b/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c
+new file mode 100644
+index 000000000000..9ca0938e36bf
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c
+@@ -0,0 +1,12 @@
++/* { dg-options "-O2" } */
++
++#include <arm_sve.h>
++typedef int __attribute__((vector_size(8))) v2si;
++typedef struct { int x; int y; } A;
++void bar(A a);
++void foo()
++{
++    A a;
++    *(v2si *)&a = (v2si){0, (int)svcntd_pat(SV_ALL)};
++    bar(a);
++}
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 06981780da3f..cc0b5b47e9b4 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -112,6 +112,9 @@ optionals noSysDirs (
 # c++tools: Don't check --enable-default-pie.
 # --enable-default-pie breaks bootstrap gcc otherwise, because libiberty.a is not found
 ++ optional (is14 || is15) ./c++tools-dont-check-enable-default-pie.patch
+# http://gcc.gnu.org/PR120718 backport (will be inclkuded in 15.3.0) to
+# fix `highway-1.3.0` ICE on aarch64-linux.
+++ optional is15 ./15/aarch64-sve-rtx.patch
 
 ## 2. Patches relevant on specific platforms ####################################
 
diff --git a/pkgs/development/compilers/gcc/versions.nix b/pkgs/development/compilers/gcc/versions.nix
index 6e49faf18628..ca6b2c91033d 100644
--- a/pkgs/development/compilers/gcc/versions.nix
+++ b/pkgs/development/compilers/gcc/versions.nix
@@ -1,7 +1,7 @@
 let
   majorMinorToVersionMap = {
     "16" = "16.1.0";
-    "15" = "15.3.0";
+    "15" = "15.2.0";
     "14" = "14.3.0";
     "13" = "13.4.0";
   };
@@ -15,7 +15,7 @@ let
       # 3 digits: releases (14.2.0)
       # 4 digits: snapshots (14.2.1.20250322)
       "16.1.0" = "sha256-UO+02Uwzl6/zsNYaWr10i03THZ0/Kre+BbFx02pRD3k=";
-      "15.3.0" = "sha256-+lnBvu+JlfJ8TXHB3yJ1hxiTFdPm+v8btDBuYbDFMOs=";
+      "15.2.0" = "sha256-Q4/ZloJrDIJIWinaA6ctcdbjVBqD7HAt9Ccfb+Al0k4=";
       "14.3.0" = "sha256-4Nx3KXYlYxrI5Q+pL//v6Jmk63AlktpcMu8E4ik6yjo=";
       "13.4.0" = "sha256-nEzm27BAVo/cVFWIrAPFy8lajb8MeqSQFwhDr7WcqPU=";
     }

From d7de769f9a1a6e3763a9dd18871c03240c579822 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 19 Jun 2026 16:59:45 +0200
Subject: [PATCH 0800/1209] jsoncpp: modernize

---
 pkgs/by-name/js/jsoncpp/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/js/jsoncpp/package.nix b/pkgs/by-name/js/jsoncpp/package.nix
index b5f4373d5bd1..288e5dc6ed51 100644
--- a/pkgs/by-name/js/jsoncpp/package.nix
+++ b/pkgs/by-name/js/jsoncpp/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "open-source-parsers";
     repo = "jsoncpp";
-    rev = finalAttrs.version;
-    sha256 = "sha256-5cH9G4/TVCM5HX6QSk3P4m5+cwuK4x8hP9FohBcmjik=";
+    tag = finalAttrs.version;
+    hash = "sha256-5cH9G4/TVCM5HX6QSk3P4m5+cwuK4x8hP9FohBcmjik=";
   };
 
   /*
@@ -60,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   ) "-DJSONCPP_WITH_TESTS=OFF";
 
   meta = {
+    changelog = "https://github.com/open-source-parsers/jsoncpp/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/open-source-parsers/jsoncpp";
     description = "C++ library for interacting with JSON";
     maintainers = [ ];

From 1ec1e0a7213f7cb343db5a9d65f7b643393f3bef Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:00:12 +0200
Subject: [PATCH 0801/1209] jsoncpp: add hythera as maintainer

---
 pkgs/by-name/js/jsoncpp/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/js/jsoncpp/package.nix b/pkgs/by-name/js/jsoncpp/package.nix
index 288e5dc6ed51..25d1bcdf8fe0 100644
--- a/pkgs/by-name/js/jsoncpp/package.nix
+++ b/pkgs/by-name/js/jsoncpp/package.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/open-source-parsers/jsoncpp/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/open-source-parsers/jsoncpp";
     description = "C++ library for interacting with JSON";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ hythera ];
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
   };

From 339d13830e1ef7c50d1a856e1e706b71881f4f69 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Fri, 26 Jun 2026 11:30:25 -0400
Subject: [PATCH 0802/1209] python3Packages.pycurl: Allow websockets tests to
 run

curlFull comes with websockets support which seems to fail the
websockets tests in pycurl, as it needs python websockets.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/development/python-modules/pycurl/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index e37e001a3419..c9fd2a8d43f2 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -11,6 +11,7 @@
   flaky,
   flask,
   numpy,
+  websockets,
   setuptools,
 }:
 
@@ -50,6 +51,7 @@ buildPythonPackage rec {
     flaky
     flask
     numpy
+    websockets
     pytestCheckHook
   ];
 

From d97307b76f4898528c59c895e86412d9607a9436 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Fri, 26 Jun 2026 11:31:34 -0400
Subject: [PATCH 0803/1209] python3Packages.pycurl: add support for curl 8.21.0
 websockets

Backport of https://github.com/pycurl/pycurl/pull/1028

Seems like a new release of pycurl is also imminent, which means we may
be able to drop this patch soon.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/development/python-modules/pycurl/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index c9fd2a8d43f2..c7c32e9e20d3 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   isPyPy,
   fetchFromGitHub,
+  fetchpatch2,
   curl,
   openssl,
   bottle,
@@ -29,6 +30,14 @@ buildPythonPackage rec {
     hash = "sha256-F40bJ7TYFK2dVkDJGGxl7XV46fKmjwvUYYulcwGL6hk=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "pycurl-curl-8.21.0-ws-support.patch";
+      url = "https://github.com/pycurl/pycurl/commit/c78fd8aba82e2f8037275063138eaa7706c111af.diff?full_index=1";
+      hash = "sha256-EBXgGiaMtXTsgJOOrzzZFJ7Q/ofAlc4zuipoEpfdFqU=";
+    })
+  ];
+
   preConfigure = ''
     substituteInPlace setup.py \
       --replace-fail '--static-libs' '--libs'

From 8ff970916b975cfd1b79ff3751061526fe88614b Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:40:20 +0200
Subject: [PATCH 0804/1209] openmpCheckPhaseHook: init

---
 .../op/openmpCheckPhaseHook/omp-check-hook.sh        | 11 +++++++++++
 pkgs/by-name/op/openmpCheckPhaseHook/package.nix     | 12 ++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh
 create mode 100644 pkgs/by-name/op/openmpCheckPhaseHook/package.nix

diff --git a/pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh b/pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh
new file mode 100644
index 000000000000..b3279b170360
--- /dev/null
+++ b/pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh
@@ -0,0 +1,11 @@
+preCheckHooks+=('setupOmpCheck')
+preInstallCheckHooks+=('setupOmpCheck')
+
+
+setupOmpCheck() {
+  # Limit number of OpenMP threads. Default is "all cores".
+  # Using all cores causes high load on builders if checks are executed with NIX_BUILD_CORE parallelism.
+  # This gets even worse if multiple builds are scheduled on the same machine, potentially growing O(n^3) without explicit core limits.
+  export OMP_NUM_THREADS="${OMP_NUM_THREADS:-1}"
+}
+
diff --git a/pkgs/by-name/op/openmpCheckPhaseHook/package.nix b/pkgs/by-name/op/openmpCheckPhaseHook/package.nix
new file mode 100644
index 000000000000..9e30609e8de5
--- /dev/null
+++ b/pkgs/by-name/op/openmpCheckPhaseHook/package.nix
@@ -0,0 +1,12 @@
+{
+  lib,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "omp-checkPhase-hook";
+
+  __structuredAttrs = true;
+
+  meta.license = lib.licenses.mit;
+} ./omp-check-hook.sh

From 71fbdd6512fcf27434aa34bbb9a830c1a8a2068b Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:50:01 +0200
Subject: [PATCH 0805/1209] doc/openmpCheckPhaseHook: init

---
 doc/hooks/index.md                     |  1 +
 doc/hooks/openmp-check-hook.section.md | 10 ++++++++++
 doc/redirects.json                     |  3 +++
 3 files changed, 14 insertions(+)
 create mode 100644 doc/hooks/openmp-check-hook.section.md

diff --git a/doc/hooks/index.md b/doc/hooks/index.md
index 7fb76b72953e..63cc9b2ded64 100644
--- a/doc/hooks/index.md
+++ b/doc/hooks/index.md
@@ -34,6 +34,7 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
+openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md
diff --git a/doc/hooks/openmp-check-hook.section.md b/doc/hooks/openmp-check-hook.section.md
new file mode 100644
index 000000000000..5a5842eb5e29
--- /dev/null
+++ b/doc/hooks/openmp-check-hook.section.md
@@ -0,0 +1,10 @@
+# openmpCheckPhaseHook {#setup-hook-omp-check}
+
+
+This hook can be used to setup a check phase that
+requires running a OpenMP application. It mostly
+serves to limit `OMP_NUM_THREADS` to avoid overloading
+build machines.
+
+This hook will not attempt to override an already existing
+definition of `OMP_NUM_THREADS` in the environment.
diff --git a/doc/redirects.json b/doc/redirects.json
index 51839e8ee9b0..c9d3a004e3e3 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -2881,6 +2881,9 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
+  "setup-hook-omp-check": [
+    "index.html#setup-hook-omp-check"
+  ],
   "ninja": [
     "index.html#ninja"
   ],

From 240ef095c6bc783e437fb69b74442db6219d0e49 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:51:33 +0200
Subject: [PATCH 0806/1209] mpiCheckPhaseHook: propagate openmpCheckPhaseHook

---
 pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh | 3 ---
 pkgs/by-name/mp/mpiCheckPhaseHook/package.nix       | 6 +++++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh b/pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh
index be2203951c0f..139dc932366f 100644
--- a/pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh
+++ b/pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh
@@ -72,8 +72,5 @@ setupMpiCheck() {
       export HWLOC_XMLFILE="@topology@"
       ;;
   esac
-
-  # Limit number of OpenMP threads. Default is "all cores".
-  export OMP_NUM_THREADS=1
 }
 
diff --git a/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix b/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix
index e5bdc817379d..db5832c28a6e 100644
--- a/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix
+++ b/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix
@@ -1,8 +1,8 @@
 {
   lib,
-  callPackage,
   makeSetupHook,
   stdenv,
+  openmpCheckPhaseHook,
 }:
 
 makeSetupHook {
@@ -13,5 +13,9 @@ makeSetupHook {
     topology = ./topology.xml;
   };
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   meta.license = lib.licenses.mit;
 } ./mpi-check-hook.sh

From 559ae88af990e9cc835f791f1fca62283ac574a7 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:52:29 +0200
Subject: [PATCH 0807/1209] llvmPackages.openmp: propagate openmpCheckPhaseHook

---
 pkgs/development/compilers/llvm/common/openmp/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/llvm/common/openmp/default.nix b/pkgs/development/compilers/llvm/common/openmp/default.nix
index a08376522d9e..10f9ce154cb4 100644
--- a/pkgs/development/compilers/llvm/common/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/common/openmp/default.nix
@@ -19,7 +19,7 @@
   ompdSupport ? true,
   ompdGdbSupport ? ompdSupport,
   getVersionFile,
-  fetchpatch,
+  openmpCheckPhaseHook,
 }:
 
 assert lib.assertMsg (ompdGdbSupport -> ompdSupport) "OMPD GDB support requires OMPD support!";
@@ -60,6 +60,10 @@ stdenv.mkDerivation (finalAttrs: {
     lit
   ];
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   buildInputs = [
     llvm
   ]

From df838c503eaeb72f9a100ccf8e5914fe65a11502 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:53:36 +0200
Subject: [PATCH 0808/1209] blas: propagate openmpCheckPhaseHook

---
 pkgs/by-name/bl/blas/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/bl/blas/package.nix b/pkgs/by-name/bl/blas/package.nix
index 01ad1839c339..51deec6c5c64 100644
--- a/pkgs/by-name/bl/blas/package.nix
+++ b/pkgs/by-name/bl/blas/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   lapack-reference,
   openblas,
+  openmpCheckPhaseHook,
   isILP64 ? false,
   blasProvider ? openblas,
 }:
@@ -186,6 +187,10 @@ stdenv.mkDerivation {
     "dev"
   ];
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   meta = (blasProvider'.meta or { }) // {
     description = "${lib.getName blasProvider} with just the BLAS C and FORTRAN ABI";
   };

From b3944a1e306623cb152573d1aaad9ba569a9d67f Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:42:53 +0200
Subject: [PATCH 0809/1209] python3Packages.numpy: propagate
 openmpCheckPhaseHook

---
 pkgs/development/python-modules/numpy/2.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index be54cb4d312e..c62619db4422 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -19,6 +19,8 @@
   coreutils,
   lapack,
 
+  openmpCheckPhaseHook,
+
   # Reverse dependency
   sage,
 
@@ -122,6 +124,10 @@ buildPythonPackage (finalAttrs: {
     ln -s ${placeholder "out"}/${finalAttrs.passthru.coreIncludeInnerDir} $out/include
   '';
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   preCheck = ''
     pushd $out
     # For numpy-config executable to be available during tests

From ef8b8d8f58919deb3d462416e582dadafe3fb833 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:43:24 +0200
Subject: [PATCH 0810/1209] python3Packages.*: remove explicit OMP_NUM_THREADS
 definitions where numpy is used

---
 pkgs/development/python-modules/astropy/default.nix        | 4 ----
 pkgs/development/python-modules/captum/default.nix         | 4 ----
 pkgs/development/python-modules/geometric/default.nix      | 4 ----
 pkgs/development/python-modules/imread/default.nix         | 1 -
 pkgs/development/python-modules/linearmodels/default.nix   | 2 --
 pkgs/development/python-modules/mace-torch/default.nix     | 4 ----
 pkgs/development/python-modules/numpy/1.nix                | 7 ++++++-
 pkgs/development/python-modules/numpy/2.nix                | 4 ----
 pkgs/development/python-modules/pyscf/default.nix          | 1 -
 pkgs/development/python-modules/qutip/default.nix          | 1 -
 pkgs/development/python-modules/scikit-bio/default.nix     | 4 ----
 pkgs/development/python-modules/scikit-learn/default.nix   | 1 -
 pkgs/development/python-modules/scipy/default.nix          | 5 -----
 .../development/python-modules/torch-geometric/default.nix | 4 ----
 pkgs/development/python-modules/x-transformers/default.nix | 4 ----
 15 files changed, 6 insertions(+), 44 deletions(-)

diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix
index 639e234acbb0..94376d603d5e 100644
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@@ -143,10 +143,6 @@ buildPythonPackage rec {
 
   preCheck = ''
     export HOME="$(mktemp -d)"
-    export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
-    if [ $OMP_NUM_THREADS -eq 0 ]; then
-      export OMP_NUM_THREADS=1
-    fi
 
     # See https://github.com/astropy/astropy/issues/17649 and see
     # --hypothesis-profile=ci pytest flag below.
diff --git a/pkgs/development/python-modules/captum/default.nix b/pkgs/development/python-modules/captum/default.nix
index 455eac5c5fc1..858e9abc4110 100644
--- a/pkgs/development/python-modules/captum/default.nix
+++ b/pkgs/development/python-modules/captum/default.nix
@@ -52,10 +52,6 @@ buildPythonPackage rec {
     scikit-learn
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   disabledTestPaths =
     lib.optionals stdenv.hostPlatform.isDarwin [
       # These tests may fail if multiple builds run them at the same time due
diff --git a/pkgs/development/python-modules/geometric/default.nix b/pkgs/development/python-modules/geometric/default.nix
index ec1553e164ab..08301b669d5c 100644
--- a/pkgs/development/python-modules/geometric/default.nix
+++ b/pkgs/development/python-modules/geometric/default.nix
@@ -28,10 +28,6 @@ buildPythonPackage rec {
     six
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
diff --git a/pkgs/development/python-modules/imread/default.nix b/pkgs/development/python-modules/imread/default.nix
index a26b89fb2b02..bc0934f5bd7c 100644
--- a/pkgs/development/python-modules/imread/default.nix
+++ b/pkgs/development/python-modules/imread/default.nix
@@ -49,7 +49,6 @@ buildPythonPackage rec {
   preCheck = ''
     cd $TMPDIR
     export HOME=$TMPDIR
-    export OMP_NUM_THREADS=1
   '';
 
   meta = {
diff --git a/pkgs/development/python-modules/linearmodels/default.nix b/pkgs/development/python-modules/linearmodels/default.nix
index d67690e48774..9a5ae03ffe5f 100644
--- a/pkgs/development/python-modules/linearmodels/default.nix
+++ b/pkgs/development/python-modules/linearmodels/default.nix
@@ -67,8 +67,6 @@ buildPythonPackage (finalAttrs: {
 
   preCheck = ''
     rm linearmodels/__init__.py
-
-    export OMP_NUM_THREADS=1
   '';
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/mace-torch/default.nix b/pkgs/development/python-modules/mace-torch/default.nix
index 4ed39d479782..3c8b486f643b 100644
--- a/pkgs/development/python-modules/mace-torch/default.nix
+++ b/pkgs/development/python-modules/mace-torch/default.nix
@@ -82,10 +82,6 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   disabledTests = [
     # _pickle.PickleError: ScriptFunction cannot be pickled
     "test_run_eval_fail_with_wrong_model"
diff --git a/pkgs/development/python-modules/numpy/1.nix b/pkgs/development/python-modules/numpy/1.nix
index 4fc274257916..7167ff94637e 100644
--- a/pkgs/development/python-modules/numpy/1.nix
+++ b/pkgs/development/python-modules/numpy/1.nix
@@ -18,6 +18,8 @@
   blas,
   lapack,
 
+  openmpCheckPhaseHook,
+
   # Reverse dependency
   sage,
 
@@ -93,7 +95,6 @@ buildPythonPackage (finalAttrs: {
   # see https://github.com/OpenMathLib/OpenBLAS/issues/2993
   preConfigure = ''
     sed -i 's/-faltivec//' numpy/distutils/system_info.py
-    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
   '';
 
   preBuild = ''
@@ -110,6 +111,10 @@ buildPythonPackage (finalAttrs: {
     typing-extensions
   ];
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   preCheck = ''
     cd "$out"
   '';
diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index c62619db4422..712130d6a0a8 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -93,10 +93,6 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
 
-  preConfigure = ''
-    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
-  '';
-
   buildInputs = [
     blas
     lapack
diff --git a/pkgs/development/python-modules/pyscf/default.nix b/pkgs/development/python-modules/pyscf/default.nix
index a248a1bb0d49..012d23f0dcfb 100644
--- a/pkgs/development/python-modules/pyscf/default.nix
+++ b/pkgs/development/python-modules/pyscf/default.nix
@@ -80,7 +80,6 @@ buildPythonPackage (finalAttrs: {
   preCheck = ''
     # Set config used by tests to ensure reproducibility
     echo 'pbc_tools_pbc_fft_engine = "NUMPY"' > pyscf/pyscf_config.py
-    export OMP_NUM_THREADS=1
     ulimit -s 20000
     export PYSCF_CONFIG_FILE=$(pwd)/pyscf/pyscf_config.py
   '';
diff --git a/pkgs/development/python-modules/qutip/default.nix b/pkgs/development/python-modules/qutip/default.nix
index 89e77b995785..aa968f51180d 100644
--- a/pkgs/development/python-modules/qutip/default.nix
+++ b/pkgs/development/python-modules/qutip/default.nix
@@ -62,7 +62,6 @@ buildPythonPackage (finalAttrs: {
   # This is due to the Cython-compiled modules not being in the correct location
   # of the source tree.
   preCheck = ''
-    export OMP_NUM_THREADS=$NIX_BUILD_CORES
     mkdir -p test && cd test
   '';
 
diff --git a/pkgs/development/python-modules/scikit-bio/default.nix b/pkgs/development/python-modules/scikit-bio/default.nix
index c909d8d66d08..1190d875005a 100644
--- a/pkgs/development/python-modules/scikit-bio/default.nix
+++ b/pkgs/development/python-modules/scikit-bio/default.nix
@@ -62,10 +62,6 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   # only the $out dir contains the built cython extensions, so we run the tests inside there
   enabledTestPaths = [ "${placeholder "out"}/${python.sitePackages}/skbio" ];
 
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index b48f5a5d8f72..bf50ab0b7a63 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -116,7 +116,6 @@ buildPythonPackage rec {
   preCheck = ''
     cd $TMPDIR
     export HOME=$TMPDIR
-    export OMP_NUM_THREADS=1
   '';
 
   pythonImportsCheck = [ "sklearn" ];
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 914b8ce07842..785a917fcf0d 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -175,11 +175,6 @@ buildPythonPackage (finalAttrs: {
   '';
 
   preCheck = ''
-    export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
-    if [ $OMP_NUM_THREADS -eq 0 ]; then
-      export OMP_NUM_THREADS=1
-    fi
-
     cd $out
   '';
 
diff --git a/pkgs/development/python-modules/torch-geometric/default.nix b/pkgs/development/python-modules/torch-geometric/default.nix
index 839f5c8e02e5..06863712e7c5 100644
--- a/pkgs/development/python-modules/torch-geometric/default.nix
+++ b/pkgs/development/python-modules/torch-geometric/default.nix
@@ -185,10 +185,6 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   pytestFlags = [
     # DeprecationWarning: Failing to pass a value to the 'type_params' parameter of
     # 'typing._eval_type' is deprecated, as it leads to incorrect behaviour when calling
diff --git a/pkgs/development/python-modules/x-transformers/default.nix b/pkgs/development/python-modules/x-transformers/default.nix
index 1496775f5eec..16d3dff4fd61 100644
--- a/pkgs/development/python-modules/x-transformers/default.nix
+++ b/pkgs/development/python-modules/x-transformers/default.nix
@@ -42,10 +42,6 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   # RuntimeError: torch.compile is not supported on Python 3.14+
   disabledTests = lib.optionals (pythonAtLeast "3.14") [ "test_up" ];
 

From d5ae461bf7277e6fcbb5239e4b268ed2792e6ef2 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:16:07 +0200
Subject: [PATCH 0811/1209] treewide: remove explicit OMP_NUM_THREADS where
 openmpCheckPhaseHook is in effect

---
 pkgs/by-name/cp/cpcm-x/package.nix                           | 4 ----
 pkgs/by-name/df/dftd4/package.nix                            | 4 ----
 pkgs/by-name/el/elpa/package.nix                             | 3 ---
 pkgs/by-name/er/ergoscf/package.nix                          | 1 -
 pkgs/by-name/gr/greenx/package.nix                           | 4 ----
 pkgs/by-name/mc/mctc-lib/package.nix                         | 4 ----
 pkgs/by-name/mo/mopac/package.nix                            | 4 ----
 pkgs/by-name/mp/mpb/package.nix                              | 2 --
 pkgs/by-name/mu/multicharge/package.nix                      | 4 ----
 pkgs/by-name/nu/numsa/package.nix                            | 4 ----
 pkgs/by-name/pi/pixman/package.nix                           | 5 -----
 pkgs/by-name/wa/wannier90/package.nix                        | 3 ---
 pkgs/by-name/xt/xtb/package.nix                              | 3 ---
 .../libraries/science/chemistry/simple-dftd3/default.nix     | 3 ---
 .../libraries/science/chemistry/tblite/default.nix           | 4 ----
 15 files changed, 52 deletions(-)

diff --git a/pkgs/by-name/cp/cpcm-x/package.nix b/pkgs/by-name/cp/cpcm-x/package.nix
index 99484edfc1d2..7a5049365423 100644
--- a/pkgs/by-name/cp/cpcm-x/package.nix
+++ b/pkgs/by-name/cp/cpcm-x/package.nix
@@ -89,10 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/df/dftd4/package.nix b/pkgs/by-name/df/dftd4/package.nix
index c58a7400c404..b4bc8271cf33 100644
--- a/pkgs/by-name/df/dftd4/package.nix
+++ b/pkgs/by-name/df/dftd4/package.nix
@@ -81,10 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
       app/tester.py
   '';
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Generally Applicable Atomic-Charge Dependent London Dispersion Correction";
     changelog = "https://github.com/dftd4/dftd4/releases/tag/${finalAttrs.src.tag}";
diff --git a/pkgs/by-name/el/elpa/package.nix b/pkgs/by-name/el/elpa/package.nix
index 170f03f697e8..650d59f93de4 100644
--- a/pkgs/by-name/el/elpa/package.nix
+++ b/pkgs/by-name/el/elpa/package.nix
@@ -116,9 +116,6 @@ stdenv.mkDerivation (finalAttrs: {
   preCheck = ''
     #patchShebangs ./
 
-    # Run dual threaded
-    export OMP_NUM_THREADS=2
-
     # Reduce test problem sizes
     export TEST_FLAGS="1500 50 16"
   '';
diff --git a/pkgs/by-name/er/ergoscf/package.nix b/pkgs/by-name/er/ergoscf/package.nix
index 9514bb89f1e4..59ccb179b2bd 100644
--- a/pkgs/by-name/er/ergoscf/package.nix
+++ b/pkgs/by-name/er/ergoscf/package.nix
@@ -39,7 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
       "-lblas"
       "-llapack"
     ];
-    OMP_NUM_THREADS = 2; # required for check phase
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/gr/greenx/package.nix b/pkgs/by-name/gr/greenx/package.nix
index c08356a17058..fb360c6728b8 100644
--- a/pkgs/by-name/gr/greenx/package.nix
+++ b/pkgs/by-name/gr/greenx/package.nix
@@ -34,10 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Uses a hacky python setup run by cmake, which is hard to get running
   doCheck = false;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Library for Green’s function based electronic structure theory calculations";
     license = [ lib.licenses.asl20 ];
diff --git a/pkgs/by-name/mc/mctc-lib/package.nix b/pkgs/by-name/mc/mctc-lib/package.nix
index abf2cd1a8509..5e677272f307 100644
--- a/pkgs/by-name/mc/mctc-lib/package.nix
+++ b/pkgs/by-name/mc/mctc-lib/package.nix
@@ -63,10 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   postPatch = ''
     patchShebangs --build config/install-mod.py
   '';
diff --git a/pkgs/by-name/mo/mopac/package.nix b/pkgs/by-name/mo/mopac/package.nix
index c5e5dacccb9b..c70b46ded59c 100644
--- a/pkgs/by-name/mo/mopac/package.nix
+++ b/pkgs/by-name/mo/mopac/package.nix
@@ -39,10 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Semiempirical quantum chemistry";
     homepage = "https://github.com/openmopac/mopac";
diff --git a/pkgs/by-name/mp/mpb/package.nix b/pkgs/by-name/mp/mpb/package.nix
index eb001a94446d..f92f7bfeeadf 100644
--- a/pkgs/by-name/mp/mpb/package.nix
+++ b/pkgs/by-name/mp/mpb/package.nix
@@ -59,8 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = "export OMP_NUM_THREADS=2";
-
   meta = {
     description = "MIT Photonic-Bands: computation of photonic band structures in periodic media";
     homepage = "https://mpb.readthedocs.io/en/latest/";
diff --git a/pkgs/by-name/mu/multicharge/package.nix b/pkgs/by-name/mu/multicharge/package.nix
index 677b9ec7f29e..625263e9d163 100644
--- a/pkgs/by-name/mu/multicharge/package.nix
+++ b/pkgs/by-name/mu/multicharge/package.nix
@@ -80,10 +80,6 @@ stdenv.mkDerivation (finalAttrs: {
     echo 'set(custom-lapack_FOUND TRUE)' >> config/cmake/Findcustom-lapack.cmake
   '';
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Electronegativity equilibration model for atomic partial charges";
     mainProgram = "multicharge";
diff --git a/pkgs/by-name/nu/numsa/package.nix b/pkgs/by-name/nu/numsa/package.nix
index c823b92a5036..336aef737d9f 100644
--- a/pkgs/by-name/nu/numsa/package.nix
+++ b/pkgs/by-name/nu/numsa/package.nix
@@ -90,10 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/pi/pixman/package.nix b/pkgs/by-name/pi/pixman/package.nix
index 367fa018c860..3ef554a9eb07 100644
--- a/pkgs/by-name/pi/pixman/package.nix
+++ b/pkgs/by-name/pi/pixman/package.nix
@@ -61,11 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dneon=disabled"
   ];
 
-  preConfigure = ''
-    # https://gitlab.freedesktop.org/pixman/pixman/-/issues/62
-    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 184 ? 184 : NIX_BUILD_CORES))
-  '';
-
   enableParallelBuilding = true;
 
   doCheck = !stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/wa/wannier90/package.nix b/pkgs/by-name/wa/wannier90/package.nix
index 2a8996daf779..321c34e4e0e7 100644
--- a/pkgs/by-name/wa/wannier90/package.nix
+++ b/pkgs/by-name/wa/wannier90/package.nix
@@ -73,9 +73,6 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
   checkInputs = [ python3 ];
   checkTarget = [ "test-serial" ];
-  preCheck = ''
-    export OMP_NUM_THREADS=4
-  '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/xt/xtb/package.nix b/pkgs/by-name/xt/xtb/package.nix
index 47f1010308fb..278220960454 100644
--- a/pkgs/by-name/xt/xtb/package.nix
+++ b/pkgs/by-name/xt/xtb/package.nix
@@ -89,9 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   doCheck = true;
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
 
   passthru.updateScript = nix-update-script {
     extraArgs = [ "--version=branch" ];
diff --git a/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix b/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix
index 7b84749d9552..8b9b68ccec9a 100644
--- a/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix
+++ b/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix
@@ -64,9 +64,6 @@ stdenv.mkDerivation rec {
   ];
 
   doCheck = true;
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
 
   meta = {
     description = "Reimplementation of the DFT-D3 program";
diff --git a/pkgs/development/libraries/science/chemistry/tblite/default.nix b/pkgs/development/libraries/science/chemistry/tblite/default.nix
index 1c21aa56c2ec..a10cea0d64db 100644
--- a/pkgs/development/libraries/science/chemistry/tblite/default.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/default.nix
@@ -100,10 +100,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = buildType == "meson";
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Light-weight tight-binding framework";
     mainProgram = "tblite";

From cd137f1c889116425f507d709e709dead46dbcea Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:16:24 +0200
Subject: [PATCH 0812/1209] pixman: use openmpCheckPhaseHook

---
 pkgs/by-name/pi/pixman/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/pi/pixman/package.nix b/pkgs/by-name/pi/pixman/package.nix
index 3ef554a9eb07..23755586fe6c 100644
--- a/pkgs/by-name/pi/pixman/package.nix
+++ b/pkgs/by-name/pi/pixman/package.nix
@@ -6,6 +6,7 @@
   ninja,
   pkg-config,
   libpng,
+  openmpCheckPhaseHook,
   glib, # just passthru
 
   # for passthru.tests
@@ -46,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
+    openmpCheckPhaseHook
     __flattenIncludeHackHook
   ];
 

From 576031cf3c432361b33dff42e71ce639518a9219 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:16:50 +0200
Subject: [PATCH 0813/1209] mctc-lib: use openmpCheckPhaseHook

---
 pkgs/by-name/mc/mctc-lib/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/mc/mctc-lib/package.nix b/pkgs/by-name/mc/mctc-lib/package.nix
index 5e677272f307..a2de791d14f0 100644
--- a/pkgs/by-name/mc/mctc-lib/package.nix
+++ b/pkgs/by-name/mc/mctc-lib/package.nix
@@ -10,6 +10,7 @@
   pkg-config,
   python3,
   jonquil,
+  openmpCheckPhaseHook,
 }:
 
 assert (
@@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     gfortran
     pkg-config
     python3
+    openmpCheckPhaseHook
   ]
   ++ lib.optionals (buildType == "meson") [
     meson

From fa7fbd4ac9c5e4e52a35ce200d5dd43b1e35d5d6 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:24:03 +0000
Subject: [PATCH 0814/1209] darwin.Csu: drop

---
 .../ap/apple-sdk/common/propagate-inputs.nix   | 18 +++++++-----------
 pkgs/stdenv/darwin/default.nix                 |  2 --
 pkgs/top-level/darwin-aliases.nix              |  1 +
 3 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
index f9551b5b9bad..f6e9cf4e2ef2 100644
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
@@ -48,17 +48,13 @@ in
 self: super: {
   # These packages are propagated only because other platforms include them in their libc (or otherwise by default).
   # Reducing the number of special cases required to support Darwin makes supporting it easier for package authors.
-  propagatedBuildInputs =
-    super.propagatedBuildInputs or [ ]
-    ++ [
-      libiconv
-      darwin.libresolv
-      darwin.libsbuf
-      # Shipped with the SDK only as a library with no headers
-      (lib.getLib darwin.libutil)
-    ]
-    # x86_64-darwin links the object files from Csu when targeting very old releases
-    ++ lib.optionals stdenvNoCC.hostPlatform.isx86_64 [ darwin.Csu ];
+  propagatedBuildInputs = super.propagatedBuildInputs or [ ] ++ [
+    libiconv
+    darwin.libresolv
+    darwin.libsbuf
+    # Shipped with the SDK only as a library with no headers
+    (lib.getLib darwin.libutil)
+  ];
 
   # The Darwin module for Swift requires certain headers to be included in the SDK (and not just be propagated).
   buildPhase = super.buildPhase or "" + ''
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index f98c8ce0a53d..b19cdcc54de2 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -285,7 +285,6 @@ let
   };
   sdkDarwinPackages = prevStage: {
     inherit (prevStage.darwin)
-      Csu
       adv_cmds
       copyfile
       libiconv
@@ -1059,7 +1058,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
             prevStage.updateAutotoolsGnuConfigScriptsHook
             prevStage.updateAutotoolsGnuConfigScriptsHook.gnu_config
           ]
-          ++ lib.optionals localSystem.isx86_64 [ prevStage.darwin.Csu ]
           ++ (with prevStage.darwin; [
             binutils
             binutils.bintools
diff --git a/pkgs/top-level/darwin-aliases.nix b/pkgs/top-level/darwin-aliases.nix
index 2d4608cc2201..96aab9d0af29 100644
--- a/pkgs/top-level/darwin-aliases.nix
+++ b/pkgs/top-level/darwin-aliases.nix
@@ -108,6 +108,7 @@ stubs
 
   ### C ###
 
+  Csu = throw "darwin.Csu has been removed, as it was only used on `x86_64-darwin`, which is no longer supported"; # added 2026-06-26
   cctools = pkgs.cctools; # added 2024-07-17
   cctools-apple = pkgs.cctools; # added 2024-07-01
   cctools-llvm = pkgs.cctools; # added 2024-07-01

From fafbfd85dbfb9331b27a888ab0e0c7b246ea161a Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:51:41 +0000
Subject: [PATCH 0815/1209] darwin.ICU: drop `x86_64-darwin` support

---
 .../darwin/by-name/ic/ICU/package.nix         | 66 ++++++++-----------
 1 file changed, 28 insertions(+), 38 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix b/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
index d2678d47b0bc..300dd48f27f3 100644
--- a/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
@@ -104,48 +104,38 @@ let
     ++ lib.optional withStatic "static";
     outputBin = "dev";
 
-    postPatch =
-      lib.optionalString self.finalPackage.doCheck (
-        ''
-          # Skip test for missing encodingSamples data.
-          substituteInPlace test/cintltst/ucsdetst.c \
-            --replace-fail "&TestMailFilterCSS" "NULL"
+    postPatch = lib.optionalString self.finalPackage.doCheck ''
+      # Skip test for missing encodingSamples data.
+      substituteInPlace test/cintltst/ucsdetst.c \
+        --replace-fail "&TestMailFilterCSS" "NULL"
 
-          # Disable failing tests
-          substituteInPlace test/cintltst/cloctst.c \
-            --replace-fail 'TESTCASE(TestCanonicalForm);' ""
+      # Disable failing tests
+      substituteInPlace test/cintltst/cloctst.c \
+        --replace-fail 'TESTCASE(TestCanonicalForm);' ""
 
-          substituteInPlace test/intltest/rbbitst.cpp \
-            --replace-fail 'TESTCASE_AUTO(TestExternalBreakEngineWithFakeYue);' ""
+      substituteInPlace test/intltest/rbbitst.cpp \
+        --replace-fail 'TESTCASE_AUTO(TestExternalBreakEngineWithFakeYue);' ""
 
-          # Add missing test data. It’s not included in the source release.
-          chmod u+w "$NIX_BUILD_TOP/source/icu"
-          tar -C "$NIX_BUILD_TOP/source" -axf ${lib.escapeShellArg icu78.src} icu/testdata
-        ''
-        + lib.optionalString stdenv.hostPlatform.isx86_64 ''
-          # These tests fail under Rosetta 2 with a floating-point exception.
-          substituteInPlace test/intltest/caltest.cpp \
-            --replace-fail 'TESTCASE_AUTO(Test22633RollTwiceGetTimeOverflow);' "" \
-            --replace-fail 'TESTCASE_AUTO(Test22750Roll);' ""
-        ''
-      )
-      + ''
-        # Otherwise `make install` is broken.
-        substituteInPlace Makefile.in \
-          --replace-fail '$(top_srcdir)/../LICENSE' "$NIX_BUILD_TOP/source/icu/LICENSE"
-        substituteInPlace config/dist-data.sh \
-          --replace-fail "\''${top_srcdir}/../LICENSE" "$NIX_BUILD_TOP/source/icu/LICENSE"
+      # Add missing test data. It’s not included in the source release.
+      chmod u+w "$NIX_BUILD_TOP/source/icu"
+      tar -C "$NIX_BUILD_TOP/source" -axf ${lib.escapeShellArg icu78.src} icu/testdata
 
-        # Make sure this ICU build puts C++ symbols in a distinct namespace to avoid symbol clashes with other ICU
-        # implementations (including both the system ICU and builds of the upstream ICU).
-        # This breaks binary compatibility for the C++ API, but it’s not ABI stable anyway. Without doing this,
-        # `dotnet` crashes on macOS 26.4 when linked against `libicucore.A.dylib` from Nixpkgs.
-        substituteInPlace common/unicode/uvernum.h \
-          --replace-fail 'U_ICU_VERSION_SUFFIX ' 'U_ICU_VERSION_SUFFIX _nix'
-        # Only enable symbol renaming for C++ symbols. C symbols need to remain unversioned for compatibility.
-        substituteInPlace common/unicode/uversion.h \
-          --replace-fail U_DISABLE_RENAMING 0
-      '';
+      # Otherwise `make install` is broken.
+      substituteInPlace Makefile.in \
+        --replace-fail '$(top_srcdir)/../LICENSE' "$NIX_BUILD_TOP/source/icu/LICENSE"
+      substituteInPlace config/dist-data.sh \
+        --replace-fail "\''${top_srcdir}/../LICENSE" "$NIX_BUILD_TOP/source/icu/LICENSE"
+
+      # Make sure this ICU build puts C++ symbols in a distinct namespace to avoid symbol clashes with other ICU
+      # implementations (including both the system ICU and builds of the upstream ICU).
+      # This breaks binary compatibility for the C++ API, but it’s not ABI stable anyway. Without doing this,
+      # `dotnet` crashes on macOS 26.4 when linked against `libicucore.A.dylib` from Nixpkgs.
+      substituteInPlace common/unicode/uvernum.h \
+        --replace-fail 'U_ICU_VERSION_SUFFIX ' 'U_ICU_VERSION_SUFFIX _nix'
+      # Only enable symbol renaming for C++ symbols. C symbols need to remain unversioned for compatibility.
+      substituteInPlace common/unicode/uversion.h \
+        --replace-fail U_DISABLE_RENAMING 0
+    '';
 
     # remove dependency on bootstrap-tools in early stdenv build
     postInstall =

From f95c28dbb5d5f11f1a02c2f476b55fa70a4fa897 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:55:49 +0000
Subject: [PATCH 0816/1209] darwin.diskdev_cmds: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in b/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in
index 00270488507a..ab4a184efaa9 100644
--- a/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in
+++ b/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in
@@ -114,7 +114,6 @@ executable(
     dependencies : [ apfs, libdisk ],
     include_directories : [ 'edt_fstab', 'fsck.tproj', 'mount_flags_dir' ],
     install : true,
-    link_args : host_machine.cpu_family() == 'x86_64' ? [ '-Wl,-undefined,dynamic_lookup' ] : [ ],
     sources : [
         'edt_fstab/edt_fstab.c',
         'mount.tproj/mount.c',

From 08b44da1274f60c609613d5d92a2b307c6b41f7f Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:56:56 +0000
Subject: [PATCH 0817/1209] darwin.dyld: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/dy/dyld/package.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix b/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
index 27ae0af42ab1..9a2cd1afa6ea 100644
--- a/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
+++ b/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
@@ -35,13 +35,8 @@ let
         '${Libc}/include/_bounds.h'
 
       mkdir -p "$out/include/System"
-      for dir in arm i386 machine; do
-        mkdir -p "$out/include/$dir"
-        for file in '${xnu}/osfmk/'$dir/*; do
-          name=$(basename "$file")
-          # Skip copying `endian.h` because it conflicts with the SDK, breaking the build on x86_64-darwin.
-          test "$name" != endian.h && cp -r "$file" "$out/include/$dir/$name"
-        done
+      for dir in arm machine; do
+        cp -r '${xnu}/osfmk/'$dir "$out/include/$dir"
         ln -s "$out/include/$dir" "$out/include/System/$dir"
       done
 

From 06add4c94beffca657d93d32fd747924758361c1 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:51:41 +0000
Subject: [PATCH 0818/1209] darwin.file_cmds: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix b/pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix
index ba754ddee3ee..8c61f41b7e74 100644
--- a/pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix
@@ -70,12 +70,6 @@ let
       typedef int32_t user32_time_t;
       typedef int64_t user64_addr_t;
       typedef int64_t user64_time_t;
-      #elif defined(__x86_64__)
-      /* https://github.com/apple-oss-distributions/xnu/blob/94d3b452840153a99b38a3a9659680b2a006908e/bsd/i386/types.h#L128-L142 */
-      typedef int32_t user32_addr_t;
-      typedef int32_t user32_time_t;
-      typedef int64_t user64_addr_t __attribute__((aligned(8)));
-      typedef int64_t user64_time_t __attribute__((aligned(8)));
       #else
       #error "Tried to build file_cmds for an unsupported architecture"
       #endif

From 98dd6b587f18847fdc19d3202bc370bc8e41e01c Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:58:07 +0000
Subject: [PATCH 0819/1209] darwin.libffi: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/li/libffi/package.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/li/libffi/package.nix b/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
index 7aefb636900e..0411e61a1f9e 100644
--- a/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
+++ b/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
@@ -53,16 +53,14 @@ mkAppleDerivation (finalAttrs: {
 
   postConfigure = ''
     # Use Apple’s configuration instead of the one generated by the `configure` script.
-    cp darwin/include/fficonfig_${stdenv.hostPlatform.darwinArch}.h build/fficonfig.h
-    cp darwin/include/ffitarget_${
-      if stdenv.hostPlatform.isAarch64 then "arm64" else "x86"
-    }.h build/include/ffitarget.h
+    cp darwin/include/fficonfig_arm64.h build/fficonfig.h
+    cp darwin/include/ffitarget_arm64.h build/include/ffitarget.h
     # Use `macCatalyst` instead of `iosmac` to avoid errors due to invalid availability annotations.
     substitute darwin/include/ffi.h build/include/ffi.h \
       --replace-fail iosmac macCatalyst
   '';
 
-  postBuild = lib.optionalString stdenv.hostPlatform.isAarch64 ''
+  postBuild = ''
     $CC -Os -Wl,-allowable_client,! -Wl,-not_for_dyld_shared_cache -Wl,-no_compact_unwind \
       src/aarch64/trampoline.S -dynamiclib -o libffi-trampolines.dylib \
       -Iinclude -Ibuild -Ibuild/include \
@@ -75,7 +73,7 @@ mkAppleDerivation (finalAttrs: {
       ln -s "$dev/include" "$dev/include/ffi"
     ''
     # Install the trampoline dylib since it is build manually.
-    + lib.optionalString stdenv.hostPlatform.isAarch64 ''
+    + ''
       cp libffi-trampolines.dylib "$out/lib/libffi-trampolines.dylib"
     '';
 

From 0fef4fe6d3c44b3416ceea22790bd2410326b68d Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:07:10 +0000
Subject: [PATCH 0820/1209] darwin.network_cmds: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix b/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
index 51455f86897f..39faf051ad14 100644
--- a/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
@@ -32,17 +32,16 @@ let
         '${xnu}/libkern/firehose/firehose_types_private.h' \
         '${xnu}/libkern/firehose/tracepoint_private.h'
 
-      for dir in arm i386 kern machine; do
+      for dir in arm kern machine; do
         mkdir -p "$out/include/$dir"
         for file in '${xnuHeaders}/include/'$dir/*; do
           name=$(basename "$file")
-          # Skip copying `endian.h` because it conflicts with the SDK, breaking the build on x86_64-darwin.
+          # Skip copying `endian.h` because it conflicts with the SDK, breaking the build.
           test "$name" != endian.h && cp -r "$file" "$out/include/$dir/$name"
         done
       done
 
       unifdef -x 1 -DKERNEL_PRIVATE -o "$out/include/arm/locks.h" '${xnu}/osfmk/arm/locks.h'
-      unifdef -x 1 -DKERNEL_PRIVATE -o "$out/include/i386/locks.h" '${xnu}/osfmk/i386/locks.h'
 
       install -D -t "$out/include/net" \
         '${xnuHeaders}/include/net/bpf.h' \

From 23c05205023464c322a0df9ac0834c00f4da9fa8 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 07:33:08 +0000
Subject: [PATCH 0821/1209] ld64: drop `x86_64-darwin` support

---
 pkgs/by-name/ld/ld64/package.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/by-name/ld/ld64/package.nix b/pkgs/by-name/ld/ld64/package.nix
index f21f90a37929..184f635cffe3 100644
--- a/pkgs/by-name/ld/ld64/package.nix
+++ b/pkgs/by-name/ld/ld64/package.nix
@@ -138,9 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     xar
   ];
 
-  # ld built with this fails to link glib's gio on x86_64 darwin
-  hardeningDisable = [ "libcxxhardeningfast" ];
-
   dontUseCmakeConfigure = true; # CMake is only needed because it’s used by Meson to find LLVM.
 
   # Note for overrides: ld64 cannot be built as a debug build because of UB in its iteration implementations,

From c84755936aa28c5e991edc49fcebb3eed38fd46a Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:08:38 +0000
Subject: [PATCH 0822/1209] apple-sdk: drop `x86_64-darwin` support

---
 pkgs/by-name/ap/apple-sdk/common/plists.nix | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/ap/apple-sdk/common/plists.nix b/pkgs/by-name/ap/apple-sdk/common/plists.nix
index a79581e7767d..304f02c6ee4d 100644
--- a/pkgs/by-name/ap/apple-sdk/common/plists.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/plists.nix
@@ -28,26 +28,24 @@ let
   # These files are all based off of Xcode spec files found in
   # /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/Library/Xcode/PrivatePlugIns/IDEOSXSupportCore.ideplugin/Contents/Resources.
 
-  # Based off of the "MacOSX Architectures.xcspec" file. All i386 stuff
-  # is removed because NixPkgs only supports darwin-x86_64 and darwin-arm64.
+  # Based off of the "MacOSX Architectures.xcspec" file. All x86 stuff
+  # is removed because Nixpkgs only supports aarch64-darwin.
   Architectures = [
     {
       Identifier = "Standard";
       Type = "Architecture";
-      Name = "Standard Architectures (Apple Silicon, 64-bit Intel)";
+      Name = "Standard Architectures (Apple Silicon)";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD";
     }
     {
       Identifier = "Universal";
       Type = "Architecture";
-      Name = "Universal (Apple Silicon, 64-bit Intel)";
+      Name = "Universal (Apple Silicon)";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD_32_64_BIT";
     }
@@ -60,17 +58,16 @@ let
     {
       Identifier = "Standard64bit";
       Type = "Architecture";
-      Name = "Apple Silicon, 64-bit Intel";
+      Name = "Apple Silicon";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD_64_BIT";
     }
     {
       Identifier = stdenvNoCC.hostPlatform.darwinArch;
       Type = "Architecture";
-      Name = "Apple Silicon or Intel 64-bit";
+      Name = "Apple Silicon";
     }
     {
       Identifier = "Standard_Including_64_bit";
@@ -78,7 +75,6 @@ let
       Name = "Standard Architectures (including 64-bit)";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD_INCLUDING_64_BIT";
     }

From 75e6236ca1e8dcfc2d03299f3b2f3f3629b1163c Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Thu, 25 Jun 2026 12:11:53 +0200
Subject: [PATCH 0823/1209] python3Packages.tornado: 6.5.4 -> 6.5.7

https://www.tornadoweb.org/en/stable/releases/v6.5.5.html
https://www.tornadoweb.org/en/stable/releases/v6.5.6.html
https://www.tornadoweb.org/en/stable/releases/v6.5.7.html

Fixes: CVE-2026-49853, CVE-2026-49855, CVE-2026-49854
---
 pkgs/development/python-modules/tornado/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index 4327db46ac9e..2cd462786b20 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -18,16 +18,16 @@
   urllib3,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tornado";
-  version = "6.5.4";
+  version = "6.5.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tornadoweb";
     repo = "tornado";
-    tag = "v${version}";
-    hash = "sha256-d6lKg8yrQqaCeKxdPjQNzv7Nc23U/v8d5x3sE3trRM4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-iE0Tf95zmPoZJhw7FDLzTmv8HaWds3ZU5xzZSMvxFH4=";
   };
 
   build-system = [ setuptools ];
@@ -63,9 +63,10 @@ buildPythonPackage rec {
   };
 
   meta = {
+    changelog = "https://www.tornadoweb.org/en/stable/releases/${finalAttrs.src.tag}.html";
     description = "Web framework and asynchronous networking library";
     homepage = "https://www.tornadoweb.org/";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})

From 6a12e4797665ab59aa79d9bd05d1df7d843ec00a Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Thu, 25 Jun 2026 12:07:09 +0200
Subject: [PATCH 0824/1209] motioneye: 0.43.1 -> 0.44.0

Diff: https://github.com/motioneye-project/motioneye/compare/0.43.1...0.44.0
---
 pkgs/by-name/mo/motioneye/package.nix | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/mo/motioneye/package.nix b/pkgs/by-name/mo/motioneye/package.nix
index 7a5ee72311ef..721cc8d75f9d 100644
--- a/pkgs/by-name/mo/motioneye/package.nix
+++ b/pkgs/by-name/mo/motioneye/package.nix
@@ -2,31 +2,20 @@
   lib,
   python3Packages,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "motioneye";
-  version = "0.43.1";
+  version = "0.44.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "motioneye-project";
     repo = "motioneye";
     tag = version;
-    hash = "sha256-ckOgYmOP5irjNutcC3FMZPBexn/CldG0UtFZ+tPYNJ4=";
+    hash = "sha256-4sXttSSkmMgsoZb7PXEXXh8KNORTSmqq4lYp3JBDmPo=";
   };
 
-  patches = [
-    # fix pytest
-    # https://github.com/motioneye-project/motioneye/pull/3271
-    (fetchpatch {
-      url = "https://github.com/motioneye-project/motioneye/commit/41c0727e2872af1b758743c41b529e76dcac6f84.patch";
-      hash = "sha256-0zDveoAN1T0SuCob0U/9GEGTh7pj2CXH/j4YrjO0VE0=";
-      includes = [ "conftest.py" ];
-    })
-  ];
-
   build-system = with python3Packages; [
     setuptools
   ];
@@ -38,6 +27,7 @@ python3Packages.buildPythonApplication rec {
     pillow
     pycurl
     tornado
+    argon2-cffi
   ];
 
   nativeCheckInputs = with python3Packages; [

From 8221f1e025fb754f284be899aee5f5ecdf8a011c Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Thu, 25 Jun 2026 12:20:06 +0200
Subject: [PATCH 0825/1209] motioneye: add versionCheckHook

---
 pkgs/by-name/mo/motioneye/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/mo/motioneye/package.nix b/pkgs/by-name/mo/motioneye/package.nix
index 721cc8d75f9d..a947a722d8c1 100644
--- a/pkgs/by-name/mo/motioneye/package.nix
+++ b/pkgs/by-name/mo/motioneye/package.nix
@@ -2,6 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -34,10 +35,17 @@ python3Packages.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
   pythonImportsCheck = [
     "motioneye"
   ];
 
+  versionCheckProgram = "${placeholder "out"}/bin/meyectl";
+  versionCheckProgramArg = "-v";
+
   meta = {
     description = "Web frontend for the motion daemon";
     homepage = "https://github.com/motioneye-project/motioneye";

From 8b4b26561ff97ba3bad6339742cd5fc7d9eae346 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 26 Jun 2026 20:19:32 +0100
Subject: [PATCH 0826/1209] socat: 1.8.1.2 -> 1.8.1.3

Changes: http://www.dest-unreach.org/socat/CHANGES
---
 pkgs/by-name/so/socat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/so/socat/package.nix b/pkgs/by-name/so/socat/package.nix
index e4e6a23e58ed..40cf1ef10dcc 100644
--- a/pkgs/by-name/so/socat/package.nix
+++ b/pkgs/by-name/so/socat/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "socat";
-  version = "1.8.1.2";
+  version = "1.8.1.3";
 
   src = fetchurl {
     url = "http://www.dest-unreach.org/socat/download/socat-${version}.tar.bz2";
-    hash = "sha256-Dht+rAxuPW+k1Vtjx/zd8D9KLqpZ+pOx8w3Cxz1Cqg0=";
+    hash = "sha256-JbxkdikrLmFCIJicd7C2/Kh7slJdl0ezGmY5sftgJBg=";
   };
 
   postPatch = ''

From 2f05530db272b87de4091030b556e383ffc95ded Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 17 Jun 2026 00:34:10 +0000
Subject: [PATCH 0827/1209] libidn: 1.43 -> 1.44

https://codeberg.org/libidn/libidn/src/tag/v1.44/NEWS

Fixes: CVE-2026-57053
---
 pkgs/by-name/li/libidn/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libidn/package.nix b/pkgs/by-name/li/libidn/package.nix
index d36eedac8fe9..071b7f08f15d 100644
--- a/pkgs/by-name/li/libidn/package.nix
+++ b/pkgs/by-name/li/libidn/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libidn";
-  version = "1.43";
+  version = "1.44";
 
   src = fetchurl {
     url = "mirror://gnu/libidn/libidn-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-vcZiwS0EGyU50OY486bnQRMM2zOmRO80lpY6RDSC0WQ=";
+    sha256 = "sha256-SZYIurOmVlCg6lKIjBOo3uvj9xQI4xms2exS4C6xOVk=";
   };
 
   outputs = [
@@ -30,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
   meta = {
+    changelog = "https://codeberg.org/libidn/libidn/src/tag/v${finalAttrs.version}/NEWS";
     homepage = "https://www.gnu.org/software/libidn/";
     description = "Library for internationalized domain names";
 

From 66e7adfa8f255bff2e1ec8c12b888a8514aad48c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:04:00 +0200
Subject: [PATCH 0828/1209] perlPackages.CpanelJSONXS: 4.37 -> 4.42

Fixes CVE-2026-9334, CVE-2026-9516. Supersedes the in-tree CVE-2025-40929 patch.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../Cpanel-JSON-XS-CVE-2025-40929.patch       | 47 -------------------
 pkgs/top-level/perl-packages.nix              |  7 ++-
 2 files changed, 3 insertions(+), 51 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch

diff --git a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch b/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
deleted file mode 100644
index 0f76f7313fde..000000000000
--- a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 5592bfb58eb8d1c8a644e67c9bba795d1384a995 Mon Sep 17 00:00:00 2001
-From: Marc Lehmann <schmorp@schmorp.de>
-Date: Sat, 6 Sep 2025 11:31:36 +0200
-Subject: [PATCH 1/2] fix json_atof_scan1 overflows
-
-with fuzzed overlong numbers. CVE-2025-40928
-Really the comparisons were wrong.
----
- XS.xs | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/XS.xs b/XS.xs
-index 9b1ce2b..94ab0d6 100755
---- a/XS.xs
-+++ b/XS.xs
-@@ -710,16 +710,16 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
-   /* if we recurse too deep, skip all remaining digits */
-   /* to avoid a stack overflow attack */
-   if (UNLIKELY(--maxdepth <= 0))
--    while (((U8)*s - '0') < 10)
-+    while ((U8)(*s - '0') < 10)
-       ++s;
- 
-   for (;;)
-     {
--      U8 dig = (U8)*s - '0';
-+      U8 dig = (U8)(*s - '0');
- 
-       if (UNLIKELY(dig >= 10))
-         {
--          if (dig == (U8)((U8)'.' - (U8)'0'))
-+          if (dig == (U8)('.' - '0'))
-             {
-               ++s;
-               json_atof_scan1 (s, accum, expo, 1, maxdepth);
-@@ -739,7 +739,7 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
-               else if (*s == '+')
-                 ++s;
- 
--              while ((dig = (U8)*s - '0') < 10)
-+              while ((dig = (U8)(*s - '0')) < 10)
-                 exp2 = exp2 * 10 + *s++ - '0';
- 
-               *expo += neg ? -exp2 : exp2;
--- 
-2.50.1
-
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3cf8a274f583..e464b0b489fc 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6673,12 +6673,11 @@ with self;
 
   CpanelJSONXS = buildPerlPackage {
     pname = "Cpanel-JSON-XS";
-    version = "4.37";
+    version = "4.42";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.37.tar.gz";
-      hash = "sha256-wkFhWg4X/3Raqoa79Gam4pzSQFFeZfBqegUBe2GebUs=";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.42.tar.gz";
+      hash = "sha256-4awvqx46bS2ZjTRAxgAGc2W9x9vwyPKyBZy85LTIMXM=";
     };
-    patches = [ ../development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch ];
     meta = {
       description = "CPanel fork of JSON::XS, fast and correct serializing";
       license = with lib.licenses; [

From 7a4c9efd01e0980532edff7245f49768ad1deb01 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:06:54 +0200
Subject: [PATCH 0829/1209] perlPackages.HTMLParser: 3.81 -> 3.85

Fixes CVE-2026-8829.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e464b0b489fc..45b5b61a9351 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16264,10 +16264,10 @@ with self;
 
   HTMLParser = buildPerlPackage {
     pname = "HTML-Parser";
-    version = "3.81";
+    version = "3.85";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTML-Parser-3.81.tar.gz";
-      hash = "sha256-wJEKXI+S+IF+3QbM/SJLocLr6MEPVR8DJYeh/IPWL/I=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTML-Parser-3.85.tar.gz";
+      hash = "sha256-/UK6ar4HJBzwrVe+JGw5gAZfaD5EZeWbRq+e/ryODHE=";
     };
     propagatedBuildInputs = [
       HTMLTagset

From 9020587aa04036671788a5745f2ea63df581b064 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:07:12 +0200
Subject: [PATCH 0830/1209] perlPackages.NetStatsd: 0.12 -> 0.13

Fixes CVE-2026-46739.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 45b5b61a9351..4283b4ef7dd6 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -26365,10 +26365,10 @@ with self;
 
   NetStatsd = buildPerlPackage {
     pname = "Net-Statsd";
-    version = "0.12";
+    version = "0.13";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/C/CO/COSIMO/Net-Statsd-0.12.tar.gz";
-      hash = "sha256-Y+RTYD2hZbxtHEygtV7aPSIE8EDFkwSkd4LFqniGVlw=";
+      url = "mirror://cpan/authors/id/C/CO/COSIMO/Net-Statsd-0.13.tar.gz";
+      hash = "sha256-xKYP9dP002ompqR3YxGI7HnNzp4wUMZ6NOm1rikgoQA=";
     };
     meta = {
       description = "Perl client for Etsy's statsd daemon";

From 0002e3ea35b952f747cc1cd19657f729422b7f42 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:07:28 +0200
Subject: [PATCH 0831/1209] perlPackages.ProtocolHTTP2: 1.11 -> 1.13

Fixes CVE-2026-10725.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4283b4ef7dd6..68c949be39ae 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -29098,10 +29098,10 @@ with self;
 
   ProtocolHTTP2 = buildPerlModule {
     pname = "Protocol-HTTP2";
-    version = "1.11";
+    version = "1.13";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.11.tar.gz";
-      hash = "sha256-Vp8Fsavpl7UHyCUVMMyB0e6WvZMsxoJTS2zkhlNQCRM=";
+      url = "mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.13.tar.gz";
+      hash = "sha256-LsO0oYpkqGHgKYHO/Y7W8iOHUTj75e/us0DvF5ZVMGI=";
     };
     buildInputs = [
       AnyEvent

From f1ec9089c3939acbba18a7e3c1650eff87cdf9c4 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:08:56 +0200
Subject: [PATCH 0832/1209] perlPackages.CryptPBKDF2: 0.161520 -> 0.261630

Fixes CVE-2017-20240, CVE-2026-9638, CVE-2026-9641.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 68c949be39ae..0f46b4433bae 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7725,15 +7725,19 @@ with self;
     };
   };
 
-  CryptPBKDF2 = buildPerlPackage {
+  CryptPBKDF2 = buildPerlModule {
     pname = "Crypt-PBKDF2";
-    version = "0.161520";
+    version = "0.261630";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AR/ARODLAND/Crypt-PBKDF2-0.161520.tar.gz";
-      hash = "sha256-l9+nmjCaCG4YSk5hBH+KEP+z2wUQJefSIqJfGRMLpBc=";
+      url = "mirror://cpan/authors/id/A/AR/ARODLAND/Crypt-PBKDF2-0.261630.tar.gz";
+      hash = "sha256-GHVxiWOJMrMJs0xFu4EKo+SFbj7VgBAAF9reZXk/RsA=";
     };
-    buildInputs = [ TestFatal ];
+    buildInputs = [
+      ModuleBuildTiny
+      TestFatal
+    ];
     propagatedBuildInputs = [
+      CryptURandom
       DigestHMAC
       DigestSHA3
       Moo

From 32536524aff1b490a54ec6d4e60c89f6f2252423 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:39 +0200
Subject: [PATCH 0833/1209] perlPackages.ExtUtilsHelpers: 0.026 -> 0.028

Required by ExtUtils::Builder.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0f46b4433bae..c61855502a35 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12662,10 +12662,10 @@ with self;
 
   ExtUtilsHelpers = buildPerlPackage {
     pname = "ExtUtils-Helpers";
-    version = "0.026";
+    version = "0.028";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Helpers-0.026.tar.gz";
-      hash = "sha256-3pAbZ5CkVXz07JCBSeA1eDsSW/EV65ZA/rG8HCTDNBY=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Helpers-0.028.tar.gz";
+      hash = "sha256-yFdIdczgc+fcU0WnsG1QLlIETWiJT5FgID/KqzeVFP4=";
     };
     meta = {
       description = "Various portability utilities for module builders";

From f57d979624839d4840d60f6c134a24b83dd95ecb Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:40 +0200
Subject: [PATCH 0834/1209] perlPackages.ExtUtilsConfig: 0.008 -> 0.010

Required by ExtUtils::Builder.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index c61855502a35..290e701f15d0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12571,10 +12571,10 @@ with self;
 
   ExtUtilsConfig = buildPerlPackage {
     pname = "ExtUtils-Config";
-    version = "0.008";
+    version = "0.010";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Config-0.008.tar.gz";
-      hash = "sha256-rlEE9jRlDc6KebftE/tZ1no5whOmd2z9qj7nSeYvGow=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Config-0.010.tar.gz";
+      hash = "sha256-gufk6Qy+OA4VL13m4+QDdGmC1QLdMBl6EjZS5GYQxm0=";
     };
     meta = {
       description = "Wrapper for perl's configuration";

From 5ebb6bf806f336e1a44479bcfc65ae10c7284a79 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:40 +0200
Subject: [PATCH 0835/1209] perlPackages.ExtUtilsBuilder: init at 0.020

Dependency of Dist::Build.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 290e701f15d0..8c7dbaef472d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12552,6 +12552,27 @@ with self;
     };
   };
 
+  ExtUtilsBuilder = buildPerlPackage {
+    pname = "ExtUtils-Builder";
+    version = "0.020";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Builder-0.020.tar.gz";
+      hash = "sha256-UtZR46oDJyUOR5h9Rf9I6cyQtbe9L7D/P3h4PlMq/8w=";
+    };
+    propagatedBuildInputs = [
+      ExtUtilsConfig
+      ExtUtilsHelpers
+    ];
+    meta = {
+      description = "Abstract representation of build processes";
+      homepage = "https://github.com/Leont/extutils-builder-plan";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ExtUtilsCChecker = buildPerlModule {
     pname = "ExtUtils-CChecker";
     version = "0.11";

From 47c2f1daf9350d321fe5a41ef4fa550f3f8a7d85 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:40 +0200
Subject: [PATCH 0836/1209] perlPackages.ExtUtilsBuilderCompiler: init at 0.037

Dependency of Dist::Build.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8c7dbaef472d..585f9c025304 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12573,6 +12573,27 @@ with self;
     };
   };
 
+  ExtUtilsBuilderCompiler = buildPerlPackage {
+    pname = "ExtUtils-Builder-Compiler";
+    version = "0.037";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Builder-Compiler-0.037.tar.gz";
+      hash = "sha256-s5VNaI45gDkoUnkWfG6+7nVX8Q6VYBzj/baBkyY2h7g=";
+    };
+    propagatedBuildInputs = [
+      ExtUtilsBuilder
+      ExtUtilsConfig
+    ];
+    meta = {
+      description = "Interface around different compilers";
+      homepage = "https://github.com/Leont/extutils-builder-compiler";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ExtUtilsCChecker = buildPerlModule {
     pname = "ExtUtils-CChecker";
     version = "0.11";

From 46324ed6bb63470975f19e9e4ba58e9ceadf268c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:21:35 +0200
Subject: [PATCH 0837/1209] perlPackages.DistBuild: init at 0.028
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Build dependency of Crypt::Argon2.

Co-authored-by: Robert Schütz <nix@dotlambda.de>
Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 585f9c025304..b4069aa21f7d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -11004,6 +11004,31 @@ with self;
     };
   };
 
+  DistBuild = buildPerlModule {
+    pname = "Dist-Build";
+    version = "0.028";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Dist-Build-0.028.tar.gz";
+      hash = "sha256-JPFLFA4Tq3x1PU25bI0zbQnepcb1H+1IvA92Khyhgx8=";
+    };
+    propagatedBuildInputs = [
+      ExtUtilsBuilder
+      ExtUtilsBuilderCompiler
+      ExtUtilsConfig
+      ExtUtilsHelpers
+      ExtUtilsInstallPaths
+    ];
+    meta = {
+      changelog = "https://github.com/Leont/dist-build/blob/v0.028/Changes";
+      description = "Modern module builder, author tools not included";
+      homepage = "https://github.com/Leont/dist-build";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   DistributionMetadata = buildPerlModule {
     pname = "Distribution-Metadata";
     version = "0.10";

From de1d803f4387e8afbccf6a7650b8a8ff0c45b2fc Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:21:35 +0200
Subject: [PATCH 0838/1209] perlPackages.CryptArgon2: 0.019 -> 0.031
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes CVE-2026-8463.

Co-authored-by: Robert Schütz <nix@dotlambda.de>
Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b4069aa21f7d..1a6501821477 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6871,13 +6871,15 @@ with self;
 
   CryptArgon2 = buildPerlModule {
     pname = "Crypt-Argon2";
-    version = "0.019";
+    version = "0.031";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Argon2-0.019.tar.gz";
-      hash = "sha256-+Fm+6NL2tAf11EZFwiOu4hL+AFkd/YLlBlrhvnio5Dg=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Argon2-0.031.tar.gz";
+      hash = "sha256-1l5RoZQ+6AglEkUNw1KuUpUQZswJI/u38uYK+l8WTi0=";
     };
     nativeBuildInputs = [ pkgs.ld-is-cc-hook ];
+    buildInputs = [ DistBuild ];
     meta = {
+      changelog = "https://github.com/Leont/crypt-argon2/blob/v0.031/Changes";
       description = "Perl interface to the Argon2 key derivation functions";
       license = with lib.licenses; [ cc0 ];
     };

From 9f61f7a1b02416d738b87a5c97d586d8fe3dd250 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:25:57 +0200
Subject: [PATCH 0839/1209] perlPackages.ClassErrorHandler: init at 0.04

Dependency of Convert::PEM.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 1a6501821477..2b541e48903b 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -5074,6 +5074,22 @@ with self;
     };
   };
 
+  ClassErrorHandler = buildPerlPackage {
+    pname = "Class-ErrorHandler";
+    version = "0.04";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TOKUHIROM/Class-ErrorHandler-0.04.tar.gz";
+      hash = "sha256-NC0tz8eXogvugXmxuWuFwK56W0iCc1lSPNjHTD5wRQI=";
+    };
+    meta = {
+      description = "Base class for error handling";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ClassInspector = buildPerlPackage {
     pname = "Class-Inspector";
     version = "1.36";

From b7bd8c9e93c0cab35230863db815c3cafaa9bd41 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:26:10 +0200
Subject: [PATCH 0840/1209] perlPackages.CryptDESEDE3: init at 0.03

Dependency of Convert::PEM.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2b541e48903b..cd6006e5ae3e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7016,6 +7016,23 @@ with self;
     };
   };
 
+  CryptDESEDE3 = buildPerlPackage {
+    pname = "Crypt-DES_EDE3";
+    version = "0.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DES_EDE3-0.03.tar.gz";
+      hash = "sha256-KFktt7njR0WqkfPhnl27uDqvRyop5we5eR0NArPiJ/U=";
+    };
+    propagatedBuildInputs = [ CryptDES ];
+    meta = {
+      description = "Triple-DES EDE encryption/decryption";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   CryptDH = buildPerlPackage {
     pname = "Crypt-DH";
     version = "0.07";

From f098e09528a436b2119e1bdee879d12079b8567f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:26:22 +0200
Subject: [PATCH 0841/1209] perlPackages.ConvertPEM: init at 0.13

Dependency of Crypt::DSA.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index cd6006e5ae3e..fd990d8864f3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6395,6 +6395,29 @@ with self;
     };
   };
 
+  ConvertPEM = buildPerlPackage {
+    pname = "Convert-PEM";
+    version = "0.13";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Convert-PEM-0.13.tar.gz";
+      hash = "sha256-eZ+jLCcAgfTmKSsN31GAlScQqKS+Ey6Qe9oxdqe9HCM=";
+    };
+    buildInputs = [ TestException ];
+    propagatedBuildInputs = [
+      ClassErrorHandler
+      ConvertASN1
+      CryptDESEDE3
+      CryptX
+    ];
+    meta = {
+      description = "Read/write encrypted ASN.1 PEM files";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ConvertUU = buildPerlPackage {
     pname = "Convert-UU";
     version = "0.5201";

From e86a4b4e44855be1d7c7ba081f2d057c98ebb928 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:27:45 +0200
Subject: [PATCH 0842/1209] perlPackages.CryptDSA: 1.17 -> 1.21

Fixes CVE-2026-8700, CVE-2026-8704, CVE-2026-12205.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index fd990d8864f3..e5e0a4bd728c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7098,14 +7098,17 @@ with self;
 
   CryptDSA = buildPerlPackage {
     pname = "Crypt-DSA";
-    version = "1.17";
+    version = "1.21";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AD/ADAMK/Crypt-DSA-1.17.tar.gz";
-      hash = "sha256-0bhYX2v3RvduXcXaNkHTJe1la8Ll80S1RRS1XDEAmgM=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.21.tar.gz";
+      hash = "sha256-pGIB6DkOi6O75RER12SJ8x2v2g9qYLCrkxndUr0rMrA=";
     };
     propagatedBuildInputs = [
+      ConvertASN1
+      ConvertPEM
+      CryptSysRandom
+      CryptURandom
       DataBuffer
-      DigestSHA1
       FileWhich
     ];
     meta = {

From 261df4c82cbef82eff433195316c3222c9dd5873 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:31:40 +0200
Subject: [PATCH 0843/1209] perlPackages.Sereal: 5.004 -> 5.006

Fixes CVE-2026-8796. Covers Sereal, Sereal::Decoder and Sereal::Encoder.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e5e0a4bd728c..fd3d5aa012a4 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -30674,10 +30674,10 @@ with self;
 
   SerealDecoder = buildPerlPackage {
     pname = "Sereal-Decoder";
-    version = "5.004";
+    version = "5.006";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-5.004.tar.gz";
-      hash = "sha256-aO8DFNh9Gm5guw9m/PQ+ssrN6xdUQy9eJeeE450+Z4Q=";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-5.006.tar.gz";
+      hash = "sha256-eZGFXpGBo3nJsBIv6PwvaONEnJFhaow1eSbxFh9oR2g=";
     };
     buildInputs = [
       TestDeep
@@ -30699,10 +30699,10 @@ with self;
 
   SerealEncoder = buildPerlPackage {
     pname = "Sereal-Encoder";
-    version = "5.004";
+    version = "5.006";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-5.004.tar.gz";
-      hash = "sha256-XlqGzNMtrjTtgJMuy+XGjil1K13g6bCnk6t+sspVyxs=";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-5.006.tar.gz";
+      hash = "sha256-kLQsyHdZgq4MdJno9ZLOeu+ug0M1g+EKWtVxKBHRcK0=";
     };
     buildInputs = [
       SerealDecoder
@@ -30724,10 +30724,10 @@ with self;
 
   Sereal = buildPerlPackage {
     pname = "Sereal";
-    version = "5.004";
+    version = "5.006";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-5.004.tar.gz";
-      hash = "sha256-nCW7euS9c20ksa0dk9dzlbDGXKh0HiZr/Ay+VCJh128=";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-5.006.tar.gz";
+      hash = "sha256-uwXnY+1ry+pEx5IX/vCy05GKwVRxlHIwOMbER+5vWd4=";
     };
     buildInputs = [
       TestDeep

From 5fb740257c36a83351b79b1dc15d8056a1533976 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:36:58 +0200
Subject: [PATCH 0844/1209] perlPackages.XMLLibXML: 2.0210 -> 2.0213

Fixes CVE-2026-8177. Drops the libxml-2.13 test patch, now included upstream.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../XML-LibXML-fix-tests-libxml-2.13.0.patch  | 242 ------------------
 pkgs/top-level/perl-packages.nix              |  10 +-
 2 files changed, 3 insertions(+), 249 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch

diff --git a/pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch b/pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch
deleted file mode 100644
index 5433d3afd934..000000000000
--- a/pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch
+++ /dev/null
@@ -1,242 +0,0 @@
-From bee8338fd1cbd7aad4bf60c2965833343b6ead6f Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Tue, 21 May 2024 15:17:30 +0200
-Subject: [PATCH 1/3] Fix test suite with libxml2 2.13.0
-
----
- t/02parse.t                        | 7 ++++++-
- t/08findnodes.t                    | 8 +++++++-
- t/19die_on_invalid_utf8_rt_58848.t | 2 +-
- t/25relaxng.t                      | 4 ++--
- t/26schema.t                       | 4 ++--
- t/60error_prev_chain.t             | 8 ++++----
- 6 files changed, 22 insertions(+), 11 deletions(-)
-
-diff --git a/t/02parse.t b/t/02parse.t
-index b111507b..40aa5f13 100644
---- a/t/02parse.t
-+++ b/t/02parse.t
-@@ -884,7 +884,12 @@ EOXML
-         eval {
-            $doc2    = $parser->parse_string( $xmldoc );
-         };
--        isnt($@, '', "error parsing $xmldoc");
-+        # https://gitlab.gnome.org/GNOME/libxml2/-/commit/b717abdd
-+        if (XML::LibXML::LIBXML_RUNTIME_VERSION() < 21300) {
-+            isnt($@, '', "error parsing $xmldoc");
-+        } else {
-+            is( $doc2->documentElement()->firstChild()->nodeName(), "foo" );
-+        }
- 
-         $parser->validation(1);
- 
-diff --git a/t/08findnodes.t b/t/08findnodes.t
-index 016c85a1..e9417bc5 100644
---- a/t/08findnodes.t
-+++ b/t/08findnodes.t
-@@ -123,7 +123,13 @@ my $docstring = q{
- my @ns = $root->findnodes('namespace::*');
- # TEST
- 
--is(scalar(@ns), 2, ' TODO : Add test name' );
-+# https://gitlab.gnome.org/GNOME/libxml2/-/commit/aca16fb3
-+# fixed xmlCopyNamespace with XML namespace.
-+if (XML::LibXML::LIBXML_RUNTIME_VERSION() < 21300) {
-+    is(scalar(@ns), 2, ' TODO : Add test name' );
-+} else {
-+    is(scalar(@ns), 3, ' TODO : Add test name' );
-+}
- 
- # bad xpaths
- # TEST:$badxpath=4;
-diff --git a/t/19die_on_invalid_utf8_rt_58848.t b/t/19die_on_invalid_utf8_rt_58848.t
-index aa8ad105..4160cb27 100644
---- a/t/19die_on_invalid_utf8_rt_58848.t
-+++ b/t/19die_on_invalid_utf8_rt_58848.t
-@@ -16,7 +16,7 @@ use XML::LibXML;
-     my $err = $@;
- 
-     # TEST
--    like ("$err", qr{parser error : Input is not proper UTF-8},
-+    like ("$err", qr{not proper UTF-8|Invalid bytes in character encoding},
-         'Parser error.',
-     );
- }
-diff --git a/t/25relaxng.t b/t/25relaxng.t
-index 93e61883..71383b2a 100644
---- a/t/25relaxng.t
-+++ b/t/25relaxng.t
-@@ -132,7 +132,7 @@ print "# 6 check that no_network => 1 works\n";
- {
-     my $rng = eval { XML::LibXML::RelaxNG->new( location => $netfile, no_network => 1 ) };
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'RNG from file location with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'RNG from file location with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $rng, 'RNG from file location with external import and no_network => 1 is not loaded.' );
- }
-@@ -152,7 +152,7 @@ print "# 6 check that no_network => 1 works\n";
- </grammar>
- EOF
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'RNG from buffer with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'RNG from buffer with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $rng, 'RNG from buffer with external import and no_network => 1 is not loaded.' );
- }
-diff --git a/t/26schema.t b/t/26schema.t
-index 17f641e4..c404cedd 100644
---- a/t/26schema.t
-+++ b/t/26schema.t
-@@ -117,7 +117,7 @@ EOF
- {
-     my $schema = eval { XML::LibXML::Schema->new( location => $netfile, no_network => 1 ) };
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'Schema from file location with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'Schema from file location with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $schema, 'Schema from file location with external import and no_network => 1 is not loaded.' );
- }
-@@ -129,7 +129,7 @@ EOF
- </xsd:schema>
- EOF
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'Schema from buffer with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'Schema from buffer with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $schema, 'Schema from buffer with external import and no_network => 1 is not loaded.' );
- }
-diff --git a/t/60error_prev_chain.t b/t/60error_prev_chain.t
-index e48215c4..55ac0b2e 100644
---- a/t/60error_prev_chain.t
-+++ b/t/60error_prev_chain.t
-@@ -16,13 +16,11 @@ use XML::LibXML;
- 
- {
-     my $parser = XML::LibXML->new();
--    $parser->validation(0);
--    $parser->load_ext_dtd(0);
- 
-     eval
-     {
-         local $^W = 0;
--        $parser->parse_file('example/JBR-ALLENtrees.htm');
-+        $parser->parse_string('<doc>&ldquo;&nbsp;&rdquo;</doc>');
-     };
- 
-     my $err = $@;
-@@ -31,7 +29,7 @@ use XML::LibXML;
-     if( $err && !ref($err) ) {
-       plan skip_all => 'The local libxml library does not support errors as objects to $@';
-     }
--    plan tests => 1;
-+    plan tests => 2;
- 
-     while (defined($err) && $count < 200)
-     {
-@@ -44,6 +42,8 @@ use XML::LibXML;
- 
-     # TEST
-     ok ((!$err), "Reached the end of the chain.");
-+    # TEST
-+    is ($count, 3, "Correct number of errors reported")
- }
- 
- =head1 COPYRIGHT & LICENSE
-
-From c9f9c2fe51173b0a00969f01b577399f1098aa47 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Thu, 13 Feb 2025 19:50:35 +0100
-Subject: [PATCH 2/3] Fix test suite with libxml2 2.14.0
-
----
- t/16docnodes.t   | 7 ++++++-
- t/49_load_html.t | 8 +++++++-
- 2 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/t/16docnodes.t b/t/16docnodes.t
-index db7bc1fc..0b0ae005 100644
---- a/t/16docnodes.t
-+++ b/t/16docnodes.t
-@@ -60,7 +60,12 @@ for my $time (0 .. 2) {
-     $doc->setDocumentElement($node);
- 
-     # TEST
--    is( $node->serialize(), '<test contents="&#xE4;"/>', 'Node serialise works.' );
-+    # libxml2 2.14 avoids unnecessary escaping of attribute values.
-+    if (XML::LibXML::LIBXML_VERSION() >= 21400) {
-+        is( $node->serialize(), "<test contents=\"\xE4\"/>", 'Node serialise works.' );
-+    } else {
-+        is( $node->serialize(), '<test contents="&#xE4;"/>', 'Node serialise works.' );
-+    }
- 
-     $doc->setEncoding('utf-8');
-     # Second output
-diff --git a/t/49_load_html.t b/t/49_load_html.t
-index 70d26607..3861edf8 100644
---- a/t/49_load_html.t
-+++ b/t/49_load_html.t
-@@ -52,7 +52,13 @@ use XML::LibXML;
- </div>
- EOS
- 
--    {
-+    SKIP: {
-+        # libxml2 2.14 tokenizes HTML according to HTML5 where
-+        # this isn't an error, see "13.2.5.73 Named character
-+        # reference state".
-+        skip("libxml2 version >= 21400", 1)
-+            if XML::LibXML::LIBXML_VERSION >= 21400;
-+
-         my $buf = '';
-         open my $fh, '>', \$buf;
-         # redirect STDERR there
-
-From ecbebc2f33fecb66b3d5487c6e48bea353e374f9 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Fri, 16 May 2025 19:11:12 +0200
-Subject: [PATCH 3/3] Remove tests that disable line numbers
-
-Line numbers are always enabled since libxml2 2.15.0.
----
- t/02parse.t | 13 ++-----------
- 1 file changed, 2 insertions(+), 11 deletions(-)
-
-diff --git a/t/02parse.t b/t/02parse.t
-index 40aa5f13..17419f8f 100644
---- a/t/02parse.t
-+++ b/t/02parse.t
-@@ -14,7 +14,7 @@ use locale;
- 
- POSIX::setlocale(LC_ALL, "C");
- 
--use Test::More tests => 533;
-+use Test::More tests => 531;
- use IO::File;
- 
- use XML::LibXML::Common qw(:libxml);
-@@ -25,7 +25,7 @@ use constant XML_DECL => "<?xml version=\"1.0\"?>\n";
- 
- use Errno qw(ENOENT);
- 
--# TEST*533
-+# TEST*531
- 
- ##
- # test values
-@@ -773,15 +773,6 @@ EOXML
- 
-     my $newkid = $root->appendChild( $doc->createElement( "bar" ) );
-     is( $newkid->line_number(), 0, "line number is 0");
--
--    $parser->line_numbers(0);
--    eval { $doc = $parser->parse_string( $goodxml ); };
--
--    $root = $doc->documentElement();
--    is( $root->line_number(), 0, "line number is 0");
--
--    @kids = $root->childNodes();
--    is( $kids[1]->line_number(), 0, "line number is 0");
- }
- 
- SKIP: {
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index fd3d5aa012a4..d3379d5774ad 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -38886,10 +38886,10 @@ with self;
 
   XMLLibXML = buildPerlPackage {
     pname = "XML-LibXML";
-    version = "2.0210";
+    version = "2.0213";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/XML-LibXML-2.0210.tar.gz";
-      hash = "sha256-opvz8Aq5ye4EIYFU4K/I95m/I2dOuZwantTeH0BZpI0=";
+      url = "mirror://cpan/authors/id/T/TO/TODDR/XML-LibXML-2.0213.tar.gz";
+      hash = "sha256-KvIcXWGsNOompfq/FbpaWEHmSPcYnbPjO28otUiYAqs=";
     };
     env.SKIP_SAX_INSTALL = 1;
     buildInputs = [
@@ -38903,10 +38903,6 @@ with self;
         zlib
       ]
     );
-    patches = [
-      # https://github.com/shlomif/perl-XML-LibXML/pull/87
-      ../development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch
-    ];
     propagatedBuildInputs = [ XMLSAX ];
     meta = {
       description = "Perl Binding for libxml2";

From 62e6ec8536bbdb987df446af821549d619a10aca Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:37:47 +0200
Subject: [PATCH 0845/1209] perlPackages.CryptPasswdMD5: 1.42 -> 1.43

Fixes CVE-2026-6659.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d3379d5774ad..59ee0f27bc15 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7302,11 +7302,12 @@ with self;
 
   CryptPasswdMD5 = buildPerlPackage {
     pname = "Crypt-PasswdMD5";
-    version = "1.42";
+    version = "1.43";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RS/RSAVAGE/Crypt-PasswdMD5-1.42.tgz";
-      hash = "sha256-/Tlubn9E7rkj6TyZOUC49nqa7Vb8dKrK8Dj8QFPvO1k=";
+      url = "mirror://cpan/authors/id/R/RS/RSAVAGE/Crypt-PasswdMD5-1.43.tgz";
+      hash = "sha256-Qr+Sk0UQlYXUlWkCVX7ONdBh7aQ454lPhucHV0EoB1k=";
     };
+    propagatedBuildInputs = [ CryptURandom ];
     meta = {
       description = "Provide interoperable MD5-based crypt() functions";
       license = with lib.licenses; [

From 4b37127ec079734d0201385a0f3f96e1c6c20f45 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:38:37 +0200
Subject: [PATCH 0846/1209] perlPackages.CryptScryptKDF: 0.010 -> 0.011

Fixes CVE-2026-8647.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 59ee0f27bc15..b4366c504dad 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7540,12 +7540,15 @@ with self;
 
   CryptScryptKDF = buildPerlModule {
     pname = "Crypt-ScryptKDF";
-    version = "0.010";
+    version = "0.011";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIK/Crypt-ScryptKDF-0.010.tar.gz";
-      hash = "sha256-fRbulczj61TBdGc6cpn0wIb7o6yF+EfQ4TT+7V93YBc=";
+      url = "mirror://cpan/authors/id/M/MI/MIK/Crypt-ScryptKDF-0.011.tar.gz";
+      hash = "sha256-IZLJ8E8rX/cHN/XNrz9PZ6VXE8MeoIVAOMvzXjttFrQ=";
     };
-    propagatedBuildInputs = [ CryptOpenSSLRandom ];
+    propagatedBuildInputs = [
+      CryptOpenSSLRandom
+      CryptX
+    ];
     meta = {
       description = "Scrypt password based key derivation function";
       homepage = "https://github.com/DCIT/perl-Crypt-ScryptKDF";

From d22c1175af2ad1614c19f547a34677bc9250618d Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:40:15 +0200
Subject: [PATCH 0847/1209] perlPackages.Starlet: 0.31 -> 0.32

Fixes CVE-2026-40561.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b4366c504dad..358f2bcc0a74 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -31505,10 +31505,10 @@ with self;
 
   Starlet = buildPerlPackage {
     pname = "Starlet";
-    version = "0.31";
+    version = "0.32";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/K/KA/KAZUHO/Starlet-0.31.tar.gz";
-      hash = "sha256-uWA7jmKIDLRYL2p5Oer+xl5u/T2QDyx900Ll9MaNYtg=";
+      url = "mirror://cpan/authors/id/K/KA/KAZUHO/Starlet-0.32.tar.gz";
+      hash = "sha256-gZI9OmCX3YHH4Og9SBvuof89ZejgHY0f59yziFV1vY8=";
     };
     buildInputs = [
       LWP

From 55c68fd7a07225921f12f09c3fca242c5335dd53 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:41:21 +0200
Subject: [PATCH 0848/1209] perlPackages.GD: 2.78 -> 2.86

Fixes CVE-2026-11526.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 358f2bcc0a74..2953ec4b86e0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -14767,10 +14767,10 @@ with self;
 
   GD = buildPerlPackage {
     pname = "GD";
-    version = "2.78";
+    version = "2.86";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/GD-2.78.tar.gz";
-      hash = "sha256-aDEFS/VCS09cI9NifT0UhEgPb5wsZmMiIpFfKFG+buQ=";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/GD-2.86.tar.gz";
+      hash = "sha256-bWTTvhQpzB606IqPICL+yRDqPgeS2k/ljT7fdpXEbKI=";
     };
 
     nativeBuildInputs = [
@@ -14785,6 +14785,7 @@ with self;
       pkgs.fontconfig
       pkgs.libxpm
       ExtUtilsPkgConfig
+      FileWhich
       TestFork
       TestNoWarnings
     ];

From 02ee43b56f68a424ce31e1c986b9fe4dccb1cb2f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:41:41 +0200
Subject: [PATCH 0849/1209] perlPackages.ConfigIniFiles: 3.000003 -> 3.002000

Fixes CVE-2026-11527.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2953ec4b86e0..044bd764f9dc 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6043,10 +6043,10 @@ with self;
 
   ConfigIniFiles = buildPerlPackage {
     pname = "Config-IniFiles";
-    version = "3.000003";
+    version = "3.002000";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/Config-IniFiles-3.000003.tar.gz";
-      hash = "sha256-PEV7ZdmOX/QL25z4FLDVmD6wxT+4aWvaO6A1rSrNaAI=";
+      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/Config-IniFiles-3.002000.tar.gz";
+      hash = "sha256-Bmke17QZl+hQxOfGs05cOWFF4M0FCvGUSiDQaMOlpAs=";
     };
     propagatedBuildInputs = [ IOStringy ];
     meta = {

From 3cb2e3221aacd925b9a2ff29b2f7ba60a0517bad Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:44:06 +0200
Subject: [PATCH 0850/1209] perlPackages.CookieBaker: 0.11 -> 0.12

Required by Plack::Middleware::Session 0.36.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 044bd764f9dc..467b42750904 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6501,10 +6501,10 @@ with self;
 
   CookieBaker = buildPerlModule {
     pname = "Cookie-Baker";
-    version = "0.11";
+    version = "0.12";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/K/KA/KAZEBURO/Cookie-Baker-0.11.tar.gz";
-      hash = "sha256-WSdfR04HwKo2EePmhLiU59uRMzPYIUQgvmPxLsGM16s=";
+      url = "mirror://cpan/authors/id/K/KA/KAZEBURO/Cookie-Baker-0.12.tar.gz";
+      hash = "sha256-mwTfXUfc1FrEKZYmoQ7JkPtAyU7lpjAMOoi9+zV17Ck=";
     };
     buildInputs = [
       ModuleBuildTiny

From 02bfa3d8bc458884286314b9b12121c5578e34f1 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:44:58 +0200
Subject: [PATCH 0851/1209] perlPackages.PlackMiddlewareSession: 0.33 -> 0.36

Fixes CVE-2025-40923, CVE-2013-10031.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 467b42750904..641ec4012eed 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -28675,12 +28675,13 @@ with self;
 
   PlackMiddlewareSession = buildPerlModule {
     pname = "Plack-Middleware-Session";
-    version = "0.33";
+    version = "0.36";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-Middleware-Session-0.33.tar.gz";
-      hash = "sha256-T/miydGK2ASbRd/ze5vdQSIeLC8eFrr7gb/tyIxRpO4=";
+      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-Middleware-Session-0.36.tar.gz";
+      hash = "sha256-kqWDFliBDSNzLm47rnpEofpafYpqbm3NdbkcapwktGY=";
     };
     propagatedBuildInputs = [
+      CryptSysRandom
       DigestHMAC
       Plack
     ];

From 2c79c8f23a6b7a61195c7f53622ef68ed3a84e9f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:46:07 +0200
Subject: [PATCH 0852/1209] perlPackages.YAMLLibYAML: 0.89 -> 0.907.0

Fixes CVE-2025-40908.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 641ec4012eed..4a3d55e2e092 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -39503,11 +39503,12 @@ with self;
 
   YAMLLibYAML = buildPerlPackage {
     pname = "YAML-LibYAML";
-    version = "0.89";
+    version = "0.907.0";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TI/TINITA/YAML-LibYAML-0.89.tar.gz";
-      hash = "sha256-FVq4NnU0XFCt0DMRrPndkVlVcH+Qmiq9ixfXeShZsuw=";
+      url = "mirror://cpan/authors/id/T/TI/TINITA/YAML-LibYAML-v0.907.0.tar.gz";
+      hash = "sha256-a6CHIkkROJ52+hmLFJzsg/BlsKx13cUmGPNJCULNlQY=";
     };
+    buildInputs = [ TestWarnings ];
     meta = {
       description = "Perl YAML Serialization using XS and libyaml";
       license = with lib.licenses; [

From 49ef24302dabf5edc456c4ed56af2133cac0b48c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:47:18 +0200
Subject: [PATCH 0853/1209] perlPackages.CryptCBC: 2.33 -> 3.07

Fixes CVE-2025-2814.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4a3d55e2e092..191240106782 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6972,11 +6972,16 @@ with self;
 
   CryptCBC = buildPerlPackage {
     pname = "Crypt-CBC";
-    version = "2.33";
+    version = "3.07";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LD/LDS/Crypt-CBC-2.33.tar.gz";
-      hash = "sha256-anDeIbbMfysQAGfo4Yjblm6agAG122+pdufLWylK5kU=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-CBC-3.07.tar.gz";
+      hash = "sha256-9N37TdasUBPfg0G/pzTZye4PEOLnEhXsj+W/eAt8kSc=";
     };
+    propagatedBuildInputs = [
+      CryptPBKDF2
+      CryptURandom
+      CryptX
+    ];
     meta = {
       description = "Encrypt Data with Cipher Block Chaining Mode";
       license = with lib.licenses; [

From 5b6275f4054ef7e0c374079db3bfd761b710aad4 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:48:14 +0200
Subject: [PATCH 0854/1209] perlPackages.Mojolicious: 9.39 -> 9.46

Fixes CVE-2024-58135.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 191240106782..ac449bd8bfa4 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -22810,10 +22810,10 @@ with self;
 
   Mojolicious = buildPerlPackage {
     pname = "Mojolicious";
-    version = "9.39";
+    version = "9.46";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.39.tar.gz";
-      hash = "sha256-EwpJDXfXYTn3NM4biU1Fm64DgF+x89/dWPxE/oKvPP0=";
+      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.46.tar.gz";
+      hash = "sha256-/kc9LK5tLe/pUBgCggc2VoJa0F20TwvIxIQhXi1xaqw=";
     };
     meta = {
       description = "Real-time web framework";

From a06c0268f6fadd8d6a070df7f3bf30cec3ee0237 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 15:21:30 +0200
Subject: [PATCH 0855/1209] perlPackages.IOCompress: 2.220 -> 2.221

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index ac449bd8bfa4..7c456f4ffd9e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17667,10 +17667,10 @@ with self;
 
   IOCompress = buildPerlPackage {
     pname = "IO-Compress";
-    version = "2.220";
+    version = "2.221";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
-      hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
+      url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.221.tar.gz";
+      hash = "sha256-r0LJyRBK3313LSVcDZpASjRi6kXnvELQbaCgtR3j0K4=";
     };
     propagatedBuildInputs = [
       CompressRawBzip2

From d95a5e6344e6e7b308e6c6e35cadfd37da5229a9 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 15:22:08 +0200
Subject: [PATCH 0856/1209] perlPackages.HTTPMessage: 6.45 -> 7.02

Required by libwww-perl 6.83.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7c456f4ffd9e..76b3b03f6192 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17004,10 +17004,10 @@ with self;
 
   HTTPMessage = buildPerlPackage {
     pname = "HTTP-Message";
-    version = "6.45";
+    version = "7.02";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Message-6.45.tar.gz";
-      hash = "sha256-AcuEBmEqP3OIQtHpcxOuTYdIcNG41tZjMfFgAJQ9TL4=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Message-7.02.tar.gz";
+      hash = "sha256-eKvvHYMxRrSNF9shmxsD1Ty743oozNrQ79zFgzylxgw=";
     };
     buildInputs = [
       TestNeeds
@@ -17015,8 +17015,11 @@ with self;
     ];
     propagatedBuildInputs = [
       Clone
+      CompressRawBzip2
+      CompressRawZlib
       EncodeLocale
       HTTPDate
+      IOCompress
       IOHTML
       LWPMediaTypes
       URI

From 03a06252a45713863ded5d69ef44e0a738281389 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 15:23:31 +0200
Subject: [PATCH 0857/1209] perlPackages.libwwwperl: 6.72 -> 6.83

Fixes CVE-2026-8368. Covers both the libwwwperl and LWP attributes.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 76b3b03f6192..c7527717d04c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -18908,10 +18908,10 @@ with self;
 
   libwwwperl = buildPerlPackage {
     pname = "libwww-perl";
-    version = "6.72";
+    version = "6.83";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.72.tar.gz";
-      hash = "sha256-6bg1T9XiC+IHr+I93VhPzVm/gpmNwHfez2hLodrloF0=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.83.tar.gz";
+      hash = "sha256-518PqdPG8Nr1pacvqfixycDSPjqEqFIsy0+DUjK5VQU=";
     };
     buildInputs = [
       HTTPDaemon
@@ -20165,10 +20165,10 @@ with self;
 
   LWP = buildPerlPackage {
     pname = "libwww-perl";
-    version = "6.72";
+    version = "6.83";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.72.tar.gz";
-      hash = "sha256-6bg1T9XiC+IHr+I93VhPzVm/gpmNwHfez2hLodrloF0=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.83.tar.gz";
+      hash = "sha256-518PqdPG8Nr1pacvqfixycDSPjqEqFIsy0+DUjK5VQU=";
     };
     propagatedBuildInputs = [
       FileListing

From f9e1063171bf862c4d17997769cc0795223f6730 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 26 Jun 2026 23:05:27 +0200
Subject: [PATCH 0858/1209] merve: add support for building without simdutf
 support

Required for Node.js 24.
---
 pkgs/by-name/me/merve/package.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/me/merve/package.nix b/pkgs/by-name/me/merve/package.nix
index e8a210d551e6..066ac8fd351d 100644
--- a/pkgs/by-name/me/merve/package.nix
+++ b/pkgs/by-name/me/merve/package.nix
@@ -26,16 +26,14 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" (!static))
     (lib.cmakeBool "MERVE_TESTING" finalAttrs.finalPackage.doCheck)
-    (lib.cmakeBool "MERVE_USE_SIMDUTF" true)
-  ];
+  ]
+  ++ lib.optional (simdutf != null) (lib.cmakeBool "MERVE_USE_SIMDUTF" true);
 
   nativeBuildInputs = [
     cmake
     validatePkgConfig
   ];
-  buildInputs = [
-    simdutf
-  ];
+  buildInputs = lib.optional (simdutf != null) simdutf;
   checkInputs = [
     gtest
   ];

From cba47cf5e84bdc7a2c5d1ef9507fe42bb4948610 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 26 Jun 2026 23:06:02 +0200
Subject: [PATCH 0859/1209] nodejs_24: fix merve dependency

---
 pkgs/development/web/nodejs/nodejs.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 537ea51b87cf..10e5d65bf58f 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -144,7 +144,7 @@ let
   );
   useSharedNBytes = lib.versionAtLeast version (if majorVersion == "24" then "24.14.0" else "25.5");
   useSharedLief = lib.versionAtLeast version "25.6";
-  useSharedMerve = lib.versionAtLeast version (if majorVersion == 24 then "24.14.0" else "25.6.1");
+  useSharedMerve = lib.versionAtLeast version (if majorVersion == "24" then "24.14.0" else "25.6.1");
   useSharedSQLite = lib.versionAtLeast version "22.5";
   useSharedTemporal = majorVersion == "26";
   useSharedZstd = lib.versionAtLeast version "22.15";
@@ -190,7 +190,8 @@ let
     inherit nbytes;
   })
   // (lib.optionalAttrs useSharedMerve {
-    inherit merve;
+    # Merve cannot be built with simdutf_6, and upstream also disables simdutf support on the 24.x branch
+    merve = if majorVersion == "24" then (merve.override { simdutf = null; }) else merve;
   })
   // (lib.optionalAttrs useSharedZstd {
     inherit zstd;

From e2eaadff3972b388d210d102e57156f3d249cd29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 14:32:16 -0700
Subject: [PATCH 0860/1209] python3Packages.pytest-cases: use setuptools_80

Otherwise it fails to build with

    ModuleNotFoundError: No module named 'pkg_resources'
---
 pkgs/development/python-modules/pytest-cases/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pytest-cases/default.nix b/pkgs/development/python-modules/pytest-cases/default.nix
index 6e5b90d27966..e5680266e742 100644
--- a/pkgs/development/python-modules/pytest-cases/default.nix
+++ b/pkgs/development/python-modules/pytest-cases/default.nix
@@ -6,6 +6,7 @@
   decopatch,
   packaging,
   pytest,
+  setuptools_80,
   setuptools-scm,
 }:
 
@@ -20,7 +21,10 @@ buildPythonPackage rec {
     hash = "sha256-xOGB8bUlyTGjGNSBL6jeZWwsj7d/zPFXHs8Mxf6Of48=";
   };
 
-  build-system = [ setuptools-scm ];
+  build-system = [
+    setuptools_80
+    setuptools-scm
+  ];
 
   dependencies = [
     decopatch

From 46ce48acd11ce2d79f83a980f9540e8baaf891ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 14:43:48 -0700
Subject: [PATCH 0861/1209] python3Packages.flexcache: remove unused dependency
 pytest-mpl

---
 pkgs/development/python-modules/flexcache/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/flexcache/default.nix b/pkgs/development/python-modules/flexcache/default.nix
index 5e1389986fb7..76276a0bf567 100644
--- a/pkgs/development/python-modules/flexcache/default.nix
+++ b/pkgs/development/python-modules/flexcache/default.nix
@@ -13,7 +13,6 @@
 
   # checks
   pytestCheckHook,
-  pytest-mpl,
 }:
 
 buildPythonPackage rec {
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    pytest-mpl
   ];
 
   pythonImportsCheck = [ "flexcache" ];

From 83c50ab4ab53e7f5ca1947d489296a8d101c277a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 14:45:05 -0700
Subject: [PATCH 0862/1209] python3Packages.flexparser: remove unused
 dependency pytest-mpl

---
 pkgs/development/python-modules/flexparser/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/flexparser/default.nix b/pkgs/development/python-modules/flexparser/default.nix
index 51d7e223c9ba..1e5be670e34b 100644
--- a/pkgs/development/python-modules/flexparser/default.nix
+++ b/pkgs/development/python-modules/flexparser/default.nix
@@ -12,7 +12,6 @@
 
   # checks
   pytestCheckHook,
-  pytest-mpl,
 }:
 
 buildPythonPackage rec {
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    pytest-mpl
   ];
 
   pythonImportsCheck = [ "flexparser" ];

From fd5878533a8db6bd401be1863a39c813f3d0b366 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 15:34:23 -0700
Subject: [PATCH 0863/1209] python3Packages.strct: support setuptools 82

---
 pkgs/development/python-modules/strct/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/python-modules/strct/default.nix b/pkgs/development/python-modules/strct/default.nix
index ff38db934034..cbc80a0261bd 100644
--- a/pkgs/development/python-modules/strct/default.nix
+++ b/pkgs/development/python-modules/strct/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  fetchpatch,
   buildPythonPackage,
   setuptools,
   pytestCheckHook,
@@ -20,6 +21,15 @@ buildPythonPackage rec {
     hash = "sha256-4IykGzy1PTrRAbx/sdtzL4My4cDSlplL9rOFBcLbaB8=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "support-setuptools-82.patch";
+      url = "https://github.com/shaypal5/strct/commit/5005a939b590cd992d985128a2c1dba230a7fe41.patch";
+      includes = [ "setup.py" ];
+      hash = "sha256-0vRRst79G6JZZ+IzBR7rr85nOo0qY0ikVBz4Lvauwbc=";
+    })
+  ];
+
   # don't append .dev0 to version
   env.RELEASING_PROCESS = "1";
 

From b545bebf4294e5bf9b92b0419aa274b4a1ee71f4 Mon Sep 17 00:00:00 2001
From: kataokatsuki <kataokatsuki@users.noreply.github.com>
Date: Sat, 27 Jun 2026 20:05:21 +0900
Subject: [PATCH 0864/1209] nodejs: call configure.py directly

nodejs.nix currently creates configureScript with writeScript. This produces an
executable text file without a shebang, which configurePhase then runs as
$configureScript.

The wrapper only invokes configure.py through Python, so call configure.py
through python.interpreter directly instead. This avoids the shebang-less
wrapper path and stops relying on python.executable being resolved through
PATH.
---
 pkgs/development/web/nodejs/nodejs.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 343be8e14791..6ce440b867bd 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -347,9 +347,7 @@ let
 
       dontDisableStatic = true;
 
-      configureScript = writeScript "nodejs-configure" ''
-        exec ${python.executable} configure.py "$@"
-      '';
+      configureScript = "${python.interpreter} configure.py";
 
       # In order to support unsupported cross configurations, we copy some intermediate executables
       # from a native build and replace all the build-system tools with a script which simply touches

From 504f6c930735259be2440a797e4318352840f6a4 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sat, 27 Jun 2026 15:39:06 +0200
Subject: [PATCH 0865/1209] nodejs_24: fix fs tracking warnings on Darwin

---
 pkgs/development/web/nodejs/nodejs.nix | 6 ------
 pkgs/development/web/nodejs/v24.nix    | 1 +
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 10e5d65bf58f..bb3f44dff31d 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -519,12 +519,6 @@ let
               "test-tick-processor-arguments"
               "test-set-raw-mode-reset-signal"
             ]
-            # Apple SDK update broke something related to those tests, so skipping them for now
-            ++ lib.optionals (majorVersion == "24" && stdenv.hostPlatform.isDarwin) [
-              "test-worker-track-unmanaged-fds"
-              "test-esm-import-meta-main-eval"
-              "test-worker-debug"
-            ]
             # These network/fetch/inspector tests fail on riscv64
             ++ lib.optionals (majorVersion == "24" && stdenv.hostPlatform.isRiscV64) [
               "test-fetch"
diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 359e20891269..ca6a16ddf1ba 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -12,6 +12,7 @@ let
   buildNodejs = callPackage ./nodejs.nix {
     inherit openssl;
     python = python3;
+    stdenv = buildPackages.llvmPackages_20.libcxxStdenv;
   };
 
   gypPatches =

From 09614c7c7db1f2fc7ce9c6f7b2a067160e43bd7f Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Tue, 9 Jun 2026 15:11:31 +0200
Subject: [PATCH 0866/1209] cmake: 4.1.2 -> 4.3.4

changelog: https://cmake.org/cmake/help/v4.3/release/4.3.html

diff: https://github.com/Kitware/CMake/compare/v4.1.2...v4.3.4
---
 .../cm/cmake/darwin-binary-paths.patch        |  13 --
 .../cm/cmake/darwin-bsd-binary-paths.patch    |   8 +-
 pkgs/by-name/cm/cmake/package.nix             |   4 +-
 .../cm/cmake/remove-impure-search-paths.patch | 130 +++++++++++-------
 4 files changed, 84 insertions(+), 71 deletions(-)

diff --git a/pkgs/by-name/cm/cmake/darwin-binary-paths.patch b/pkgs/by-name/cm/cmake/darwin-binary-paths.patch
index b4e84bef22e6..af9d5af2cfe1 100644
--- a/pkgs/by-name/cm/cmake/darwin-binary-paths.patch
+++ b/pkgs/by-name/cm/cmake/darwin-binary-paths.patch
@@ -46,16 +46,3 @@ index 15a1e2c0c3..33bb304cf7 100644
          OUTPUT_VARIABLE OSX_VERSION
          OUTPUT_STRIP_TRAILING_WHITESPACE
          )
-diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
-index ddc975c202..8ff651fd90 100644
---- a/Utilities/cmcurl/CMakeLists.txt
-+++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -127,7 +127,7 @@
-     set(OSX_VERSION ${CMAKE_OSX_DEPLOYMENT_TARGET})
-   else()
-     execute_process(
--      COMMAND sw_vers -productVersion
-+      COMMAND @sw_vers@ -productVersion
-       OUTPUT_VARIABLE OSX_VERSION
-       OUTPUT_STRIP_TRAILING_WHITESPACE
-       )
diff --git a/pkgs/by-name/cm/cmake/darwin-bsd-binary-paths.patch b/pkgs/by-name/cm/cmake/darwin-bsd-binary-paths.patch
index b7917467f2f0..8fe699ac2953 100644
--- a/pkgs/by-name/cm/cmake/darwin-bsd-binary-paths.patch
+++ b/pkgs/by-name/cm/cmake/darwin-bsd-binary-paths.patch
@@ -39,13 +39,13 @@ index 260b6631c0..ffb8fcd8d2 100644
      if(ProcessorCount_cmd_sysctl)
        execute_process(COMMAND ${ProcessorCount_cmd_sysctl} -n hw.ncpu
 diff --git a/Source/kwsys/ProcessUNIX.c b/Source/kwsys/ProcessUNIX.c
-index a918b8d9a7..36145707e1 100644
+index 8c22b4e43a..6d9ccef5e7 100644
 --- a/Source/kwsys/ProcessUNIX.c
 +++ b/Source/kwsys/ProcessUNIX.c
-@@ -2503,7 +2503,7 @@
-    have two integers to store: the pid and then the ppid.  */
+@@ -2503,7 +2503,7 @@ static pid_t kwsysProcessFork(kwsysProcess* cp,
  #if defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__) ||       \
-   defined(__OpenBSD__) || defined(__GLIBC__) || defined(__GNU__)
+   defined(__NetBSD__) || defined(__OpenBSD__) || defined(__GLIBC__) ||        \
+   defined(__GNU__)
 -#  define KWSYSPE_PS_COMMAND "ps axo pid,ppid"
 +#  define KWSYSPE_PS_COMMAND "@ps@ axo pid,ppid"
  #  define KWSYSPE_PS_FORMAT "%d %d\n"
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index dc16992a27aa..134896e1fee7 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -50,11 +50,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "4.1.2";
+  version = "4.3.4";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ZD8EGCt7oyOrMfUm94UTT7ecujGIqFIgbvBHP+4oKhU=";
+    hash = "sha256-/e/4l7nrSddkU58rHtxut+FEDfMlZ4qXwZeEmekxrdo=";
   };
 
   patches = [
diff --git a/pkgs/by-name/cm/cmake/remove-impure-search-paths.patch b/pkgs/by-name/cm/cmake/remove-impure-search-paths.patch
index cb01326b9c35..87c58b4ecb42 100644
--- a/pkgs/by-name/cm/cmake/remove-impure-search-paths.patch
+++ b/pkgs/by-name/cm/cmake/remove-impure-search-paths.patch
@@ -157,10 +157,10 @@ index 2a2f478fd7..f22281bdca 100644
  list(REMOVE_DUPLICATES _CPACK_IFW_PATHS)
  
 diff --git a/Modules/FindBLAS.cmake b/Modules/FindBLAS.cmake
-index b45a279b94..884ccc0e32 100644
+index 9f986a78e7..5a6a9758ea 100644
 --- a/Modules/FindBLAS.cmake
 +++ b/Modules/FindBLAS.cmake
-@@ -1098,16 +1098,8 @@
+@@ -1112,16 +1112,10 @@ if(BLA_VENDOR MATCHES "ACML" OR BLA_VENDOR STREQUAL "All")
      ((BLA_VENDOR STREQUAL "ACML_GPU") AND (NOT BLAS_ACML_GPU_LIB_DIRS))
      )
    # try to find acml in "standard" paths
@@ -176,9 +176,11 @@ index b45a279b94..884ccc0e32 100644
 -  endif()
 +  set(_ACML_ROOT)
 +  set(_ACML_GPU_ROOT)
-   list(GET _ACML_ROOT 0 _ACML_ROOT)
-   list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
++  list(GET _ACML_ROOT 0 _ACML_ROOT)
++  list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
    if(_ACML_ROOT)
+     list(GET _ACML_ROOT 0 _ACML_ROOT)
+     list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
 diff --git a/Modules/FindCUDA.cmake b/Modules/FindCUDA.cmake
 index bceb615ca0..2350b15655 100644
 --- a/Modules/FindCUDA.cmake
@@ -229,26 +231,13 @@ index bceb615ca0..2350b15655 100644
  
  # Example of how to find an include file from the CUDA_SDK_ROOT_DIR
 diff --git a/Modules/FindCUDAToolkit.cmake b/Modules/FindCUDAToolkit.cmake
-index b00cd26b7e..f5f74ebe1d 100644
+index df36f9a19b..825d1e7386 100644
 --- a/Modules/FindCUDAToolkit.cmake
 +++ b/Modules/FindCUDAToolkit.cmake
-@@ -776,12 +776,6 @@
-       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
-         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
-         break()
--      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
--        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
--        break()
--      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
--        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
--        break()
-       endif()
-     endforeach()
-   endfunction()
-@@ -864,18 +858,8 @@
-   # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
-   # directory is the desired location.
-   if(NOT CUDAToolkit_ROOT_DIR)
+@@ -830,18 +830,9 @@ else()
+     # We will also search the default symlink location /usr/local/cuda first since
+     # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
+     # directory is the desired location.
 -    if(UNIX)
 -      if(NOT APPLE)
 -        set(platform_base "/usr/local/cuda-")
@@ -258,14 +247,14 @@ index b00cd26b7e..f5f74ebe1d 100644
 -    else()
 -      set(platform_base "C:\\Program Files\\NVIDIA GPU Computing Toolkit\\CUDA\\v")
 -    endif()
--
+ 
      # Build out a descending list of possible cuda installations, e.g.
 -    file(GLOB possible_paths "${platform_base}*")
 +    set(possible_paths)
      # Iterate the glob results and create a descending list.
      set(versions)
      foreach(p ${possible_paths})
-@@ -891,14 +875,6 @@
+@@ -857,14 +848,6 @@ else()
  
      # With a descending list of versions, populate possible paths to search.
      set(search_paths)
@@ -280,6 +269,19 @@ index b00cd26b7e..f5f74ebe1d 100644
  
      # Now search for the toolkit again using the platform default search paths.
      _CUDAToolkit_find_root_dir(SEARCH_PATHS "${search_paths}" FIND_FLAGS PATH_SUFFIXES bin)
+@@ -889,12 +872,6 @@ else()
+       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
+         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
+         break()
+-      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+-      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+       endif()
+     endforeach()
+   endfunction()
 diff --git a/Modules/FindCoin3D.cmake b/Modules/FindCoin3D.cmake
 index 1d89c604e0..5b70e71a87 100644
 --- a/Modules/FindCoin3D.cmake
@@ -579,10 +581,10 @@ index 82156747d3..cc3f2a64af 100644
         "Ice-${Ice_VERSION_SLICE2CPP_FULL}/slice"
         "Ice-${Ice_VERSION_SLICE2CPP_SHORT}/slice"
 diff --git a/Modules/FindJNI.cmake b/Modules/FindJNI.cmake
-index 10dcc51776..e272bd9583 100644
+index a70b00f330..1962b55d4a 100644
 --- a/Modules/FindJNI.cmake
 +++ b/Modules/FindJNI.cmake
-@@ -363,51 +363,6 @@
+@@ -367,57 +367,6 @@ if (WIN32)
  endif()
  
  set(_JNI_JAVA_DIRECTORIES_BASE
@@ -604,6 +606,11 @@ index 10dcc51776..e272bd9583 100644
 -  # Arch Linux specific paths for default JVM
 -  /usr/lib/jvm/default
 -  # Ubuntu specific paths for default JVM
+-  /usr/lib/jvm/java-26-openjdk-{libarch}
+-  /usr/lib/jvm/java-25-openjdk-{libarch}    # Ubuntu 24.04 LTS
+-  /usr/lib/jvm/java-24-openjdk-{libarch}
+-  /usr/lib/jvm/java-23-openjdk-{libarch}
+-  /usr/lib/jvm/java-22-openjdk-{libarch}
 -  /usr/lib/jvm/java-21-openjdk-{libarch}    # Ubuntu 23.04
 -  /usr/lib/jvm/java-20-openjdk-{libarch}    # Ubuntu 22.10
 -  /usr/lib/jvm/java-19-openjdk-{libarch}    # Ubuntu 22.04 LTS
@@ -631,9 +638,10 @@ index 10dcc51776..e272bd9583 100644
 -  # SuSE specific paths for default JVM
 -  /usr/lib64/jvm/java
 -  /usr/lib64/jvm/jre
-   )
+-  )
  
  set(_JNI_JAVA_AWT_LIBRARY_TRIES)
+ set(_JNI_JAVA_INCLUDE_TRIES)
 diff --git a/Modules/FindJava.cmake b/Modules/FindJava.cmake
 index 1587ce648b..e92213cba7 100644
 --- a/Modules/FindJava.cmake
@@ -1093,28 +1101,28 @@ index edef791cb8..5515f44710 100644
  
  find_path(PHP4_FOUND_INCLUDE_PATH main/php.h
 diff --git a/Modules/FindPerlLibs.cmake b/Modules/FindPerlLibs.cmake
-index 330700e183..7fc89df6eb 100644
+index fbe1aade72..34562e7807 100644
 --- a/Modules/FindPerlLibs.cmake
 +++ b/Modules/FindPerlLibs.cmake
-@@ -141,10 +141,6 @@
+@@ -176,10 +176,6 @@ if (PERL_EXECUTABLE)
      PATHS
        "${PERL_UPDATE_ARCHLIB}/CORE"
        "${PERL_ARCHLIB}/CORE"
--      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/CORE
    )
  
    ### PERL_LIBRARY
-@@ -154,10 +150,6 @@
+@@ -189,10 +185,6 @@ if (PERL_EXECUTABLE)
      PATHS
        "${PERL_UPDATE_ARCHLIB}/CORE"
        "${PERL_ARCHLIB}/CORE"
--      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/CORE
    )
  
  endif ()
@@ -1343,17 +1351,21 @@ index 2c62a5f17f..772a8d88f6 100644
    PATH_SUFFIXES
      bin lib/qt lib/qt3 qt qt3 qt/bin qt3/bin lib/qt/bin lib/qt3/bin
 diff --git a/Modules/FindRuby.cmake b/Modules/FindRuby.cmake
-index 18b9e35855..dba9976565 100644
+index 863f70a7f2..17e3ac606a 100644
 --- a/Modules/FindRuby.cmake
 +++ b/Modules/FindRuby.cmake
-@@ -367,7 +367,6 @@
-           HINTS
-           ${Ruby_HDR_DIR}
-           ${Ruby_ARCH_DIR}
--          /usr/lib/ruby/${_Ruby_VERSION_SHORT}/i586-linux-gnu/
- )
+@@ -366,11 +366,6 @@ if (NOT Ruby_EXECUTABLE AND Ruby_FIND_VIRTUALENV MATCHES "^(FIRST|ONLY)$")
+   endif ()
+ endif ()
  
- set(Ruby_INCLUDE_DIRS ${Ruby_INCLUDE_DIR})
+-# Check for Homebrew Ruby (non-virtualenv, common on MacOS)
+-if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
+-  _RUBY_CHECK_BREW()
+-endif ()
+-
+ # Fallback to system installed Ruby
+ if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
+   _RUBY_CHECK_SYSTEM()
 diff --git a/Modules/FindSDL.cmake b/Modules/FindSDL.cmake
 index a720dcc3df..73e222a27c 100644
 --- a/Modules/FindSDL.cmake
@@ -1644,6 +1656,20 @@ index 7c4f123a1d..4cfd53de9f 100644
  
  if(NOT CMAKE_CROSSCOMPILING)
    execute_process(COMMAND @sw_vers@ -productVersion
+@@ -277,13 +277,6 @@ if(NOT CMAKE_OSX_SYSROOT)
+     RESULT_VARIABLE _result
+   )
+   unset(_sdk_macosx)
+-
+-  list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES_EXCLUDE
+-    # Without -isysroot, some compiler drivers implicitly pass -L/usr/local/lib
+-    # to the linker.  Since the macOS dynamic loader does not search it by
+-    # default, it is not a fully-implemented implicit link directory.
+-    /usr/local/lib
+-  )
+ endif()
+ 
+ #----------------------------------------------------------------------------
 diff --git a/Modules/Platform/Darwin.cmake b/Modules/Platform/Darwin.cmake
 index 42c6b35424..f2985f3765 100644
 --- a/Modules/Platform/Darwin.cmake
@@ -1905,10 +1931,10 @@ index b977d955ca..5ff835298d 100644
      set(_jar_doc "NOTSET")
  
 diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
-index 8ff651fd90..9659deedf5 100644
+index 2c6a6e6a19..3a43da619a 100644
 --- a/Utilities/cmcurl/CMakeLists.txt
 +++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -1826,43 +1826,6 @@
+@@ -1566,43 +1566,6 @@ if(_curl_ca_bundle_supported)
    endif()
    mark_as_advanced(CURL_CA_PATH_SET)
  
@@ -1929,8 +1955,8 @@ index 8ff651fd90..9659deedf5 100644
 -        if(EXISTS "${_search_ca_bundle_path}")
 -          message(STATUS "Found CA bundle: ${_search_ca_bundle_path}")
 -          set(CURL_CA_BUNDLE "${_search_ca_bundle_path}" CACHE
--            STRING "Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
--          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
+-            STRING "Absolute path to the CA bundle. ${_ca_opt_desc}")
+-          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
 -          break()
 -        endif()
 -      endforeach()
@@ -1943,8 +1969,8 @@ index 8ff651fd90..9659deedf5 100644
 -        unset(_curl_ca_files_found)
 -        message(STATUS "Found CA path: ${_search_ca_path}")
 -        set(CURL_CA_PATH "${_search_ca_path}" CACHE
--          STRING "Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
--        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
+-          STRING "Absolute path to a directory containing CA certificates stored individually. ${_ca_opt_desc}")
+-        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
 -      endif()
 -    endif()
 -  endif()

From 69fe6e919a916e5b7584aec358cf6311e298772f Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Sat, 27 Jun 2026 22:25:21 +1000
Subject: [PATCH 0867/1209] python3Packages.numpy: fix build

Remove old distutils patches. Distutils as a build system has been
deprecated for a while in favor of meson, and we don't use it anymore.
They've finally fully removed all the upstream distutils code, so remove
the distutils patch as it isn't needed anymore
---
 pkgs/development/python-modules/numpy/2.nix   |  7 -----
 .../numpy/numpy-distutils-C++.patch           | 30 -------------------
 2 files changed, 37 deletions(-)
 delete mode 100644 pkgs/development/python-modules/numpy/numpy-distutils-C++.patch

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 712130d6a0a8..e097ad7bb298 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -48,13 +48,6 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-RiC1dLoDamK5B2VzHBL0V//K/Vix25q11wNGcl3Witk=";
   };
 
-  patches = lib.optionals python.hasDistutilsCxxPatch [
-    # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
-    # Patching of numpy.distutils is needed to prevent it from undoing the
-    # patch to distutils.
-    ./numpy-distutils-C++.patch
-  ];
-
   postPatch = ''
     # remove needless reference to full Python path stored in built wheel
     substituteInPlace numpy/meson.build \
diff --git a/pkgs/development/python-modules/numpy/numpy-distutils-C++.patch b/pkgs/development/python-modules/numpy/numpy-distutils-C++.patch
deleted file mode 100644
index 6c75f34ce07a..000000000000
--- a/pkgs/development/python-modules/numpy/numpy-distutils-C++.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/numpy/distutils/unixccompiler.py b/numpy/distutils/unixccompiler.py
---- a/numpy/distutils/unixccompiler.py
-+++ b/numpy/distutils/unixccompiler.py
-@@ -37,8 +37,6 @@ def UnixCCompiler__compile(self, obj, src, ext, cc_args, extra_postargs, pp_opts
-         if opt not in llink_s:
-             self.linker_so = llink_s.split() + opt.split()
- 
--    display = '%s: %s' % (os.path.basename(self.compiler_so[0]), src)
--
-     # gcc style automatic dependencies, outputs a makefile (-MF) that lists
-     # all headers needed by a c file as a side effect of compilation (-MMD)
-     if getattr(self, '_auto_depends', False):
-@@ -47,8 +45,15 @@ def UnixCCompiler__compile(self, obj, src, ext, cc_args, extra_postargs, pp_opts
-         deps = []
- 
-     try:
--        self.spawn(self.compiler_so + cc_args + [src, '-o', obj] + deps +
--                   extra_postargs, display = display)
-+        if self.detect_language(src) == 'c++':
-+            display = '%s: %s' % (os.path.basename(self.compiler_so_cxx[0]), src)
-+            self.spawn(self.compiler_so_cxx + cc_args + [src, '-o', obj] + deps +
-+                       extra_postargs, display = display)
-+        else:
-+            display = '%s: %s' % (os.path.basename(self.compiler_so[0]), src)
-+            self.spawn(self.compiler_so + cc_args + [src, '-o', obj] + deps +
-+                       extra_postargs, display = display)
-+
-     except DistutilsExecError as e:
-         msg = str(e)
-         raise CompileError(msg)

From dac6a74b0fbc65f7ae37f26051e791ca23fa0ad1 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 27 Jun 2026 19:59:31 +0100
Subject: [PATCH 0868/1209] libheif: 1.23.0 -> 1.23.1

Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.1
---
 pkgs/by-name/li/libheif/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index 42171d469f5a..940c3015dfb5 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libheif";
-  version = "1.23.0";
+  version = "1.23.1";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+LbYwDSxixy4TaraUCN2LiCnn32dkMppCA8EOFXbvtg=";
+    hash = "sha256-o+gQCv/lpRx+IaqpjHACh8ysgl/N4Mo/9zbAI/cnWas=";
   };
 
   nativeBuildInputs = [

From 703a55ddf48d1ebb4ace62665dfec573e7cbe933 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 4 Jun 2026 22:12:16 +0100
Subject: [PATCH 0869/1209] sqlite, sqlite-analyzer: 3.53.1 -> 3.53.3

Changes:
- https://sqlite.org/releaselog/3_53_2.html
- https://sqlite.org/releaselog/3_53_3.html
---
 pkgs/development/libraries/sqlite/default.nix | 6 +++---
 pkgs/development/libraries/sqlite/tools.nix   | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index bc27578cda3d..2672613e357e 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -28,17 +28,17 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.53.1";
+  version = "3.53.3";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2026/sqlite-src-${archiveVersion version}.zip";
-    hash = "sha256-GytXVdkGTE1dGwv1MHtIsImWPikcQMxzUTGKobYcRg4=";
+    hash = "sha256-u4C/ijv/wZJBzoq6WkvHTpw5gAE8sLXw8JdqmVFpQq8=";
   };
   docsrc = fetchurl {
     url = "https://sqlite.org/2026/sqlite-doc-${archiveVersion version}.zip";
-    hash = "sha256-n9Bgv33YwseOdBHQb7gdyKqgWeth7sgMZeBlioVFtDM=";
+    hash = "sha256-Fo+Zhph2vPTbjZPvoqSDqcgVNlN9AZAMWM110KZ8yic=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 9755b3733273..dfbcad20cad9 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -19,14 +19,14 @@ let
     }:
     stdenv.mkDerivation rec {
       inherit pname;
-      version = "3.53.1";
+      version = "3.53.3";
 
       # nixpkgs-update: no auto update
       src =
         assert version == sqlite.version;
         fetchurl {
           url = "https://sqlite.org/2026/sqlite-src-${archiveVersion version}.zip";
-          hash = "sha256-GytXVdkGTE1dGwv1MHtIsImWPikcQMxzUTGKobYcRg4=";
+          hash = "sha256-u4C/ijv/wZJBzoq6WkvHTpw5gAE8sLXw8JdqmVFpQq8=";
         };
 
       nativeBuildInputs = [ unzip ];

From 8b8a66589be58af369517aa6a10d18b8c21c7bb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 27 Jun 2026 12:21:29 -0700
Subject: [PATCH 0870/1209] python3Packages.pytest-mpl: 0.18.0 -> 0.19.0

Diff: https://github.com/matplotlib/pytest-mpl/compare/v0.18.0...v0.19.0

Changelog: https://github.com/matplotlib/pytest-mpl/releases/tag/v0.19.0
---
 .../python-modules/pytest-mpl/default.nix         | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-mpl/default.nix b/pkgs/development/python-modules/pytest-mpl/default.nix
index f3f672324d35..7cc159faa61c 100644
--- a/pkgs/development/python-modules/pytest-mpl/default.nix
+++ b/pkgs/development/python-modules/pytest-mpl/default.nix
@@ -12,16 +12,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pytest-mpl";
-  version = "0.18.0";
+  version = "0.19.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "matplotlib";
     repo = "pytest-mpl";
-    tag = "v${version}";
-    hash = "sha256-9fMhVgeEL4bjNIegmJV7lisrdzp27h0syn9pMwzX4Gg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qSOGGq2lOikm3kwZmGI1hFkuPU+zuh0iGL9TbH6ktEQ=";
   };
 
   build-system = [
@@ -43,6 +43,10 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # Following are broken since at least a1548780dbc79d76360580691dc1bb4af4e837f6
     "tests/subtests/test_subtest.py"
+    # https://github.com/matplotlib/pytest-mpl/issues/263
+    "tests/test_baseline_path.py::test_config"
+    "tests/test_results_always.py::test_config"
+    "tests/test_use_full_test_name.py::test_config"
   ];
 
   # need to set MPLBACKEND=agg for headless matplotlib for darwin
@@ -59,9 +63,10 @@ buildPythonPackage rec {
   '';
 
   meta = {
+    changelog = "https://github.com/matplotlib/pytest-mpl/blob/${finalAttrs.src.tag}/CHANGES.md";
     description = "Pytest plugin to help with testing figures output from Matplotlib";
     homepage = "https://github.com/matplotlib/pytest-mpl";
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})

From 35ebf72241e43fc7bff59f6244b3bca0299d0820 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 27 Jun 2026 22:52:43 +0100
Subject: [PATCH 0871/1209] cargo-auditable: disable `test_bare_linker`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This tries to use `linker = "rust-lld"` on `aarch64-darwin`, Linux
Musl and ARMv7 targets, and MSVC Windows, but we deliberately don’t
provide that.
---
 pkgs/by-name/ca/cargo-auditable/builder.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ca/cargo-auditable/builder.nix b/pkgs/by-name/ca/cargo-auditable/builder.nix
index da652a61fcad..a865d352943b 100644
--- a/pkgs/by-name/ca/cargo-auditable/builder.nix
+++ b/pkgs/by-name/ca/cargo-auditable/builder.nix
@@ -42,7 +42,20 @@ lib.extendMkDerivation {
         # https://github.com/rust-secure-code/cargo-auditable/issues/235
         "--skip=test_proc_macro"
         "--skip=test_self_hosting"
-      ];
+      ]
+      # TODO: Clean up on `staging`.
+      ++
+        lib.optionals
+          (
+            stdenv.hostPlatform.isMusl
+            || stdenv.hostPlatform.isAarch32
+            || stdenv.hostPlatform.isDarwin
+            || stdenv.hostPlatform.isMsvc
+          )
+          [
+            # Expects `linker = "rust-lld"` to work.
+            "--skip=test_bare_linker"
+          ];
 
       postInstall = ''
         installManPage cargo-auditable/cargo-auditable.1

From cb7ec1e71814d63516992dff2790388d786d721d Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 27 Jun 2026 23:06:36 +0100
Subject: [PATCH 0872/1209] cargo-auditable: clean up rebuild avoidance

---
 pkgs/by-name/ca/cargo-auditable/builder.nix | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-auditable/builder.nix b/pkgs/by-name/ca/cargo-auditable/builder.nix
index a865d352943b..1f3034e511c6 100644
--- a/pkgs/by-name/ca/cargo-auditable/builder.nix
+++ b/pkgs/by-name/ca/cargo-auditable/builder.nix
@@ -42,20 +42,9 @@ lib.extendMkDerivation {
         # https://github.com/rust-secure-code/cargo-auditable/issues/235
         "--skip=test_proc_macro"
         "--skip=test_self_hosting"
-      ]
-      # TODO: Clean up on `staging`.
-      ++
-        lib.optionals
-          (
-            stdenv.hostPlatform.isMusl
-            || stdenv.hostPlatform.isAarch32
-            || stdenv.hostPlatform.isDarwin
-            || stdenv.hostPlatform.isMsvc
-          )
-          [
-            # Expects `linker = "rust-lld"` to work.
-            "--skip=test_bare_linker"
-          ];
+        # Expects `linker = "rust-lld"` to work.
+        "--skip=test_bare_linker"
+      ];
 
       postInstall = ''
         installManPage cargo-auditable/cargo-auditable.1

From c6fb06d051c66275e8f0f7369c86e53fbc209755 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 27 Jun 2026 23:24:34 +0100
Subject: [PATCH 0873/1209] binutilsDualAs: drop

---
 pkgs/top-level/aliases.nix         |  1 +
 pkgs/top-level/all-packages.nix    |  5 -----
 pkgs/top-level/darwin-aliases.nix  |  2 ++
 pkgs/top-level/darwin-packages.nix | 26 --------------------------
 4 files changed, 3 insertions(+), 31 deletions(-)

diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 171fbaccca1c..f7155afa6133 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -388,6 +388,7 @@ mapAliases {
   biff = throw "biff has been renamed to/replaced by 'bttf'"; # Added 2026-06-04
   bindle = throw "bindle has been removed since it is vulnerable to CVE-2025-62518 and upstream has been archived"; # Added 2025-10-24
   binserve = throw "'binserve' has been removed because it is unmaintained upstream."; # Added 2025-11-29
+  binutilsDualAs = throw "binutilsDualAs has been removed because it was only useful on `x86_64-darwin` and also only useful for the GNAT bootstrap and also not even used for that any more and actually what on earth were you using this thing for anyway?"; # Added 2026-06-27
   bitbucket-server-cli = throw "bitbucket-server-cli has been removed due to lack of maintenance upstream."; # Added 2025-05-27
   bitcoin-abc = throw "bitcoin-abc has been removed due to a lack of maintanance"; # Added 2025-06-17
   bitcoind-abc = throw "bitcoind-abc has been removed due to a lack of maintanance"; # Added 2025-06-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2de278fceb56..c8f0c8aa7bb4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5006,11 +5006,6 @@ with pkgs;
     bintools = bintools-unwrapped;
   };
 
-  bintoolsDualAs = wrapBintoolsWith {
-    bintools = darwin.binutilsDualAs-unwrapped;
-    wrapGas = true;
-  };
-
   black = with python3Packages; toPythonApplication black;
 
   black-macchiato = with python3Packages; toPythonApplication black-macchiato;
diff --git a/pkgs/top-level/darwin-aliases.nix b/pkgs/top-level/darwin-aliases.nix
index 96aab9d0af29..72a7dbc9434a 100644
--- a/pkgs/top-level/darwin-aliases.nix
+++ b/pkgs/top-level/darwin-aliases.nix
@@ -103,6 +103,8 @@ stubs
 
   ### B ###
 
+  binutilsDualAs = throw "binutilsDualAs has been removed because it was only useful on `x86_64-darwin` and also only useful for the GNAT bootstrap and also not even used for that any more and actually what on earth were you using this thing for anyway?"; # Added 2026-06-27
+  binutilsDualAs-unwrapped = throw "binutilsDualAs has been removed because it was only useful on `x86_64-darwin` and also only useful for the GNAT bootstrap and also not even used for that any more and actually what on earth were you using this thing for anyway?"; # Added 2026-06-27
   builder = throw "'darwin.builder' has been changed and renamed to 'darwin.linux-builder'. The default ssh port is now 31022. Please update your configuration or override the port back to 22. See https://nixos.org/manual/nixpkgs/unstable/#sec-darwin-builder"; # added 2023-07-06
   bsdmake = pkgs.bmake; # added 2024-10-03
 
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 5010f2658c7e..33e09e254c43 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -69,32 +69,6 @@ makeScopeWithSplicing' {
         bintools = self.binutils-unwrapped;
       };
 
-      # x86-64 Darwin gnat-bootstrap emits assembly
-      # with MOVQ as the mnemonic for quadword interunit moves
-      # such as `movq %rbp, %xmm0`.
-      # The clang integrated assembler recognises this as valid,
-      # but unfortunately the cctools.gas GNU assembler does not;
-      # it instead uses MOVD as the mnemonic.
-      # The assembly that a GCC build emits is determined at build time
-      # and cannot be changed afterwards.
-      #
-      # To build GNAT on x86-64 Darwin, therefore,
-      # we need both the clang _and_ the cctools.gas assemblers to be available:
-      # the former to build at least the stage1 compiler,
-      # and the latter at least to be detectable
-      # as the target for the final compiler.
-      binutilsDualAs-unwrapped = buildEnv {
-        name = "${lib.getName self.binutils-unwrapped}-dualas-${lib.getVersion self.binutils-unwrapped}";
-        paths = [
-          self.binutils-unwrapped
-          (lib.getOutput "gas" cctools)
-        ];
-      };
-
-      binutilsDualAs = self.binutils.override {
-        bintools = self.binutilsDualAs-unwrapped;
-      };
-
       sourceRelease = self.callPackage ../os-specific/darwin/sourceRelease { };
 
       inherit (self.file_cmds) xattr;

From 9714f07c1f6e4c7611533c6715eb899c63e08656 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 04:33:30 +0200
Subject: [PATCH 0874/1209] nodejs: require big-parallel system feature

This helps schedule it onto a bigger build slot on hydra.
---
 pkgs/development/web/nodejs/nodejs.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 5fd5eeac6919..1c099fb75fc8 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -683,6 +683,9 @@ let
         done
       '';
 
+      # reduces build time from ~90 to ~15 minutes on hydra
+      requiredSystemFeatures = [ "big-parallel" ];
+
       passthru.tests = {
         version = testers.testVersion {
           package = self;

From 91916cd91572d0553382b1b5a290b1a57d6db4a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 27 Jun 2026 21:24:38 -0700
Subject: [PATCH 0875/1209] alsa-lib: 1.2.16 -> 1.2.16.1

Changelog: https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1
---
 pkgs/by-name/al/alsa-lib/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alsa-lib/package.nix b/pkgs/by-name/al/alsa-lib/package.nix
index 4c02e2a8d7eb..398edd5f40fe 100644
--- a/pkgs/by-name/al/alsa-lib/package.nix
+++ b/pkgs/by-name/al/alsa-lib/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.16";
+  version = "1.2.16.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-EiseMWbVX+GbzeZWU116NvKrEOZscsatL0PyD/3tCpY=";
+    hash = "sha256-90Dbf0iCVZRP/UQoQW7jOQqWdChWkWQz30aMKBQ2SA4=";
   };
 
   patches = [
@@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-lib/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture libraries";
     mainProgram = "aserver";
 

From 15d080f2505130339cb088f1a350b2fd4439db8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 27 Jun 2026 21:25:17 -0700
Subject: [PATCH 0876/1209] alsa-ucm-conf: 1.2.16 -> 1.2.16.1

Changelog: https://github.com/alsa-project/alsa-ucm-conf/releases/tag/v1.2.16.1
---
 pkgs/by-name/al/alsa-ucm-conf/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alsa-ucm-conf/package.nix b/pkgs/by-name/al/alsa-ucm-conf/package.nix
index eace84e7b18f..261b09ad78a6 100644
--- a/pkgs/by-name/al/alsa-ucm-conf/package.nix
+++ b/pkgs/by-name/al/alsa-ucm-conf/package.nix
@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
-  version = "1.2.16";
+  version = "1.2.16.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-rLyXLW5x7fo0Xnav3xDDmf0PHzz5DYSv20z1G/xKZUg=";
+    hash = "sha256-zz0cB+CJqDxOziwg8F3WqKq3/NEIdow4gROGiAV1SSs=";
   };
 
   patches = [
@@ -47,6 +47,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-ucm-conf/releases/tag/v${finalAttrs.version}";
     description = "ALSA Use Case Manager configuration";
 
     longDescription = ''

From 2a90ef803ff71a935d1e1c7d2f4d57fe53c493c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 27 Jun 2026 21:26:25 -0700
Subject: [PATCH 0877/1209] alsa-utils: add meta.changelog

---
 pkgs/by-name/al/alsa-utils/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/al/alsa-utils/package.nix b/pkgs/by-name/al/alsa-utils/package.nix
index 4476b715cdcf..91653a4848b6 100644
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@@ -85,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-utils/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture utils";
     longDescription = ''
       The Advanced Linux Sound Architecture (ALSA) provides audio and

From 7c68582546513a7f5d0c022f1ba08369745af8b4 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sat, 27 Jun 2026 16:29:46 +0200
Subject: [PATCH 0878/1209] musl: backport stuff needed by systemd

These are in musl 1.2.6, but I'm not ready to do that update with all
the appropriate testing right now.  These should be safe to backport
since they're just additions.
---
 pkgs/by-name/mu/musl/package.nix            |  8 +++
 pkgs/by-name/mu/musl/renameat2.patch        | 55 +++++++++++++++++++++
 pkgs/by-name/mu/musl/statx-attr.patch       | 35 +++++++++++++
 pkgs/by-name/mu/musl/statx-linux-6.11.patch | 49 ++++++++++++++++++
 pkgs/by-name/mu/musl/statx.patch            | 39 +++++++++++++++
 5 files changed, 186 insertions(+)
 create mode 100644 pkgs/by-name/mu/musl/renameat2.patch
 create mode 100644 pkgs/by-name/mu/musl/statx-attr.patch
 create mode 100644 pkgs/by-name/mu/musl/statx-linux-6.11.patch
 create mode 100644 pkgs/by-name/mu/musl/statx.patch

diff --git a/pkgs/by-name/mu/musl/package.nix b/pkgs/by-name/mu/musl/package.nix
index b13ea98e18b7..4e9ce959c31e 100644
--- a/pkgs/by-name/mu/musl/package.nix
+++ b/pkgs/by-name/mu/musl/package.nix
@@ -98,6 +98,14 @@ stdenv.mkDerivation (finalAttrs: {
     # drop next release
     # https://git.musl-libc.org/cgit/musl/commit/?id=fde29c04adbab9d5b081bf6717b5458188647f1c
     ./stdio-skip-empty-iovec-when-buffering-is-disabled.patch
+    # Backport addition of statx fields needed by systemd
+    ./statx.patch
+    # Backport addition of statx attrs needed by systemd
+    ./statx-attr.patch
+    # Backport even more statx stuff for systemd
+    ./statx-linux-6.11.patch
+    # Backport addition of renameat2 syscall wrapper needed by systemd
+    ./renameat2.patch
   ];
 
   env = {
diff --git a/pkgs/by-name/mu/musl/renameat2.patch b/pkgs/by-name/mu/musl/renameat2.patch
new file mode 100644
index 000000000000..22416191d20c
--- /dev/null
+++ b/pkgs/by-name/mu/musl/renameat2.patch
@@ -0,0 +1,55 @@
+From 05ce67fea99ca09cd4b6625cff7aec9cc222dd5a Mon Sep 17 00:00:00 2001
+From: Tony Ambardar <tony.ambardar@gmail.com>
+Date: Mon, 6 May 2024 20:28:32 -0700
+Subject: add renameat2 linux syscall wrapper
+
+This syscall is available since Linux 3.15 and also implemented in
+glibc from version 2.28. It is commonly used in filesystem or security
+contexts.
+
+Constants RENAME_NOREPLACE, RENAME_EXCHANGE, RENAME_WHITEOUT are
+guarded by _GNU_SOURCE as with glibc.
+---
+ include/stdio.h       |  7 +++++++
+ src/linux/renameat2.c | 11 +++++++++++
+ 2 files changed, 18 insertions(+)
+ create mode 100644 src/linux/renameat2.c
+
+diff --git a/include/stdio.h b/include/stdio.h
+index cb858618..4ea4c170 100644
+--- a/include/stdio.h
++++ b/include/stdio.h
+@@ -158,6 +158,13 @@ char *ctermid(char *);
+ #define L_ctermid 20
+ #endif
+ 
++#if defined(_GNU_SOURCE)
++#define RENAME_NOREPLACE (1 << 0)
++#define RENAME_EXCHANGE  (1 << 1)
++#define RENAME_WHITEOUT  (1 << 2)
++
++int renameat2(int, const char *, int, const char *, unsigned);
++#endif
+ 
+ #if defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE) \
+  || defined(_BSD_SOURCE)
+diff --git a/src/linux/renameat2.c b/src/linux/renameat2.c
+new file mode 100644
+index 00000000..b8060388
+--- /dev/null
++++ b/src/linux/renameat2.c
+@@ -0,0 +1,11 @@
++#define _GNU_SOURCE
++#include <stdio.h>
++#include "syscall.h"
++
++int renameat2(int oldfd, const char *old, int newfd, const char *new, unsigned flags)
++{
++#ifdef SYS_renameat
++	if (!flags) return syscall(SYS_renameat, oldfd, old, newfd, new);
++#endif
++	return syscall(SYS_renameat2, oldfd, old, newfd, new, flags);
++}
+-- 
+cgit v1.2.1
+
diff --git a/pkgs/by-name/mu/musl/statx-attr.patch b/pkgs/by-name/mu/musl/statx-attr.patch
new file mode 100644
index 000000000000..50c2a16d433c
--- /dev/null
+++ b/pkgs/by-name/mu/musl/statx-attr.patch
@@ -0,0 +1,35 @@
+From cbf1c7b605d979bb7fdde8b8e6a66acdba18c6b0 Mon Sep 17 00:00:00 2001
+From: Rich Felker <dalias@aerifal.cx>
+Date: Wed, 24 Apr 2024 13:26:03 -0400
+Subject: add missing STATX_ATTR_* macros omitted when statx was added
+
+commit b817541f1cfd38e4b81257b3215e276ea9d0fc61 added statx and the
+mask constant macros, but not the stx_attributes[_mask] ones.
+---
+ include/sys/stat.h | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/include/sys/stat.h b/include/sys/stat.h
+index 6690192d..57d640d7 100644
+--- a/include/sys/stat.h
++++ b/include/sys/stat.h
+@@ -121,6 +121,16 @@ int lchmod(const char *, mode_t);
+ #define STATX_BTIME 0x800U
+ #define STATX_ALL 0xfffU
+ 
++#define STATX_ATTR_COMPRESSED 0x4
++#define STATX_ATTR_IMMUTABLE 0x10
++#define STATX_ATTR_APPEND 0x20
++#define STATX_ATTR_NODUMP 0x40
++#define STATX_ATTR_ENCRYPTED 0x800
++#define STATX_ATTR_AUTOMOUNT 0x1000
++#define STATX_ATTR_MOUNT_ROOT 0x2000
++#define STATX_ATTR_VERITY 0x100000
++#define STATX_ATTR_DAX 0x200000
++
+ struct statx_timestamp {
+ 	int64_t tv_sec;
+ 	uint32_t tv_nsec, __pad;
+-- 
+cgit v1.2.1
+
diff --git a/pkgs/by-name/mu/musl/statx-linux-6.11.patch b/pkgs/by-name/mu/musl/statx-linux-6.11.patch
new file mode 100644
index 000000000000..6e5564a06ef9
--- /dev/null
+++ b/pkgs/by-name/mu/musl/statx-linux-6.11.patch
@@ -0,0 +1,49 @@
+From fcdff46a3203400e08a2264c34b3c7fb62bf6969 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=2E=20Neusch=C3=A4fer?= <j.neuschaefer@gmx.net>
+Date: Thu, 24 Oct 2024 01:19:30 +0200
+Subject: statx: add Linux 6.11 fields/constants
+
+As of Linux 6.11, these fields and mask macros have been added to
+include/uapi/linux/stat.h.
+---
+ include/sys/stat.h | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/include/sys/stat.h b/include/sys/stat.h
+index c924ce2f..4f7dc2b1 100644
+--- a/include/sys/stat.h
++++ b/include/sys/stat.h
+@@ -123,6 +123,8 @@ int lchmod(const char *, mode_t);
+ #define STATX_MNT_ID 0x1000U
+ #define STATX_DIOALIGN 0x2000U
+ #define STATX_MNT_ID_UNIQUE 0x4000U
++#define STATX_SUBVOL 0x8000U
++#define STATX_WRITE_ATOMIC 0x10000U
+ 
+ #define STATX_ATTR_COMPRESSED 0x4
+ #define STATX_ATTR_IMMUTABLE 0x10
+@@ -133,6 +135,7 @@ int lchmod(const char *, mode_t);
+ #define STATX_ATTR_MOUNT_ROOT 0x2000
+ #define STATX_ATTR_VERITY 0x100000
+ #define STATX_ATTR_DAX 0x200000
++#define STATX_ATTR_WRITE_ATOMIC 0x400000
+ 
+ struct statx_timestamp {
+ 	int64_t tv_sec;
+@@ -164,7 +167,12 @@ struct statx {
+ 	uint32_t stx_dio_mem_align;
+ 	uint32_t stx_dio_offset_align;
+ 	uint64_t stx_subvol;
+-	uint64_t __pad1[11];
++	uint32_t stx_atomic_write_unit_min;
++	uint32_t stx_atomic_write_unit_max;
++	uint32_t stx_atomic_write_segments_max;
++	uint32_t __pad1[1];
++	uint64_t __pad2[9];
++
+ };
+ 
+ int statx(int, const char *__restrict, int, unsigned, struct statx *__restrict);
+-- 
+cgit v1.2.1
+
diff --git a/pkgs/by-name/mu/musl/statx.patch b/pkgs/by-name/mu/musl/statx.patch
new file mode 100644
index 000000000000..fd08b5303cbb
--- /dev/null
+++ b/pkgs/by-name/mu/musl/statx.patch
@@ -0,0 +1,39 @@
+From 23ab04a8630225371455d5f4538fd078665bb646 Mon Sep 17 00:00:00 2001
+From: Rich Felker <dalias@aerifal.cx>
+Date: Fri, 13 Sep 2024 17:21:17 -0400
+Subject: statx: add new struct statx fields and corresponding mask macros
+
+---
+ include/sys/stat.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/include/sys/stat.h b/include/sys/stat.h
+index 57d640d7..0c10dc21 100644
+--- a/include/sys/stat.h
++++ b/include/sys/stat.h
+@@ -120,6 +120,9 @@ int lchmod(const char *, mode_t);
+ #define STATX_BASIC_STATS 0x7ffU
+ #define STATX_BTIME 0x800U
+ #define STATX_ALL 0xfffU
++#define STATX_MNT_ID 0x1000U
++#define STATX_DIOALIGN 0x2000U
++#define STATX_MNT_ID_UNIQUE 0x4000U
+ 
+ #define STATX_ATTR_COMPRESSED 0x4
+ #define STATX_ATTR_IMMUTABLE 0x10
+@@ -157,7 +160,11 @@ struct statx {
+ 	uint32_t stx_rdev_minor;
+ 	uint32_t stx_dev_major;
+ 	uint32_t stx_dev_minor;
+-	uint64_t __pad1[14];
++	uint64_t stx_mnt_id;
++	uint32_t stx_dio_mem_align;
++	uint32_t stx_dio_offet_align;
++	uint64_t stx_subvol;
++	uint64_t __pad1[11];
+ };
+ 
+ int statx(int, const char *__restrict, int, unsigned, struct statx *__restrict);
+-- 
+cgit v1.2.1
+

From 9ea284ac3f6c383c37bba25c57a74c117a3b7a6c Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sat, 27 Jun 2026 16:30:22 +0200
Subject: [PATCH 0879/1209] systemd: add libucontext dependency for musl

Required for musl, unused otherwise.

Fixes: ccc474fdb400 ("systemd: v260.2 -> v261")
---
 pkgs/os-specific/linux/systemd/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 4652d2cf8d11..fd0c8cc9da44 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -34,6 +34,7 @@
   acl,
   lz4,
   openssl,
+  libucontext,
   libgcrypt,
   libidn2,
   curl,
@@ -325,7 +326,9 @@ stdenv.mkDerivation (finalAttrs: {
     libuuid
     linuxHeaders
   ]
-
+  ++ lib.optionals stdenv.hostPlatform.isMusl [
+    libucontext
+  ]
   ++ lib.optionals withGcrypt [
     libgcrypt
   ]

From f352780c96819972b5f87ce0c7487c242f0ec5b4 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sat, 27 Jun 2026 22:56:38 +0200
Subject: [PATCH 0880/1209] systemd: don't try to dlopen libintl.so.8 on musl

---
 pkgs/os-specific/linux/systemd/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index fd0c8cc9da44..eab1a27055ec 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -319,7 +319,14 @@ stdenv.mkDerivation (finalAttrs: {
     buildPackages.llvmPackages.libllvm
   ];
 
-  autoPatchelfFlags = [ "--keep-libc" ];
+  autoPatchelfFlags = [
+    "--keep-libc"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isMusl [
+    # TODO: can be unconditionalized on staging.
+    # Nixpkgs does not rely on gettext for libintl for musl.
+    "--ignore-missing=libintl.so.8"
+  ];
 
   buildInputs = [
     libxcrypt

From ba13cc996e3c61073ea06af735938589fade71c5 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 28 Jun 2026 12:13:22 +0100
Subject: [PATCH 0881/1209] gssdp_1_6: 1.6.5 -> 1.6.6

Changes: https://gitlab.gnome.org/GNOME/gssdp/-/blob/gssdp-1.6.6/NEWS?ref_type=tags
---
 pkgs/by-name/gs/gssdp_1_6/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gs/gssdp_1_6/package.nix b/pkgs/by-name/gs/gssdp_1_6/package.nix
index a25d7c8f1547..47c18a41e48b 100644
--- a/pkgs/by-name/gs/gssdp_1_6/package.nix
+++ b/pkgs/by-name/gs/gssdp_1_6/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gssdp";
-  version = "1.6.5";
+  version = "1.6.6";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor finalAttrs.version}/gssdp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NP2CTDbvn1dVlNVXJyhBLduMUi9ga2yRPvi1qACq/E4=";
+    hash = "sha256-dn0idSVM4O/q6sZEGf+fTwrUcNE072cvXFVrKrt4a8s=";
   };
 
   depsBuildBuild = [

From 516366f11a89a66e1bb44681b690001417406754 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 14:09:38 +0200
Subject: [PATCH 0882/1209] python3Packages.numba: fix numpy 2.5 compat

---
 .../python-modules/numba/default.nix          | 29 +++++++++++--------
 .../python-modules/numba/numpy2.4.patch       | 28 ------------------
 .../python-modules/numba/numpy2.5.patch       | 26 +++++++++++++++++
 3 files changed, 43 insertions(+), 40 deletions(-)
 delete mode 100644 pkgs/development/python-modules/numba/numpy2.4.patch
 create mode 100644 pkgs/development/python-modules/numba/numpy2.5.patch

diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index 0e38f0392cde..11c25c98168d 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   buildPythonPackage,
   replaceVars,
-  fetchpatch,
 
   # nativeBuildInputs
   setuptools,
@@ -16,8 +15,8 @@
   # tests
   numba,
   pytestCheckHook,
+  pytest-xdist,
   writableTmpDirAsHomeHook,
-  numpy_1,
   writers,
   python,
 
@@ -56,11 +55,26 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-DMmUyTElDFyMK4BUQ4EhDNmG43lOWQHurKbnSyhAs5k=";
   };
 
+  patches = [
+    ./numpy2.5.patch
+  ]
+  ++ lib.optionals cudaSupport [
+    (replaceVars ./cuda_path.patch {
+      cuda_toolkit_path = cudatoolkit;
+      cuda_toolkit_lib_path = lib.getLib cudatoolkit;
+    })
+  ];
+
   postPatch = ''
     substituteInPlace numba/cuda/cudadrv/driver.py \
       --replace-fail \
         "dldir = [" \
         "dldir = [ '${addDriverRunpath.driverLink}/lib', "
+
+    substituteInPlace setup.py \
+      --replace-fail 'max_numpy_run_version = "2.5"' 'max_numpy_run_version = "2.6"'
+    substituteInPlace numba/__init__.py \
+      --replace-fail "(2, 4)" "(2, 6)"
   '';
 
   build-system = [
@@ -84,15 +98,9 @@ buildPythonPackage (finalAttrs: {
     llvmlite
   ];
 
-  patches = lib.optionals cudaSupport [
-    (replaceVars ./cuda_path.patch {
-      cuda_toolkit_path = cudatoolkit;
-      cuda_toolkit_lib_path = lib.getLib cudatoolkit;
-    })
-  ];
-
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-xdist
     writableTmpDirAsHomeHook
   ];
 
@@ -145,9 +153,6 @@ buildPythonPackage (finalAttrs: {
       doFullCheck = true;
       testsWithoutSandbox = false;
     };
-    numpy_1 = numba.override {
-      numpy = numpy_1;
-    };
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/numba/numpy2.4.patch b/pkgs/development/python-modules/numba/numpy2.4.patch
deleted file mode 100644
index 37fd13bd9582..000000000000
--- a/pkgs/development/python-modules/numba/numpy2.4.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/numba/__init__.py b/numba/__init__.py
-index 33f752018..7d3b3ae8d 100644
---- a/numba/__init__.py
-+++ b/numba/__init__.py
-@@ -39,8 +39,8 @@ def _ensure_critical_deps():
-                f"{numpy_version[0]}.{numpy_version[1]}.")
-         raise ImportError(msg)
- 
--    if numpy_version > (2, 3):
--        msg = (f"Numba needs NumPy 2.3 or less. Got NumPy "
-+    if numpy_version > (2, 4):
-+        msg = (f"Numba needs NumPy 2.4 or less. Got NumPy "
-                 f"{numpy_version[0]}.{numpy_version[1]}.")
-         raise ImportError(msg)
-
-diff --git a/setup.py b/setup.py
-index 9eaa191cb..a5febef1e 100644
---- a/setup.py
-+++ b/setup.py
-@@ -23,7 +23,7 @@ min_python_version = "3.10"
- max_python_version = "3.15"  # exclusive
- min_numpy_build_version = "2.0.0rc1"
- min_numpy_run_version = "1.22"
--max_numpy_run_version = "2.4"
-+max_numpy_run_version = "2.5"
- min_llvmlite_version = "0.46.0dev0"
- max_llvmlite_version = "0.47"
-
diff --git a/pkgs/development/python-modules/numba/numpy2.5.patch b/pkgs/development/python-modules/numba/numpy2.5.patch
new file mode 100644
index 000000000000..7cc84679ced9
--- /dev/null
+++ b/pkgs/development/python-modules/numba/numpy2.5.patch
@@ -0,0 +1,26 @@
+diff --git a/numba/np/arrayobj.py b/numba/np/arrayobj.py
+index ae81627ec..dd69a2a45 100644
+--- a/numba/np/arrayobj.py
++++ b/numba/np/arrayobj.py
+@@ -6639,7 +6639,7 @@ def impl_np_vstack(tup):
+         return impl
+ 
+ 
+-if numpy_version >= (2, 0):
++if (2, 0) <= numpy_version < (2, 5):
+     overload(np.row_stack)(impl_np_vstack)
+ 
+ 
+diff --git a/numba/tests/test_dyn_array.py b/numba/tests/test_dyn_array.py
+index 99328052c..dfbf57589 100644
+--- a/numba/tests/test_dyn_array.py
++++ b/numba/tests/test_dyn_array.py
+@@ -36,7 +36,7 @@ def np_vstack(a, b, c):
+     return np.vstack((a, b, c))
+ 
+ def np_row_stack(a, b, c):
+-    return np.row_stack((a, b, c))
++    return np.vstack((a, b, c))
+ 
+ def np_dstack(a, b, c):
+     return np.dstack((a, b, c))

From c191a1732b47c2281f6c8e4b6327901b9b0fd5c1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 14:56:17 +0200
Subject: [PATCH 0883/1209] python3Packages.barectf: fix setuptools 82 compat

---
 .../python-modules/barectf/default.nix        | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/barectf/default.nix b/pkgs/development/python-modules/barectf/default.nix
index 661826855615..0ef38100e3cd 100644
--- a/pkgs/development/python-modules/barectf/default.nix
+++ b/pkgs/development/python-modules/barectf/default.nix
@@ -2,9 +2,9 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   poetry-core,
   pytest7CheckHook,
-  setuptools,
   jsonschema,
   pyyaml,
   jinja2,
@@ -23,6 +23,18 @@ buildPythonPackage rec {
     hash = "sha256-JelFfd3WS012dveNlIljhLdyPmgE9VEOXoZE3MBA/Gw=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "setuptools-82-compat.patch";
+      url = "https://github.com/efficios/barectf/commit/e16d289546bb4f6b0d909f79b8d6188eabe32640.patch";
+      hash = "sha256-5tSOxc6trSHFPnVj+7YVO9J65bZ1H2MFKrZAbRy1WTM=";
+      excludes = [
+        "pyproject.toml"
+        "poetry.lock"
+      ];
+    })
+  ];
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -33,8 +45,11 @@ buildPythonPackage rec {
     "termcolor"
   ];
 
+  pythonRemoveDeps = [
+    "setuptools"
+  ];
+
   propagatedBuildInputs = [
-    setuptools # needs pkg_resources at runtime
     jsonschema
     pyyaml
     jinja2

From 529a1fc31812b1cd93236dc2e59bcd22ba889ed2 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 14:35:36 +0300
Subject: [PATCH 0884/1209] playwright.webkit: fix libjxl override

---
 pkgs/development/web/playwright/webkit.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/web/playwright/webkit.nix b/pkgs/development/web/playwright/webkit.nix
index 55f20bdcd9eb..1a29cf31c1e5 100644
--- a/pkgs/development/web/playwright/webkit.nix
+++ b/pkgs/development/web/playwright/webkit.nix
@@ -79,6 +79,13 @@ let
         hash = "sha256-I3PGgh0XqRkCFz7lUZ3Q4eU0+0GwaQcVb6t4Pru1kKo=";
         fetchSubmodules = true;
       };
+
+      # override split output shenanigans from the main package
+      outputs = [
+        "out"
+        "dev"
+      ];
+
       patches = [
         # Add missing <atomic> content to fix gcc compilation for RISCV architecture
         # https://github.com/libjxl/libjxl/pull/2211

From 4f39574b549ef678d7b2318515746d82f087d587 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 14:38:52 +0300
Subject: [PATCH 0885/1209] python3Packages.fontparts: unpin setuptools-scm

---
 pkgs/development/python-modules/fontparts/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/fontparts/default.nix b/pkgs/development/python-modules/fontparts/default.nix
index bc6b8c1e797a..43bf78c3dd3b 100644
--- a/pkgs/development/python-modules/fontparts/default.nix
+++ b/pkgs/development/python-modules/fontparts/default.nix
@@ -31,7 +31,10 @@ buildPythonPackage (finalAttrs: {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail ', "vcs-versioning"' ""
+      --replace-fail ', "vcs-versioning"' "" \
+      --replace-fail "setuptools_scm[toml]>=3.4,<10" "setuptools_scm[toml]"
+    substituteInPlace setup.cfg \
+      --replace-fail "setuptools_scm==9.2.2" "setuptools_scm"
   '';
 
   build-system = [

From b812bc2a4a1597b73bc9a5422318fe6bcc9bde34 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 14:47:03 +0300
Subject: [PATCH 0886/1209] treewide: drop gst-vaapi

Upstream dropped it and it no longer builds.
---
 .../obs-studio/plugins/obs-vaapi/default.nix  |   2 -
 pkgs/by-name/ci/citrix-workspace/package.nix  |   1 -
 pkgs/by-name/de/deltachat-tauri/package.nix   |   1 -
 .../fl/flet-client-flutter/package.nix        |   2 +-
 .../gn/gnome-network-displays/package.nix     |   1 -
 pkgs/by-name/ka/kazumi/package.nix            |   1 -
 pkgs/by-name/pi/picard/package.nix            |  18 +--
 pkgs/by-name/pi/pipeline/package.nix          |   1 -
 pkgs/by-name/py/pympress/package.nix          |   1 -
 pkgs/by-name/xp/xpra/package.nix              |   1 -
 .../libraries/gstreamer/default.nix           |   3 +-
 .../libraries/gstreamer/vaapi/default.nix     | 120 ------------------
 pkgs/development/libraries/qt-6/default.nix   |   1 -
 .../qt-6/modules/qtmultimedia/default.nix     |   2 -
 14 files changed, 9 insertions(+), 146 deletions(-)
 delete mode 100644 pkgs/development/libraries/gstreamer/vaapi/default.nix

diff --git a/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix b/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
index fd7837eb5cc3..840c5a50ac76 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
@@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
   # - We need "getLib" instead of default derivation, otherwise it brings gstreamer-bin;
   # - without gst-plugins-base it won't even show proper errors in logs;
   # - Without gst-plugins-bad it won't find element "vapostproc";
-  # - gst-vaapi adds "VA-API" to "Encoder type";
   # Tip: "could not link appsrc to videoconvert1" can mean a lot of things, enable GST_DEBUG=2 for help.
   passthru.obsWrapperArguments =
     let
@@ -48,7 +47,6 @@ stdenv.mkDerivation rec {
       gstreamer
       gst-plugins-base
       gst-plugins-bad
-      gst-vaapi
     ];
 
   # Fix output directory
diff --git a/pkgs/by-name/ci/citrix-workspace/package.nix b/pkgs/by-name/ci/citrix-workspace/package.nix
index 7b1f996bfcf2..9051b4e72b37 100644
--- a/pkgs/by-name/ci/citrix-workspace/package.nix
+++ b/pkgs/by-name/ci/citrix-workspace/package.nix
@@ -91,7 +91,6 @@ let
     gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-ugly
-    gst_all_1.gst-vaapi
   ];
 
   gstPluginPath = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gstPackages;
diff --git a/pkgs/by-name/de/deltachat-tauri/package.nix b/pkgs/by-name/de/deltachat-tauri/package.nix
index 26cb46756bca..1387196ffbae 100644
--- a/pkgs/by-name/de/deltachat-tauri/package.nix
+++ b/pkgs/by-name/de/deltachat-tauri/package.nix
@@ -64,7 +64,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       gst_all_1.gst-plugins-base
       gst_all_1.gst-plugins-good
       gst_all_1.gst-plugins-bad
-      gst_all_1.gst-vaapi
       gst_all_1.gstreamer
       libayatana-appindicator
       openssl
diff --git a/pkgs/by-name/fl/flet-client-flutter/package.nix b/pkgs/by-name/fl/flet-client-flutter/package.nix
index 867b9d0f2e9c..7733ee43da04 100644
--- a/pkgs/by-name/fl/flet-client-flutter/package.nix
+++ b/pkgs/by-name/fl/flet-client-flutter/package.nix
@@ -51,7 +51,7 @@ flutter338.buildFlutterApplication rec {
     mpv-unwrapped
     gst_all_1.gst-libav
     gst_all_1.gst-plugins-base
-    gst_all_1.gst-vaapi
+    gst_all_1.gst-plugins-bad
     gst_all_1.gstreamer
     libunwind
     orc
diff --git a/pkgs/by-name/gn/gnome-network-displays/package.nix b/pkgs/by-name/gn/gnome-network-displays/package.nix
index 681954677367..57e2576d2b7d 100644
--- a/pkgs/by-name/gn/gnome-network-displays/package.nix
+++ b/pkgs/by-name/gn/gnome-network-displays/package.nix
@@ -59,7 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
     gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-ugly
     gst_all_1.gst-rtsp-server
-    gst_all_1.gst-vaapi
     pipewire
     networkmanager
     json-glib
diff --git a/pkgs/by-name/ka/kazumi/package.nix b/pkgs/by-name/ka/kazumi/package.nix
index 511e88086d0e..da2c473ae1bb 100644
--- a/pkgs/by-name/ka/kazumi/package.nix
+++ b/pkgs/by-name/ka/kazumi/package.nix
@@ -91,7 +91,6 @@ flutter.buildFlutterApplication {
     gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
-    gst_all_1.gst-vaapi
     gst_all_1.gstreamer
     libayatana-appindicator
     mpv-unwrapped
diff --git a/pkgs/by-name/pi/picard/package.nix b/pkgs/by-name/pi/picard/package.nix
index db9009ebaedf..51336472ded0 100644
--- a/pkgs/by-name/pi/picard/package.nix
+++ b/pkgs/by-name/pi/picard/package.nix
@@ -45,17 +45,13 @@ pythonPackages.buildPythonApplication (finalAttrs: {
   ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform qt5.qtwayland) [
     qt5.qtwayland
   ]
-  ++ lib.optionals (pyqt5.multimediaEnabled) (
-    [
-      qt5.qtmultimedia.bin
-      gst_all_1.gst-libav
-      gst_all_1.gst-plugins-base
-      gst_all_1.gst-plugins-good
-    ]
-    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform gst_all_1.gst-vaapi) [
-      gst_all_1.gst-vaapi
-    ]
-  );
+  ++ lib.optionals (pyqt5.multimediaEnabled) [
+    qt5.qtmultimedia.bin
+    gst_all_1.gst-libav
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+  ];
 
   pythonRelaxDeps = lib.optionals stdenv.hostPlatform.isDarwin [
     # Should be resolved in the next version
diff --git a/pkgs/by-name/pi/pipeline/package.nix b/pkgs/by-name/pi/pipeline/package.nix
index ffd0e38f62a7..32e6e5e887b6 100644
--- a/pkgs/by-name/pi/pipeline/package.nix
+++ b/pkgs/by-name/pi/pipeline/package.nix
@@ -74,7 +74,6 @@ stdenv.mkDerivation (finalAttrs: {
     gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-ugly
-    gst_all_1.gst-vaapi
     glib-networking # For GIO_EXTRA_MODULES. Fixes "TLS support is not available"
   ];
 
diff --git a/pkgs/by-name/py/pympress/package.nix b/pkgs/by-name/py/pympress/package.nix
index 288ea438fb5d..55a6b40b82cb 100644
--- a/pkgs/by-name/py/pympress/package.nix
+++ b/pkgs/by-name/py/pympress/package.nix
@@ -56,7 +56,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     gst_all_1.gst-plugins-ugly
     (gst_all_1.gst-plugins-good.override { gtkSupport = true; })
     gst_all_1.gst-libav
-    gst_all_1.gst-vaapi
   ];
 
   doCheck = false; # there are no tests
diff --git a/pkgs/by-name/xp/xpra/package.nix b/pkgs/by-name/xp/xpra/package.nix
index 6d9c26e42de9..bcd5776b7d21 100644
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -159,7 +159,6 @@ effectiveBuildPythonApplication rec {
   ]
   ++ (with gst_all_1; [
     gst-libav
-    gst-vaapi
     gst-plugins-ugly
     gst-plugins-bad
     gst-plugins-base
diff --git a/pkgs/development/libraries/gstreamer/default.nix b/pkgs/development/libraries/gstreamer/default.nix
index b41e8192aaa4..21712e04da55 100644
--- a/pkgs/development/libraries/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/default.nix
@@ -37,8 +37,6 @@ lib.makeScope newScope (
 
     gst-editing-services = callPackage ./ges { };
 
-    gst-vaapi = callPackage ./vaapi { };
-
     icamerasrc-ipu6 = callPackage ./icamerasrc { };
     icamerasrc-ipu6ep = callPackage ./icamerasrc {
       ipu6-camera-hal = ipu6ep-camera-hal;
@@ -51,5 +49,6 @@ lib.makeScope newScope (
   }
   // lib.optionalAttrs config.allowAliases {
     gst-plugins-viperfx = throw "'gst_all_1.gst-plugins-viperfx' was removed as it is broken and not maintained upstream"; # Added 2024-12-16
+    gst-vaapi = throw "'gst_all_1.gst-vaapi' has been removed in GStreamer 1.28. Users are recommended to switch to gst-plugins-bad, however it is not an in-place upgrade."; # Added 2026-06-28
   }
 )
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
deleted file mode 100644
index e5796cc6a9e8..000000000000
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ /dev/null
@@ -1,120 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  meson,
-  ninja,
-  pkg-config,
-  gst-plugins-base,
-  bzip2,
-  libva,
-  wayland,
-  wayland-protocols,
-  wayland-scanner,
-  libdrm,
-  udev,
-  libxv,
-  libxrandr,
-  libxext,
-  libx11,
-  libsm,
-  libice,
-  libxcb,
-  libGLU,
-  libGL,
-  gstreamer,
-  gst-plugins-bad,
-  nasm,
-  libvpx,
-  python3,
-  # Checks meson.is_cross_build(), so even canExecute isn't enough.
-  enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
-  hotdoc,
-  directoryListingUpdater,
-  apple-sdk_gstreamer,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "gstreamer-vaapi";
-  version = "1.26.11";
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  src = fetchurl {
-    url = "https://gstreamer.freedesktop.org/src/gstreamer-vaapi/gstreamer-vaapi-${finalAttrs.version}.tar.xz";
-    hash = "sha256-8S+TAnPHodPg1/hblP+dE3nRYqzMky6Mo9OJk+0n/Kw=";
-  };
-
-  separateDebugInfo = true;
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-    python3
-    bzip2
-    wayland-scanner
-  ]
-  ++ lib.optionals enableDocumentation [
-    hotdoc
-  ];
-
-  buildInputs = [
-    gstreamer
-    gst-plugins-base
-    gst-plugins-bad
-    libva
-    wayland
-    wayland-protocols
-    libdrm
-    udev
-    libx11
-    libxcb
-    libxext
-    libxv
-    libxrandr
-    libsm
-    libice
-    nasm
-    libvpx
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-    libGL
-    libGLU
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_gstreamer
-  ];
-
-  mesonFlags = [
-    "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
-    (lib.mesonEnable "doc" enableDocumentation)
-  ];
-
-  postPatch = ''
-    patchShebangs \
-      scripts/extract-release-date-from-doap-file.py
-  '';
-
-  preFixup = ''
-    moveToOutput "lib/gstreamer-1.0/pkgconfig" "$dev"
-  '';
-
-  passthru = {
-    updateScript = directoryListingUpdater { odd-unstable = true; };
-  };
-
-  meta = {
-    description = "Set of VAAPI GStreamer Plug-ins";
-    homepage = "https://gstreamer.freedesktop.org";
-    license = lib.licenses.lgpl21Plus;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ tmarkus ];
-  };
-})
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index b8a7afb5496c..6f1489005a12 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -89,7 +89,6 @@ let
           gst-plugins-base
           gst-plugins-good
           gst-libav
-          gst-vaapi
           ;
       };
       qtmqtt = callPackage ./modules/qtmqtt.nix { };
diff --git a/pkgs/development/libraries/qt-6/modules/qtmultimedia/default.nix b/pkgs/development/libraries/qt-6/modules/qtmultimedia/default.nix
index 104bfb752531..50829d0b0ef7 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmultimedia/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmultimedia/default.nix
@@ -14,7 +14,6 @@
   gst-plugins-base,
   gst-plugins-good,
   gst-libav,
-  gst-vaapi,
   ffmpeg,
   libva,
   libpulseaudio,
@@ -59,7 +58,6 @@ qtModule {
     gst-plugins-base
     gst-plugins-good
     gst-libav
-    gst-vaapi
   ];
 
   patches = lib.optionals stdenv.hostPlatform.isMinGW [

From d5f3ba05b658a8842ed5d483b29564c968c78209 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 14:49:03 +0300
Subject: [PATCH 0887/1209] python3Packages.jq: skip another test that relies
 on exact jq error text

---
 pkgs/development/python-modules/jq/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/jq/default.nix b/pkgs/development/python-modules/jq/default.nix
index 01c93b61a9fe..39fc694fa546 100644
--- a/pkgs/development/python-modules/jq/default.nix
+++ b/pkgs/development/python-modules/jq/default.nix
@@ -38,6 +38,7 @@ buildPythonPackage rec {
   disabledTests = [
     # tries to match exact error text, fails with jq 1.8
     "test_value_error_is_raised_if_program_is_invalid"
+    "test_value_error_is_raised_if_input_cannot_be_processed_by_program"
   ];
 
   pythonImportsCheck = [ "jq" ];

From 22927b96798d1cdbf665448f97898f1b32253e52 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 14:50:45 +0300
Subject: [PATCH 0888/1209] treewide: drop python3Packages.aiosasl and friends

---
 pkgs/by-name/ur/urlwatch/package.nix          |  1 -
 .../python-modules/aiosasl/default.nix        | 52 ----------
 .../python-modules/aioxmpp/default.nix        | 98 -------------------
 pkgs/top-level/python-aliases.nix             |  2 +
 pkgs/top-level/python-packages.nix            |  4 -
 5 files changed, 2 insertions(+), 155 deletions(-)
 delete mode 100644 pkgs/development/python-modules/aiosasl/default.nix
 delete mode 100644 pkgs/development/python-modules/aioxmpp/default.nix

diff --git a/pkgs/by-name/ur/urlwatch/package.nix b/pkgs/by-name/ur/urlwatch/package.nix
index 662eb3ec4fe1..8e9a88908a66 100644
--- a/pkgs/by-name/ur/urlwatch/package.nix
+++ b/pkgs/by-name/ur/urlwatch/package.nix
@@ -19,7 +19,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   build-system = with python3Packages; [ setuptools ];
 
   dependencies = with python3Packages; [
-    aioxmpp
     beautifulsoup4
     cssbeautifier
     cssselect
diff --git a/pkgs/development/python-modules/aiosasl/default.nix b/pkgs/development/python-modules/aiosasl/default.nix
deleted file mode 100644
index 95f5ed8e7470..000000000000
--- a/pkgs/development/python-modules/aiosasl/default.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  fetchpatch,
-  pyopenssl,
-  pytestCheckHook,
-  setuptools,
-}:
-
-buildPythonPackage rec {
-  pname = "aiosasl";
-  version = "0.5.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "horazont";
-    repo = "aiosasl";
-    tag = "v${version}";
-    hash = "sha256-JIuNPb/l4QURMQc905H2iNGCfMz+zM/QJhDQOR8LPdc=";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "python311-compat.patch";
-      url = "https://github.com/horazont/aiosasl/commit/44c48d36b416bd635d970dba2607a31b2167ea1b.patch";
-      hash = "sha256-u6PJKV54dU2MA9hXa/9hJ3eLVds1DuLHGbt8y/OakWs=";
-    })
-  ];
-
-  postPatch = ''
-    # https://github.com/horazont/aiosasl/issues/28
-    substituteInPlace tests/test_aiosasl.py \
-      --replace-fail "assertRaisesRegexp" "assertRaisesRegex"
-  '';
-
-  build-system = [ setuptools ];
-
-  nativeCheckInputs = [
-    pyopenssl
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [ "aiosasl" ];
-
-  meta = {
-    description = "Asyncio SASL library";
-    homepage = "https://github.com/horazont/aiosasl";
-    license = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ dotlambda ];
-  };
-}
diff --git a/pkgs/development/python-modules/aioxmpp/default.nix b/pkgs/development/python-modules/aioxmpp/default.nix
deleted file mode 100644
index e0285de62caa..000000000000
--- a/pkgs/development/python-modules/aioxmpp/default.nix
+++ /dev/null
@@ -1,98 +0,0 @@
-{
-  lib,
-  aioopenssl,
-  aiosasl,
-  babel,
-  buildPythonPackage,
-  dnspython,
-  fetchFromCodeberg,
-  lxml,
-  multidict,
-  pyasn1-modules,
-  pyasn1,
-  pyopenssl,
-  pytestCheckHook,
-  pythonAtLeast,
-  pytz,
-  setuptools,
-  sortedcollections,
-  tzlocal,
-}:
-
-buildPythonPackage rec {
-  pname = "aioxmpp";
-  version = "0.13.3";
-  pyproject = true;
-
-  src = fetchFromCodeberg {
-    owner = "jssfr";
-    repo = "aioxmpp";
-    tag = "v${version}";
-    hash = "sha256-bQPKEM5eKhFI3Kx3U1espdxqjnG4yUgOXmYCrd98PDo=";
-  };
-
-  postPatch = ''
-    substituteInPlace tests/bookmarks/test_service.py \
-      --replace-fail 'can only assign an iterable$' 'must assign iterable'
-    substituteInPlace tests/test_utils.py \
-      --replace-fail 'property of .* has no' 'property .*of .* has no'
-  '';
-
-  pythonRelaxDeps = [
-    "lxml"
-  ];
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    aiosasl
-    aioopenssl
-    babel
-    dnspython
-    lxml
-    multidict
-    pyasn1
-    pyasn1-modules
-    pyopenssl
-    pytz
-    sortedcollections
-    tzlocal
-  ];
-
-  pythonImportsCheck = [
-    "aioxmpp"
-    "aioxmpp.node"
-    "aioxmpp.security_layer"
-    "aioxmpp.stanza"
-    "aioxmpp.stream"
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  disabledTestPaths = [ "benchmarks" ];
-
-  disabledTests = [
-    # AttributeError: 'zoneinfo.ZoneInfo' object has no attribute 'normalize'
-    "test_convert_field_datetime_default_locale"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.12") [
-    # asyncio issues
-    "test_is_abstract"
-    "Testbackground"
-    "TestCapturingXSO"
-    "Testcheck_x509"
-    "TestClient"
-    "TestIntegerType"
-    "TestStanzaStream"
-    "TestStanzaToken"
-    "TestXMLStream"
-  ];
-
-  meta = {
-    description = "Pure-python XMPP library for asyncio";
-    homepage = "https://codeberg.org/jssfr/aioxmpp";
-    changelog = "https://codeberg.org/jssfr/aioxmpp/src/tag/${src.tag}/docs/api/changelog.rst";
-    license = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ dotlambda ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index bb7a0d656d72..09ee27d347d3 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -78,8 +78,10 @@ mapAliases {
   abjad = throw "'abjad' was removed due to lack of maintenance"; # Added 2026-03-24
   abodepy = throw "'abodepy' has been renamed to/replaced by 'jaraco-abode'"; # Converted to throw 2025-10-29
   aioinflux = throw "'aioinflux' was removed because it is abandonned upstream. For InfluxDB v2+ support, please use the official Python client library"; # Added 2026-01-15
+  aiosasl = throw "'aiosasl' was removed because it is abandoned upstream and does not work on modern Python versions."; # Added 2026-06-28
   aiosenz = throw "aiosenz was removed because Home Assistant switched to pysenz"; # added 2025-12-29
   aioshutil = throw "'aioshutil' was removed because uiprotect no longer depends on it"; # added 2026-02-16
+  aioxmpp = throw "'aioxmpp' was removed because it depends on aiosasl, which is abandoned and does not work on modern Python versions."; # Added 2026-06-28
   amazon-kclpy = throw "amazon-kclpy has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-03
   amazon_kclpy = throw "'amazon_kclpy' has been renamed to/replaced by 'amazon-kclpy'"; # Converted to throw 2025-10-29
   amqplib = throw "amqplib has been removed as it was unmaintained upstream"; # Added 2025-11-22
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8f90a996d573..921aef1f726a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -516,8 +516,6 @@ self: super: with self; {
 
   aiorwlock = callPackage ../development/python-modules/aiorwlock { };
 
-  aiosasl = callPackage ../development/python-modules/aiosasl { };
-
   aiosendspin = callPackage ../development/python-modules/aiosendspin { };
 
   aiosendspin-mpris = callPackage ../development/python-modules/aiosendspin-mpris { };
@@ -600,8 +598,6 @@ self: super: with self; {
 
   aiowmi = callPackage ../development/python-modules/aiowmi { };
 
-  aioxmpp = callPackage ../development/python-modules/aioxmpp { };
-
   aioymaps = callPackage ../development/python-modules/aioymaps { };
 
   aiozeroconf = callPackage ../development/python-modules/aiozeroconf { };

From 8240c4665a8083eef1f75d2d6f29ffed313c627d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 15:10:01 +0300
Subject: [PATCH 0889/1209] python3Packages.aiohttp-jinja2: fix build with
 aiohttp 3.14

---
 .../python-modules/aiohttp-jinja2/aiohttp-3.14.patch  | 11 +++++++++++
 .../python-modules/aiohttp-jinja2/default.nix         |  5 +++++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/development/python-modules/aiohttp-jinja2/aiohttp-3.14.patch

diff --git a/pkgs/development/python-modules/aiohttp-jinja2/aiohttp-3.14.patch b/pkgs/development/python-modules/aiohttp-jinja2/aiohttp-3.14.patch
new file mode 100644
index 000000000000..7070f63fefb1
--- /dev/null
+++ b/pkgs/development/python-modules/aiohttp-jinja2/aiohttp-3.14.patch
@@ -0,0 +1,11 @@
+--- a/aiohttp_jinja2/__init__.py
++++ b/aiohttp_jinja2/__init__.py
+@@ -38,7 +38,7 @@
+     "APP_CONTEXT_PROCESSORS_KEY"
+ )
+ APP_KEY: Final = web.AppKey[jinja2.Environment]("APP_KEY")
+-REQUEST_CONTEXT_KEY: Final = "aiohttp_jinja2_context"
++REQUEST_CONTEXT_KEY: Final = web.RequestKey("jinja_context", dict)
+ 
+ _T = TypeVar("_T")
+ _P = ParamSpec("_P")
\ No newline at end of file
diff --git a/pkgs/development/python-modules/aiohttp-jinja2/default.nix b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
index 9ccf48edc5e1..d917bc9eaced 100644
--- a/pkgs/development/python-modules/aiohttp-jinja2/default.nix
+++ b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
@@ -20,6 +20,11 @@ buildPythonPackage rec {
     hash = "sha256-o6f/UmTlvKUuiuVHu/0HYbcklSMNQ40FtsCRW+YZsOI=";
   };
 
+  patches = [
+    # Adapted from https://github.com/aio-libs/aiohttp-jinja2/pull/1025
+    ./aiohttp-3.14.patch
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [

From db6a86467918a3cd155b8e0eedee144d628931ec Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 15:10:13 +0300
Subject: [PATCH 0890/1209] tpm2-tss: don't test on 32-bit

swtpm doesn't build on 32-bit targets so we can't run the tests.
---
 pkgs/development/libraries/tpm2-tss/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/tpm2-tss/default.nix b/pkgs/development/libraries/tpm2-tss/default.nix
index b4bce91d0878..6bf372a5dd92 100644
--- a/pkgs/development/libraries/tpm2-tss/default.nix
+++ b/pkgs/development/libraries/tpm2-tss/default.nix
@@ -167,7 +167,9 @@ stdenv.mkDerivation (finalAttrs: {
     stdenv.buildPlatform.canExecute stdenv.hostPlatform
     && !stdenv.hostPlatform.isDarwin
     # Tests rely on mocking, which can't work with static libs.
-    && !stdenv.hostPlatform.isStatic;
+    && !stdenv.hostPlatform.isStatic
+    # swtpm does not build on 32-bit targets
+    && !stdenv.hostPlatform.is32bit;
   # Since we rewrote the load path in the dynamic loader for the TCTI
   # The various tcti implementation should be placed in their target directory
   # before we could run tests, so we make turn checkPhase into installCheckPhase

From 87e2e48e4e3d3fc4057446c16a59af901e4c08bd Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 15:12:21 +0300
Subject: [PATCH 0891/1209] lemmy-server: allow warnings

Remember kids, don't -Werror in production.
---
 pkgs/servers/web-apps/lemmy/server.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/servers/web-apps/lemmy/server.nix b/pkgs/servers/web-apps/lemmy/server.nix
index c3cb5c6444e1..1b6028b4f37e 100644
--- a/pkgs/servers/web-apps/lemmy/server.nix
+++ b/pkgs/servers/web-apps/lemmy/server.nix
@@ -49,6 +49,9 @@ rustPlatform.buildRustPackage rec {
 
     PROTOC = "${protobuf}/bin/protoc";
     PROTOC_INCLUDE = "${protobuf}/include";
+
+    # #[deny(warnings)] trips on newer rustc
+    RUSTFLAGS = "--cap-lints warn";
   };
   nativeBuildInputs = [
     protobuf

From b9ec3822af779f9bb6df21b40fe7d12ca8e5bd64 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 17:09:01 +0300
Subject: [PATCH 0892/1209] python3Packages.pandas: 3.0.3 -> 3.0.4

Fixes crash
---
 pkgs/development/python-modules/pandas/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index e4b838dba6ba..a0519d35c2ab 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -63,7 +63,7 @@
 let
   pandas = buildPythonPackage rec {
     pname = "pandas";
-    version = "3.0.3";
+    version = "3.0.4";
     pyproject = true;
 
     src = fetchFromGitHub {
@@ -73,7 +73,7 @@ let
       postFetch = ''
         sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pandas/_version.py
       '';
-      hash = "sha256-G+pWdmft/kcxv97ySa+0ZFEgvMKuNaK33DseZQ8R1z8=";
+      hash = "sha256-cPnvBVs5xXjbRoj6KU/KeNn+To9oue7H0OBaJ2JdJG4=";
     };
 
     # A NOTE regarding the Numpy version relaxing: Both Numpy versions 1.x &

From ffec75b842aa60673fc860a56a1f6f2a81f4d864 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 17:04:34 +0200
Subject: [PATCH 0893/1209] 
 python3Packages.opentelemetry-instrumentation-logging: disable benchmarking

---
 .../opentelemetry-instrumentation-logging/default.nix      | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation-logging/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation-logging/default.nix
index c81381cdf363..6e459a895c75 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation-logging/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation-logging/default.nix
@@ -1,10 +1,10 @@
 {
-  lib,
   buildPythonPackage,
   hatchling,
   opentelemetry-api,
   opentelemetry-instrumentation,
   opentelemetry-test-utils,
+  pytest-benchmark,
   pytestCheckHook,
 }:
 
@@ -24,9 +24,14 @@ buildPythonPackage {
 
   nativeCheckInputs = [
     opentelemetry-test-utils
+    pytest-benchmark
     pytestCheckHook
   ];
 
+  pytestFlags = [
+    "--benchmark-disable"
+  ];
+
   pythonImportsCheck = [ "opentelemetry.instrumentation.logging" ];
 
   meta = opentelemetry-instrumentation.meta // {

From 22eda77d98d8ce851be280be2310a53405e136f2 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 28 Jun 2026 17:17:41 +0200
Subject: [PATCH 0894/1209] nodejs_24: limit pinning of LLVM to darwin

---
 pkgs/development/web/nodejs/v24.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index ca6a16ddf1ba..823cd488c5b8 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -9,11 +9,15 @@
 }:
 
 let
-  buildNodejs = callPackage ./nodejs.nix {
-    inherit openssl;
-    python = python3;
-    stdenv = buildPackages.llvmPackages_20.libcxxStdenv;
-  };
+  buildNodejs =
+    callPackage ./nodejs.nix {
+      inherit openssl;
+      python = python3;
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      # libcxx21 makes FD tracking unreliable on Darwin. Pinning to libcxx20:
+      stdenv = buildPackages.llvmPackages_20.libcxxStdenv;
+    };
 
   gypPatches =
     if stdenv.buildPlatform.isDarwin then

From 5aece2a41360ef27c0c67cfd83abb77b191b707d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 17:26:46 +0200
Subject: [PATCH 0895/1209] python3Packages.seaborn: disable failing tests

These are probably related to the matplotlib 3.11 bump.
---
 pkgs/development/python-modules/seaborn/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/seaborn/default.nix b/pkgs/development/python-modules/seaborn/default.nix
index 08041d7a5d7b..3a48512d690b 100644
--- a/pkgs/development/python-modules/seaborn/default.nix
+++ b/pkgs/development/python-modules/seaborn/default.nix
@@ -12,6 +12,7 @@
   pandas,
   scipy,
   statsmodels,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
@@ -64,11 +65,16 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytest-xdist
     pytest8_3CheckHook
+    writableTmpDirAsHomeHook
   ];
 
   disabledTests = [
     # requires internet connection
     "test_load_dataset_string_error"
+    # matplotlib error string matching
+    "test_theme_validation"
+    # log scale transformation match too strict
+    "test_log_scale"
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isx86) [
     # overly strict float tolerances

From 38c44143d78644394f0b50c5695904c58e33c213 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 28 Jun 2026 17:45:22 +0200
Subject: [PATCH 0896/1209] nodejs_24: fix typo in derivation

---
 pkgs/development/web/nodejs/v24.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 823cd488c5b8..3388b484ebe8 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -9,15 +9,16 @@
 }:
 
 let
-  buildNodejs =
-    callPackage ./nodejs.nix {
+  buildNodejs = callPackage ./nodejs.nix (
+    {
       inherit openssl;
       python = python3;
     }
     // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
       # libcxx21 makes FD tracking unreliable on Darwin. Pinning to libcxx20:
       stdenv = buildPackages.llvmPackages_20.libcxxStdenv;
-    };
+    }
+  );
 
   gypPatches =
     if stdenv.buildPlatform.isDarwin then

From 7cf24f3f52260c0a493a1af856e735e754dc5dba Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 17:35:00 +0200
Subject: [PATCH 0897/1209] python3Packages.opentelemetry-api: 1.40.0 -> 1.43.0

https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.43.0
---
 pkgs/development/python-modules/opentelemetry-api/default.nix | 4 ++--
 .../python-modules/opentelemetry-test-utils/default.nix       | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-api/default.nix b/pkgs/development/python-modules/opentelemetry-api/default.nix
index f5a482ee5155..c3af4ad016e0 100644
--- a/pkgs/development/python-modules/opentelemetry-api/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-api/default.nix
@@ -14,7 +14,7 @@
 let
   self = buildPythonPackage rec {
     pname = "opentelemetry-api";
-    version = "1.40.0";
+    version = "1.43.0";
     pyproject = true;
 
     # to avoid breakage, every package in opentelemetry-python must inherit this version, src, and meta
@@ -22,7 +22,7 @@ let
       owner = "open-telemetry";
       repo = "opentelemetry-python";
       tag = "v${version}";
-      hash = "sha256-1KVy9s+zjlB4w7E45PMCWRxPus24bgBmmM3k2R9d+Jg=";
+      hash = "sha256-NnRx0sMVlht2CVXeKjP7mZlzhyOqU/YyveDMWRbmAD8=";
     };
 
     sourceRoot = "${src.name}/opentelemetry-api";
diff --git a/pkgs/development/python-modules/opentelemetry-test-utils/default.nix b/pkgs/development/python-modules/opentelemetry-test-utils/default.nix
index 99769b3ffec4..8c415e19b559 100644
--- a/pkgs/development/python-modules/opentelemetry-test-utils/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-test-utils/default.nix
@@ -5,6 +5,7 @@
   opentelemetry-api,
   opentelemetry-instrumentation,
   opentelemetry-sdk,
+  requests,
 }:
 
 buildPythonPackage {
@@ -23,6 +24,7 @@ buildPythonPackage {
     asgiref
     opentelemetry-api
     opentelemetry-sdk
+    requests
   ];
 
   pythonImportsCheck = [ "opentelemetry.test" ];

From 060bb0f04d4cbd9e6a77fbeda137cffa87fe3bc9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 17:35:56 +0200
Subject: [PATCH 0898/1209] python3Packages.opentelemetry-instrumentation:
 0.61b0 -> 0.64b0

https://github.com/open-telemetry/opentelemetry-python-contrib/releases/tag/vv0.64b0
---
 .../default.nix                               | 19 ++++++++-----------
 .../opentelemetry-instrumentation/default.nix |  4 ++--
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix
index 5adf35cc516f..f482bc846903 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix
@@ -1,6 +1,5 @@
 {
   buildPythonPackage,
-  fetchpatch,
   requests,
   hatchling,
   opentelemetry-api,
@@ -8,7 +7,9 @@
   opentelemetry-semantic-conventions,
   opentelemetry-util-http,
   httpretty,
+  mocket,
   opentelemetry-test-utils,
+  pytest-benchmark,
   pytestCheckHook,
 }:
 
@@ -19,16 +20,6 @@ buildPythonPackage {
 
   sourceRoot = "${opentelemetry-instrumentation.src.name}/instrumentation/opentelemetry-instrumentation-requests";
 
-  patches = [
-    # remove hardcoded requests version from fixtures
-    (fetchpatch {
-      url = "https://github.com/open-telemetry/opentelemetry-python-contrib/commit/69a94e0c3b25edfdc4abeb18a4d26f5b7532e7ba.patch";
-      stripLen = 2;
-      includes = [ "tests/test_requests_integration.py" ];
-      hash = "sha256-JGWJVHR6lAg8bG1fpfJ4BJbqipnVFRLV7i/bKwOmtPk=";
-    })
-  ];
-
   build-system = [ hatchling ];
 
   dependencies = [
@@ -41,10 +32,16 @@ buildPythonPackage {
 
   nativeCheckInputs = [
     httpretty
+    mocket
     opentelemetry-test-utils
+    pytest-benchmark
     pytestCheckHook
   ];
 
+  pytestFlags = [
+    "--benchmark-disable"
+  ];
+
   pythonImportsCheck = [ "opentelemetry.instrumentation.requests" ];
 
   meta = opentelemetry-instrumentation.meta // {
diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
index 9bb8ba599c2e..83fd84b4be6f 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "opentelemetry-instrumentation";
-  version = "0.61b0";
+  version = "0.64b0";
   pyproject = true;
 
   # To avoid breakage, every package in opentelemetry-python-contrib must inherit this version, src, and meta
@@ -20,7 +20,7 @@ buildPythonPackage (finalAttrs: {
     owner = "open-telemetry";
     repo = "opentelemetry-python-contrib";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DT13gcYPNYXBPnf622WsA16C+7sabJfOshDquHn06Ok=";
+    hash = "sha256-dOcDzJD1xxCN7+Zrn+2mF/gbZjy/XC6uAKDhpfYLf98=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/opentelemetry-instrumentation";

From 5bcf867fca3bd2aa72c060a4530b0a3f18b9f9da Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 17:53:10 +0200
Subject: [PATCH 0899/1209] python3Packages.mocket: disable failing test

---
 pkgs/development/python-modules/mocket/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/mocket/default.nix b/pkgs/development/python-modules/mocket/default.nix
index 8cf838a93b29..4d5373b9457e 100644
--- a/pkgs/development/python-modules/mocket/default.nix
+++ b/pkgs/development/python-modules/mocket/default.nix
@@ -90,6 +90,8 @@ buildPythonPackage rec {
     "test_gethostbyname"
     # httpx read failure
     "test_no_dangling_fds"
+    # redis-py response mismatch
+    "test_hgetall"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # fails on darwin due to upstream bug: https://github.com/mindflayer/python-mocket/issues/287

From 3ac7d3d7852d7db6de137e43cca81e650af4a452 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 18:00:32 +0200
Subject: [PATCH 0900/1209] python3Packages.opentelemetry-resourcedetector-gcp:
 1.11.0a0 -> 1.12.0a0

---
 .../opentelemetry-resourcedetector-gcp/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix b/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix
index 02b3917a0cfa..88a8a3c99de4 100644
--- a/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "opentelemetry-resourcedetector-gcp";
-  version = "1.11.0a0";
+  version = "1.12.0a0";
   pyproject = true;
 
   # Use PyPi instead of GitHub because the GitHub tags are inaccurate
@@ -20,7 +20,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "opentelemetry_resourcedetector_gcp";
     inherit (finalAttrs) version;
-    hash = "sha256-kVodb9FdrKnu3T/FKw9wU3UFTy7xQOLnprTMqVpHzbE=";
+    hash = "sha256-1eP3goOicuuSVH4Au+/0W3Myo0rnkacKtOuoGvm8O68=";
   };
 
   build-system = [ setuptools ];

From 6438670b44d366fadc1192d9c88668bfa3ae9e62 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 18:00:48 +0200
Subject: [PATCH 0901/1209] 
 python3Packages.opentelemetry-semantic-conventions-ai: 0.4.15 -> 0.5.1

---
 .../opentelemetry-semantic-conventions-ai/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
index b282e160d6ea..4022a30b5622 100644
--- a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
@@ -8,7 +8,7 @@
   pytestCheckHook,
 }:
 let
-  version = "0.4.15";
+  version = "0.5.1";
 in
 buildPythonPackage {
   pname = "opentelemetry-semantic-conventions-ai";
@@ -18,7 +18,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "opentelemetry_semantic_conventions_ai";
     inherit version;
-    hash = "sha256-Et4XLR4R0hxugrv1eMfopxNYmn/adq+e14VjJWSii4E=";
+    hash = "sha256-FTkGIA2MHS+OCb142+9SaRYCPehaw9qzWRK/r7af8Ew=";
   };
 
   build-system = [ hatchling ];

From 67695b335b7a99572e9ee51582b0f191f0fb9b31 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 Jun 2026 19:31:21 +0300
Subject: [PATCH 0902/1209] home-assistant: fix plexapi override

---
 pkgs/servers/home-assistant/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 8de81bf72298..b5ebfba471e3 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -150,6 +150,11 @@ let
           tag = version;
           hash = "sha256-NwGGNN6LC3gvE8zoVL5meNWMbqZjJ+6PcU2ebJTfJmU=";
         };
+
+        # ancient pinned version requires pkg_resources
+        nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [
+          self.setuptools_80
+        ];
       });
 
       # Pinned due to API changes in 0.1.0

From 2469d1f5558c698be0cf30b74ddb369cb7d23eb2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 18:44:04 +0200
Subject: [PATCH 0903/1209] python3Packages.fastparquet: ignore numpy
 deprecation warning

---
 pkgs/development/python-modules/fastparquet/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/python-modules/fastparquet/default.nix b/pkgs/development/python-modules/fastparquet/default.nix
index 1c8dcd43b6b7..d7f7c5a74afa 100644
--- a/pkgs/development/python-modules/fastparquet/default.nix
+++ b/pkgs/development/python-modules/fastparquet/default.nix
@@ -62,6 +62,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = [
+    # DeprecationWarning: The 'generic' unit for NumPy timedelta is deprecated,
+    # and will raise an error in the future. This includes implicit conversion of bare
+    # integers (e.g. `+ 1`).Please use a specific unit instead.
+    "test_import_without_warning"
+  ];
+
   # Workaround https://github.com/NixOS/nixpkgs/issues/123561
   preCheck = ''
     mv fastparquet/test .

From 5f08853644352cc04d2b75f967583e621d22bff6 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sun, 28 Jun 2026 17:33:04 +0100
Subject: [PATCH 0904/1209] glib: use LLD on Darwin to work around ld64
 hardening issue

---
 pkgs/by-name/gl/glib/package.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index cf554d53e403..ab72587c7b56 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -24,6 +24,8 @@
   gi-docgen,
   # use util-linuxMinimal to avoid circular dependency (util-linux, systemd, glib)
   util-linuxMinimal ? null,
+  # TODO: Clean up on `staging`.
+  llvmPackages,
   buildPackages,
 
   # this is just for tests (not in the closure of any regular package)
@@ -210,6 +212,10 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals withDtrace [
     systemtap' # for dtrace
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   propagatedBuildInputs = [
@@ -253,6 +259,13 @@ stdenv.mkDerivation (finalAttrs: {
       "-DG_DISABLE_CAST_CHECKS"
     ];
     DETERMINISTIC_BUILD = 1;
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # Work around ld64 hardening issue.
+    #
+    # TODO: Clean up on `staging`.
+    CC_LD = "lld";
+    OBJC_LD = "lld";
   };
 
   postPatch = ''

From b799c7b11402caf17f3ad9be53c96ca1f86e69d5 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sun, 28 Jun 2026 17:33:04 +0100
Subject: [PATCH 0905/1209] glib: remove obsolete Darwin patch

---
 pkgs/by-name/gl/glib/darwin-compilation.patch | 24 -------------------
 pkgs/by-name/gl/glib/package.nix              |  5 +---
 2 files changed, 1 insertion(+), 28 deletions(-)
 delete mode 100644 pkgs/by-name/gl/glib/darwin-compilation.patch

diff --git a/pkgs/by-name/gl/glib/darwin-compilation.patch b/pkgs/by-name/gl/glib/darwin-compilation.patch
deleted file mode 100644
index f215eef798af..000000000000
--- a/pkgs/by-name/gl/glib/darwin-compilation.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-Fix compilation on Mac OS X with gcc 4.8.
-
-diff -ru glib-2.40.0-orig/gio/gdummyfile.c glib-2.40.0/gio/gdummyfile.c
---- glib-2.40.0-orig/gio/gdummyfile.c   2014-02-03 18:40:41.000000000 +0100
-+++ glib-2.40.0/gio/gdummyfile.c        2014-07-15 10:58:31.000000000 +0200
-@@ -454,7 +454,8 @@
-   result = g_malloc (escaped_string_end - escaped_string + 1);
-        
-   out = result;
--  for (in = escaped_string; in < escaped_string_end; in++) 
-+  in = escaped_string;
-+  for (; in < escaped_string_end; in++) 
-     {
-       character = *in;
-       if (*in == '%') 
-@@ -551,6 +552,7 @@
-   
-   decoded->scheme = g_malloc (p - uri);
-   out = decoded->scheme;
--  for (in = uri; in < p - 1; in++)
-+  in = uri;
-+  for (; in < p - 1; in++)
-     *out++ = g_ascii_tolower (*in);
-   *out = 0;
diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index ab72587c7b56..bda3d4a4a09c 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -101,10 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      ./darwin-compilation.patch
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isMusl [
+    lib.optionals stdenv.hostPlatform.isMusl [
       ./quark_init_on_demand.patch
       ./gobject_init_on_demand.patch
     ]

From 22931e0854568241165ab93ec3fbdb04820ffeda Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 19:08:59 +0200
Subject: [PATCH 0906/1209] python3Packages.vcrpy: 8.1.1 -> 8.2.1

https://github.com/kevin1024/vcrpy/releases/tag/v8.2.0
https://github.com/kevin1024/vcrpy/releases/tag/v8.2.1
---
 pkgs/development/python-modules/vcrpy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/vcrpy/default.nix b/pkgs/development/python-modules/vcrpy/default.nix
index 78e41447623a..5556125736ee 100644
--- a/pkgs/development/python-modules/vcrpy/default.nix
+++ b/pkgs/development/python-modules/vcrpy/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "vcrpy";
-  version = "8.1.1";
+  version = "8.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kevin1024";
     repo = "vcrpy";
     tag = "v${version}";
-    hash = "sha256-X6cOoj+XP0lVvf78FTb7FkNqrq5RfXtQlQ3lcOzr3D8=";
+    hash = "sha256-PlpbBzAj9a4bAfORGozAAsbrzngJt2Pnnp3bI96wYfI=";
   };
 
   build-system = [ setuptools ];

From 43bfa3ff3b249dc519578e322ffa7e8446cc9d1a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 19:57:00 +0200
Subject: [PATCH 0907/1209] python3Packages.librosa: disable failing tests

The display tests compare images rendered and expect them to be within
a certain tolerance. With matplotlib 3.11.0 this tolerance gets exceeded.
---
 pkgs/development/python-modules/librosa/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/librosa/default.nix b/pkgs/development/python-modules/librosa/default.nix
index 33f4e1c5c56a..7b8a5cf6a795 100644
--- a/pkgs/development/python-modules/librosa/default.nix
+++ b/pkgs/development/python-modules/librosa/default.nix
@@ -143,6 +143,11 @@ buildPythonPackage (finalAttrs: {
     "test_resample_stereo"
   ];
 
+  disabledTestPaths = [
+    # matplotlib 3.11 exceeds tolerances for image comparison
+    "tests/test_display.py"
+  ];
+
   meta = {
     description = "Python library for audio and music analysis";
     homepage = "https://github.com/librosa/librosa";

From c07b089cad35d800b889c8a65e98d939513ff209 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 21:15:45 +0200
Subject: [PATCH 0908/1209] arrow-cpp: 23.0.0 -> 24.0.0

https://arrow.apache.org/release/24.0.0.html
---
 pkgs/by-name/ar/arrow-cpp/package.nix         |  6 ++++--
 .../python-modules/pyarrow/default.nix        | 19 +++++++++++++++----
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ar/arrow-cpp/package.nix b/pkgs/by-name/ar/arrow-cpp/package.nix
index e675f1a55df8..3becc5f51f39 100644
--- a/pkgs/by-name/ar/arrow-cpp/package.nix
+++ b/pkgs/by-name/ar/arrow-cpp/package.nix
@@ -80,7 +80,7 @@ let
     hash = "sha256-Xd6o3RT6Q0tPutV77J0P1x3F6U3RHdCBOKGUKtkQCKk=";
   };
 
-  version = "23.0.0";
+  version = "24.0.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "arrow-cpp";
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "apache";
     repo = "arrow";
     rev = "apache-arrow-${version}";
-    hash = "sha256-BluUlbtGJwvlrpN/c/KziOfFh5dvzZyuCy4JZkkFea4=";
+    hash = "sha256-qTdkzZegANNvtO7nbqXVC8hc7BexvmeFF/0l5VzRb8g=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/cpp";
@@ -305,6 +305,8 @@ stdenv.mkDerivation (finalAttrs: {
         "arrow-flight-integration-test"
         # File already exists in database: orc_proto.proto
         "arrow-orc-adapter-test"
+        # missing test fixture
+        "parquet-encryption-test"
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         # https://github.com/NixOS/nixpkgs/issues/460687
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index 9f4366c6685d..f21dac9e39cc 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -11,14 +11,16 @@
   cython,
   fsspec,
   hypothesis,
+  libcst,
+  ninja,
   numpy,
   pandas,
   pytestCheckHook,
   pytest-lazy-fixture,
   pkg-config,
+  scikit-build-core,
   setuptools,
   setuptools-scm,
-  oldest-supported-numpy,
 }:
 
 let
@@ -32,18 +34,21 @@ buildPythonPackage rec {
 
   sourceRoot = "${src.name}/python";
 
-  nativeBuildInputs = [
+  build-system = [
+    scikit-build-core
     cmake
     cython
+    libcst
+    ninja
+    numpy
     pkg-config
     setuptools
     setuptools-scm
-    oldest-supported-numpy
   ];
 
   buildInputs = [ arrow-cpp ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     cffi
     numpy
   ];
@@ -134,6 +139,12 @@ buildPythonPackage rec {
     "pyarrow/tests/test_udf.py::test_scalar_input"
     "pyarrow/tests/test_udf.py::test_scalar_udf_context"
     "pyarrow/tests/test_udf.py::test_udf_array_unary"
+    # CSV pickle mismatches
+    "pyarrow/tests/test_csv.py::TestThreadedStreamingCSVRead::test_invalid_row_handler["
+    "pyarrow/tests/test_csv.py::TestThreadedStreamingCSVRead::test_row_number_offset_in_errors"
+    "pyarrow/tests/test_csv.py::TestThreadedStreamingCSVRead::test_row_number_offset_in_errors"
+    # Does not raise NotImplementedError
+    "pyarrow/tests/test_table.py::test_table_group_by_first"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # Requires loopback networking.

From fbc8fd8ee3a085a4dbe937d6d579a07aabc77a93 Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Fri, 26 Jun 2026 01:21:24 +0200
Subject: [PATCH 0909/1209] python3Packages.cryptography: disable tests failing
 with overcommit

---
 .../python-modules/cryptography/default.nix      | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 56fb295e6dd9..148402b9ce78 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchpatch,
   buildPythonPackage,
   callPackage,
   setuptools,
@@ -36,6 +37,15 @@ buildPythonPackage rec {
     hash = "sha256-mp+1Fw8xNBJD1DM8obAqYBP8erxXiP768+ifqRN1Uqs=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Add test marks where malloc failure is expected on systems with overcommit enabled
+      name = "malloc-overcommit-mark.patch";
+      url = "https://github.com/pyca/cryptography/commit/2efeba9cc67809b67e659bea8eaea680df2135e8.patch";
+      hash = "sha256-06Z+sk2JTJ50CCnPf2vXyPL5BZeI98oc43LpccenzNg=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "--benchmark-disable" ""
@@ -71,12 +81,6 @@ buildPythonPackage rec {
 
   pytestFlags = [ "--disable-pytest-warnings" ];
 
-  disabledTests = [
-    # Tries to allocate 1 TiB with vm.overcommit_memory=1
-    # https://github.com/pyca/cryptography/pull/14782
-    "test_argon2_malloc_failure"
-  ];
-
   disabledTestPaths = [
     # save compute time by not running benchmarks
     "tests/bench"

From 6cddca7cc4efb8039bba344749c079c8b6ec400d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 23:11:36 +0200
Subject: [PATCH 0910/1209] python3Packages.cryptography: 48.0.0 -> 49.0.0

https://cryptography.io/en/latest/changelog/#v49-0-0
---
 pkgs/development/python-modules/cryptography/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 148402b9ce78..f0560b576078 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -22,19 +22,19 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "48.0.0";
+  version = "49.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyca";
     repo = "cryptography";
     tag = version;
-    hash = "sha256-S1oOLou6tE1atqZ6HXwVQDps9BnjiEpRdoZY5VQm+Kg=";
+    hash = "sha256-yHUIGauFZYnjcoROvocT1UqQ0B8ZuVTaJ0ZAfri6T1E=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-mp+1Fw8xNBJD1DM8obAqYBP8erxXiP768+ifqRN1Uqs=";
+    hash = "sha256-yMCBu/RGRcEQST8tEWCNgVvlQsp2KamOqt60qvOYdt8=";
   };
 
   patches = [

From ca2662455d1b12accdfd5a14dfbcf4e124d916f9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 23:29:56 +0200
Subject: [PATCH 0911/1209] python3Packages.duckdb: ignore numpy deprecation

---
 pkgs/development/python-modules/duckdb/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index 4ce00e36200a..edc2419ab06a 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -109,7 +109,10 @@ buildPythonPackage rec {
   ++ optional-dependencies.all;
 
   # test flags from .github/workflows/Python.yml
-  pytestFlags = [ "--verbose" ];
+  pytestFlags = [
+    "--verbose"
+    "-Wignore::DeprecationWarning"
+  ];
   enabledTestPaths = if stdenv.hostPlatform.isDarwin then [ "tests/fast" ] else [ "tests" ];
 
   disabledTestPaths = [

From bf2d049739a5ff7adb817c6e716c49281b2d6f87 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 23:41:40 +0200
Subject: [PATCH 0912/1209] python3Packages.pyopenssl: 26.0.0 -> 26.3.0

https://github.com/pyca/pyopenssl/blob/26.3.0/CHANGELOG.rst
---
 pkgs/development/python-modules/pyopenssl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 46e99e1e4bbf..3924e6cd73ad 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pyopenssl";
-  version = "26.0.0";
+  version = "26.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyca";
     repo = "pyopenssl";
     tag = version;
-    hash = "sha256-3Z9I4T1KPObZebVEMhykeq9yzQ446i9CZ5YwkeqlVTs=";
+    hash = "sha256-ASpF7CcakrPS4qg8XFGYgYb7Etjg7wcVyMBbtAZaKO0=";
   };
 
   outputs = [

From 3a0a3eb696eae60bc29a7316f5318c9110fd7ba3 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 23:44:13 +0200
Subject: [PATCH 0913/1209] python3Packages.msal: 1.34.0 -> 1.37.0

https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.37.0
---
 pkgs/development/python-modules/msal/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/msal/default.nix b/pkgs/development/python-modules/msal/default.nix
index f053b318e350..9e4b3eddc90e 100644
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "msal";
-  version = "1.34.0";
+  version = "1.37.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-drqDtxbqWm11sCecCsNToOBbggyh9mgsDrf0UZDEPC8=";
+    hash = "sha256-GxZyoz7kZ8HXCzQbsWyv1RuzyBcUepW5MmN5SwOXG+w=";
   };
 
   build-system = [ setuptools ];

From edc937acabd900ae4763f9805aac7b036067f96c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Jun 2026 23:48:40 +0200
Subject: [PATCH 0914/1209] yubikey-manager: relax cryptography constraint

---
 pkgs/by-name/yu/yubikey-manager/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/yu/yubikey-manager/package.nix b/pkgs/by-name/yu/yubikey-manager/package.nix
index c9047d500930..22395b761736 100644
--- a/pkgs/by-name/yu/yubikey-manager/package.nix
+++ b/pkgs/by-name/yu/yubikey-manager/package.nix
@@ -43,6 +43,10 @@ python3Packages.buildPythonPackage rec {
     python-pskc
   ];
 
+  pythonRelaxDeps = [
+    "cryptography"
+  ];
+
   postInstall = ''
     installManPage man/ykman.1
   ''

From 77a82ea8e1fed17fd1de069255844e504d058933 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Sun, 28 Jun 2026 21:06:51 -0400
Subject: [PATCH 0915/1209] python3Packages.twisted: add patch for removed
 pyopenssl apis

pyOpenSSL dropped the x509Req APIs that had been deprecated, which broke
twisted. until this reaches a release, we fetch the commit that replaced
it with functionality from pyca/cryptography.
---
 .../development/python-modules/twisted/default.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index f96bed372e06..e298aabb4d01 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -5,6 +5,7 @@
   pythonAtLeast,
   pythonOlder,
   fetchFromGitHub,
+  fetchpatch,
   python,
 
   # build-system
@@ -65,6 +66,19 @@ buildPythonPackage rec {
     hash = "sha256-D6vDa+8qwjryKnElPBZgXCNokMX2l3i2bMdtk4FhEp4=";
   };
 
+  patches = [
+    # pyOpenSSL 26.3.0 dropped some deprecated APIs, which breaks various
+    # functionality in twisted. We include the patch which replaces these
+    # with equivalent functionality from pyca/cryptography.
+    # https://github.com/twisted/twisted/issues/12660
+    # https://github.com/twisted/twisted/pull/12661
+    (fetchpatch {
+      name = "twisted-replace-pyopenssl-x509req-with-cryptography-csr.patch";
+      url = "https://github.com/twisted/twisted/commit/5b4601c9965ffc92d6aa952b8c05127d5ac37307.patch";
+      hash = "sha256-mbSZOvzinfUolfOHJl+vEdAEGjy8OF2S/SrTsAbvjIw=";
+    })
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   build-system = [

From a8f768361ea0d4b2234b88199e231680e832bebe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 28 Jun 2026 20:22:20 -0700
Subject: [PATCH 0916/1209] libadwaita: 1.9.1 -> 1.9.2

Diff: https://gitlab.gnome.org/GNOME/libadwaita/-/compare/1.9.1...1.9.2

Changelog: https://gitlab.gnome.org/GNOME/libadwaita/-/blob/1.9.2/NEWS
---
 pkgs/by-name/li/libadwaita/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libadwaita/package.nix b/pkgs/by-name/li/libadwaita/package.nix
index 8f289c6e4977..fdad6431655b 100644
--- a/pkgs/by-name/li/libadwaita/package.nix
+++ b/pkgs/by-name/li/libadwaita/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.9.1";
+  version = "1.9.2";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-Oy3WcsymNbbmAacm5hEOrorI1wKXjSp063mh4jCJRAE=";
+    hash = "sha256-XKKjnZz4CII6w9fKFptPK3aTNa5eMfyE7rcerbgaDco=";
   };
 
   depsBuildBuild = [

From ee9587600e5a685afd615111e7273eb11caae653 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 29 Jun 2026 10:00:59 +0300
Subject: [PATCH 0917/1209] python3Packages.webrtcvad: don't use pkg_resources

Fixes build on 3.14
---
 .../python-modules/webrtcvad/default.nix      |  6 ++++++
 .../webrtcvad/no-pkg-resources.patch          | 21 +++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 pkgs/development/python-modules/webrtcvad/no-pkg-resources.patch

diff --git a/pkgs/development/python-modules/webrtcvad/default.nix b/pkgs/development/python-modules/webrtcvad/default.nix
index b18d159fcdd4..1613d10047e7 100644
--- a/pkgs/development/python-modules/webrtcvad/default.nix
+++ b/pkgs/development/python-modules/webrtcvad/default.nix
@@ -17,6 +17,12 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-8b7S+yW2P7expV1kCQyZPJyRZ7KEha4Lzdgc9u3pauo=";
   };
 
+  patches = [
+    # remove pkg_resources usage
+    # backport of https://github.com/wiseman/py-webrtcvad/pull/96
+    ./no-pkg-resources.patch
+  ];
+
   build-system = [ setuptools ];
 
   # required WAV files for testing are not included in the tarball
diff --git a/pkgs/development/python-modules/webrtcvad/no-pkg-resources.patch b/pkgs/development/python-modules/webrtcvad/no-pkg-resources.patch
new file mode 100644
index 000000000000..e38ecbfcd9fb
--- /dev/null
+++ b/pkgs/development/python-modules/webrtcvad/no-pkg-resources.patch
@@ -0,0 +1,21 @@
+--- a/webrtcvad.py
++++ b/webrtcvad.py
+@@ -1,11 +1,16 @@
+-import pkg_resources
++try:
++    # Python 3.8+
++    from importlib.metadata import version
++except Exception:  # pragma: no cover
++    # Backport for Python < 3.8
++    from importlib_metadata import version
+ 
+ import _webrtcvad
+ 
+ __author__ = "John Wiseman jjwiseman@gmail.com"
+ __copyright__ = "Copyright (C) 2016 John Wiseman"
+ __license__ = "MIT"
+-__version__ = pkg_resources.get_distribution('webrtcvad').version
++__version__ = version("webrtcvad")
+ 
+ 
+ class Vad(object):
\ No newline at end of file

From 135034ac717fd02a478c869bd355f41cb36e5adf Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 29 Jun 2026 11:00:12 +0300
Subject: [PATCH 0918/1209] curl: allow runtimeShellPackage to be referenced by
 curl.dev

Fixes https://github.com/NixOS/nixpkgs/pull/535878#issuecomment-4815172957

`patchShebangsAuto` uses `--build` by default for dev outputs, which
includes `$dev/bin/curl-config` in this package.
---
 pkgs/by-name/cu/curlMinimal/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index cd277649a5ae..8ef587a7ab88 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -257,7 +257,8 @@ stdenv.mkDerivation (finalAttrs: {
   + lib.optionalString isCross ''
     patchShebangs --update --host "''${!outputBin}/bin"
   '';
-  disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
+  outputChecks.bin.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
+  outputChecks.out.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
   buildInputs = lib.optional isCross runtimeShellPackage;
 
   passthru =

From d0c0d01afc8ea5d0f189fd4f4805e98b136a7299 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Fri, 19 Jun 2026 19:55:30 +0200
Subject: [PATCH 0919/1209] libressl_4_3: 4.3.1 -> 4.3.2

---
 pkgs/by-name/li/libressl/default.nix | 21 ++++-----------------
 1 file changed, 4 insertions(+), 17 deletions(-)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 4bf139efc381..6f0faa1a563d 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -151,23 +151,10 @@ in
     ];
   };
 
-  # 4.3 was released April 2026 and will become unsupported one year after the
-  # release of OpenBSD 7.9.
+  # 4.3 was released April 2026 and will become unsupported on May 19, 2027,
+  # one year after the release of OpenBSD 7.9.
   libressl_4_3 = generic {
-    version = "4.3.1";
-    hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
-    patches = [
-      # Fix for https://github.com/libressl/portable/issues/1278, where LibreSSL
-      # 4.3 started requiring executable stack because some objects were missing
-      # a .note.GNU-stack section; will probably be included in the next release.
-      (fetchpatch {
-        url = "https://raw.githubusercontent.com/libressl/portable/4dae91d056c6c75ba5cf2bc5e6148b8e02239119/patches/gnu-stack.patch";
-        hash = "sha256-Q1oWL4N8w5Zmjfq5QkTJR53NgZ4GqChSDaBicli5G2I=";
-        # This patch is written to be applied with -p0, with no leading path
-        # component, but Nix applies with -p1 by default, so we add it to not
-        # break compatibility with how other patches must be applied.
-        decode = "sed 's|^--- |--- a/|; s|^+++ |+++ b/|'";
-      })
-    ];
+    version = "4.3.2";
+    hash = "sha256-7fAa7iTGXWnmqe/LnUS82mgv+dTzu72V55Th36kIR7U=";
   };
 }

From f108b21b61fb1443121bf47ce87301b102129ade Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 29 Jun 2026 12:31:06 +0300
Subject: [PATCH 0920/1209] python3Packages.scipy: skip flaky test

---
 pkgs/development/python-modules/scipy/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 785a917fcf0d..52b1b035c20c 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -101,7 +101,12 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTests =
-    lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+    [
+      # precision issues on at least some x86_64 and aarch64
+      # see: https://github.com/scipy/scipy/issues/25488
+      "test_nyquist"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
       # The following tests are broken on aarch64-darwin with newer compilers and library versions.
       # See https://github.com/scipy/scipy/issues/18308
       "test_a_b_neg_int_after_euler_hypergeometric_transformation"

From 42cedbeb91a254124bc61612c236f064c00bda07 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 29 Jun 2026 16:11:46 +0300
Subject: [PATCH 0921/1209] python3Packages.scipy: skip another test on
 aarch64-linux

---
 pkgs/development/python-modules/scipy/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 52b1b035c20c..75c66680de00 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -106,6 +106,11 @@ buildPythonPackage (finalAttrs: {
       # see: https://github.com/scipy/scipy/issues/25488
       "test_nyquist"
     ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+      # more flakiness
+      # see: https://github.com/scipy/scipy/issues/25522
+      "test_convergence"
+    ]
     ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
       # The following tests are broken on aarch64-darwin with newer compilers and library versions.
       # See https://github.com/scipy/scipy/issues/18308

From 629568389d449e76dddc576819ccb01dcff6e626 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 29 Jun 2026 17:13:09 +0300
Subject: [PATCH 0922/1209] python3Packages.scipy: nixfmt

---
 .../python-modules/scipy/default.nix          | 71 +++++++++----------
 1 file changed, 35 insertions(+), 36 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 75c66680de00..388e665f78cc 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -100,42 +100,41 @@ buildPythonPackage (finalAttrs: {
     pytest-xdist
   ];
 
-  disabledTests =
-    [
-      # precision issues on at least some x86_64 and aarch64
-      # see: https://github.com/scipy/scipy/issues/25488
-      "test_nyquist"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
-      # more flakiness
-      # see: https://github.com/scipy/scipy/issues/25522
-      "test_convergence"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
-      # The following tests are broken on aarch64-darwin with newer compilers and library versions.
-      # See https://github.com/scipy/scipy/issues/18308
-      "test_a_b_neg_int_after_euler_hypergeometric_transformation"
-      "test_dst4_definition_ortho"
-      "test_load_mat4_le"
-      "hyp2f1_test_case47"
-      "hyp2f1_test_case3"
-      "test_uint64_max"
-      "test_large_m4" # https://github.com/scipy/scipy/issues/22466
-      "test_spiral_cleanup"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) [
-      # https://github.com/scipy/scipy/issues/24090
-      "test_cython_api"
-      "test_distance_transform_cdt05"
-      "test_eval_chebyt_gh20129"
-      "test_hyp0f1"
-      "test_hyp0f1_gh5764"
-      "test_simple_det_shapes_real_complex"
-    ]
-    ++ lib.optionals (python.isPy311) [
-      # https://github.com/scipy/scipy/issues/22789 Observed only with Python 3.11
-      "test_funcs"
-    ];
+  disabledTests = [
+    # precision issues on at least some x86_64 and aarch64
+    # see: https://github.com/scipy/scipy/issues/25488
+    "test_nyquist"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # more flakiness
+    # see: https://github.com/scipy/scipy/issues/25522
+    "test_convergence"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+    # The following tests are broken on aarch64-darwin with newer compilers and library versions.
+    # See https://github.com/scipy/scipy/issues/18308
+    "test_a_b_neg_int_after_euler_hypergeometric_transformation"
+    "test_dst4_definition_ortho"
+    "test_load_mat4_le"
+    "hyp2f1_test_case47"
+    "hyp2f1_test_case3"
+    "test_uint64_max"
+    "test_large_m4" # https://github.com/scipy/scipy/issues/22466
+    "test_spiral_cleanup"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) [
+    # https://github.com/scipy/scipy/issues/24090
+    "test_cython_api"
+    "test_distance_transform_cdt05"
+    "test_eval_chebyt_gh20129"
+    "test_hyp0f1"
+    "test_hyp0f1_gh5764"
+    "test_simple_det_shapes_real_complex"
+  ]
+  ++ lib.optionals (python.isPy311) [
+    # https://github.com/scipy/scipy/issues/22789 Observed only with Python 3.11
+    "test_funcs"
+  ];
 
   doCheck = !(stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isDarwin);
 

From c057afbc4d8ea908adc18855c9ecb890a7802c51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 21 Jun 2026 21:20:46 +0200
Subject: [PATCH 0923/1209] python3Packages.pytest-memray: init at 1.8.0

---
 .../python-modules/pytest-memray/default.nix  | 56 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 58 insertions(+)
 create mode 100644 pkgs/development/python-modules/pytest-memray/default.nix

diff --git a/pkgs/development/python-modules/pytest-memray/default.nix b/pkgs/development/python-modules/pytest-memray/default.nix
new file mode 100644
index 000000000000..f24ffe21881a
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-memray/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  anyio,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flaky,
+  hatchling,
+  hatch-vcs,
+  memray,
+  pytest,
+  pytest-xdist,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pytest-memray";
+  version = "1.8.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bloomberg";
+    repo = "pytest-memray";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-73Lyy14t2Hcqo0aTlWbGMzaxJ73bKjzc4BFE/jPG99I=";
+  };
+
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  dependencies = [ memray ];
+
+  buildInputs = [ pytest ];
+
+  nativeCheckInputs = [
+    anyio
+    flaky
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  enabledTestPaths = [
+    # don't run the demo tests
+    "tests"
+  ];
+
+  pythonImportsCheck = [ "pytest_memray" ];
+
+  meta = {
+    description = "Pytest plugin for easy integration of memray memory profiler";
+    homepage = "https://github.com/bloomberg/pytest-memray";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4666c70de2f0..7903e561e516 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15846,6 +15846,8 @@ self: super: with self; {
 
   pytest-md-report = callPackage ../development/python-modules/pytest-md-report { };
 
+  pytest-memray = callPackage ../development/python-modules/pytest-memray { };
+
   pytest-metadata = callPackage ../development/python-modules/pytest-metadata { };
 
   pytest-mock = callPackage ../development/python-modules/pytest-mock { };

From 4ddd9cf2489a4b8a68f38318b671605fa6a71bd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 21 Jun 2026 21:20:57 +0200
Subject: [PATCH 0924/1209] python314Packages.pyturbojpeg: enable tests

---
 .../python-modules/pyturbojpeg/default.nix     | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/pyturbojpeg/default.nix b/pkgs/development/python-modules/pyturbojpeg/default.nix
index f6aa0ba577f3..d45067c67647 100644
--- a/pkgs/development/python-modules/pyturbojpeg/default.nix
+++ b/pkgs/development/python-modules/pyturbojpeg/default.nix
@@ -6,7 +6,8 @@
   libjpeg_turbo,
   setuptools,
   numpy,
-  python,
+  pytest-memray,
+  pytestCheckHook,
   replaceVars,
 }:
 
@@ -32,14 +33,15 @@ buildPythonPackage rec {
 
   dependencies = [ numpy ];
 
-  # upstream has no tests, but we want to test whether the library is found
-  checkPhase = ''
-    runHook preCheck
+  nativeCheckInputs = [
+    pytest-memray
+    pytestCheckHook
+  ];
 
-    ${python.interpreter} -c 'from turbojpeg import TurboJPEG; TurboJPEG()'
-
-    runHook postCheck
-  '';
+  disabledTests = [
+    # our patch breaks the test
+    "test_library_loading_error_message"
+  ];
 
   pythonImportsCheck = [ "turbojpeg" ];
 

From ef9bf0291e0908cb3fc7217baaf8443f144e1e11 Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Mon, 29 Jun 2026 19:18:31 +0200
Subject: [PATCH 0925/1209] python3Packages.jax: disable test broken with numpy
 2.5

---
 pkgs/development/python-modules/jax/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index b1e084faa030..cc3ae7a61914 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -132,6 +132,10 @@ buildPythonPackage (finalAttrs: {
     # --numprocesses.
     # New test in jax 0.10.2 (tests/random_impl_test.py).
     "test_random_bits"
+
+    # Jax uses deprecated numpy logic as an oracle. Fixed upstream in jax 0.11.0, can't be properly backported.
+    # https://github.com/jax-ml/jax/commit/d219f03b589a1075f499148113aa9c647e1be0b9
+    "testCross"
   ]
   ++ lib.optionals usingMKL [
     # See

From eb58007af76c976a03436887b5325d18c492ddb0 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 29 Jun 2026 14:20:41 -0400
Subject: [PATCH 0926/1209] attr: 2.5.2 -> 2.6.0

changelog: https://cgit.git.savannah.nongnu.org/cgit/attr.git/tree/doc/CHANGES?h=v2.6.0
advisory: https://lists.nongnu.org/archive/html/acl-devel/2026-06/msg00000.html

Fixes: CVE-2026-54371
---
 pkgs/development/libraries/attr/default.nix |  9 ++-----
 pkgs/development/libraries/attr/musl.patch  | 27 ---------------------
 2 files changed, 2 insertions(+), 34 deletions(-)
 delete mode 100644 pkgs/development/libraries/attr/musl.patch

diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix
index f2e057a33058..10891ece56a8 100644
--- a/pkgs/development/libraries/attr/default.nix
+++ b/pkgs/development/libraries/attr/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "attr";
-  version = "2.5.2";
+  version = "2.6.0";
 
   src = fetchurl {
     url = "mirror://savannah/attr/attr-${version}.tar.gz";
-    sha256 = "sha256-Ob9nRS+kHQlIwhl2AQU/SLPXigKTiXNDMqYwmmgMbIc=";
+    hash = "sha256-1C+jdFExgLtIyxGkZpb0iCQOUST/HmrYiwq/9waYVhI=";
   };
 
   outputs = [
@@ -29,11 +29,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gettext ];
 
-  # tools/attr.c: Add missing libgen.h include for basename(3)
-  # Fixes compilation issue with musl and modern C99 compilers.
-  # See: https://bugs.gentoo.org/926294
-  patches = [ ./musl.patch ];
-
   postPatch = ''
     for script in install-sh include/install-sh; do
       patchShebangs $script
diff --git a/pkgs/development/libraries/attr/musl.patch b/pkgs/development/libraries/attr/musl.patch
deleted file mode 100644
index 818161f15243..000000000000
--- a/pkgs/development/libraries/attr/musl.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 8a80d895dfd779373363c3a4b62ecce5a549efb2 Mon Sep 17 00:00:00 2001
-From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
-Date: Sat, 30 Mar 2024 10:17:10 +0100
-Subject: tools/attr.c: Add missing libgen.h include for basename(3)
-
-Fixes compilation issue with musl and modern C99 compilers.
-
-See: https://bugs.gentoo.org/926294
----
- tools/attr.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/tools/attr.c b/tools/attr.c
-index f12e4af..6a3c1e9 100644
---- a/tools/attr.c
-+++ b/tools/attr.c
-@@ -28,6 +28,7 @@
- #include <errno.h>
- #include <string.h>
- #include <locale.h>
-+#include <libgen.h>
- 
- #include <attr/attributes.h>
- 
--- 
-cgit v1.1
-

From 3e9573a974855d064f8ec0d7a96e7bf800da67f7 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 29 Jun 2026 14:29:14 -0400
Subject: [PATCH 0927/1209] acl: 2.3.2 -> 2.4.0

changelog: https://cgit.git.savannah.nongnu.org/cgit/acl.git/tree/doc/CHANGES?h=v2.4.0
advisory: https://lists.nongnu.org/archive/html/acl-devel/2026-06/msg00000.html

Fixes: CVE-2026-54369, CVE-2026-54370
---
 pkgs/development/libraries/acl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index 3397e6e27a14..75934d780a90 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "acl";
-  version = "2.3.2";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "mirror://savannah/acl/acl-${finalAttrs.version}.tar.gz";
-    hash = "sha256-XyvbrWKXB6p9hcYj+ZSqih0t7FWnPeUgW6wL9gWKL3w=";
+    hash = "sha256-c8hTw9ROH2k+WpaphvG9GdPQ2sLH1FPnlhd3dLxOX2o=";
   };
 
   outputs = [

From f27ed93faa96aeffc6eb7e47f99467c81fe2fa30 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 29 Jun 2026 21:37:49 +0300
Subject: [PATCH 0928/1209] python3Packages.redis: 8.0.0 -> 8.0.1

Diff: https://github.com/redis/redis-py/compare/v8.0.0...v8.0.1

Changelog: https://github.com/redis/redis-py/releases/tag/v8.0.1
---
 pkgs/development/python-modules/redis/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 0800bfe085c3..2e92150b8f9e 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "redis";
-  version = "8.0.0";
+  version = "8.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ze9Q8IfSWDAEH0sR+ql0tOu7ajeXF78AKYD6SHpZqRU=";
+    hash = "sha256-41i4oZmbWi87KBSaAAaZe2gPlCpgw6kEPne1IA3PHQM=";
   };
 
   build-system = [ hatchling ];

From 61bf491213fb6da0b7067d1ed0c4a642e0104519 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 29 Jun 2026 15:42:27 -0400
Subject: [PATCH 0929/1209] gnutar: avoid name conflicts with acl 2.4.0

---
 .../gn/gnutar/acl-2.4.0-name-conflicts.patch  | 85 +++++++++++++++++++
 pkgs/by-name/gn/gnutar/package.nix            | 14 ++-
 2 files changed, 96 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/by-name/gn/gnutar/acl-2.4.0-name-conflicts.patch

diff --git a/pkgs/by-name/gn/gnutar/acl-2.4.0-name-conflicts.patch b/pkgs/by-name/gn/gnutar/acl-2.4.0-name-conflicts.patch
new file mode 100644
index 000000000000..c871551bc772
--- /dev/null
+++ b/pkgs/by-name/gn/gnutar/acl-2.4.0-name-conflicts.patch
@@ -0,0 +1,85 @@
+diff --git a/src/xattrs.c b/src/xattrs.c
+index 86a7e59cbc..c872ae308d 100644
+--- a/src/xattrs.c
++++ b/src/xattrs.c
+@@ -139,13 +139,13 @@
+ #ifdef HAVE_POSIX_ACLS
+ 
+ /* acl-at wrappers, TODO: move to gnulib in future? */
+-static acl_t acl_get_file_at (int, const char *, acl_type_t);
+-static int acl_set_file_at (int, const char *, acl_type_t, acl_t);
++static acl_t tar_acl_get_file_at (int, const char *, acl_type_t);
++static int tar_acl_set_file_at (int, const char *, acl_type_t, acl_t);
+ static int file_has_acl_at (int, char const *, struct stat const *);
+-static int acl_delete_def_file_at (int, char const *);
++static int tar_acl_delete_def_file_at (int, char const *);
+ 
+-/* acl_get_file_at */
+-#define AT_FUNC_NAME acl_get_file_at
++/* tar_acl_get_file_at */
++#define AT_FUNC_NAME tar_acl_get_file_at
+ #define AT_FUNC_RESULT acl_t
+ #define AT_FUNC_FAIL (acl_t)NULL
+ #define AT_FUNC_F1 acl_get_file
+@@ -159,8 +159,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+ 
+-/* acl_set_file_at */
+-#define AT_FUNC_NAME acl_set_file_at
++/* tar_acl_set_file_at */
++#define AT_FUNC_NAME tar_acl_set_file_at
+ #define AT_FUNC_F1 acl_set_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS   , acl_type_t type, acl_t acl
+ #define AT_FUNC_POST_FILE_ARGS          , type, acl
+@@ -170,8 +170,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+ 
+-/* acl_delete_def_file_at */
+-#define AT_FUNC_NAME acl_delete_def_file_at
++/* tar_acl_delete_def_file_at */
++#define AT_FUNC_NAME tar_acl_delete_def_file_at
+ #define AT_FUNC_F1 acl_delete_def_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS
+ #define AT_FUNC_POST_FILE_ARGS
+@@ -299,10 +299,10 @@
+       /* No "default" IEEE 1003.1e ACL set for directory.  At this moment,
+          FILE_NAME may already have inherited default acls from parent
+          directory;  clean them up. */
+-      if (acl_delete_def_file_at (chdir_fd, file_name))
++      if (tar_acl_delete_def_file_at (chdir_fd, file_name))
+         WARNOPT (WARN_XATTR_WRITE,
+                 (0, errno,
+-                 _("acl_delete_def_file_at: Cannot drop default POSIX ACLs "
++                 _("tar_acl_delete_def_file_at: Cannot drop default POSIX ACLs "
+                    "for file '%s'"),
+                  file_name));
+       return;
+@@ -316,11 +316,11 @@
+       return;
+     }
+ 
+-  if (acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
++  if (tar_acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
+     /* warn even if filesystem does not support acls */
+     WARNOPT (WARN_XATTR_WRITE,
+ 	     (0, errno,
+-	      _ ("acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
++	      _ ("tar_acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
+ 	      file_name));
+ 
+   acl_free (acl);
+@@ -357,10 +357,10 @@
+   char *val = NULL;
+   acl_t acl;
+ 
+-  if (!(acl = acl_get_file_at (parentfd, file_name, type)))
++  if (!(acl = tar_acl_get_file_at (parentfd, file_name, type)))
+     {
+       if (errno != ENOTSUP)
+-        call_arg_warn ("acl_get_file_at", file_name);
++        call_arg_warn ("tar_acl_get_file_at", file_name);
+       return;
+     }
+ 
diff --git a/pkgs/by-name/gn/gnutar/package.nix b/pkgs/by-name/gn/gnutar/package.nix
index acf5f3233aeb..c7b072b71d10 100644
--- a/pkgs/by-name/gn/gnutar/package.nix
+++ b/pkgs/by-name/gn/gnutar/package.nix
@@ -24,9 +24,17 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-TWL/NzQux67XSFNTI5MMfPlKz3HDWRiCsmp+pQ8+3BY=";
   };
 
-  # GNU tar fails to link libiconv even though the configure script detects it.
-  # https://savannah.gnu.org/bugs/index.php?64441
-  patches = [ ./link-libiconv.patch ];
+  patches = [
+    # GNU tar fails to link libiconv even though the configure script detects it.
+    # https://savannah.gnu.org/bugs/index.php?64441
+    ./link-libiconv.patch
+
+    # acl 2.4.0 adds functions that have name conflicts with internal
+    # (`static`) functions from GNU tar. we prefix `tar_` to these names to
+    # avoid this, matching the approach from
+    # https://lists.gnu.org/archive/html/bug-tar/2026-06/msg00013.html
+    ./acl-2.4.0-name-conflicts.patch
+  ];
 
   # gnutar tries to call into gettext between `fork` and `exec`,
   # which is not safe on darwin.

From 0042d4e701714331a5c714b5675a9b10ae888bbb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 13 Jun 2026 02:05:56 +0200
Subject: [PATCH 0930/1209] rust-cbindgen: 0.29.3 -> 0.29.4

https://github.com/mozilla/cbindgen/blob/v0.29.4/CHANGES
---
 pkgs/by-name/ru/rust-cbindgen/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rust-cbindgen/package.nix b/pkgs/by-name/ru/rust-cbindgen/package.nix
index 88bb855e800b..c6e5427f80c2 100644
--- a/pkgs/by-name/ru/rust-cbindgen/package.nix
+++ b/pkgs/by-name/ru/rust-cbindgen/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-cbindgen";
-  version = "0.29.3";
+  version = "0.29.4";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cbindgen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-d0rY7Sk37s8HEZlQq9Sbjj1P+DgygD0Yjx8cXlFKEIA=";
+    hash = "sha256-leeHOwpzXuzg2cTjXehBnCsS+dvU4eIIFtWKeCee20U=";
   };
 
-  cargoHash = "sha256-UeierkQpfCiB5ES9ZW9hO+0AcI9Ip8qSJ/Nd+I1xrmQ=";
+  cargoHash = "sha256-f6YoDoiVoh0BVPYHFO1FsdI4OCsF+LY72QaD57StdIQ=";
 
   nativeCheckInputs = [
     cmake

From 1cb1099ea97eefaaaa1833b97f964e4c81fde20c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 30 Jun 2026 03:08:30 +0200
Subject: [PATCH 0931/1209] buildMozillaMach: backport cbindgen 0.29.4 compat

Cherry-picked from 153 to remain compatible with cbindgen 0.29.4.
---
 .../153-cbindgen-0.29.4-compat.patch          | 36 +++++++++++++++++++
 .../build-mozilla-mach/default.nix            |  5 +++
 2 files changed, 41 insertions(+)
 create mode 100644 pkgs/build-support/build-mozilla-mach/153-cbindgen-0.29.4-compat.patch

diff --git a/pkgs/build-support/build-mozilla-mach/153-cbindgen-0.29.4-compat.patch b/pkgs/build-support/build-mozilla-mach/153-cbindgen-0.29.4-compat.patch
new file mode 100644
index 000000000000..84238f025fc6
--- /dev/null
+++ b/pkgs/build-support/build-mozilla-mach/153-cbindgen-0.29.4-compat.patch
@@ -0,0 +1,36 @@
+commit c4aab1ba6aadd6985fcd271679d2118f094ec876
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Tue Jun 9 22:04:44 2026 +0000
+
+    Bug 2046162 - Remove some redundant pub qualifiers. r=gfx-reviewers,aosmond
+    
+    The enum is not public so this doesn't change behavior but a patch I'm
+    working on in cbindgen gets a bit confused with this.
+    
+    Differential Revision: https://phabricator.services.mozilla.com/D305678
+
+diff --git a/gfx/wr/webrender/src/texture_cache.rs b/gfx/wr/webrender/src/texture_cache.rs
+index e14c26bd3190..77e1f3a312ac 100644
+--- a/gfx/wr/webrender/src/texture_cache.rs
++++ b/gfx/wr/webrender/src/texture_cache.rs
+@@ -273,9 +273,9 @@ enum BudgetType {
+ }
+ 
+ impl BudgetType {
+-    pub const COUNT: usize = 7;
++    const COUNT: usize = 7;
+ 
+-    pub const VALUES: [BudgetType; BudgetType::COUNT] = [
++    const VALUES: [BudgetType; BudgetType::COUNT] = [
+         BudgetType::SharedColor8Linear,
+         BudgetType::SharedColor8Nearest,
+         BudgetType::SharedColor8Glyphs,
+@@ -285,7 +285,7 @@ impl BudgetType {
+         BudgetType::Standalone,
+     ];
+ 
+-    pub const PRESSURE_COUNTERS: [usize; BudgetType::COUNT] = [
++    const PRESSURE_COUNTERS: [usize; BudgetType::COUNT] = [
+         profiler::ATLAS_COLOR8_LINEAR_PRESSURE,
+         profiler::ATLAS_COLOR8_NEAREST_PRESSURE,
+         profiler::ATLAS_COLOR8_GLYPHS_PRESSURE,
diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index d6fce120abb7..cee18f7439ef 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -341,6 +341,11 @@ buildStdenv.mkDerivation {
       # https://bugzilla.mozilla.org/show_bug.cgi?id=1985509
       ./140-bindgen-string-view.patch
     ]
+    ++ lib.optionals (lib.versionAtLeast version "140" && lib.versionOlder version "140.13") [
+      # https://github.com/mozilla/cbindgen/issues/1165
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=2046162
+      ./153-cbindgen-0.29.4-compat.patch
+    ]
     ++ extraPatches;
 
   postPatch = ''

From c96946219c2f56e976f4b8a413c201d9e637348f Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Mon, 29 Jun 2026 19:57:59 +0200
Subject: [PATCH 0932/1209] astropy-iers-data: 0.2026.1 -> 0.2026.6

---
 pkgs/development/python-modules/astropy-iers-data/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/astropy-iers-data/default.nix b/pkgs/development/python-modules/astropy-iers-data/default.nix
index 59397e348885..e2031f81cffc 100644
--- a/pkgs/development/python-modules/astropy-iers-data/default.nix
+++ b/pkgs/development/python-modules/astropy-iers-data/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "astropy-iers-data";
-  version = "0.2026.1.19.0.42.31";
+  version = "0.2026.6.22.1.23.34";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astropy";
     repo = "astropy-iers-data";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-psxVL7375xQuo6mqh+5rvv0xEuZNUOtFco1BrPPWLtg=";
+    hash = "sha256-q3uW3G3WTHpaRC54tO7ytmSg65SMaOQKO5KbqaSxeq4=";
   };
 
   build-system = [

From 3121bc49c6ac97f29c298a635f544ed89f519ce2 Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Mon, 29 Jun 2026 19:57:59 +0200
Subject: [PATCH 0933/1209] astropy: 7.2.0 -> 8.0.0

---
 pkgs/development/python-modules/astropy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix
index 94376d603d5e..02291cdfef73 100644
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@@ -54,14 +54,14 @@
 
 buildPythonPackage rec {
   pname = "astropy";
-  version = "7.2.0";
+  version = "8.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astropy";
     repo = "astropy";
     tag = "v${version}";
-    hash = "sha256-U9kCzyOZcttlUP0DUGkhJVkk96sBM/Gm/s5ZPJZcEoA=";
+    hash = "sha256-pKptFnbhiE6DfsEZ557ugd6nrbWGg2FmEdhp78z+bUM=";
   };
 
   env = lib.optionalAttrs stdenv.cc.isClang {

From 9a8a028e8c8fd81ae37965ad5ea47282ee951bc9 Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Tue, 30 Jun 2026 03:57:28 +0200
Subject: [PATCH 0934/1209] python3Packages.google-cloud-datacatalog: 3.29.0 ->
 3.31.0

---
 .../python-modules/google-cloud-datacatalog/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
index f5b745956ce1..599dd3073cd2 100644
--- a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-datacatalog";
-  version = "3.29.0";
+  version = "3.31.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
     tag = "google-cloud-datacatalog-v${finalAttrs.version}";
-    hash = "sha256-dVgcnnInqjUjySL7wjxGzI33t1YZJ8e9mSsmjAJ+fBI=";
+    hash = "sha256-M/7uDWWz4YCfxa4gyM9BaAo10iyTMvtR2MhNpdFYnis=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/google-cloud-datacatalog";

From f6cb3d53056342c80498eafc796e16cde77338f4 Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Tue, 30 Jun 2026 03:57:28 +0200
Subject: [PATCH 0935/1209] python3Packages.dask: fix numpy 2.5 update

---
 pkgs/development/python-modules/dask/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index f10b8b100be4..7053d02a0dc6 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   pythonAtLeast,
   util-linux,
 
@@ -54,6 +55,14 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-JfCiABGSCJKKSz2/r8fvpVwdQSZqvoQICe+lDvuNhoM=";
   };
 
+  patches = [
+    # Unit-less timedelta64 is deprecated in NumPy 2.5
+    (fetchpatch {
+      url = "https://github.com/dask/dask/commit/ade7a30c5a222f838b0f69f5a00c804e4cdf3d19.patch";
+      hash = "sha256-V2jNcTfmEXjUzsXKnK2+/AWaujXN+c7JCCGojzwY5dM=";
+    })
+  ];
+
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace dask/tests/test_system.py \
       --replace-fail \

From e27d7aa3b7894be6dc8865ab05d9e0e18d1dd2fd Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Mon, 8 Jun 2026 13:16:22 +1000
Subject: [PATCH 0936/1209] gprbuild-boot: Mark broken on darwin

---
 pkgs/development/ada-modules/gprbuild/boot.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/ada-modules/gprbuild/boot.nix b/pkgs/development/ada-modules/gprbuild/boot.nix
index 0f8227d50d35..f23628f37b7a 100644
--- a/pkgs/development/ada-modules/gprbuild/boot.nix
+++ b/pkgs/development/ada-modules/gprbuild/boot.nix
@@ -110,5 +110,11 @@ stdenv.mkDerivation {
     license = lib.licenses.gpl3Plus;
     maintainers = [ lib.maintainers.sternenseemann ];
     platforms = lib.platforms.all;
+    # gprbuild-boot builds on darwin, but `gprconfig` stack overflows whenever
+    # it runs during the enumeration of available toolchains
+    # This doesn't seem to be a problem with our compiler definition `./nixpkgs-gnat.xml`
+    # as a gprbuild system without that configuration also stack faults.
+    # Maybe a linker issue?
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

From b71417e791dcf9d48a42a3c052fe572a4f420c9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@sap.com>
Date: Mon, 29 Jun 2026 15:18:48 +0200
Subject: [PATCH 0937/1209] isa-l: mark unbroken for aarch64-darwin

Tested with a gzip encoded test file and works without errors.
---
 pkgs/by-name/is/isa-l/package.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/by-name/is/isa-l/package.nix b/pkgs/by-name/is/isa-l/package.nix
index 22bdfce4ef02..ae3af26a13b4 100644
--- a/pkgs/by-name/is/isa-l/package.nix
+++ b/pkgs/by-name/is/isa-l/package.nix
@@ -97,9 +97,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ jbedo ];
     platforms = lib.platforms.all;
     badPlatforms = [
-      # <instantiation>:4:26: error: unexpected token in argument list
-      #  movk x7, p4_low_b1, lsl 16
-      "aarch64-darwin"
       # https://github.com/intel/isa-l/issues/188
       "i686-linux"
     ];

From a74c47e5d1cdbcf8e0a3be7ed83ce567bf497ff1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 30 Jun 2026 08:41:58 +0200
Subject: [PATCH 0938/1209] isa-l: mark unbroken for i686-linux

---
 pkgs/by-name/is/isa-l/package.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/by-name/is/isa-l/package.nix b/pkgs/by-name/is/isa-l/package.nix
index ae3af26a13b4..6aa81650728e 100644
--- a/pkgs/by-name/is/isa-l/package.nix
+++ b/pkgs/by-name/is/isa-l/package.nix
@@ -96,9 +96,5 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/intel/isa-l/releases/tag/v${finalAttrs.version}";
     maintainers = with lib.maintainers; [ jbedo ];
     platforms = lib.platforms.all;
-    badPlatforms = [
-      # https://github.com/intel/isa-l/issues/188
-      "i686-linux"
-    ];
   };
 })

From 8ee90271bed9a9ab63e1b18b6ba32b4a04cbd8db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 30 Jun 2026 08:39:03 +0200
Subject: [PATCH 0939/1209] python314Packages.aiohttp: drop unused inputs

---
 pkgs/development/python-modules/aiohttp/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 9b76c5565090..e6fe548878bc 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  replaceVars,
   isPyPy,
   pythonOlder,
 
@@ -18,7 +17,6 @@
   # dependencies
   aiohappyeyeballs,
   aiosignal,
-  async-timeout,
   attrs,
   backports-zstd,
   frozenlist,

From f1921ed9229bfb199dfda3aa397e3defa3fc0a37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 30 Jun 2026 08:44:48 +0200
Subject: [PATCH 0940/1209] python314Packages.aiohttp: remove now unused isal
 condition

---
 pkgs/development/python-modules/aiohttp/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index e6fe548878bc..15ef808fcecf 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -33,7 +33,6 @@
   blockbuster,
   freezegun,
   gunicorn,
-  isa-l,
   isal,
   proxy-py,
   pytest-codspeed,
@@ -107,8 +106,7 @@ buildPythonPackage rec {
     blockbuster
     freezegun
     gunicorn
-    # broken on aarch64-darwin
-    (if lib.meta.availableOn stdenv.hostPlatform isa-l then isal else null)
+    isal
     proxy-py
     pytest-codspeed
     pytest-cov-stub

From 6ef2f1dbccc03ab26014fcc1dc0bdf2d0746584f Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Tue, 30 Jun 2026 01:20:42 -0600
Subject: [PATCH 0941/1209] libmemcached: fix build on darwin

---
 ...emcached-fix-linking-with-libpthread.patch | 19 -------------------
 pkgs/by-name/li/libmemcached/package.nix      | 10 ++++++++++
 2 files changed, 10 insertions(+), 19 deletions(-)
 delete mode 100644 pkgs/by-name/li/libmemcached/libmemcached-fix-linking-with-libpthread.patch

diff --git a/pkgs/by-name/li/libmemcached/libmemcached-fix-linking-with-libpthread.patch b/pkgs/by-name/li/libmemcached/libmemcached-fix-linking-with-libpthread.patch
deleted file mode 100644
index e5e21c433587..000000000000
--- a/pkgs/by-name/li/libmemcached/libmemcached-fix-linking-with-libpthread.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff -up libmemcached-1.0.16/build-aux/ltmain.sh.orig libmemcached-1.0.16/build-aux/ltmain.sh
---- libmemcached-1.0.16/build-aux/ltmain.sh.orig	2013-12-03 16:36:53.222107642 +0100
-+++ libmemcached-1.0.16/build-aux/ltmain.sh	2013-12-03 16:37:35.770132249 +0100
-@@ -5664,6 +5664,15 @@ func_mode_link ()
- 	    *" $arg "*) ;;
- 	    * ) func_append new_inherited_linker_flags " $arg" ;;
- 	esac
-+	# As we are forced to pass -nostdlib to g++ during linking, the option
-+	# -pthread{,s} is not in effect;  add the -lpthread to $deplist
-+	# explicitly to link correctly.
-+	if test "$tagname" = CXX -a x"$with_gcc" = xyes; then
-+	  case "$arg" in
-+	    -pthread*) func_append deplibs " -lpthread" ;;
-+	  esac
-+	fi
-+
- 	continue
- 	;;
- 
diff --git a/pkgs/by-name/li/libmemcached/package.nix b/pkgs/by-name/li/libmemcached/package.nix
index bb3b5a90e3d2..0da1dfeb7ebf 100644
--- a/pkgs/by-name/li/libmemcached/package.nix
+++ b/pkgs/by-name/li/libmemcached/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   bison,
   cmake,
   flex,
@@ -22,6 +23,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-jEw6L2/139oo4sGprl9Xp0DTarxAK1bEF2ak2kHWSAs=";
   };
 
+  patches = lib.optionals stdenv.hostPlatform.isDarwin [
+    (fetchpatch {
+      name = "libcxx-compat.patch";
+      url = "https://github.com/awesomized/libmemcached/commit/547460c12287a34a5993045157a0e13e14203f92.patch";
+      includes = [ "test/lib/random.cpp" ];
+      hash = "sha256-aH51O4UM3M4yzTtC8bTy+6NKrtPfgqysrvspMZ/gWDc=";
+    })
+  ];
+
   nativeBuildInputs = [
     bison
     cmake

From 91832859b41ba457d5e760f7289b01f7c9621a01 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Tue, 30 Jun 2026 18:10:28 +1000
Subject: [PATCH 0942/1209] python3Packages.roman: fix build with older
 setuptools_80

---
 pkgs/development/python-modules/roman/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/roman/default.nix b/pkgs/development/python-modules/roman/default.nix
index 754a889cc795..fbf8712820e5 100644
--- a/pkgs/development/python-modules/roman/default.nix
+++ b/pkgs/development/python-modules/roman/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
   pytestCheckHook,
 }:
 
@@ -18,7 +18,7 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-ZtwHlS3V18EqDXJxTTwfUdtOvyQg9GbSArV7sOs1b38=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   pythonImportsCheck = [ "roman" ];
 

From 5c62da7ead7f27c60229be52f015007c7f9a5217 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 30 Jun 2026 17:29:36 +0200
Subject: [PATCH 0943/1209] libmemcached: make the patch unconditional

---
 pkgs/by-name/li/libmemcached/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libmemcached/package.nix b/pkgs/by-name/li/libmemcached/package.nix
index 0da1dfeb7ebf..df17fef7a93a 100644
--- a/pkgs/by-name/li/libmemcached/package.nix
+++ b/pkgs/by-name/li/libmemcached/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-jEw6L2/139oo4sGprl9Xp0DTarxAK1bEF2ak2kHWSAs=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [
+  patches = [
     (fetchpatch {
       name = "libcxx-compat.patch";
       url = "https://github.com/awesomized/libmemcached/commit/547460c12287a34a5993045157a0e13e14203f92.patch";

From 08528a7b676164242a4fa6d2958f0ec2a7b29141 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 30 Jun 2026 21:04:54 +0200
Subject: [PATCH 0944/1209] python3Packages.dask: fix patch hash stability

---
 pkgs/development/python-modules/dask/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index 7053d02a0dc6..89c9bcad48f4 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -56,10 +56,11 @@ buildPythonPackage (finalAttrs: {
   };
 
   patches = [
-    # Unit-less timedelta64 is deprecated in NumPy 2.5
     (fetchpatch {
-      url = "https://github.com/dask/dask/commit/ade7a30c5a222f838b0f69f5a00c804e4cdf3d19.patch";
-      hash = "sha256-V2jNcTfmEXjUzsXKnK2+/AWaujXN+c7JCCGojzwY5dM=";
+      # Unit-less timedelta64 is deprecated in NumPy 2.5
+      name = "numpy-2.5-compat.patch";
+      url = "https://github.com/dask/dask/commit/ade7a30c5a222f838b0f69f5a00c804e4cdf3d19.patch?full_index=1";
+      hash = "sha256-4uZOHjWW+S7if47pOw9ydYAei9PsdIVqZYeYfHR93Z0=";
     })
   ];
 

From 4bb77f4c82891ac3a0ba769b714432bf94f9d8d0 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 30 Jun 2026 20:43:55 -0400
Subject: [PATCH 0945/1209] libssh2: patch CVE-2025-15661, CVE-2026-55199, and
 CVE-2026-55200

for vulnerability information, see: https://seclists.org/oss-sec/2026/q2/1010
patches are pulled from debian as upstream fixes don't cleanly apply.
---
 pkgs/by-name/li/libssh2/package.nix | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/pkgs/by-name/li/libssh2/package.nix b/pkgs/by-name/li/libssh2/package.nix
index 71ed533d7a74..1e987379f73c 100644
--- a/pkgs/by-name/li/libssh2/package.nix
+++ b/pkgs/by-name/li/libssh2/package.nix
@@ -26,6 +26,31 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1
     ./CVE-2026-7598.patch
+
+    (fetchurl {
+      name = "CVE-2025-15661.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2025-15661.patch";
+      hash = "sha256-Rz6i/881CbObUDcZbcPlgVPaKizSp6ZRTdmJNJ9HLHE=";
+    })
+
+    (fetchurl {
+      name = "CVE-2026-55199.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2026-55199.patch";
+      hash = "sha256-AFZa5kohha62aE0if5ckmAdJ0TZNcjfP32yDznoEhNo=";
+    })
+
+    (fetchurl {
+      name = "CVE-2026-55200.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2026-55200.patch";
+      hash = "sha256-wCAglr8BsBWIhnh3SiFeyKzZmIp8rC5MVfFgoEzp/hE=";
+    })
+
+    # necessary for the fix for CVE-2026-15661
+    (fetchurl {
+      name = "libssh-unconst-backport.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/libssh-unconst-backport.patch";
+      hash = "sha256-jc01Fb70GbaD9+RYeSjRaLFBtKLiMPTMuXas21aC0Ag=";
+    })
   ];
 
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion

From 2d7df49016885cc472425f7a29b1062ca7eb622b Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Sat, 27 Jun 2026 14:22:12 -0400
Subject: [PATCH 0946/1209] rust: 1.96.0 -> 1.96.1

blog: https://blog.rust-lang.org/releases/1.96.1
changelog: https://github.com/rust-lang/rust/releases/tag/1.96.1
diff: https://github.com/rust-lang/rust/compare/1.96.0...1.96.1
---
 pkgs/development/compilers/rust/1_96.nix | 40 ++++++++++++------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/compilers/rust/1_96.nix b/pkgs/development/compilers/rust/1_96.nix
index 26d58ab8474a..b198c84400b5 100644
--- a/pkgs/development/compilers/rust/1_96.nix
+++ b/pkgs/development/compilers/rust/1_96.nix
@@ -50,8 +50,8 @@ let
 in
 import ./default.nix
   {
-    rustcVersion = "1.96.0";
-    rustcSha256 = "sha256-6QqesVOylIr6yEDb6dd7ZON2cG8oZDh+53F/dFAEO0Q=";
+    rustcVersion = "1.96.1";
+    rustcSha256 = "sha256-0Km1GYxBhoU4rhKvKAZBY1UdBtzOqxHvCxvJqm6Yt6c=";
 
     llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
     llvmSharedForHost = llvmSharedFor pkgsBuildHost;
@@ -65,27 +65,27 @@ import ./default.nix
     # Note: the version MUST be the same version that we are building. Upstream
     # ensures that each released compiler can compile itself:
     # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
-    bootstrapVersion = "1.96.0";
+    bootstrapVersion = "1.96.1";
 
     # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
     bootstrapHashes = {
-      i686-unknown-linux-gnu = "1547d452083642c33118cc7fce1697d702ff94fdb4875bf5448fe5b1a6300bbd";
-      x86_64-unknown-linux-gnu = "c1130e4f7976f230766ab062b105b1fb050d6a78177db2246a5878fd6a589680";
-      x86_64-unknown-linux-musl = "545aff63f37dea2fcbd8037b877219fca6fbba97660bdcb8d3a0fc5df5fa9edf";
-      arm-unknown-linux-gnueabihf = "31758cb4175a0b7d2868d149c711ebfbe7b780a9cba5d2f84dce58ddf5a283e4";
-      armv7-unknown-linux-gnueabihf = "737d8ab2ace6107e4a3af4189b0e18f805adcafcc00195d5a377fe33e36577ce";
-      aarch64-unknown-linux-gnu = "20d5ebe3916fe489891fc577574e47fc679cdf62080c1bb1be6b6905ff4e275b";
-      aarch64-unknown-linux-musl = "f55a1f02736d9bcd38969a30f2e6bde8184fd36f13e94f773cac068a56407f16";
-      x86_64-apple-darwin = "ddaf6a98ccc500891a74bcb95807a04c89a0d1ad7b9c58bd7116620ff6f903a8";
-      aarch64-apple-darwin = "d97daf14c5c346c2d5a3271880d5a06d9885ec9af7e1fd2f072986e338526f8c";
-      powerpc64-unknown-linux-gnu = "e49b9fb0671cadef9e5b81871bcfc1dc2c53d7503de7f2d7fa34b7cacc7f62e6";
-      powerpc64le-unknown-linux-gnu = "0a80537d96ea86e6520687fa03841f2dfde2c7154ae4bf517d9664d4f13b0c31";
-      powerpc64le-unknown-linux-musl = "1deb71349f7ba2af27b9f348429fdae1d7841e6ad6c1bfd5fa9e759922fc79c3";
-      riscv64gc-unknown-linux-gnu = "ffdf86a600890771414ada76c711800114501c390631aa7b9c3cbfb94a2f6db3";
-      s390x-unknown-linux-gnu = "d29755bb2292ca25ec35ae1407379132a5d87cd916247e895162b93cb91dc5ae";
-      loongarch64-unknown-linux-gnu = "3a86d71a43f434234d3ac578ef06a5da86fe5c75ac34e9e43f60fe650577bed2";
-      loongarch64-unknown-linux-musl = "6cf0e53ed4678306de34d0f38b934e6dea1b0de56a4f99b725d56be49e1ba8ee";
-      x86_64-unknown-freebsd = "5457c15df17ff963b582b95c55fae3bc3736468e4df765182c75c19b1b6e8e74";
+      i686-unknown-linux-gnu = "9a3ef03fa419d662fbaf9b152a81db96379781771e6853ca06e31215fb177449";
+      x86_64-unknown-linux-gnu = "b177534946e6e5422d8a75398b39625c08eabad675c08bd3d6565d3ba90c8450";
+      x86_64-unknown-linux-musl = "12404d68457d3344877fbba3fde2c68743cd200fc70475451568e18076cc2a3d";
+      arm-unknown-linux-gnueabihf = "c0c4b52bf5614dfcf6b9e94876f97509c71831fc09b8f0f0e228e13ce896ea92";
+      armv7-unknown-linux-gnueabihf = "59320d46850c750b0a0d3e49939c00c3eed9917fab9a633300fb4d04bd8cfebc";
+      aarch64-unknown-linux-gnu = "212cebf45b0669b2176eb08ffa17c90b07f9de2689d6aae3604d78699fa4f5c2";
+      aarch64-unknown-linux-musl = "9e936f24cfd76db8a45ab352919336978531c0fb4eab7a7bdecc76b9562fcbdb";
+      x86_64-apple-darwin = "c19cc27b3387e2dfe7eb4b5becc75ab5acf348b2a7f2142ad3716d93a0abaa2a";
+      aarch64-apple-darwin = "c080e506af9cba3ca9472c17d989c2d8d5bcfc818eb5e196c77beee982788b50";
+      powerpc64-unknown-linux-gnu = "7133e2e1ccf0eb66c4feeca8a2bbf21ad3223904a3459b3f228ff7c8dfc76871";
+      powerpc64le-unknown-linux-gnu = "4cde26acb968f98fdb2f7f52e7f78b75a24afdea38abed7217e1cd02c6acbe06";
+      powerpc64le-unknown-linux-musl = "d20d271134a11b3ba74c1c54fb926ea09f1c629321dcf53fb5d510f1ac1125a6";
+      riscv64gc-unknown-linux-gnu = "b4c54315491239d2a4816535cea22a57ad1021e2529812ccfc938e64c53da276";
+      s390x-unknown-linux-gnu = "17cb4a74048429dc03be326f976b35500c96290af248ed212071bafb4e366762";
+      loongarch64-unknown-linux-gnu = "7f646ab7f798e7258db25286cbaed4fb54cae90afe44efebc7ff6c6120e4d3d9";
+      loongarch64-unknown-linux-musl = "fd8e5e02e5c4bf879a54a31ebc4c24bbd2feb353a54b4e690e1cd04a97c60354";
+      x86_64-unknown-freebsd = "8f5f247b7195a8925c092949c4eea96a6228d67e643dc10d97b1ed7c17e4c433";
     };
 
     selectRustPackage = pkgs: pkgs.rust_1_96;

From e00f711fb217048d938c5583a59d100b4c1d6b44 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Tue, 30 Jun 2026 22:33:59 +1000
Subject: [PATCH 0947/1209] pango: fix build on darwin

---
 pkgs/by-name/pa/pango/package.nix | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pa/pango/package.nix b/pkgs/by-name/pa/pango/package.nix
index e05febccd593..4122b43b8550 100644
--- a/pkgs/by-name/pa/pango/package.nix
+++ b/pkgs/by-name/pa/pango/package.nix
@@ -25,6 +25,8 @@
   buildPackages,
   gobject-introspection,
   testers,
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -58,6 +60,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withIntrospection [
     gi-docgen
     gobject-introspection
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -83,8 +89,17 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Fontconfig error: Cannot load default config file
-  env.FONTCONFIG_FILE = makeFontsConf {
-    fontDirectories = [ freefont_ttf ];
+  env = {
+    FONTCONFIG_FILE = makeFontsConf {
+      fontDirectories = [ freefont_ttf ];
+    };
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # workaround for ld64 hardening issue
+    #
+    # TODO: Clean up on `staging`
+    CC_LD = "lld";
+    OBJC_LD = "lld";
   };
 
   # Run-time dependency gi-docgen found: NO (tried pkgconfig and cmake)

From 80748a6ce4444826c0fa3deb3c23aab7d88563eb Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Tue, 30 Jun 2026 22:34:13 +1000
Subject: [PATCH 0948/1209] tk: fix build on darwin

---
 pkgs/development/libraries/tk/generic.nix | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix
index 65270be3e345..7088a60468cc 100644
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -9,6 +9,8 @@
   zlib,
   patches ? [ ],
   enableAqua ? stdenv.hostPlatform.isDarwin,
+  # TODO: Clean up on `staging`.
+  llvmPackages,
   ...
 }:
 
@@ -74,6 +76,10 @@ tcl.mkTclDerivation {
   ++ lib.optionals (lib.versionAtLeast tcl.version "9.0") [
     # Only used to detect the presence of zlib. Could be replaced with a stub.
     zip
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
   buildInputs = lib.optionals (lib.versionAtLeast tcl.version "9.0") [
     zlib
@@ -89,9 +95,16 @@ tcl.mkTclDerivation {
 
   inherit tcl;
 
-  env = lib.optionalAttrs (lib.versionOlder tcl.version "8.6") {
-    NIX_CFLAGS_COMPILE = "-std=gnu17";
-  };
+  env =
+    lib.optionalAttrs (lib.versionOlder tcl.version "8.6") {
+      NIX_CFLAGS_COMPILE = "-std=gnu17";
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      # workaround for ld64 hardening issue
+      #
+      # TODO: Clean up on `staging`
+      NIX_CFLAGS_COMPILE = "-fuse-ld=lld";
+    };
 
   passthru = rec {
     inherit (tcl) release version;

From d8fcedbd279b575bf2f46ed29e6d81264b8f4025 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Wed, 1 Jul 2026 12:05:32 +1000
Subject: [PATCH 0949/1209] pango: fix pkg-config test

---
 pkgs/by-name/pa/pango/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/pa/pango/package.nix b/pkgs/by-name/pa/pango/package.nix
index 4122b43b8550..90028c86166a 100644
--- a/pkgs/by-name/pa/pango/package.nix
+++ b/pkgs/by-name/pa/pango/package.nix
@@ -154,6 +154,8 @@ stdenv.mkDerivation (finalAttrs: {
       "pangofc"
       "pangoft2"
       "pangoot"
+    ]
+    ++ lib.optionals x11Support [
       "pangoxft"
     ];
   };

From ff8210b83c8431dcc7a774a62155e516327d324c Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Sat, 2 May 2026 17:29:12 +1000
Subject: [PATCH 0950/1209] gnat-bootstrap15: init at 15.2.0-1

---
 .../compilers/gnat-bootstrap/default.nix      | 53 ++++++++++++-------
 pkgs/top-level/all-packages.nix               | 13 +++--
 2 files changed, 42 insertions(+), 24 deletions(-)

diff --git a/pkgs/development/compilers/gnat-bootstrap/default.nix b/pkgs/development/compilers/gnat-bootstrap/default.nix
index fad7f427fbe6..3a3cecb77620 100644
--- a/pkgs/development/compilers/gnat-bootstrap/default.nix
+++ b/pkgs/development/compilers/gnat-bootstrap/default.nix
@@ -33,23 +33,6 @@ stdenv.mkDerivation (
         url = "https://github.com/alire-project/GNAT-FSF-builds/releases/download/gnat-${finalAttrs.version}/gnat-${stdenv.hostPlatform.system}-${finalAttrs.version}.tar.gz";
       in
       {
-        "12" = {
-          gccVersion = "12.1.0";
-          alireRevision = "2";
-        }
-        // {
-          x86_64-darwin = {
-            inherit url;
-            hash = "sha256-zrcVFvFZMlGUtkG0p1wST6kGInRI64Icdsvkcf25yVs=";
-            upstreamTriplet = "x86_64-apple-darwin19.6.0";
-          };
-          x86_64-linux = {
-            inherit url;
-            hash = "sha256-EPDPOOjWJnJsUM7GGxj20/PXumjfLoMIEFX1EDtvWVY=";
-            upstreamTriplet = "x86_64-pc-linux-gnu";
-          };
-        }
-        .${stdenv.hostPlatform.system} or throwUnsupportedSystem;
         "13" = {
           gccVersion = "13.2.0";
           alireRevision = "2";
@@ -99,6 +82,36 @@ stdenv.mkDerivation (
           };
         }
         .${stdenv.hostPlatform.system} or throwUnsupportedSystem;
+        "15" = {
+          gccVersion = "15.2.0";
+        }
+        // {
+          x86_64-darwin = {
+            alireRevision = "1";
+            inherit url;
+            hash = "sha256-1YTqWsLBwNH/GBAtF5CL/YZHQvfE/3PE0LlLJ9HmjAg=";
+            upstreamTriplet = "x86_64-apple-darwin22.6.0";
+          };
+          x86_64-linux = {
+            alireRevision = "1";
+            inherit url;
+            hash = "sha256-b4hAg3ifoBRqgPxpfMYuOdunw7wzRTL/G5YGBO+im24=";
+            upstreamTriplet = "x86_64-pc-linux-gnu";
+          };
+          aarch64-linux = {
+            alireRevision = "1";
+            inherit url;
+            hash = "sha256-0V/VHqOSYQI6LmvpUIHy3zB6hI3dG0njOcDsrg8oZq8=";
+            upstreamTriplet = "aarch64-linux-gnu";
+          };
+          aarch64-darwin = {
+            alireRevision = "2-pre0";
+            url = "https://github.com/alire-project/GNAT-FSF-builds/releases/download/gnat-15.2.0-2-macos-pre0/gnat-${stdenv.hostPlatform.system}-${finalAttrs.version}.tar.gz";
+            hash = "sha256-4bFtsjixfXYc8wYOc+5iAbp1MmiIS1h1NcdKno2IdJg=";
+            upstreamTriplet = "aarch64-apple-darwin24.6.0";
+          };
+        }
+        .${stdenv.hostPlatform.system} or throwUnsupportedSystem;
       };
     inherit (versionMap.${majorVersion}) gccVersion alireRevision upstreamTriplet;
   in
@@ -146,13 +159,15 @@ stdenv.mkDerivation (
     ++
       lib.optionals
         (
-          lib.versionAtLeast majorVersion "14" && stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux
+          (majorVersion == "14" && stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux)
+          || (lib.versionAtLeast majorVersion "15" && stdenv.hostPlatform.isLinux)
         )
         [
           # not sure why the bootstrap binaries link to zstd only on this architecture but they do
           zstd
         ];
 
+    __structuredAttrs = true;
     strictDeps = true;
 
     # https://github.com/alire-project/GNAT-FSF-builds/issues/51
@@ -245,8 +260,6 @@ stdenv.mkDerivation (
       platforms = [
         "x86_64-linux"
         "x86_64-darwin"
-      ]
-      ++ lib.optionals (lib.versionAtLeast majorVersion "13") [
         "aarch64-darwin"
       ]
       ++ lib.optionals (lib.versionAtLeast majorVersion "14") [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a8f8f3e967a2..ac829ad6ab91 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3535,7 +3535,7 @@ with pkgs;
       # If we are cross-compiling GNAT, we may as well do the same.
       gnat-bootstrap =
         if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
-          buildPackages.gnat-bootstrap14
+          buildPackages.gnat-bootstrap15
         else
           buildPackages.gnat15;
       stdenv =
@@ -3544,7 +3544,7 @@ with pkgs;
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
         then
-          overrideCC gccStdenv gnat-bootstrap14
+          overrideCC gccStdenv gnat-bootstrap15
         else
           stdenv;
     }
@@ -3562,7 +3562,7 @@ with pkgs;
       # If we are cross-compiling GNAT, we may as well do the same.
       gnat-bootstrap =
         if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
-          buildPackages.gnat-bootstrap14
+          buildPackages.gnat-bootstrap15
         else
           buildPackages.gnat16;
       stdenv =
@@ -3571,7 +3571,7 @@ with pkgs;
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
         then
-          overrideCC gccStdenv gnat-bootstrap14
+          overrideCC gccStdenv gnat-bootstrap15
         else
           stdenv;
     }
@@ -3588,6 +3588,11 @@ with pkgs;
     isAlireGNAT = true;
   };
 
+  gnat-bootstrap15 = wrapCCWith {
+    cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "15"; };
+    isAlireGNAT = true;
+  };
+
   gnat13Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat13; });
   gnat14Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat14; });
   gnat15Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat15; });

From b7b9f65c486108453f26e48de473a154558c8a6d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 07:18:55 +0000
Subject: [PATCH 0951/1209] publicsuffix-list: 0-unstable-2026-05-13 ->
 0-unstable-2026-06-24

---
 pkgs/by-name/pu/publicsuffix-list/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index ea3f3d9fa1e4..7dd02eb4f21d 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2026-05-13";
+  version = "0-unstable-2026-06-24";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "e452c7058d6946bd76952b128c12f5ce87a5acb8";
-    hash = "sha256-5D4RZAyJOL4hMU32Rmp3SYmjgqEtF36mZJr4YBG0k7E=";
+    rev = "18ecca5d54471f21918798da451dd8d03a18f3c7";
+    hash = "sha256-xvOAZpWhuOU3koEHgNfVK6aHy+VMYRoHj3fq9PxaAFo=";
   };
 
   dontBuild = true;

From fc2366b122699000d38f11d8b4e6a91f3f1a84e0 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Wed, 1 Jul 2026 20:37:03 +1000
Subject: [PATCH 0952/1209] perlPackages.HTMLForm: 6.11 -> 6.13

---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 152f9b53cfee..dfe9e57f7eb5 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16155,10 +16155,10 @@ with self;
 
   HTMLForm = buildPerlPackage {
     pname = "HTML-Form";
-    version = "6.11";
+    version = "6.13";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SI/SIMBABQUE/HTML-Form-6.11.tar.gz";
-      hash = "sha256-Q7+qcIc5NIfS1RJhoap/b4Gpex2P73pI/PbvMrFtZFQ=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTML-Form-6.13.tar.gz";
+      hash = "sha256-rlrQ9v5wsaOCeJ1eg6m2acxUHunUWeG/qJtDrgwBTN0=";
     };
     buildInputs = [ TestWarnings ];
     propagatedBuildInputs = [

From 00aa7f801d8fa0434429e57a80be040b624b6063 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 1 Jul 2026 13:53:00 +0200
Subject: [PATCH 0953/1209] python3Packages.zeroconf: 0.149.16 -> 0.150.0

---
 pkgs/development/python-modules/zeroconf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index 863e80a87385..bbb6d4164aa2 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "zeroconf";
-  version = "0.149.16";
+  version = "0.150.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jstasiak";
     repo = "python-zeroconf";
     tag = finalAttrs.version;
-    hash = "sha256-l/F+Cz0HEtsgfQj01ayl+FQYoQbZVpMfRhNs27BqThI=";
+    hash = "sha256-Etk8sQZotwmsM6HkArAl2sDZop77wTAcE4aUSIoM1ds=";
   };
 
   build-system = [

From 57b3c44a08d5b7b10bef7dd97a586eade0faa399 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Sun, 28 Jun 2026 21:01:29 +1000
Subject: [PATCH 0954/1209] gnat-bootstrap16: init at 16.1.0-1

---
 .../compilers/gnat-bootstrap/default.nix      | 27 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  9 +++++--
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/gnat-bootstrap/default.nix b/pkgs/development/compilers/gnat-bootstrap/default.nix
index 3a3cecb77620..9a6e728c9fcc 100644
--- a/pkgs/development/compilers/gnat-bootstrap/default.nix
+++ b/pkgs/development/compilers/gnat-bootstrap/default.nix
@@ -112,6 +112,33 @@ stdenv.mkDerivation (
           };
         }
         .${stdenv.hostPlatform.system} or throwUnsupportedSystem;
+        "16" = {
+          gccVersion = "16.1.0";
+          alireRevision = "1";
+        }
+        // {
+          x86_64-darwin = {
+            inherit url;
+            hash = "sha256-u/cYFKqWLTaFADTscDxnrkYSoemKrfKpNIZ8XPlTbLI=";
+            upstreamTriplet = "x86_64-apple-darwin24.6.0";
+          };
+          x86_64-linux = {
+            inherit url;
+            hash = "sha256-5bKYPJnXDGa80BtAogLE82X0zTuYKdN2cKh503oMeic=";
+            upstreamTriplet = "x86_64-pc-linux-gnu";
+          };
+          aarch64-linux = {
+            inherit url;
+            hash = "sha256-jJnqDJGBOjqbT4hDW0nRpV0oA3RXxJhvI7BuvQkPDQI=";
+            upstreamTriplet = "aarch64-linux-gnu";
+          };
+          aarch64-darwin = {
+            inherit url;
+            hash = "sha256-TJlV/Ngq6SwpIgGkwamTN3aRGP2BnEzJyBGovtWb6Y0=";
+            upstreamTriplet = "aarch64-apple-darwin24.6.0";
+          };
+        }
+        .${stdenv.hostPlatform.system} or throwUnsupportedSystem;
       };
     inherit (versionMap.${majorVersion}) gccVersion alireRevision upstreamTriplet;
   in
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ac829ad6ab91..2de22e5837ee 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3562,7 +3562,7 @@ with pkgs;
       # If we are cross-compiling GNAT, we may as well do the same.
       gnat-bootstrap =
         if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
-          buildPackages.gnat-bootstrap15
+          buildPackages.gnat-bootstrap16
         else
           buildPackages.gnat16;
       stdenv =
@@ -3571,7 +3571,7 @@ with pkgs;
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
         then
-          overrideCC gccStdenv gnat-bootstrap15
+          overrideCC gccStdenv gnat-bootstrap16
         else
           stdenv;
     }
@@ -3593,6 +3593,11 @@ with pkgs;
     isAlireGNAT = true;
   };
 
+  gnat-bootstrap16 = wrapCCWith {
+    cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "16"; };
+    isAlireGNAT = true;
+  };
+
   gnat13Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat13; });
   gnat14Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat14; });
   gnat15Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat15; });

From 54c63611750b9e22db783d6c03ca40526f45004c Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Sat, 2 May 2026 18:02:16 +1000
Subject: [PATCH 0955/1209] gnat: 13.4.0 -> 15.2.0

---
 pkgs/top-level/all-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2de22e5837ee..770cca51a28c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3467,7 +3467,7 @@ with pkgs;
     enableLTO = false;
   };
 
-  gnat = gnat13; # When changing this, update also gnatPackages
+  gnat = pkgs."gnat${toString default-gcc-version}"; # When changing this, update also gnatPackages
 
   gnat13 = wrapCC (
     gcc13.cc.override {
@@ -3577,7 +3577,8 @@ with pkgs;
     }
   );
 
-  gnat-bootstrap = gnat-bootstrap13;
+  gnat-bootstrap = pkgs."gnat-bootstrap${toString default-gcc-version}";
+
   gnat-bootstrap13 = wrapCCWith {
     cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "13"; };
     isAlireGNAT = true;
@@ -3602,7 +3603,7 @@ with pkgs;
   gnat14Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat14; });
   gnat15Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat15; });
   gnat16Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat16; });
-  gnatPackages = gnat13Packages;
+  gnatPackages = pkgs."gnat${toString default-gcc-version}Packages";
 
   inherit (gnatPackages)
     gprbuild

From 27f813249bb0dc258b17be085f7a2f5edd8c3622 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Wed, 1 Jul 2026 21:59:23 +1000
Subject: [PATCH 0956/1209] emacs: fix build on darwin

---
 .../applications/editors/emacs/make-emacs.nix | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 0a92e2cb11d9..d33fb2ef12bc 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -116,6 +116,8 @@
 
   # test
   callPackage,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 assert (withGTK3 && !withNS && variant != "macport") -> withX || withPgtk;
@@ -252,7 +254,11 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
   ]
   ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    sigtool
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
+  ];
 
   buildInputs = [
     gnutls
@@ -418,10 +424,15 @@ stdenv.mkDerivation (finalAttrs: {
       NATIVE_FULL_AOT = "1";
       LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
     }
-    // lib.optionalAttrs (variant == "macport") {
-      # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
-      # See https://github.com/NixOS/nixpkgs/issues/127902
-      NIX_CFLAGS_COMPILE = "-isystem ${./macport-noescape-noop}";
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      # workaround for ld64 hardening issue
+      #
+      # TODO: Clean up on `staging`
+      NIX_CFLAGS_COMPILE =
+        "-fuse-ld=lld"
+        # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
+        # See https://github.com/NixOS/nixpkgs/issues/127902
+        + lib.optionalString (variant == "macport") " -isystem ${./macport-noescape-noop}";
     };
 
   enableParallelBuilding = true;

From ade4a26bc1c6ecc3098e9fa80c7c4dc43eaff275 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Wed, 1 Jul 2026 22:00:13 +1000
Subject: [PATCH 0957/1209] vim: fix build on darwin

---
 pkgs/applications/editors/vim/default.nix | 13 +++++++++++++
 pkgs/applications/editors/vim/full.nix    | 12 ++++++++++--
 pkgs/applications/editors/vim/macvim.nix  |  7 ++++++-
 3 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index ec3e7c9a6253..d9abd14e2e51 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -14,6 +14,8 @@
     url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   },
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -37,6 +39,10 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     gettext
     pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
   buildInputs = [
     ncurses
@@ -44,6 +50,13 @@ stdenv.mkDerivation {
     gawk
   ];
 
+  # workaround for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_COMPILE = "-fuse-ld=lld";
+  };
+
   strictDeps = true;
 
   configureFlags = [
diff --git a/pkgs/applications/editors/vim/full.nix b/pkgs/applications/editors/vim/full.nix
index a2a105e3182c..f07960cf950c 100644
--- a/pkgs/applications/editors/vim/full.nix
+++ b/pkgs/applications/editors/vim/full.nix
@@ -48,6 +48,9 @@
   darwinSupport ? config.vim.darwin or false, # Enable Darwin support
   ftNixSupport ? config.vim.ftNix or true, # Add nix indentation support from vim-nix (not needed for basic syntax highlighting)
   sodiumSupport ? config.vim.sodium or true, # Enable sodium based encryption
+
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -169,7 +172,9 @@ stdenv.mkDerivation {
   ++ lib.optional nlsSupport gettext
   ++ lib.optional perlSupport perl
   ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook3
-  ++ lib.optional waylandSupport wayland-scanner;
+  ++ lib.optional waylandSupport wayland-scanner
+  # TODO: Clean up on `staging`
+  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
 
   buildInputs = [
     ncurses
@@ -196,7 +201,10 @@ stdenv.mkDerivation {
   ++ lib.optional sodiumSupport libsodium;
 
   # error: '__declspec' attributes are not enabled; use '-fdeclspec' or '-fms-extensions' to enable support for __declspec attributes
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec";
+  # workaround for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec -fuse-ld=lld";
 
   preConfigure = lib.optionalString ftNixSupport ''
     cp ${vimPlugins.vim-nix.src}/ftplugin/nix.vim runtime/ftplugin/nix.vim
diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix
index 36e22ddc2b0a..9e48750c0b0a 100644
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@@ -17,6 +17,8 @@
   # This can be set to one of the `darwin.xcode_*` packages as well.
   # If set, this should be a path to Xcode.app, e.g. `"/Applications/Xcode.app"`.
   withXcodePath ? null,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 # Try to match MacVim's documented script interface compatibility
@@ -48,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
   ];
   buildInputs = [
     # MacVim references up to MAC_OS_VERSION_14_0 in its source
@@ -188,7 +192,8 @@ stdenv.mkDerivation (finalAttrs: {
   # macvim obj-c log macro triggers -Wformat-security (seems like a bug? it's a string literal!)
   hardeningDisable = common.hardeningDisable ++ [ "format" ];
   # os_log also enables -Werror,-Wformat by default
-  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS";
+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS -fuse-ld=lld";
 
   # We rely on the user's Xcode install to build. It may be located in an arbitrary place, and
   # it's not clear what system-level components it may require, so for now we'll just allow full

From 7487e9cc518250e1c7085640f74fbe08d5d74a90 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Wed, 1 Jul 2026 22:00:25 +1000
Subject: [PATCH 0958/1209] gtk3: fix build on darwin

---
 pkgs/by-name/gt/gtk3/package.nix | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gt/gtk3/package.nix b/pkgs/by-name/gt/gtk3/package.nix
index 3c3ffc066dbb..bd66967f1014 100644
--- a/pkgs/by-name/gt/gtk3/package.nix
+++ b/pkgs/by-name/gt/gtk3/package.nix
@@ -58,6 +58,8 @@
   broadwaySupport ? true,
   wayland-scanner,
   testers,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -142,6 +144,10 @@ stdenv.mkDerivation (finalAttrs: {
       ]
   ++ lib.optionals waylandSupport [
     wayland-scanner
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs =
@@ -213,7 +219,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   # These are the defines that'd you'd get with --enable-debug=minimum (default).
   # See: https://developer.gnome.org/gtk3/stable/gtk-building.html#extra-configuration-options
-  env.NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
+  env = {
+    NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # workaround for ld64 hardening issue
+    #
+    # TODO: Clean up on `staging`
+
+    CC_LD = "lld";
+    OBJC_LD = "lld";
+  };
 
   postPatch = ''
     # See https://github.com/NixOS/nixpkgs/issues/132259

From 2555c86506cb9b298c8ad6e41cc9125d09612abc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 1 Jul 2026 18:31:44 +0200
Subject: [PATCH 0959/1209] libxml2: fix CVE-2026-11979

---
 pkgs/development/libraries/libxml2/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 015688e4474b..2858711b095d 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -54,6 +54,13 @@ let
         tag = "v${packages.libxml2.version}";
         hash = "sha256-fDntZDyITs223by8n7ueOXiO7yyzshtANoWbY0+yeqo=";
       };
+      extraPatches = [
+        (fetchpatch {
+          name = "CVE-2026-11979.patch";
+          url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e.patch";
+          hash = "sha256-s7hnAW7r4fbb95WnFHhUMZbMJzTynV7umKIqc7Kdp/Q=";
+        })
+      ];
       extraMeta = {
         maintainers = with lib.maintainers; [
           jtojnar

From d1e81cb2d58014c4cc2ffd510c797a301c30a595 Mon Sep 17 00:00:00 2001
From: Cathal Mullan <contact@cathal.dev>
Date: Fri, 5 Jun 2026 17:07:09 +0100
Subject: [PATCH 0960/1209] jemalloc: enable heap profiling by default

---
 pkgs/by-name/je/jemalloc/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/je/jemalloc/package.nix b/pkgs/by-name/je/jemalloc/package.nix
index 880e776d2dc0..15d3b903b5f5 100644
--- a/pkgs/by-name/je/jemalloc/package.nix
+++ b/pkgs/by-name/je/jemalloc/package.nix
@@ -60,6 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [
     "--with-version=${finalAttrs.version}-0-g0000000000000000000000000000000000000000"
     "--with-lg-vaddr=${with stdenv.hostPlatform; toString (if isILP32 then 32 else parsed.cpu.bits)}"
+    # Profiling is inert unless enabled at runtime
+    "--enable-prof"
   ]
   # see the comment on stripPrefix
   ++ lib.optional stripPrefix "--with-jemalloc-prefix="

From 9af198a62febc8db3610b434b78fb2f6de552b0d Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Wed, 1 Jul 2026 20:55:49 +0200
Subject: [PATCH 0961/1209] python3Packages.numbagg: unbreak with pandas 3.0

---
 pkgs/development/python-modules/numbagg/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/numbagg/default.nix b/pkgs/development/python-modules/numbagg/default.nix
index 38d47436b392..68187a35dfc1 100644
--- a/pkgs/development/python-modules/numbagg/default.nix
+++ b/pkgs/development/python-modules/numbagg/default.nix
@@ -56,6 +56,12 @@ buildPythonPackage rec {
 
   pytestFlags = [ "--benchmark-disable" ];
 
+  disabledTests = [
+    # Uses outdated pandas API as an oracle
+    "nanargmin"
+    "nanargmax"
+  ];
+
   meta = {
     description = "Fast N-dimensional aggregation functions with Numba";
     homepage = "https://github.com/numbagg/numbagg";

From f71b8a5c7d25f082f96687e56ae1b54723a2437f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 1 Jul 2026 22:05:23 +0200
Subject: [PATCH 0962/1209] python3Packages.pillow: 12.2.0 -> 12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Fixes:
CVE-2026-55798, CVE-2026-54059, CVE-2026-54060, CVE-2026-55379,
CVE-2026-55380
---
 pkgs/development/python-modules/pillow/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index e2c0b2eb75ad..e19a87b695eb 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "pillow";
-  version = "12.2.0";
+  version = "12.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-pillow";
     repo = "pillow";
     tag = version;
-    hash = "sha256-7w6FbZLTAoUMvLtSPvafk3wSRv8TrkAAfgZ/dfu3HpA=";
+    hash = "sha256-kmUlgR+f75Y8DAKKPdEbchLLgg0m95oyVP53WTQni88=";
   };
 
   build-system = [

From 4c551237f8eea52c06127c6ac628c8b138bcf3e2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 20:16:53 +0000
Subject: [PATCH 0963/1209] libsepol: 3.10 -> 3.11

---
 pkgs/by-name/li/libsepol/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libsepol/package.nix b/pkgs/by-name/li/libsepol/package.nix
index 9e06808644cf..cefaad72d6ca 100644
--- a/pkgs/by-name/li/libsepol/package.nix
+++ b/pkgs/by-name/li/libsepol/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsepol";
-  version = "3.10";
+  version = "3.11";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "${finalAttrs.se_url}/${finalAttrs.version}/libsepol-${finalAttrs.version}.tar.gz";
-    hash = "sha256-1VVYZ5f6nzg0RJbSp+wRR7bKrz/MRMQtjVFz7denmnE=";
+    hash = "sha256-efPSyI9Et+tc9U2XkuAyMil+F/l6F5Fj8nUAmaAPFk0=";
   };
 
   nativeBuildInputs = [ flex ];

From a7a6bd99a28765c664f1863db885b36dc64f5547 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Wed, 1 Jul 2026 17:48:40 -0400
Subject: [PATCH 0964/1209] gzip: security fixes

Fixes #536998
---
 .../compression/gzip/CVE-2026-41991.patch     | 52 +++++++++++++++++++
 .../compression/gzip/CVE-2026-41992.patch     | 35 +++++++++++++
 pkgs/tools/compression/gzip/default.nix       |  5 ++
 3 files changed, 92 insertions(+)
 create mode 100644 pkgs/tools/compression/gzip/CVE-2026-41991.patch
 create mode 100644 pkgs/tools/compression/gzip/CVE-2026-41992.patch

diff --git a/pkgs/tools/compression/gzip/CVE-2026-41991.patch b/pkgs/tools/compression/gzip/CVE-2026-41991.patch
new file mode 100644
index 000000000000..657d8553bcd2
--- /dev/null
+++ b/pkgs/tools/compression/gzip/CVE-2026-41991.patch
@@ -0,0 +1,52 @@
+From 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Thu, 16 Apr 2026 12:11:44 -0700
+Subject: gzexe: use -C if lacking mktemp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(Problem reported by Michał Majchrowicz.)
+* gzexe.in: If mktemp is needed but not installed,
+use ‘set -C’ to avoid a race when creating a temporary file.
+* zdiff.in: Use the same pattern here, even though the old
+code was probably OK anyway.
+---
+ gzexe.in | 1 +
+ zdiff.in | 7 +++----
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/gzexe.in b/gzexe.in
+index ea4ef94..f3d46cc 100644
+--- a/gzexe.in
++++ b/gzexe.in
+@@ -127,6 +127,7 @@ for i do
+     tmp=`mktemp "${dir}gzexeXXXXXXXXX"`
+   else
+     tmp=${dir}gzexe$$
++    (umask 77; set -C; > "$tmp")
+   fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || {
+     res=$?
+     printf >&2 '%s\n' "$0: cannot copy $file"
+diff --git a/zdiff.in b/zdiff.in
+index 289e466..53266df 100644
+--- a/zdiff.in
++++ b/zdiff.in
+@@ -156,12 +156,11 @@ case $file2 in
+                           *) TMPDIR=/tmp/;;
+                         esac
+                         if command -v mktemp >/dev/null 2>&1; then
+-                          tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` ||
+-                            exit 2
++                          tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"`
+                         else
+-                          set -C
+                           tmp=${TMPDIR}zdiff$$
+-                        fi
++                          (umask 77; set -C; > "$tmp")
++                        fi &&
+                         'gzip' -cdfq -- "$file2" > "$tmp" || exit 2
+                         gzip_status=$(
+                           exec 4>&1
+-- 
+cgit v1.2.3
diff --git a/pkgs/tools/compression/gzip/CVE-2026-41992.patch b/pkgs/tools/compression/gzip/CVE-2026-41992.patch
new file mode 100644
index 000000000000..f7576a2b7872
--- /dev/null
+++ b/pkgs/tools/compression/gzip/CVE-2026-41992.patch
@@ -0,0 +1,35 @@
+From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Wed, 15 Apr 2026 12:00:17 -0700
+Subject: gzip: don’t mishandle .lzh after .Z
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* unlzh.c (read_c_len): Clear left and right when n == 0.
+---
+ unlzh.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+(limited to 'unlzh.c')
+
+diff --git a/unlzh.c b/unlzh.c
+index 3320196..a6cf109 100644
+--- a/unlzh.c
++++ b/unlzh.c
+@@ -232,6 +232,12 @@ read_c_len ()
+         c = getbits(CBIT);
+         for (i = 0; i < NC; i++) c_len[i] = 0;
+         for (i = 0; i < 4096; i++) c_table[i] = c;
++
++        /* Needed in case LEFT and RIGHT are reused from a previous
++           LZW decompression.  It may be overkill to clear all of both
++           arrays, but nobody has had time to analyze this carefully.  */
++        memzero(left, (2 * NC - 1) * sizeof *left);
++        memzero(right, (2 * NC - 1) * sizeof *left);
+     } else {
+         i = 0;
+         while (i < n) {
+-- 
+cgit v1.3
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 446e5fab0af8..6aafcf6481df 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Aae4gb0iC/32Ffl7hxj4C9/T9q3ThbmT3Pbv0U6MCsY=";
   };
 
+  patches = [
+    ./CVE-2026-41991.patch
+    ./CVE-2026-41992.patch
+  ];
+
   outputs = [
     "out"
     "man"

From 4fadb90a41288f56f0d7856458d5fbdafd743999 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 1 Jul 2026 22:49:52 +0100
Subject: [PATCH 0965/1209] sdl3: 3.4.10 -> 3.4.12

Changes: https://github.com/libsdl-org/SDL/releases/tag/release-3.4.12
---
 pkgs/by-name/sd/sdl3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index f5814d3f91b8..9345096f3fa7 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -70,7 +70,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.4.10";
+  version = "3.4.12";
 
   outputs = [
     "lib"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-6Dph2eLiJUmpQzPWe8EuY5LrWhrFwde2f2dwfgCcWNw=";
+    hash = "sha256-b6l3HgdhqIe9LazJmLivbCJgbKPAS8S54fuB9xvgalI=";
   };
 
   postPatch =

From ee83756eecff7095b88eb706025dd6a8d5208fa7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 00:33:33 +0200
Subject: [PATCH 0966/1209] python3Packages.mediapy: 1.2.5 -> 1.2.7

https://github.com/google/mediapy/releases/tag/v1.2.7
---
 .../python-modules/mediapy/default.nix        | 42 ++++++++++++++-----
 1 file changed, 32 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/mediapy/default.nix b/pkgs/development/python-modules/mediapy/default.nix
index de5dc2ed90eb..1081b0cc331e 100644
--- a/pkgs/development/python-modules/mediapy/default.nix
+++ b/pkgs/development/python-modules/mediapy/default.nix
@@ -1,40 +1,62 @@
 {
   lib,
+  bash,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   flit-core,
   ipython,
   matplotlib,
   numpy,
   pillow,
+  absl-py,
+  ffmpeg-headless,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "mediapy";
-  version = "1.2.5";
+  version = "1.2.7";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-LHpMUXBLJmQnNxkKbl++qCYLAn/enZnGRKZwJVquhg8=";
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "mediapy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+p88Zc7YuN0P4i1AzTQfQqCFo6Uc6hpDKgoDpdJxMaI=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  postPatch = ''
+    substituteInPlace mediapy_test.py \
+      --replace-fail "/bin/bash" "${lib.getExe bash}"
+  '';
 
-  propagatedBuildInputs = [
+  build-system = [ flit-core ];
+
+  dependencies = [
     ipython
     matplotlib
     numpy
     pillow
   ];
 
+  nativeCheckInputs = [
+    absl-py
+    ffmpeg-headless
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # AssertionError: np.float64(148.75258355982479) not less than 51.2
+    "test_video_read_write_10bit"
+  ];
+
   pythonImportsCheck = [ "mediapy" ];
 
   meta = {
     description = "Read/write/show images and videos in an IPython notebook";
     homepage = "https://github.com/google/mediapy";
-    changelog = "https://github.com/google/mediapy/releases/tag/v${version}";
+    changelog = "https://github.com/google/mediapy/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ mcwitt ];
   };
-}
+})

From c516683a6a4fe1baac0a0d6d707fc1441dd79cda Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Jul 2026 00:09:22 +0000
Subject: [PATCH 0967/1209] libjxl: 0.11.2 -> 0.12.0

---
 pkgs/by-name/li/libjxl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libjxl/package.nix b/pkgs/by-name/li/libjxl/package.nix
index ce50b109a961..c09bce6f9488 100644
--- a/pkgs/by-name/li/libjxl/package.nix
+++ b/pkgs/by-name/li/libjxl/package.nix
@@ -31,7 +31,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.11.2";
+  version = "0.12.0";
 
   outputs = [
     "out"
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     owner = "libjxl";
     repo = "libjxl";
     tag = "v${version}";
-    hash = "sha256-L4/BY68ZBCpebQxryR7D1CxrsneYvw8B8EvW2mkF7bA=";
+    hash = "sha256-rJyvJo1ZveE1pvMErK9ilFQA0NXkD2ka93L+1gXeqf8=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };

From a450c2d068f288e3ca1279f889265101ec08790a Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:25:19 +1000
Subject: [PATCH 0968/1209] fltk_1_{3,4}: fix darwin build

---
 pkgs/by-name/fl/fltk_1_3/package.nix | 12 ++++++++++++
 pkgs/by-name/fl/fltk_1_4/package.nix | 12 ++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/pkgs/by-name/fl/fltk_1_3/package.nix b/pkgs/by-name/fl/fltk_1_3/package.nix
index 41762add1ce7..af71afe150d8 100644
--- a/pkgs/by-name/fl/fltk_1_3/package.nix
+++ b/pkgs/by-name/fl/fltk_1_3/package.nix
@@ -35,6 +35,8 @@
   withShared ? true,
 
   nix-update-script,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -68,6 +70,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withDocs [
     doxygen
     graphviz
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs =
@@ -139,6 +145,12 @@ stdenv.mkDerivation (finalAttrs: {
 
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
     (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+  ]
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   preBuild = lib.optionalString (withCairo && withShared && stdenv.hostPlatform.isDarwin) ''
diff --git a/pkgs/by-name/fl/fltk_1_4/package.nix b/pkgs/by-name/fl/fltk_1_4/package.nix
index 57d9b9d87805..f6fe650fafd7 100644
--- a/pkgs/by-name/fl/fltk_1_4/package.nix
+++ b/pkgs/by-name/fl/fltk_1_4/package.nix
@@ -46,6 +46,8 @@
   withExamples ? (stdenv.buildPlatform == stdenv.hostPlatform),
 
   nix-update-script,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 # pango support depends on Xft
@@ -84,6 +86,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withDocs [
     doxygen
     graphviz
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs =
@@ -169,6 +175,12 @@ stdenv.mkDerivation (finalAttrs: {
 
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
     (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+  ]
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   postBuild = lib.optionalString withDocs ''

From adf395eab93e4ad624fce769455bf51e9b96f9e9 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:25:47 +1000
Subject: [PATCH 0969/1209] gtk2: fix darwin build

---
 pkgs/by-name/gt/gtk2/package.nix | 41 ++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/gt/gtk2/package.nix b/pkgs/by-name/gt/gtk2/package.nix
index 3f05469c1afc..369cfbee3695 100644
--- a/pkgs/by-name/gt/gtk2/package.nix
+++ b/pkgs/by-name/gt/gtk2/package.nix
@@ -27,6 +27,8 @@
   gdktarget ? if stdenv.hostPlatform.isDarwin then "quartz" else "x11",
   cupsSupport ? config.gtk2.cups or stdenv.hostPlatform.isLinux,
   xineramaSupport ? stdenv.hostPlatform.isLinux,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -56,13 +58,19 @@ stdenv.mkDerivation (finalAttrs: {
     gtkCleanImmodulesCache
   ];
 
-  nativeBuildInputs = finalAttrs.setupHooks ++ [
-    gdk-pixbuf
-    gettext
-    gobject-introspection
-    perl
-    pkg-config
-  ];
+  nativeBuildInputs =
+    finalAttrs.setupHooks
+    ++ [
+      gdk-pixbuf
+      gettext
+      gobject-introspection
+      perl
+      pkg-config
+    ]
+    # TODO: Clean up on `staging`
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      llvmPackages.lld
+    ];
 
   patches = [
     ./patches/2.0-immodules.cache.patch
@@ -120,12 +128,19 @@ stdenv.mkDerivation (finalAttrs: {
     "ac_cv_path_GDK_PIXBUF_CSOURCE=${buildPackages.gdk-pixbuf.dev}/bin/gdk-pixbuf-csource"
   ];
 
-  env = lib.optionalAttrs stdenv.cc.isGNU {
-    NIX_CFLAGS_COMPILE = toString [
-      "-Wno-error=implicit-int"
-      "-Wno-error=incompatible-pointer-types"
-    ];
-  };
+  env =
+    lib.optionalAttrs stdenv.cc.isGNU {
+      NIX_CFLAGS_COMPILE = toString [
+        "-Wno-error=implicit-int"
+        "-Wno-error=incompatible-pointer-types"
+      ];
+    }
+    # Fix for ld64 hardening issue
+    #
+    # TODO: Clean up on `staging`
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   enableParallelBuilding = true;
 

From f3c69aae506bd64cbc7afff907e09b01af7e744f Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:26:10 +1000
Subject: [PATCH 0970/1209] moltenvk: fix darwin build

---
 pkgs/by-name/mo/moltenvk/package.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/mo/moltenvk/package.nix b/pkgs/by-name/mo/moltenvk/package.nix
index d39bb52b35e9..7c028f16e0f5 100644
--- a/pkgs/by-name/mo/moltenvk/package.nix
+++ b/pkgs/by-name/mo/moltenvk/package.nix
@@ -17,6 +17,8 @@
   # but that’s not really a concern for nixpkgs, so use them by default.
   # See: https://github.com/KhronosGroup/MoltenVK/blob/main/README.md#metal_private_api
   enablePrivateAPIUsage ? true,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,7 +37,11 @@ stdenv.mkDerivation (finalAttrs: {
     vulkan-headers
   ];
 
-  nativeBuildInputs = [ xcbuildHook ];
+  nativeBuildInputs = [
+    xcbuildHook
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
+  ];
 
   outputs = [
     "out"
@@ -114,6 +120,11 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional enablePrivateAPIUsage "-DMVK_USE_METAL_PRIVATE_API=1"
   );
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   env.NIX_LDFLAGS = toString [
     "-lglslang"
     "-lSPIRV"

From 401b87c97d4922866c708247b3d23818dbc308fa Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:26:47 +1000
Subject: [PATCH 0971/1209] swiftPackages.swift-unwrapped: fix darwin build

---
 pkgs/development/compilers/swift/compiler/default.nix | 10 ++++++++++
 pkgs/development/compilers/swift/default.nix          |  3 ++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
index 2f6fa2a9450f..dc15009aac72 100644
--- a/pkgs/development/compilers/swift/compiler/default.nix
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -37,6 +37,8 @@
   DarwinTools,
   apple-sdk_14,
   darwinMinVersionHook,
+  # TODO: Clean up on `staging`
+  lld,
 }:
 
 let
@@ -252,6 +254,8 @@ stdenv.mkDerivation {
     DarwinTools # sw_vers
     fixDarwinDylibNames
     cctools.libtool
+    # TODO: Clean up on `staging`
+    lld
   ];
 
   buildInputs = [
@@ -562,6 +566,12 @@ stdenv.mkDerivation {
     #   Fixed in: https://github.com/apple/swift/commit/84083afef1de5931904d5c815d53856cdb3fb232
     cmakeFlags="
       -GNinja
+      ${
+        # Fix for ld64 hardening issue
+        #
+        # TODO: Clean up on staging
+        lib.optionalString stdenv.hostPlatform.isDarwin "-DCMAKE_LINKER_TYPE=LLD"
+      }
       -DBOOTSTRAPPING_MODE=BOOTSTRAPPING${lib.optionalString stdenv.hostPlatform.isDarwin "-WITH-HOSTLIBS"}
       -DSWIFT_ENABLE_EXPERIMENTAL_DIFFERENTIABLE_PROGRAMMING=ON
       -DSWIFT_ENABLE_EXPERIMENTAL_CONCURRENCY=ON
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index ad4fe81c46cb..8af33b495e9d 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -15,7 +15,8 @@ let
     inherit stdenv;
 
     swift-unwrapped = callPackage ./compiler {
-      inherit (llvmPackages) stdenv;
+      # TODO: Clean up on `staging`
+      inherit (llvmPackages) stdenv lld;
       inherit (darwin) DarwinTools sigtool;
     };
 

From fb7e04210400b472485bbd8f81adf6e8cd592ca6 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:27:51 +1000
Subject: [PATCH 0972/1209] gstreamer: fix build on darwin

---
 .../libraries/gstreamer/base/default.nix           | 14 ++++++++++++++
 .../libraries/gstreamer/core/default.nix           | 14 ++++++++++++++
 .../libraries/gstreamer/good/default.nix           | 13 +++++++++++++
 3 files changed, 41 insertions(+)

diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index a2a478c76ff2..8b779a923226 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -46,6 +46,8 @@
   hotdoc,
   directoryListingUpdater,
   apple-sdk_gstreamer,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -87,6 +89,10 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableWayland [
     wayland-scanner
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -159,6 +165,14 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (!enableCdparanoia) "-Dcdparanoia=disabled"
   ++ lib.optional stdenv.hostPlatform.isDarwin "-Ddrm=disabled";
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    CC_LD = "lld";
+    OBJC_LD = "lld";
+  };
+
   postPatch = ''
     patchShebangs \
       scripts/meson-pkg-config-file-fixup.py \
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index d50923558017..35151386097a 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -33,6 +33,8 @@
   hotdoc,
   directoryListingUpdater,
   apple-sdk_gstreamer,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -84,6 +86,10 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableDocumentation [
     hotdoc
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -117,6 +123,14 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "libdw" (withLibunwind && hasElfutils))
   ];
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    CC_LD = "lld";
+    OBJC_LD = "lld";
+  };
+
   postPatch = ''
     patchShebangs \
       gst/parse/get_flex_version.py \
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 4a689f5d82c7..6d0dd4edbdaf 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -66,6 +66,8 @@
   gst-plugins-good,
   directoryListingUpdater,
   apple-sdk_gstreamer,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -137,6 +139,10 @@ stdenv.mkDerivation (finalAttrs: {
   )
   ++ lib.optionals enableWayland [
     wayland-protocols
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -265,6 +271,13 @@ stdenv.mkDerivation (finalAttrs: {
       # linking error on Darwin
       # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
       "-lncurses";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # Fix for ld64 hardening issue
+    #
+    # TODO: Clean up on `staging`
+    CC_LD = "lld";
+    OBJC_LD = "lld";
   };
 
   # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"

From 17cafcb3652f5a7a36fe5a5c7fb46991cc7af851 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:28:14 +1000
Subject: [PATCH 0973/1209] qt5.qtbase: fix build on darwin

---
 pkgs/development/libraries/qt-5/modules/qtbase.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index c1e05d0a8b62..480bd31a6bc1 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -20,6 +20,8 @@
   which,
   # darwin support
   xcbuild,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 
   dbus,
   fontconfig,
@@ -192,6 +194,8 @@ stdenv.mkDerivation (
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         xcbuild
+        # TODO: Clean up on `staging`
+        llvmPackages.lld
       ];
 
     }
@@ -373,6 +377,12 @@ stdenv.mkDerivation (
         # if dependency paths contain the string "pq", which can occur in the hash.
         # To prevent these failures, we need to override PostgreSQL detection.
         PSQL_LIBS = "-L${libpq}/lib -lpq";
+      }
+      // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+        # Fix for ld64 hardening issue
+        #
+        # TODO: Clean up on `staging`
+        NIX_CFLAGS_LINK = "-fuse-ld=lld";
       };
 
       prefixKey = "-prefix ";

From 3aa4bf236f9cc482420331fdbe805465e37fc564 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:28:29 +1000
Subject: [PATCH 0974/1209] pinentry-mac: fix build

---
 pkgs/tools/security/pinentry/mac.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/tools/security/pinentry/mac.nix b/pkgs/tools/security/pinentry/mac.nix
index 6b354ef48d23..fd9dee1723a7 100644
--- a/pkgs/tools/security/pinentry/mac.nix
+++ b/pkgs/tools/security/pinentry/mac.nix
@@ -10,6 +10,8 @@
   common-updater-scripts,
   writers,
   re-plistbuddy,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation rec {
@@ -47,6 +49,8 @@ stdenv.mkDerivation rec {
     makeBinaryWrapper
     texinfo
     re-plistbuddy
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
   ];
 
   configureFlags = [
@@ -56,6 +60,11 @@ stdenv.mkDerivation rec {
     "--with-libassuan-prefix=${libassuan.dev}"
   ];
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   installPhase = ''
     mkdir -p $out/Applications $out/bin
     mv macosx/pinentry-mac.app $out/Applications

From 30585245b95977313ae04446f15f1447818be62e Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:52:13 +1000
Subject: [PATCH 0975/1209] gtk-mac-integration: Fix build on darwin

---
 pkgs/by-name/gt/gtk-mac-integration/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/gt/gtk-mac-integration/package.nix b/pkgs/by-name/gt/gtk-mac-integration/package.nix
index 19976e462e15..26b30559c991 100644
--- a/pkgs/by-name/gt/gtk-mac-integration/package.nix
+++ b/pkgs/by-name/gt/gtk-mac-integration/package.nix
@@ -9,6 +9,8 @@
   gtk ? gtk3,
   gtk3,
   gobject-introspection,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation rec {
@@ -28,6 +30,8 @@ stdenv.mkDerivation rec {
     pkg-config
     gtk-doc
     gobject-introspection
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
   ];
   buildInputs = [ glib ];
   propagatedBuildInputs = [ gtk ];
@@ -36,6 +40,13 @@ stdenv.mkDerivation rec {
     gtkdocize
   '';
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   meta = {
     description = "Provides integration for GTK applications into the Mac desktop";
     license = lib.licenses.lgpl21;

From 76fd246bc5a079068a954f20aa02fb7dfb666205 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Jul 2026 09:05:29 +0000
Subject: [PATCH 0976/1209] libva-minimal: 2.23.0 -> 2.24.0

---
 pkgs/development/libraries/libva/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index 7e383fa49352..d8b9cb278773 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.23.0";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "libva";
     rev = finalAttrs.version;
-    sha256 = "sha256-ePtzZPzBnkhV0cV3Nw/pgOnKnzDkk7U2Svzo0e1YMbc=";
+    sha256 = "sha256-NDh8XI1JJPegDXO2nH2XKVywp25Su/ytgR1OHI7nvdI=";
   };
 
   outputs = [

From 939244d6dd8024f6ab6bfb59e1ffaddbd8cd9545 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 19 Jun 2026 03:24:57 +0200
Subject: [PATCH 0977/1209] python3Packages.cnf-lint: disable failing tests

Bisected to 252225814ab5f11143a02e8aad9459c2d9f498cd on
staging-next-26.05.

(cherry picked from commit eb643cb18ca43227504637f5c5d6e93234510abb)
---
 pkgs/development/python-modules/cfn-lint/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index db06eac38155..a14902531efa 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -69,6 +69,15 @@ buildPythonPackage rec {
     "test_update_docs"
   ];
 
+  disabledTestPaths = [
+    # unexpected exit code afer nodejs_24 24.16.0 update
+    "test/integration/test_quickstart_templates.py::TestQuickStartTemplates::test_templates"
+    "test/integration/test_quickstart_templates_non_strict.py::TestQuickStartTemplates::test_module_integration"
+    "test/integration/test_quickstart_templates_non_strict.py::TestQuickStartTemplates::test_templates"
+    "test/integration/test_good_templates.py::TestQuickStartTemplates::test_module_integration"
+    "test/integration/test_good_templates.py::TestQuickStartTemplates::test_templates"
+  ];
+
   pythonImportsCheck = [ "cfnlint" ];
 
   meta = {

From 53d960f8d55a922ffa6aee3ef996ca2f199aa902 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 2 Jul 2026 14:17:12 +0300
Subject: [PATCH 0978/1209] paperless-ngx: fix build

This is ultra cursed. Help.
---
 pkgs/by-name/pa/paperless-ngx/package.nix | 28 +++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 641da02e2848..8f6a53ea7034 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -3,10 +3,12 @@
   stdenv,
   fetchFromGitHub,
   fetchPypi,
+  fetchpatch,
   callPackage,
   nixosTests,
   gettext,
-  python3,
+  # tests fail and eventually lock up on 3.14
+  python313,
   ghostscript_headless,
   imagemagickBig,
   jbig2enc,
@@ -40,9 +42,21 @@ let
 
     # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
     ocrmypdf = prev.ocrmypdf_16.override { tesseract = tesseract5; };
+
+    # these are broken on 3.13
+    google-cloud-firestore = null;
+    google-cloud-iam = null;
+    google-cloud-kms = null;
+    google-cloud-monitoring = null;
+    google-cloud-pubsub = null;
+    google-cloud-storage = null;
+
+    # these depend on google-cloud stuff in tests
+    celery = prev.celery.overridePythonAttrs { doCheck = false; };
+    kombu = prev.kombu.overridePythonAttrs { doCheck = false; };
   };
 
-  python = python3.override {
+  python = python313.override {
     self = python;
     packageOverrides = lib.composeManyExtensions [
       defaultPythonPackageOverrides
@@ -83,6 +97,15 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     hash = "sha256-Czh4Knel0IIHsTc3kEnp1153Kv+3721GRCbTYTkeCDg=";
   };
 
+  patches = [
+    # fix tests with latest filelock
+    (fetchpatch {
+      url = "https://github.com/paperless-ngx/paperless-ngx/commit/5e1202a4168fbc8e36f816f36eb16dd7636e9d9c.diff";
+      includes = [ "src/*" ];
+      hash = "sha256-ZDC+T4DyOBBV8SCw8xyeYGua1XOhiP7eoZthnSE/Fkk=";
+    })
+  ];
+
   postPatch = ''
     # pytest-xdist with to many threads makes the tests flaky
     if (( $NIX_BUILD_CORES > 3)); then
@@ -114,6 +137,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     # requested by maintainer
     "imap-tools"
     "ocrmypdf"
+    "filelock"
   ];
 
   dependencies =

From d0a2b56b4fd0927ebf3a4ef599b388f21bbb619b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 1 Jul 2026 23:58:53 +0200
Subject: [PATCH 0979/1209] python314Packages.ipython: disable timing sensitive
 tests

---
 pkgs/development/python-modules/ipython/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 9d9e1d227c5b..208bc638c649 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -85,7 +85,12 @@ buildPythonPackage (finalAttrs: {
     testpath
   ];
 
-  disabledTests = lib.optionals (stdenv.hostPlatform.isDarwin) [
+  disabledTests = [
+    # timing sensitive
+    "test_debug_magic_passes_through_generators"
+    "test_nest_embed"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # FileNotFoundError: [Errno 2] No such file or directory: 'pbpaste'
     "test_clipboard_get"
   ];

From b9d7f2b1a0559d5434ff86984eb617058d4cb71a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Thu, 2 Jul 2026 13:23:24 +0000
Subject: [PATCH 0980/1209] libjxl: Update comments

* 0.12 removed the GIMP plugin as it's now in GIMP, see
  https://github.com/NixOS/nixpkgs/pull/537623#issuecomment-4866205199
* In genreal plugins are now built, so this got outdated by:
  * https://github.com/NixOS/nixpkgs/pull/299988
  * https://github.com/NixOS/nixpkgs/pull/306127
---
 pkgs/by-name/li/libjxl/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/li/libjxl/package.nix b/pkgs/by-name/li/libjxl/package.nix
index c09bce6f9488..169c82036368 100644
--- a/pkgs/by-name/li/libjxl/package.nix
+++ b/pkgs/by-name/li/libjxl/package.nix
@@ -67,7 +67,6 @@ stdenv.mkDerivation rec {
   # that the cmake build can apparently use:
   #     OpenGL/GLUT (for Examples -> comparison with sjpeg)
   #     viewer (see `cmakeFlags`)
-  #     plugins like for GDK and GIMP (see `cmakeFlags`)
 
   # Vendored libraries:
   # `libjxl` currently vendors many libraries as git submodules that they
@@ -125,7 +124,6 @@ stdenv.mkDerivation rec {
   ++ lib.optionals enablePlugins [
     # Enable plugins, such as:
     # * the `gdk-pixbuf` one, which allows applications like `eog` to load jpeg-xl files
-    # * the `gimp` one, which allows GIMP to load jpeg-xl files
     "-DJPEGXL_ENABLE_PLUGINS=ON"
   ]
   ++ lib.optionals stdenv.hostPlatform.isStatic [

From 7bf3333ea395ab2137b40ec16c594356f15d8f62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 2 Jul 2026 17:01:34 +0200
Subject: [PATCH 0981/1209] python314Packages.mitmproxy: relax cryptography

---
 pkgs/development/python-modules/mitmproxy/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 2d4e4f5a95d8..3f5407613d6e 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -56,11 +56,12 @@ buildPythonPackage rec {
     # just keep those
     "typing-extensions"
 
-    "urwid"
     "asgiref"
+    "cryptography"
     "pyparsing"
     "ruamel.yaml"
     "tornado"
+    "urwid"
     "wsproto"
   ];
 

From 777658b080770994750433aba602f28552c215f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 2 Jul 2026 17:05:25 +0200
Subject: [PATCH 0982/1209] python314Packages.oslo-i18n: update ignored tests

---
 pkgs/development/python-modules/oslo-i18n/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/oslo-i18n/default.nix b/pkgs/development/python-modules/oslo-i18n/default.nix
index 3cad5136d858..50fd28dcb0c5 100644
--- a/pkgs/development/python-modules/oslo-i18n/default.nix
+++ b/pkgs/development/python-modules/oslo-i18n/default.nix
@@ -41,8 +41,8 @@ buildPythonPackage rec {
     runHook preCheck
 
     stestr run -e <(echo "
-    # test counts warnings which no longer matches in python 3.11
-    oslo_i18n.tests.test_message.MessageTestCase.test_translate_message_bad_translation
+    # list is not deduped
+    oslo_i18n.tests.test_gettextutils.GettextTest.test_get_available_languages
     ")
 
     runHook postCheck

From 05e5a4e27941717c399a477ffa1d44ac9f412e15 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Thu, 2 Jul 2026 16:15:16 +0100
Subject: [PATCH 0983/1209] ffmpeg: work around `ld64` hardening issue

---
 pkgs/development/libraries/ffmpeg/generic.nix | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 7e7519567883..46a32fec2e7e 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -367,6 +367,9 @@
   libnpp,
   # Testing
   testers,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 /*
@@ -832,7 +835,9 @@ stdenv.mkDerivation (
     # Texinfo version 7.1 introduced breaking changes, which older versions of ffmpeg do not handle.
     ++ optionals (lib.versionAtLeast version "6") [ texinfo ]
     ++ optionals withCudaLLVM [ clang.cc ]
-    ++ optionals withCudaNVCC [ cuda_nvcc ];
+    ++ optionals withCudaNVCC [ cuda_nvcc ]
+    # TODO: Clean up on `staging`.
+    ++ optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
     buildInputs =
       [ ]
@@ -976,12 +981,17 @@ stdenv.mkDerivation (
 
     buildFlags = [ "all" ] ++ optional buildQtFaststart "tools/qt-faststart"; # Build qt-faststart executable
 
-    env = lib.optionalAttrs stdenv.cc.isGNU {
-      NIX_CFLAGS_COMPILE = toString [
-        "-Wno-error=incompatible-pointer-types"
-        "-Wno-error=int-conversion"
-      ];
-    };
+    env =
+      lib.optionalAttrs stdenv.cc.isGNU {
+        NIX_CFLAGS_COMPILE = toString [
+          "-Wno-error=incompatible-pointer-types"
+          "-Wno-error=int-conversion"
+        ];
+      }
+      # TODO: Clean up on `staging`.
+      // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+        NIX_CFLAGS_LINK = "-fuse-ld=lld";
+      };
 
     # tests linking broken with shaderc after https://github.com/NixOS/nixpkgs/pull/477464/changes/5a47b12dfcd1b909ba35778a866394430054319a
     doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform && !withShaderc;

From 1caf0c31ad74a5d2f7b222f0da9cb857b228c68d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 2 Jul 2026 18:37:43 +0200
Subject: [PATCH 0984/1209] python314Packages.cyclopts: disable more timing
 sensitive tests

---
 pkgs/development/python-modules/cyclopts/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/cyclopts/default.nix b/pkgs/development/python-modules/cyclopts/default.nix
index 64fb1c8d18fc..6b634027e6cf 100644
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -84,6 +84,9 @@ buildPythonPackage (finalAttrs: {
     # Building docs
     "build_succeeds"
     # timeouts under heavy concurrency
+    "test_behavior[zsh-root-subcommands]"
+    "test_behavior[zsh-subcommand-prefix]"
+    "test_path_completion_action"
     "test_requires_equals_eq_form_value_completion"
   ];
 

From 984fe3dd058506862bce440677cfaf2e1749e320 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Thu, 2 Jul 2026 17:47:08 +0100
Subject: [PATCH 0985/1209] sdl3: work around `ld64` hardening issue

---
 pkgs/by-name/sd/sdl3/package.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index f5814d3f91b8..aea62e081629 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -61,6 +61,9 @@
   vulkanSupport ? true,
   waylandSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
   x11Support ? !stdenv.hostPlatform.isAndroid && !stdenv.hostPlatform.isWindows,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 assert lib.assertMsg (
@@ -127,7 +130,8 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     validatePkgConfig
   ]
-  ++ lib.optional waylandSupport wayland-scanner;
+  ++ lib.optional waylandSupport wayland-scanner
+  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
 
   buildInputs =
     lib.optionals libusbSupport [
@@ -207,6 +211,10 @@ stdenv.mkDerivation (finalAttrs: {
       && !(stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAndroid)
       && !(x11Support || waylandSupport)
     ))
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   doCheck = true;

From 2edaccc3905ea7c0cf53ba3e2d4883ab8922e3cb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 12:48:05 +0200
Subject: [PATCH 0986/1209] python3Packages.google-cloud-logging: 3.13.0 ->
 3.16.0

https://github.com/googleapis/google-cloud-python/blob/3.16.0/packages/google-cloud-logging/CHANGELOG.md
---
 .../python-modules/google-cloud-logging/default.nix    | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-logging/default.nix b/pkgs/development/python-modules/google-cloud-logging/default.nix
index b422a3dceab8..f4de6a36e21a 100644
--- a/pkgs/development/python-modules/google-cloud-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-logging/default.nix
@@ -23,13 +23,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-logging";
-  version = "3.13.0";
+  version = "3.16.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_logging";
     inherit version;
-    hash = "sha256-Oq4Fc7GhpPWezfRXH054gbWCO9Ep/kaVYcHEmn+opME=";
+    hash = "sha256-CKMHa48PckIZ1vc7KiQu9p1R6LziJhM66+QaJfI/VAA=";
   };
 
   build-system = [ setuptools ];
@@ -77,8 +77,6 @@ buildPythonPackage rec {
     # Tests require credentials
     "tests/system/test_system.py"
     "tests/unit/test__gapic.py"
-    # Exclude performance tests
-    "tests/performance/test_performance.py"
   ];
 
   pythonImportsCheck = [
@@ -88,8 +86,8 @@ buildPythonPackage rec {
 
   meta = {
     description = "Stackdriver Logging API client library";
-    homepage = "https://github.com/googleapis/python-logging";
-    changelog = "https://github.com/googleapis/python-logging/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-logging";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${version}/packages/google-cloud-logging/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };

From 7fb989d71db3a347c90bf9a37221326f6dc481f0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 12:52:20 +0200
Subject: [PATCH 0987/1209] python3Packages.google-cloud-kms: 3.9.0 -> 3.14.0

https://github.com/googleapis/google-cloud-python/blob/google-cloud-kms-v3.14.0/packages/google-cloud-kms/CHANGELOG.md
---
 pkgs/development/python-modules/google-cloud-kms/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-kms/default.nix b/pkgs/development/python-modules/google-cloud-kms/default.nix
index 46d1df626da1..7afa896fad59 100644
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-kms";
-  version = "3.9.0";
+  version = "3.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
     tag = "google-cloud-kms-v${version}";
-    hash = "sha256-JR3fcwCuMZkHyJHnMt4EGvTZZ7MLgQrgxCaTlJZ1zYE=";
+    hash = "sha256-ywRS1BfK6s+gcU8QRem0cSnfZq4BUQ2ABNcgnOa01LI=";
   };
 
   sourceRoot = "${src.name}/packages/google-cloud-kms";

From 05cb19eaaedd570d0abd790d71060a235d743d0a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 12:56:23 +0200
Subject: [PATCH 0988/1209] python3Packages.google-cloud-artifact-registry:
 1.19.0 -> 1.22.0

https://github.com/googleapis/google-cloud-python/blob/google-cloud-artifact-registry-v1.22.0/packages/google-cloud-artifact-registry/CHANGELOG.md
---
 .../python-modules/google-cloud-artifact-registry/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix b/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
index 6ecf3a920149..e10f2d5e3850 100644
--- a/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
+++ b/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-artifact-registry";
-  version = "1.19.0";
+  version = "1.22.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_artifact_registry";
     inherit version;
-    hash = "sha256-QVAy29BzPd9EO4RDKo3kiZqktupkGWDJjd8v6x10mpE=";
+    hash = "sha256-DoFzqXrmld/PAsgyd6D9V04aOb5AnaY0W5Rb6+V3rZQ=";
   };
 
   build-system = [ setuptools ];

From ed1b68c4a769f1944e2c3e57091e3cefa54cbca8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 12:56:26 +0200
Subject: [PATCH 0989/1209] python3Packages.google-cloud-iam: 2.21.0 -> 2.24.0

https://github.com/googleapis/google-cloud-python/blob/google-cloud-iam-v2.24.0/packages/google-cloud-iam/CHANGELOG.md
---
 pkgs/development/python-modules/google-cloud-iam/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-iam/default.nix b/pkgs/development/python-modules/google-cloud-iam/default.nix
index 1f6f48522359..b1108657a84f 100644
--- a/pkgs/development/python-modules/google-cloud-iam/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam";
-  version = "2.21.0";
+  version = "2.24.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
     tag = "google-cloud-iam-v${version}";
-    hash = "sha256-dVgcnnInqjUjySL7wjxGzI33t1YZJ8e9mSsmjAJ+fBI=";
+    hash = "sha256-ywRS1BfK6s+gcU8QRem0cSnfZq4BUQ2ABNcgnOa01LI=";
   };
 
   sourceRoot = "${src.name}/packages/google-cloud-iam";

From 92ea6d7b2fb7af7e3dbc124bd86283543a35e9ea Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 12:58:32 +0200
Subject: [PATCH 0990/1209] python3Packages.google-cloud-asset: 4.2.0 -> 4.4.0

https://github.com/googleapis/google-cloud-python/blob/google-cloud-asset-v4.4.0/packages/google-cloud-asset/CHANGELOG.md
---
 .../development/python-modules/google-cloud-asset/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-asset/default.nix b/pkgs/development/python-modules/google-cloud-asset/default.nix
index f1be9e6ea0b4..9e8c9995c8fb 100644
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-asset";
-  version = "4.2.0";
+  version = "4.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
     tag = "google-cloud-asset-v${finalAttrs.version}";
-    sha256 = "sha256-dVgcnnInqjUjySL7wjxGzI33t1YZJ8e9mSsmjAJ+fBI=";
+    sha256 = "sha256-M/7uDWWz4YCfxa4gyM9BaAo10iyTMvtR2MhNpdFYnis=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/google-cloud-asset";

From ac6bdef3bc3f4d7fdadba68fc535e49e516e3a61 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 12:58:52 +0200
Subject: [PATCH 0991/1209] python3Packages.google-cloud-dlp: 3.34.0 -> 3.38.0

https://github.com/googleapis/google-cloud-python/blob/google-cloud-dlp-v3.38.0/packages/google-cloud-dlp/CHANGELOG.md
---
 pkgs/development/python-modules/google-cloud-dlp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-dlp/default.nix b/pkgs/development/python-modules/google-cloud-dlp/default.nix
index 4d6e46b35c30..cee8ca896753 100644
--- a/pkgs/development/python-modules/google-cloud-dlp/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dlp/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dlp";
-  version = "3.34.0";
+  version = "3.38.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_dlp";
     inherit version;
-    hash = "sha256-bfoxclINWn+ozM5HqWIs3oFfA3tKpvttaZhP1Ze/gAc=";
+    hash = "sha256-BcdlhL62CzBcE9xRMhp9Aebj7DHd8QXxjVDy+DT3toQ=";
   };
 
   build-system = [ setuptools ];

From b6ae6284aead9b02260de6cc3cfda319bb8ad7d4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 13:00:25 +0200
Subject: [PATCH 0992/1209] python3Packages.google-cloud-monitoring: 2.30.0 ->
 2.31.0

https://github.com/googleapis/google-cloud-python/tree/google-cloud-monitoring-v2.31.0/packages/google-cloud-monitoring
---
 .../python-modules/google-cloud-monitoring/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index eaa6fb87b374..ceeb26b8db3f 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-monitoring";
-  version = "2.30.0";
+  version = "2.31.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_monitoring";
     inherit (finalAttrs) version;
-    hash = "sha256-qVMKqaokbEkIEN+nvjLWfoNA0ZEIrMmcvALR7UlPunY=";
+    hash = "sha256-tMnTUoyGQ9TrS51ojLs8WRS8X2mzFP98XhtHvcBzqa4=";
   };
 
   build-system = [ setuptools ];

From fb5c1417424f45885bfb372d9dc8e40fbe1e63c4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 13:04:44 +0200
Subject: [PATCH 0993/1209] python3Packages.google-cloud-firestore: 2.27.0 ->
 2.28.0

https://github.com/googleapis/google-cloud-python/tree/google-cloud-firestore-v2.28.0/packages/google-cloud-firestore/CHANGELOG.md
---
 .../python-modules/google-cloud-firestore/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-firestore/default.nix b/pkgs/development/python-modules/google-cloud-firestore/default.nix
index 072ba065326f..0c81217d1ac3 100644
--- a/pkgs/development/python-modules/google-cloud-firestore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-firestore/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-firestore";
-  version = "2.27.0";
+  version = "2.28.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
     tag = "google-cloud-firestore-v${finalAttrs.version}";
-    hash = "sha256-hdUT4SRPOL+ArpU4RcsNCUCV3UCW3vQgwtHuxJiyZeU=";
+    hash = "sha256-dct5yBerIMNQgVIvOWdO9yTxSrH1JDUen6I7CYHftC0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/google-cloud-firestore";

From dad1724d2627a5c48686793647c59939c48f9519 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 13:05:00 +0200
Subject: [PATCH 0994/1209] python3Packages.google-cloud-pubsub: 2.34.0 ->
 2.39.0

https://github.com/googleapis/python-pubsub/blob/v2.39.0/CHANGELOG.md
---
 .../python-modules/google-cloud-pubsub/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index a2a635cd758a..1ce8e8f571db 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -19,13 +19,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.34.0";
+  version = "2.39.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_pubsub";
     inherit version;
-    hash = "sha256-JfmMO6FqaYcfnruteuzj/mPIr+e6OSqtIJS+cw1UWXY=";
+    hash = "sha256-7tZeJfV/lb8+AtltfuFxaIsjkiRx+fIbWpHtkOEoLA8=";
   };
 
   build-system = [ setuptools ];

From 2e415623174d691cae60c4f74861f7704acd5024 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 13:22:37 +0200
Subject: [PATCH 0995/1209] python3Packages.systemrdl-compiler: fix build

---
 pkgs/development/python-modules/systemrdl-compiler/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/systemrdl-compiler/default.nix b/pkgs/development/python-modules/systemrdl-compiler/default.nix
index 7763a6a78b19..4c655d0df55e 100644
--- a/pkgs/development/python-modules/systemrdl-compiler/default.nix
+++ b/pkgs/development/python-modules/systemrdl-compiler/default.nix
@@ -8,6 +8,7 @@
   markdown,
   setuptools,
   setuptools-scm,
+  typing-extensions,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -32,6 +33,7 @@ buildPythonPackage (finalAttrs: {
     antlr4-python3-runtime
     colorama
     markdown
+    typing-extensions
   ];
 
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };

From c8e7ab2adcfb916a467760d73826a3a30a91d721 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 13:27:05 +0200
Subject: [PATCH 0996/1209] python3Packages.libsass: fix build

---
 pkgs/development/python-modules/libsass/default.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/libsass/default.nix b/pkgs/development/python-modules/libsass/default.nix
index 348014d5fca4..f26c4bcb09be 100644
--- a/pkgs/development/python-modules/libsass/default.nix
+++ b/pkgs/development/python-modules/libsass/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   libsass,
-  six,
+  setuptools_80,
   pytestCheckHook,
   werkzeug,
 }:
@@ -11,7 +11,7 @@
 buildPythonPackage (finalAttrs: {
   pname = "libsass";
   version = "0.23.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sass";
@@ -20,13 +20,11 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-CiSr9/3EDwpDEzu6VcMBAlm3CtKTmGYbZMnMEjyZVxI=";
   };
 
+  build-system = [ setuptools_80 ];
+
   buildInputs = [ libsass ];
 
-  propagatedBuildInputs = [ six ];
-
-  preBuild = ''
-    export SYSTEM_SASS=true;
-  '';
+  env.SYSTEM_SASS = "true";
 
   nativeCheckInputs = [
     pytestCheckHook
@@ -41,6 +39,7 @@ buildPythonPackage (finalAttrs: {
     description = "Python binding for libsass to compile Sass/SCSS";
     mainProgram = "pysassc";
     homepage = "https://sass.github.io/libsass-python/";
+    downloadPage = "https://github.com/sass/libsass-python";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sigmanificient ];
   };

From 9a0c7e00b690ac4f3df97659241ba1666973031c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 13:28:33 +0200
Subject: [PATCH 0997/1209] python3Packages.genshi: fix build

---
 pkgs/development/python-modules/genshi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/genshi/default.nix b/pkgs/development/python-modules/genshi/default.nix
index 1dee12d5bb70..7531c484cc15 100644
--- a/pkgs/development/python-modules/genshi/default.nix
+++ b/pkgs/development/python-modules/genshi/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  setuptools,
+  setuptools_80,
   pytestCheckHook,
 }:
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     hash = "sha256-hbDbETYlMU8PRPP+bvDrJWTWw03S7lZ3tJXRUUK7SXM=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 

From 4e934a8ed38daeed0ab719aa2ac25501a0cf94cb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 13:30:19 +0200
Subject: [PATCH 0998/1209] python3Packages.zconfig: relax setuptools
 constraint

---
 pkgs/development/python-modules/zconfig/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/zconfig/default.nix b/pkgs/development/python-modules/zconfig/default.nix
index bb739b974cca..83db908d50b0 100644
--- a/pkgs/development/python-modules/zconfig/default.nix
+++ b/pkgs/development/python-modules/zconfig/default.nix
@@ -23,6 +23,11 @@ buildPythonPackage rec {
 
   patches = lib.optional stdenv.hostPlatform.isMusl ./remove-setlocale-test.patch;
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools >= 78.1.1,< 81" setuptools
+  '';
+
   build-system = [ setuptools ];
 
   buildInputs = [

From c8febf01a85399f73f3bb5a8f16a80605362a48e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 13:57:31 +0200
Subject: [PATCH 0999/1209] python3Packages.google-cloud-firestore: disable
 failing tests

---
 .../python-modules/google-cloud-firestore/default.nix        | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/google-cloud-firestore/default.nix b/pkgs/development/python-modules/google-cloud-firestore/default.nix
index 0c81217d1ac3..86f06063126e 100644
--- a/pkgs/development/python-modules/google-cloud-firestore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-firestore/default.nix
@@ -71,6 +71,11 @@ buildPythonPackage (finalAttrs: {
     # Test requires credentials
     "tests/system/test_pipeline_acceptance.py"
   ]
+  ++ lib.optionals (pythonOlder "3.14") [
+    # RuntimeError: There is no current event loop in thread 'MainThread'.
+    "tests/unit/v1/test_base_client.py::test_baseclient__emulator_channel"
+    "tests/unit/v1/test_bundle.py::TestAsyncBundle::test_async_query"
+  ]
   ++ lib.optionals (pythonAtLeast "3.14") [
     # RuntimeError: There is no current event loop in thread 'MainThread'
     # due to eliding aiounittest

From edee9eaae8d0c81d6879470d2d14f635c5d33744 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 14:13:11 +0200
Subject: [PATCH 1000/1209] python3Packages.google-cloud-storage: 3.10.1 ->
 3.12.0

https://github.com/googleapis/google-cloud-python/blob/google-cloud-storage-v3.12.0/packages/google-cloud-storage/CHANGELOG.md
---
 .../google-cloud-storage/default.nix          | 24 ++++++++++++++-----
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index 55e252a4f12c..10ca5fc8ec98 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -25,16 +25,18 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "3.10.1";
+  version = "3.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
-    repo = "python-storage";
-    tag = "v${version}";
-    hash = "sha256-pKy1A9RNyRlAn4bXclcdvbfW4kZOP9Z4HqKWwcrDePo=";
+    repo = "google-cloud-python";
+    tag = "google-cloud-storage-v${version}";
+    hash = "sha256-4rmrRvYW9FOpvYY4a+vbDzQRcLXfFHGSCnv7yL6S1FM=";
   };
 
+  sourceRoot = "${src.name}/packages/google-cloud-storage";
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -94,6 +96,16 @@ buildPythonPackage rec {
     "test_update_user_agent_when_default_clientinfo_provided"
     "test_update_user_agent_when_none_clientinfo_provided"
     "test_update_user_agent_with_existing_user_agent"
+    "test_403_permission_cache_fallback"
+    "test_404_on_blob_bucket_deleted"
+    "test_404_on_blob_but_bucket_exists"
+    "test_cache_eviction_on_bucket_404"
+    "test_cache_eviction_on_bucket_delete"
+    "test_cache_stampede_protection"
+    "test_disable_bucket_md_env_flag"
+    "test_lru_bounded_capacity_eviction"
+    "test_sequential_cache_priming"
+    "test_sequential_cache_priming_multi_region"
   ];
 
   disabledTestPaths = [
@@ -117,8 +129,8 @@ buildPythonPackage rec {
 
   meta = {
     description = "Google Cloud Storage API client library";
-    homepage = "https://github.com/googleapis/python-storage";
-    changelog = "https://github.com/googleapis/python-storage/blob/${src.tag}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-storage";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${src.tag}/packages/google-cloud-storage/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ sarahec ];
   };

From e4dcf195a38b04f5db507b3db3a8aeb79695297d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 14:27:04 +0200
Subject: [PATCH 1001/1209] paperless-ngx: remove hacks

---
 pkgs/by-name/pa/paperless-ngx/package.nix | 45 ++++++++---------------
 1 file changed, 15 insertions(+), 30 deletions(-)

diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 8f6a53ea7034..93fb9c165ce2 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -8,7 +8,7 @@
   nixosTests,
   gettext,
   # tests fail and eventually lock up on 3.14
-  python313,
+  python313Packages,
   ghostscript_headless,
   imagemagickBig,
   jbig2enc,
@@ -42,27 +42,12 @@ let
 
     # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
     ocrmypdf = prev.ocrmypdf_16.override { tesseract = tesseract5; };
-
-    # these are broken on 3.13
-    google-cloud-firestore = null;
-    google-cloud-iam = null;
-    google-cloud-kms = null;
-    google-cloud-monitoring = null;
-    google-cloud-pubsub = null;
-    google-cloud-storage = null;
-
-    # these depend on google-cloud stuff in tests
-    celery = prev.celery.overridePythonAttrs { doCheck = false; };
-    kombu = prev.kombu.overridePythonAttrs { doCheck = false; };
   };
 
-  python = python313.override {
-    self = python;
-    packageOverrides = lib.composeManyExtensions [
-      defaultPythonPackageOverrides
-      extraPythonPackageOverrides
-    ];
-  };
+  pythonPackages = python313Packages.overrideScope (
+    final: prev:
+    lib.composeManyExtensions [ defaultPythonPackageOverrides extraPythonPackageOverrides ] final prev
+  );
 
   path = lib.makeBinPath [
     ghostscript_headless
@@ -84,7 +69,7 @@ let
     ];
   };
 in
-python.pkgs.buildPythonApplication (finalAttrs: {
+pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "paperless-ngx";
   pyproject = true;
 
@@ -116,7 +101,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
       --replace-fail '--maxprocesses=16' "--numprocesses=$NIX_BUILD_CORES"
   '';
 
-  build-system = [ python.pkgs.setuptools ];
+  build-system = [ pythonPackages.setuptools ];
 
   nativeBuildInputs = [
     gettext
@@ -141,7 +126,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   dependencies =
-    with python.pkgs;
+    with pythonPackages;
     [
       babel
       bleach
@@ -207,18 +192,18 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   postBuild = ''
     # Compile manually because `pythonRecompileBytecodeHook` only works
     # for files in `python.sitePackages`
-    ${python.pythonOnBuildForHost.interpreter} -OO -m compileall src
+    ${pythonPackages.python.pythonOnBuildForHost.interpreter} -OO -m compileall src
 
     # Collect static files
-    ${python.pythonOnBuildForHost.interpreter} src/manage.py collectstatic --clear --no-input
+    ${pythonPackages.python.pythonOnBuildForHost.interpreter} src/manage.py collectstatic --clear --no-input
 
     # Compile string translations using gettext
-    ${python.pythonOnBuildForHost.interpreter} src/manage.py compilemessages
+    ${pythonPackages.python.pythonOnBuildForHost.interpreter} src/manage.py compilemessages
   '';
 
   installPhase =
     let
-      pythonPath = python.pkgs.makePythonPath finalAttrs.passthru.dependencies;
+      pythonPath = pythonPackages.makePythonPath finalAttrs.passthru.dependencies;
     in
     ''
       runHook preInstall
@@ -230,7 +215,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
       makeWrapper $out/lib/paperless-ngx/src/manage.py $out/bin/paperless-ngx \
         --prefix PYTHONPATH : "${pythonPath}" \
         --prefix PATH : "${path}"
-      makeWrapper ${lib.getExe python.pkgs.celery} $out/bin/celery \
+      makeWrapper ${lib.getExe pythonPackages.celery} $out/bin/celery \
         --prefix PYTHONPATH : "${pythonPath}:$out/lib/paperless-ngx/src" \
         --prefix PATH : "${path}"
 
@@ -242,7 +227,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     find $out/lib/paperless-ngx -type d -name tests -exec rm -rv {} +
   '';
 
-  nativeCheckInputs = with python.pkgs; [
+  nativeCheckInputs = with pythonPackages; [
     daphne
     factory-boy
     imagehash
@@ -310,9 +295,9 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     inherit
       nltkDataDir
       path
-      python
       tesseract5
       ;
+    inherit (pythonPackages) python;
     tests = { inherit (nixosTests) paperless; };
     updateScript = nix-update-script {
       extraArgs = [

From 77685124ff47a2facca05182641b59a9acf4dd3f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 16:54:34 +0200
Subject: [PATCH 1002/1209] python3Packages.mistralai: disable failing test

And enable async tests.
---
 pkgs/development/python-modules/mistralai/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/mistralai/default.nix b/pkgs/development/python-modules/mistralai/default.nix
index 7fc33720d0a2..ab19f5aa4b11 100644
--- a/pkgs/development/python-modules/mistralai/default.nix
+++ b/pkgs/development/python-modules/mistralai/default.nix
@@ -25,6 +25,7 @@
 
   # tests
   opentelemetry-sdk,
+  pytest-asyncio,
   pytestCheckHook,
 }:
 
@@ -79,6 +80,7 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     opentelemetry-sdk
+    pytest-asyncio
     pytestCheckHook
   ]
   ++ finalAttrs.passthru.optional-dependencies.agents
@@ -87,6 +89,8 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # AssertionError: <Response [200 OK]> is not an instance of <class 'mistralai.extra.observability.otel.TracedResponse'>
     "TestOtelTracing"
+    # '062f2cad7f1fee8c3e409b73d431e71b' not found in '00-e5d29cde482d5d796428c10d13e86060-468fe44f7efdb086-01'
+    "test_propagates_sampled_active_span"
   ];
 
   meta = {

From 9644c6368542783de2df5d0bb4d239ec849732d0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 17:02:29 +0200
Subject: [PATCH 1003/1209] python3Packages.phply: pin setuptools 80 for
 pkg_resources

---
 pkgs/development/python-modules/phply/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/phply/default.nix b/pkgs/development/python-modules/phply/default.nix
index 392c5e264a33..087da4f1a8d2 100644
--- a/pkgs/development/python-modules/phply/default.nix
+++ b/pkgs/development/python-modules/phply/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  setuptools,
+  setuptools_80,
   ply,
   pytestCheckHook,
 }:
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     hash = "sha256-Cyd3TShfUHo0RYBaBfj7KZj1bXCScPeLiSCLZbDYSRc=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [ ply ];
 

From dc36382bc151e00efff13e73d71ec067bc095003 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 17:11:22 +0200
Subject: [PATCH 1004/1209] python3Packages.django-compressor: remove calmjs
 from tests

The calmjs library is very stuck on pkg_resources, which has been removed
in setuptools 82. Older versions cannot be propagated in the python
package set.
---
 pkgs/development/python-modules/django-compressor/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-compressor/default.nix b/pkgs/development/python-modules/django-compressor/default.nix
index eedf03e28863..6e1686fe0b8b 100644
--- a/pkgs/development/python-modules/django-compressor/default.nix
+++ b/pkgs/development/python-modules/django-compressor/default.nix
@@ -15,7 +15,6 @@
   # tests
   beautifulsoup4,
   brotli,
-  calmjs,
   csscompressor,
   django-sekizai,
   jinja2,
@@ -52,7 +51,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     beautifulsoup4
     brotli
-    calmjs
     csscompressor
     django-sekizai
     jinja2
@@ -68,6 +66,8 @@ buildPythonPackage rec {
   disabledTests = [
     # we set mtime to 1980-01-02
     "test_css_mtimes"
+    # calmjs removed from test deps, because it requires pkg_resources at runtime
+    "test_calmjs_filter"
   ];
 
   pythonImportsCheck = [ "compressor" ];

From 8dd46a9af8e054f0cc279ed38e445392557acc4d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 17:32:34 +0200
Subject: [PATCH 1005/1209] python3Packages.chardet_5: init at 5.2.0

Required for Pretix, because otherwise tests have weird ass failures.
---
 pkgs/development/python-modules/chardet/5.nix | 44 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/development/python-modules/chardet/5.nix

diff --git a/pkgs/development/python-modules/chardet/5.nix b/pkgs/development/python-modules/chardet/5.nix
new file mode 100644
index 000000000000..50959e4753fd
--- /dev/null
+++ b/pkgs/development/python-modules/chardet/5.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  hypothesis,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "chardet";
+  version = "5.2.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-Gztv9HmoxBS8P6LAhSmVaVxKAm3NbQYzst0JLKOcHPc=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    hypothesis
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # flaky; https://github.com/chardet/chardet/issues/256
+    "test_detect_all_and_detect_one_should_agree"
+  ];
+
+  pythonImportsCheck = [ "chardet" ];
+
+  meta = {
+    changelog = "https://github.com/chardet/chardet/releases/tag/${finalAttrs.version}";
+    description = "Universal encoding detector";
+    mainProgram = "chardetect";
+    homepage = "https://github.com/chardet/chardet";
+    license = lib.licenses.lgpl21Plus;
+    maintainers = [ ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 623c83d48724..0f47434af46d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2785,6 +2785,8 @@ self: super: with self; {
 
   chardet = callPackage ../development/python-modules/chardet { };
 
+  chardet_5 = callPackage ../development/python-modules/chardet/5.nix { };
+
   charset-normalizer = callPackage ../development/python-modules/charset-normalizer { };
 
   chat-downloader = callPackage ../development/python-modules/chat-downloader { };

From 739c6e8f6327fb4607d8fd2a94c2d5eb8b53d5ee Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 17:33:20 +0200
Subject: [PATCH 1006/1209] pretix: pin chardet 5.x

---
 pkgs/by-name/pr/pretix/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 22f3855b68e9..b16dc8903405 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -17,6 +17,7 @@ let
   python = python3.override {
     self = python;
     packageOverrides = self: super: {
+      chardet = super.chardet_5;
       django = super.django_5;
 
       django-oauth-toolkit = super.django-oauth-toolkit.overridePythonAttrs (oldAttrs: rec {

From 70da982844f2aca5b6f197e87313d6a3369c1ea9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 17:51:03 +0200
Subject: [PATCH 1007/1209] python3Packages.influxdb: disable failing tests

---
 .../python-modules/influxdb/default.nix           | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/development/python-modules/influxdb/default.nix b/pkgs/development/python-modules/influxdb/default.nix
index d6785f77f8a9..71c865ed28e0 100644
--- a/pkgs/development/python-modules/influxdb/default.nix
+++ b/pkgs/development/python-modules/influxdb/default.nix
@@ -79,6 +79,21 @@ buildPythonPackage rec {
     "test_write_points_from_dataframe_with_tag_escaped"
     # AssertionError: 2 != 1 : <class 'influxdb.tests.helper_test.TestSeriesHelper.testWarnBulkSizeNoEffect.<locals>.WarnBulkSizeNoEffect'> call should have generated one warning.
     "testWarnBulkSizeNoEffect"
+    # Timestamp precision 10^9 vs 10^12
+    "test_dataframe_write_points_with_whitespace_in_column_names"
+    "test_dataframe_write_points_with_whitespace_measurement"
+    "test_write_points_from_dataframe"
+    "test_write_points_from_dataframe_with_leading_none_column"
+    "test_write_points_from_dataframe_with_line_of_none"
+    "test_write_points_from_dataframe_with_nan_line"
+    "test_write_points_from_dataframe_with_none"
+    "test_write_points_from_dataframe_with_numeric_column_names"
+    "test_write_points_from_dataframe_with_period_index"
+    "test_write_points_from_dataframe_with_tag_cols_and_defaults"
+    "test_write_points_from_dataframe_with_tag_cols_and_global_tags"
+    "test_write_points_from_dataframe_with_tag_columns"
+    "test_write_points_from_dataframe_with_tags_and_nan_line"
+    "test_write_points_from_dataframe_with_time_precision"
   ];
 
   pythonImportsCheck = [ "influxdb" ];

From 343f8dbe89021d89e8b28519394629c2d82f2d34 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 18:01:27 +0200
Subject: [PATCH 1008/1209] python3Packages.encutils: fix chardet6 compat

Chardet can return None, don't return it and fallback instead.
---
 .../encutils/chardet6-compat.patch            | 79 +++++++++++++++++++
 .../python-modules/encutils/default.nix       |  3 +
 2 files changed, 82 insertions(+)
 create mode 100644 pkgs/development/python-modules/encutils/chardet6-compat.patch

diff --git a/pkgs/development/python-modules/encutils/chardet6-compat.patch b/pkgs/development/python-modules/encutils/chardet6-compat.patch
new file mode 100644
index 000000000000..11730056e5c9
--- /dev/null
+++ b/pkgs/development/python-modules/encutils/chardet6-compat.patch
@@ -0,0 +1,79 @@
+diff --git a/encutils/__init__.py b/encutils/__init__.py
+index 02922be..8a85574 100644
+--- a/encutils/__init__.py
++++ b/encutils/__init__.py
+@@ -442,7 +442,7 @@ def tryEncodings(text, log=None):  # noqa: C901
+ 
+         encoding = chardet.detect(text)["encoding"]
+ 
+-    except ImportError:
++    except (ImportError, AttributeError):
+         msg = 'Using simplified encoding detection, you might want to install chardet.'
+         if log:
+             log.warn(msg)
+encutils-1.0.0 on  main [!] is 📦 v1.0.0 via 🐍 v3.13.13 
+❯ hx encutils/__init__.py
+encutils-1.0.0 on  main [!] is 📦 v1.0.0 via 🐍 v3.13.13 took 59s 
+❯ git diff
+diff --git a/encutils/__init__.py b/encutils/__init__.py
+index 02922be..100e06e 100644
+--- a/encutils/__init__.py
++++ b/encutils/__init__.py
+@@ -441,6 +441,8 @@ def tryEncodings(text, log=None):  # noqa: C901
+         import chardet
+ 
+         encoding = chardet.detect(text)["encoding"]
++        if encoding is not None:
++            return encoding
+ 
+     except ImportError:
+         msg = 'Using simplified encoding detection, you might want to install chardet.'
+@@ -449,27 +451,27 @@ def tryEncodings(text, log=None):  # noqa: C901
+         else:
+             print(msg)
+ 
+-        encodings = (
+-            'ascii',
+-            'iso-8859-1',
+-            # 'windows-1252', # test later
+-            'utf-8',
+-        )
+-        encoding = None
+-        for e in encodings:
+-            try:
+-                text.decode(e)
+-            except UnicodeDecodeError:
+-                pass
+-            else:
+-                if 'iso-8859-1' == e:
+-                    try:
+-                        if '€' in text.decode('windows-1252'):
+-                            return 'windows-1252'
+-                    except UnicodeDecodeError:
+-                        pass
+-
+-                return e
++    encodings = (
++        'ascii',
++        'iso-8859-1',
++        # 'windows-1252', # test later
++        'utf-8',
++    )
++    encoding = None
++    for e in encodings:
++        try:
++            text.decode(e)
++        except UnicodeDecodeError:
++            pass
++        else:
++            if 'iso-8859-1' == e:
++                try:
++                    if '€' in text.decode('windows-1252'):
++                        return 'windows-1252'
++                except UnicodeDecodeError:
++                    pass
++
++            return e
+ 
+     return encoding
+ 
diff --git a/pkgs/development/python-modules/encutils/default.nix b/pkgs/development/python-modules/encutils/default.nix
index 37f91db5a007..84b77e0f840e 100644
--- a/pkgs/development/python-modules/encutils/default.nix
+++ b/pkgs/development/python-modules/encutils/default.nix
@@ -18,6 +18,9 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-OOylrxjOur2L5DwX8UydP7uoPMX3rI46schuJMSyuRo=";
   };
 
+  # expect chardet.detect to return None
+  patches = [ ./chardet6-compat.patch ];
+
   build-system = [ flit-core ];
 
   dependencies = [

From 7b84adab8225effbf6f3bd98abe401ac9fedd809 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 18:04:16 +0200
Subject: [PATCH 1009/1209] python3Packages.db-dtypes: ignore numpy
 deprecations

---
 pkgs/development/python-modules/db-dtypes/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index c2bb9a49595a..4393f725aafe 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -45,6 +45,10 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  pytestFlags = [
+    "-Wignore::DeprecationWarning"
+  ];
+
   pythonImportsCheck = [ "db_dtypes" ];
 
   meta = {

From 4b68410d1381a465c94b8a9de4285cc5d7a7d9e4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 18:21:02 +0200
Subject: [PATCH 1010/1209] python3Packages.narwhals: 2.16.0 -> 2.23.0

https://github.com/narwhals-dev/narwhals/releases/tag/v2.23.0
---
 .../python-modules/narwhals/default.nix       | 33 +++++--------------
 1 file changed, 8 insertions(+), 25 deletions(-)

diff --git a/pkgs/development/python-modules/narwhals/default.nix b/pkgs/development/python-modules/narwhals/default.nix
index c37327e9ea01..7e2aa326772b 100644
--- a/pkgs/development/python-modules/narwhals/default.nix
+++ b/pkgs/development/python-modules/narwhals/default.nix
@@ -5,8 +5,7 @@
   dask,
   duckdb,
   fetchFromGitHub,
-  fetchpatch2,
-  hatchling,
+  uv-build,
   hypothesis,
   ibis-framework,
   packaging,
@@ -24,37 +23,17 @@
 
 buildPythonPackage rec {
   pname = "narwhals";
-  version = "2.16.0";
+  version = "2.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "narwhals-dev";
     repo = "narwhals";
     tag = "v${version}";
-    hash = "sha256-k7CeM8Q4JgKbkLisAaVrljro4diOf0K0immek6AI0vM=";
+    hash = "sha256-fT3v7T2S7cmv0tX60kjRBrUq+89TG2/Ar9Qh9O4LP8U=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "fix-dask-deprecationwarning.patch";
-      url = "https://github.com/narwhals-dev/narwhals/commit/254655af21872e8127f7fee9a9afbfb279f1eda2.patch?full_index=1";
-      # Exclude unrelated change to non-test code.
-      includes = [ "pyproject.toml" ];
-      hash = "sha256-tgz0b08P36CENOYFBILbicHhdB4BytXgFQk3nIxpw0A=";
-    })
-    (fetchpatch2 {
-      name = "fix-dask-deprecationwarning.patch";
-      url = "https://github.com/narwhals-dev/narwhals/commit/b92d5a840e08bdf7806947ffde27de856900c5ab.patch?full_index=1";
-      hash = "sha256-2lct6/MfViKnRjpEehNKqF6zdZVIkXi7tYxycDh/Hn8=";
-    })
-    (fetchpatch2 {
-      name = "ignore-polars-deprecation-warning-in-tests.patch";
-      url = "https://github.com/narwhals-dev/narwhals/commit/fb798716eb5f8835096d8f88d422baae2b22b3ce.patch?full_index=1";
-      hash = "sha256-pWi0y4S48aADJ1MA3kB9FsLuoA+HfZp5+AgEn69pUuA=";
-    })
-  ];
-
-  build-system = [ hatchling ];
+  build-system = [ uv-build ];
 
   optional-dependencies = {
     # cudf = [ cudf ];
@@ -108,6 +87,10 @@ buildPythonPackage rec {
     "test_first_expr_broadcasting"
     # sqlframe improvements cause strict XPASS failures (tests expected to fail now pass)
     "test_unique_expr"
+    # sqlframe issues
+    "test_over_quantile"
+    "test_quantile_expr"
+    "test_join_duplicate_column_names"
   ];
 
   disabledTestPaths = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [

From 19d71d6403167a33330f4b5f66993d7f48a2d81a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 19:46:57 +0200
Subject: [PATCH 1011/1209] python3Packages.sigstore: relax rich constraint

---
 pkgs/development/python-modules/sigstore/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/sigstore/default.nix b/pkgs/development/python-modules/sigstore/default.nix
index 6cc24de623ba..365356b0dd8e 100644
--- a/pkgs/development/python-modules/sigstore/default.nix
+++ b/pkgs/development/python-modules/sigstore/default.nix
@@ -52,6 +52,7 @@ buildPythonPackage (finalAttrs: {
 
   pythonRelaxDeps = [
     "cryptography"
+    "rich"
     "sigstore-models"
   ];
 

From 6d36abafd2de9a08fe99346c30cdf85d4dbcdc40 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 19:51:25 +0200
Subject: [PATCH 1012/1209] python3Packages.anyio: 4.14.0 -> 4.14.1

https://github.com/agronholm/anyio/blob/4.14.1/docs/versionhistory.rst
---
 pkgs/development/python-modules/anyio/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 2337ee8f6c8b..2aa45bf41a62 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "4.14.0";
+  version = "4.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "agronholm";
     repo = "anyio";
     tag = version;
-    hash = "sha256-g+2d/j3ke+RjwIYq0JyFfYxg80QXrura9Dsx7cQyMIQ=";
+    hash = "sha256-LPNRNb1RuSVQqsI6aAAiYWC2c2CZAhFS67XW9OfbIiE=";
   };
 
   build-system = [ setuptools-scm ];
@@ -91,6 +91,7 @@ buildPythonPackage rec {
     "test_nonexistent_main_module"
     #  3 second timeout expired
     "test_keyboardinterrupt_during_test"
+    "test_dynamic_async_fixture_access_does_not_hang"
     # racy with high thread count, see https://github.com/NixOS/nixpkgs/issues/448125
     "test_multiple_threads"
 

From 0a1b373a6762ee98990ee250af47e7421ef7e3bf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 20:01:58 +0200
Subject: [PATCH 1013/1209] python3Packages.fastapi: don't test tutorials

Very racy.
---
 pkgs/development/python-modules/fastapi/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 886b6ecccd7c..e7c8a426fae7 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -126,7 +126,7 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # Don't test docs and examples
     "docs_src"
-    "tests/test_tutorial/test_sql_databases"
+    "tests/test_tutorial"
     # Infinite recursion with strawberry-graphql
     "tests/test_tutorial/test_graphql/test_tutorial001.py"
   ];

From 76b00caca524056f55c90646e6e4c03febd28a7c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 21:01:32 +0200
Subject: [PATCH 1014/1209] python3Packages.textual-fastdatatables: relax
 pandas constraint

---
 .../development/python-modules/textual-fastdatatable/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/textual-fastdatatable/default.nix b/pkgs/development/python-modules/textual-fastdatatable/default.nix
index d97f7d3730f4..691f3031cfb6 100644
--- a/pkgs/development/python-modules/textual-fastdatatable/default.nix
+++ b/pkgs/development/python-modules/textual-fastdatatable/default.nix
@@ -50,6 +50,7 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "numpy"
+    "pandas"
     "pyarrow"
   ];
 

From 4a9e1937cc174d1ae62a77325ab20abcd9d845db Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 21:01:52 +0200
Subject: [PATCH 1015/1209] python3Packages.fastmcp: disable failing tests

---
 pkgs/development/python-modules/fastmcp/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/fastmcp/default.nix b/pkgs/development/python-modules/fastmcp/default.nix
index 3879e40bb830..43f7c474f2dc 100644
--- a/pkgs/development/python-modules/fastmcp/default.nix
+++ b/pkgs/development/python-modules/fastmcp/default.nix
@@ -114,6 +114,11 @@ buildPythonPackage (finalAttrs: {
     "test_multi_server"
     "test_server_starts_without_auth"
     "test_canonical_multi_client_with_transforms"
+
+    # RuntimeError: Attempted to exit a cancel scope that isn't the current tasks's current cancel scope
+    "test_stateful_proxy"
+    "test_concurrent_log_requests_no_mixing"
+    "test_multi_proxies_no_mixing"
   ]
   ++ lib.optionals stdenv.hostPlatform.isAarch64 [
     # floating point error

From f17b9575111bf3d214ab888b07d9992a0bc061e7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 21:14:45 +0200
Subject: [PATCH 1016/1209] python3Packages.django-q2: 1.9.0 -> 1.10.0

https://github.com/django-q2/django-q2/releases/tag/v1.10.0
---
 pkgs/development/python-modules/django-q2/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-q2/default.nix b/pkgs/development/python-modules/django-q2/default.nix
index e5ebe7e58eda..f114e4a24eb7 100644
--- a/pkgs/development/python-modules/django-q2/default.nix
+++ b/pkgs/development/python-modules/django-q2/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "django-q2";
-  version = "1.9.0";
+  version = "1.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-q2";
     repo = "django-q2";
     tag = "v${version}";
-    hash = "sha256-xqRm9vv/lD9HLX+ekdPgIGGwr5H7QZBATPx0CCjQAmw=";
+    hash = "sha256-VwB3pvDAGsMvcKblRnmCYHzvEBCz8E13Qov4LjWEqxc=";
   };
 
   build-system = [
@@ -74,6 +74,9 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     "django_q/tests/test_commands.py"
+    #  assert 0 == 1 where 0 = <django_q.cluster.Sentinel object at 0x7ffff3861e50>.reincarnations
+    "django_q/tests/test_cluster.py::test_recycle"
+    "django_q/tests/test_cluster.py::test_max_rss"
   ];
 
   pytestFlags = [ "-vv" ];

From e79c4b39b6ae7b317d25dc4fde4cdc41ee44fe14 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 21:27:49 +0200
Subject: [PATCH 1017/1209] python3Packages.morfessor: fix build

---
 .../python-modules/morfessor/default.nix            | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/morfessor/default.nix b/pkgs/development/python-modules/morfessor/default.nix
index 969e2f347a99..0fda02a714f4 100644
--- a/pkgs/development/python-modules/morfessor/default.nix
+++ b/pkgs/development/python-modules/morfessor/default.nix
@@ -2,13 +2,14 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools_80,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "morfessor";
   version = "2.0.6";
-
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "Morfessor";
@@ -16,7 +17,13 @@ buildPythonPackage rec {
     sha256 = "bb3beac234341724c5f640f65803071f62373a50dba854d5a398567f9aefbab2";
   };
 
-  checkPhase = "python -m unittest -v morfessor/test/*";
+  build-system = [ setuptools_80 ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  enabledTestPaths = [
+    "morfessor/test/*"
+  ];
 
   pythonImportsCheck = [ "morfessor" ];
 

From 55dd7780530f3d4f780141d63bd5f6ce9adaf2a6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 21:45:18 +0200
Subject: [PATCH 1018/1209] python3Packages.vega-datasets: disable failing
 tests

---
 pkgs/development/python-modules/vega-datasets/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/vega-datasets/default.nix b/pkgs/development/python-modules/vega-datasets/default.nix
index efe73ec81ce7..8de4b62fc21d 100644
--- a/pkgs/development/python-modules/vega-datasets/default.nix
+++ b/pkgs/development/python-modules/vega-datasets/default.nix
@@ -26,6 +26,12 @@ buildPythonPackage rec {
 
   pytestFlags = [ "--doctest-modules" ];
 
+  disabledTests = [
+    # timestamp precision mismatch
+    "test_date_types"
+    "test_stock_date_parsing"
+  ];
+
   pythonImportsCheck = [ "vega_datasets" ];
 
   meta =

From d755b88d68de1911898d911fb22fdf6d5f39edd0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 21:54:54 +0200
Subject: [PATCH 1019/1209] python3Packages.pydeck: 0.9.1 -> 0.9.2

---
 pkgs/development/python-modules/pydeck/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pydeck/default.nix b/pkgs/development/python-modules/pydeck/default.nix
index d7c7de2030eb..866834959dfd 100644
--- a/pkgs/development/python-modules/pydeck/default.nix
+++ b/pkgs/development/python-modules/pydeck/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "pydeck";
-  version = "0.9.1";
+  version = "0.9.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-90R1rmN5UdY/LuWDJnV/jU+c2fKkV89ClQcVAD4stgU=";
+    hash = "sha256-wQ2QNegerWOFJkysjRlAJHH2hmoVyh998UAPUhQrz4c=";
   };
 
   # upstream has an invalid pyproject.toml

From 2acd69784ce4b6c9625e19f373a7e8093373ccae Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 22:18:54 +0200
Subject: [PATCH 1020/1209] python3Packages.flatdict: 4.0.1 -> 4.1.0

---
 .../python-modules/flatdict/default.nix           | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/flatdict/default.nix b/pkgs/development/python-modules/flatdict/default.nix
index 93d495a6de6c..7cf444e08893 100644
--- a/pkgs/development/python-modules/flatdict/default.nix
+++ b/pkgs/development/python-modules/flatdict/default.nix
@@ -2,20 +2,27 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  hatchling,
+  hatch-vcs,
 }:
 
 buildPythonPackage rec {
   pname = "flatdict";
-  version = "4.0.1";
-  format = "setuptools";
+  version = "4.1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gmr";
     repo = "flatdict";
-    rev = version;
-    hash = "sha256-CWsTiCNdIKSQtjpQC07lhZoU1hXT/MGpXdj649x2GlU=";
+    tag = version;
+    hash = "sha256-sLeW92F473H90+EMHaIWPt9ETqSeL/DoLmlMAg9Thj4=";
   };
 
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
   pythonImportsCheck = [ "flatdict" ];
 
   meta = {

From 4fcfe8246e997fe17e11b6c2304e586b17e2af94 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 22:56:45 +0200
Subject: [PATCH 1021/1209] python3Packages.rpy2-rinterface: fix build

---
 .../python-modules/rpy2-rinterface/default.nix      | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/rpy2-rinterface/default.nix b/pkgs/development/python-modules/rpy2-rinterface/default.nix
index 726311ba8e3c..4ec273c8ea1f 100644
--- a/pkgs/development/python-modules/rpy2-rinterface/default.nix
+++ b/pkgs/development/python-modules/rpy2-rinterface/default.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   buildPythonPackage,
   fetchurl,
@@ -11,6 +10,7 @@
   zlib,
   zstd,
   icu,
+  libdeflate,
   pytestCheckHook,
   setuptools,
   cffi,
@@ -39,7 +39,8 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
-    substituteInPlace 'src/rpy2/rinterface_lib/embedded.py' --replace '@NIX_R_LIBS_SITE@' "$R_LIBS_SITE"
+    substituteInPlace 'src/rpy2/rinterface_lib/embedded.py' \
+      --replace-fail '@NIX_R_LIBS_SITE@' "$R_LIBS_SITE"
   '';
 
   buildInputs = [
@@ -48,6 +49,7 @@ buildPythonPackage rec {
     zlib
     zstd
     icu
+    libdeflate
   ]
   ++ rWrapper.recommendedPackages;
 
@@ -55,11 +57,14 @@ buildPythonPackage rec {
     R # needed at setup time to detect R_HOME (alternatively set R_HOME explicitly)
   ];
 
-  propagatedBuildInputs = [
-    cffi
+  build-system = [
     setuptools
   ];
 
+  dependencies = [
+    cffi
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   # https://github.com/rpy2/rpy2/issues/1111

From 3d7bc0a86fe2152ab36982b2ac58c6b4d7b8c9cb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 23:00:04 +0200
Subject: [PATCH 1022/1209] python3Packages.rpy3-robjects: fix build

---
 .../python-modules/rpy2-robjects/default.nix          | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rpy2-robjects/default.nix b/pkgs/development/python-modules/rpy2-robjects/default.nix
index 72034f447237..637a76b82a5e 100644
--- a/pkgs/development/python-modules/rpy2-robjects/default.nix
+++ b/pkgs/development/python-modules/rpy2-robjects/default.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   buildPythonPackage,
   fetchurl,
@@ -11,6 +10,7 @@
   jinja2,
   numpy,
   pandas,
+  setuptools,
   tzlocal,
   pytestCheckHook,
 }:
@@ -42,7 +42,9 @@ buildPythonPackage rec {
     R # needed at setup time to detect R_HOME (alternatively set R_HOME explicitly)
   ];
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     ipython
     jinja2
     numpy
@@ -58,6 +60,11 @@ buildPythonPackage rec {
     "-Wignore::pytest.PytestRemovedIn9Warning"
   ];
 
+  disabledTests = [
+    # panda 3.0 type mismatch
+    "test_ri2pandas"
+  ];
+
   meta = {
     homepage = "https://rpy2.github.io/";
     description = "Python interface to R";

From d451baced8dc08b8446f6231c295b9afadd25bf1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 23:01:59 +0200
Subject: [PATCH 1023/1209] python3Packages.rpy2: fix build

---
 pkgs/development/python-modules/rpy2/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/rpy2/default.nix b/pkgs/development/python-modules/rpy2/default.nix
index 053bceb0b9ab..cd506db94100 100644
--- a/pkgs/development/python-modules/rpy2/default.nix
+++ b/pkgs/development/python-modules/rpy2/default.nix
@@ -1,12 +1,11 @@
 {
-  stdenv,
   lib,
   buildPythonPackage,
   fetchPypi,
   isPyPy,
   rpy2-rinterface,
   rpy2-robjects,
-  pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
@@ -20,7 +19,9 @@ buildPythonPackage rec {
     hash = "sha256-8ftGSc59FOk1EzCI3sl82ifrN858xxA4X4HcpVb+jJ8=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     rpy2-rinterface
     rpy2-robjects
   ];

From 6a682deaa50218398a80269cb9989dd692a982f8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 23:29:36 +0200
Subject: [PATCH 1024/1209] python3Packages.ibis-framework: ignore numpy
 deprecation

---
 pkgs/development/python-modules/ibis-framework/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index 70d05e492e23..61c2d9daedea 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -148,10 +148,11 @@ buildPythonPackage (finalAttrs: {
     "-Wignore:fetch_arrow_table:DeprecationWarning"
     # DeprecationWarning: fetch_record_batch() is deprecated, use to_arrow_reader() instead.
     "-Wignore:fetch_record_batch:DeprecationWarning"
+    # DeprecationWarning: '_UnionGenericAlias' is deprecated and slated for removal in Python 3.17
+    # DeprecationWarning: The 'generic' unit for NumPy timedelta is deprecated, and will raise an error in the future. This includes implicit conversion of bare integers (e.g. `+ 1`).Please use a specific unit instead.
+    "-Wignore::DeprecationWarning"
   ]
   ++ lib.optionals (pythonAtLeast "3.14") [
-    # DeprecationWarning: '_UnionGenericAlias' is deprecated and slated for removal in Python 3.17
-    "-Wignore::DeprecationWarning"
     # Multiple tests with warnings fail without it
     "-Wignore::pytest.PytestUnraisableExceptionWarning"
   ];

From dac44d4a952eb3c4da690aad741c1e3254788429 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 3 Jul 2026 00:29:35 +0000
Subject: [PATCH 1025/1209] unixodbcDrivers.psql: 18.00.0001 -> 18.00.0002

---
 pkgs/by-name/ps/psqlodbc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ps/psqlodbc/package.nix b/pkgs/by-name/ps/psqlodbc/package.nix
index e62928863aac..b38c756eee66 100644
--- a/pkgs/by-name/ps/psqlodbc/package.nix
+++ b/pkgs/by-name/ps/psqlodbc/package.nix
@@ -18,13 +18,13 @@ assert lib.xor withLibiodbc withUnixODBC;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "psqlodbc";
-  version = "18.00.0001";
+  version = "18.00.0002";
 
   src = fetchFromGitHub {
     owner = "postgresql-interfaces";
     repo = "psqlodbc";
     tag = "REL-${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-gCacZjP0FkCEuZRBfawZ2B3BcjR/sV1fypuT8XD2l+A=";
+    hash = "sha256-qzbyo9P/o784Ux3KDA8NDMbcm0EbnfG8LiBLRk6n698=";
   };
 
   buildInputs = [

From ed597bddff92686a85e1bab3922883723ddc2550 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 00:48:29 +0200
Subject: [PATCH 1026/1209] python3Packages.moddb: fix build

---
 pkgs/development/python-modules/moddb/default.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/moddb/default.nix b/pkgs/development/python-modules/moddb/default.nix
index d2792616c6b1..8c025e7fd306 100644
--- a/pkgs/development/python-modules/moddb/default.nix
+++ b/pkgs/development/python-modules/moddb/default.nix
@@ -5,22 +5,25 @@
   beautifulsoup4,
   pyrate-limiter,
   requests,
+  setuptools_80,
   toolz,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "moddb";
   version = "0.12.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ClementJ18";
     repo = "moddb";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-idBja/W9r8iX69Af+x2TZcLpSLy45fC9pmrMKJZ0RsA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools_80 ];
+
+  dependencies = [
     beautifulsoup4
     pyrate-limiter
     requests
@@ -39,4 +42,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})

From 74d09649411e04b342f4a47aa9ab33787ba5cf51 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 00:58:27 +0200
Subject: [PATCH 1027/1209] ubports-click: pin to setuptools 80

And don't propagate setuptools, it is not required at runtime.
---
 pkgs/by-name/ub/ubports-click/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ub/ubports-click/package.nix b/pkgs/by-name/ub/ubports-click/package.nix
index b85dc331c31d..8bbf7b66e49d 100644
--- a/pkgs/by-name/ub/ubports-click/package.nix
+++ b/pkgs/by-name/ub/ubports-click/package.nix
@@ -90,11 +90,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
     properties-cpp
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  build-system = [
+    python3Packages.setuptools_80
+  ];
+
+  dependencies = with python3Packages; [
     python-debian
     chardet
     pygobject3
-    setuptools
   ];
 
   nativeCheckInputs = [

From 448d62b526d32dca5fb2afddfb66b22c11ad34c7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 01:07:23 +0200
Subject: [PATCH 1028/1209] python3Packages.ase: 3.28.0 -> 3.29.0

https://ase-lib.org/releasenotes.html
---
 pkgs/development/python-modules/ase/default.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ase/default.nix b/pkgs/development/python-modules/ase/default.nix
index e5c29e34c1fa..ad2617bfbf34 100644
--- a/pkgs/development/python-modules/ase/default.nix
+++ b/pkgs/development/python-modules/ase/default.nix
@@ -16,6 +16,7 @@
   psycopg2,
   scipy,
   tkinter,
+  typing-extensions,
 
   # tests
   addBinToPathHook,
@@ -27,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "ase";
-  version = "3.28.0";
+  version = "3.29.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "ase";
     repo = "ase";
     tag = version;
-    hash = "sha256-ZbQxCd8uFTNPVUjjsCCiZR9pKRucobWfxDZGdyMm6ko=";
+    hash = "sha256-hMeGeQFoC+eWfHkJize21IdxLKAR7Oc0Txwg2BQIvWg=";
   };
 
   build-system = [ setuptools ];
@@ -46,6 +47,7 @@ buildPythonPackage rec {
     pillow
     psycopg2
     scipy
+    typing-extensions
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     tkinter
@@ -59,6 +61,10 @@ buildPythonPackage rec {
     writableTmpDirAsHomeHook
   ];
 
+  pytestFlags = [
+    "-Wignore::DeprecationWarning"
+  ];
+
   disabledTests = [
     "test_fundamental_params"
     "test_ase_bandstructure"

From b440c439354017f8902e021202005ab11a4a4d88 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 01:26:25 +0200
Subject: [PATCH 1029/1209] python3Packages.readability-lxml: relax chardet
 constraint

---
 pkgs/development/python-modules/readability-lxml/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/readability-lxml/default.nix b/pkgs/development/python-modules/readability-lxml/default.nix
index e016767db614..30453064016a 100644
--- a/pkgs/development/python-modules/readability-lxml/default.nix
+++ b/pkgs/development/python-modules/readability-lxml/default.nix
@@ -25,7 +25,10 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  pythonRelaxDeps = [ "lxml" ];
+  pythonRelaxDeps = [
+    "chardet"
+    "lxml"
+  ];
 
   dependencies = [
     chardet

From 78d8afdd7ff11e6f9f5c5005161f41fa29653daf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 01:42:18 +0200
Subject: [PATCH 1030/1209] python3Packages.django-rq: fix redis-py 8.0 compat

Fast-forward to maintain and apply a patch to fix the tests.
---
 .../python-modules/django-rq/default.nix          | 12 ++++++++----
 .../django-rq/redis-py-8.0-compat.patch           | 15 +++++++++++++++
 2 files changed, 23 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/python-modules/django-rq/redis-py-8.0-compat.patch

diff --git a/pkgs/development/python-modules/django-rq/default.nix b/pkgs/development/python-modules/django-rq/default.nix
index a946f4d89b54..330e28aca47c 100644
--- a/pkgs/development/python-modules/django-rq/default.nix
+++ b/pkgs/development/python-modules/django-rq/default.nix
@@ -16,16 +16,20 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "django-rq";
-  version = "4.1";
+  version = "4.1-unstable-2026-05-28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rq";
     repo = "django-rq";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-c/elbEi+m3WVGl8137ct1PsxRM397uZNPy9X54b8fmg=";
+    rev = "39539ab680cf6a23073f4907b5e7332226494784";
+    hash = "sha256-Yrc0HQmCsrdTs66RZwwmZQraxB5/eJG8dOPcVn53rjA=";
   };
 
+  patches = [
+    ./redis-py-8.0-compat.patch
+  ];
+
   build-system = [ hatchling ];
 
   dependencies = [
@@ -61,7 +65,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Simple app that provides django integration for RQ (Redis Queue)";
     homepage = "https://github.com/rq/django-rq";
-    changelog = "https://github.com/rq/django-rq/releases/tag/${finalAttrs.src.tag}";
+    # changelog = "https://github.com/rq/django-rq/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hexa ];
   };
diff --git a/pkgs/development/python-modules/django-rq/redis-py-8.0-compat.patch b/pkgs/development/python-modules/django-rq/redis-py-8.0-compat.patch
new file mode 100644
index 000000000000..e74181ad2be6
--- /dev/null
+++ b/pkgs/development/python-modules/django-rq/redis-py-8.0-compat.patch
@@ -0,0 +1,15 @@
+diff --git a/tests/utils.py b/tests/utils.py
+index 90ba1d4..e320a58 100644
+--- a/tests/utils.py
++++ b/tests/utils.py
+@@ -38,6 +38,10 @@ def get_queue_index(name='default'):
+         if q.name == name:
+             # assert that the connection is correct
+             pool_kwargs = q.connection.connection_pool.connection_kwargs
++            pool_kwargs.pop("maint_notifications_config", None)
++            pool_kwargs.pop("maint_notifications_pool_handler", None)
++            connection_kwargs.pop("maint_notifications_config", None)
++            connection_kwargs.pop("maint_notifications_pool_handler", None)
+             if not _is_buggy_retry(pool_kwargs) or not _is_buggy_retry(connection_kwargs):
+                 assert pool_kwargs == connection_kwargs
+             else:

From 0f5dab0bfd731849361541f4c9f8026040ca7976 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 02:13:12 +0200
Subject: [PATCH 1031/1209] python3Packages.pygraphviz:
 1.14-unstable-2026-05-07 -> 2.0

https://github.com/pygraphviz/pygraphviz/releases/tag/pygraphviz-2.0
---
 .../python-modules/pygraphviz/default.nix     | 20 +++++++------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/pygraphviz/default.nix b/pkgs/development/python-modules/pygraphviz/default.nix
index 526fd967b103..c6b365bf23f1 100644
--- a/pkgs/development/python-modules/pygraphviz/default.nix
+++ b/pkgs/development/python-modules/pygraphviz/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   replaceVars,
   graphviz,
   coreutils,
@@ -12,16 +11,16 @@
   pytest,
 }:
 
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "pygraphviz";
-  version = "1.14-unstable-2026-05-07";
+  version = "2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pygraphviz";
     repo = "pygraphviz";
-    rev = "6b9efcd1a76a97836de79d1380c0d003c6f834e7";
-    hash = "sha256-ghtnwOevSnecshMBoASCZircgOsPF7+l+Cer+J+yEqM=";
+    tag = "pygraphviz-${finalAttrs.version}";
+    hash = "sha256-AxiaKEmVjofAi6LV1ozOPERqZyOhmBWMLV3GYlhSuNo=";
   };
 
   patches = [
@@ -37,13 +36,6 @@ buildPythonPackage {
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail ', "swig>4.1.0"' ""
-
-    # https://github.com/pygraphviz/pygraphviz/pull/573
-    substituteInPlace pygraphviz/graphviz.i \
-      --replace-fail '%cstring_output_allocate_size(char **result, unsigned int* size, free(*$1));' \
-                     '%cstring_output_allocate_size(char **result, size_t* size, free(*$1));' \
-      --replace-fail 'int gvRenderData(GVC_t *gvc, Agraph_t* g, char *format, char **result, unsigned int *size);' \
-                     'int gvRenderData(GVC_t *gvc, Agraph_t* g, char *format, char **result, size_t *size);'
   '';
 
   env.GRAPHVIZ_PREFIX = graphviz;
@@ -53,6 +45,7 @@ buildPythonPackage {
   ];
 
   nativeBuildInputs = [
+    graphviz # for dot
     pkg-config
     swig
   ];
@@ -70,6 +63,7 @@ buildPythonPackage {
   pythonImportsCheck = [ "pygraphviz" ];
 
   meta = {
+    changelog = "https://github.com/pygraphviz/pygraphviz/releases/tag/pygraphviz-${finalAttrs.version}";
     description = "Python interface to Graphviz graph drawing package";
     homepage = "https://github.com/pygraphviz/pygraphviz";
     license = lib.licenses.bsd3;
@@ -78,4 +72,4 @@ buildPythonPackage {
       dotlambda
     ];
   };
-}
+})

From 9836c44776b3129a7795109c04e8f268bdcc7a6f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 02:19:15 +0200
Subject: [PATCH 1032/1209] python3Packages.modelsearch: relax setuptools
 constraint

---
 pkgs/development/python-modules/modelsearch/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/modelsearch/default.nix b/pkgs/development/python-modules/modelsearch/default.nix
index 8caa4a4f6007..2bedecb5f91e 100644
--- a/pkgs/development/python-modules/modelsearch/default.nix
+++ b/pkgs/development/python-modules/modelsearch/default.nix
@@ -31,6 +31,11 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-UH1t/CXJ7OX250SoUZYKMIAHuCxYxOT6l79RXI/oMLs=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools>=80,<81" setuptools
+  '';
+
   build-system = [
     setuptools
   ];

From 3f262fa470e99e86020956f30c199e7e8a0d9a08 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 02:19:42 +0200
Subject: [PATCH 1033/1209] python3Packages.transitions: disable crashing tests

tests/test_pygraphviz.py::TestPygraphvizNested::test_binary_stream <- tests/test_graphviz.py Fatal Python error: Segmentation fault

Current thread 0x00007ffff756a780 [python3.14] (most recent call first):
  File "/nix/store/ngv6hbc9hvqvrxdh6sl2bpaz2rf3g1nh-python3.14-pygraphviz-2.0/lib/python3.14/site-packages/pygraphviz/graphviz.py", line 256 in gvRender
  File "/nix/store/ngv6hbc9hvqvrxdh6sl2bpaz2rf3g1nh-python3.14-pygraphviz-2.0/lib/python3.14/site-packages/pygraphviz/agraph.py", line 1630 in draw
  File "/build/transitions-0.9.3/tests/test_graphviz.py", line 262 in test_binary_stream
  File "/nix/store/jxyrvv4gbpnp3ap5iy7wxwl1sg4x2x88-python3-3.14.6/lib/python3.14/unittest/case.py", line 615 in _callTestMethod
  File "/nix/store/jxyrvv4gbpnp3ap5iy7wxwl1sg4x2x88-python3-3.14.6/lib/python3.14/unittest/case.py", line 669 in run
  File "/nix/store/jxyrvv4gbpnp3ap5iy7wxwl1sg4x2x88-python3-3.14.6/lib/python3.14/unittest/case.py", line 725 in __call__
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/unittest.py", line 389 in runtest
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/runner.py", line 179 in pytest_runtest_call
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/runner.py", line 245 in <lambda>
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/runner.py", line 353 in from_call
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/runner.py", line 244 in call_and_report
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/runner.py", line 137 in runtestprotocol
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/runner.py", line 118 in pytest_runtest_protocol
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/main.py", line 396 in pytest_runtestloop
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/main.py", line 372 in _main
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/main.py", line 318 in wrap_session
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/main.py", line 365 in pytest_cmdline_main
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/nix/store/z8zm1d0h20y4bgf3gv65nh9fxdbgqhiw-python3.14-pluggy-1.6.0/lib/python3.14/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/config/__init__.py", line 199 in main
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/_pytest/config/__init__.py", line 223 in console_main
  File "/nix/store/16b7qk569x4v836n226vl7kyxlq4ly9f-python3.14-pytest-9.0.3/lib/python3.14/site-packages/pytest/__main__.py", line 9 in <module>
  File "<frozen runpy>", line 88 in _run_code
  File "<frozen runpy>", line 203 in _run_module_as_main
---
 pkgs/development/python-modules/transitions/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/transitions/default.nix b/pkgs/development/python-modules/transitions/default.nix
index 1c44cd1ffe12..281010a17b78 100644
--- a/pkgs/development/python-modules/transitions/default.nix
+++ b/pkgs/development/python-modules/transitions/default.nix
@@ -42,7 +42,12 @@ buildPythonPackage rec {
     export HOME=$TMPDIR
   '';
 
-  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTestPaths = [
+    # crashes in pygraphviz/graphviz
+    "tests/test_pygraphviz.py::PygraphvizTest::test_binary_stream"
+    "tests/test_pygraphviz.py::TestPygraphvizNested::test_binary_stream"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # sleep is not accurate on Darwin
     "tests/test_async.py"
   ];

From afb614a5892e86696bdd3abd9bf21c76cc556f8f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 02:55:34 +0200
Subject: [PATCH 1034/1209] python3Packages.pybtex-docutils: pin setuptools 80

---
 .../development/python-modules/pybtex-docutils/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pybtex-docutils/default.nix b/pkgs/development/python-modules/pybtex-docutils/default.nix
index 393323831668..7b5752f79eed 100644
--- a/pkgs/development/python-modules/pybtex-docutils/default.nix
+++ b/pkgs/development/python-modules/pybtex-docutils/default.nix
@@ -5,19 +5,22 @@
   fetchPypi,
   pybtex,
   pytestCheckHook,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
   pname = "pybtex-docutils";
   version = "1.0.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-On69+StZPgDowcU4qpogvKXZLYQjESRxWsyWTVHZPGs=";
   };
 
-  buildInputs = [
+  build-system = [ setuptools_80 ];
+
+  dependencies = [
     docutils
     pybtex
   ];

From 74242e70d82ca1cd50427940067fafaea5ad3804 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 03:00:15 +0200
Subject: [PATCH 1035/1209] python3Packages.skein: pin to setuptools 80

---
 pkgs/development/python-modules/skein/default.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/skein/default.nix b/pkgs/development/python-modules/skein/default.nix
index c7d4995fc1cc..df2552ed6f5d 100644
--- a/pkgs/development/python-modules/skein/default.nix
+++ b/pkgs/development/python-modules/skein/default.nix
@@ -10,7 +10,7 @@
   grpcio-tools,
   hadoop,
   pytestCheckHook,
-  setuptools,
+  setuptools_80,
   versioneer,
 }:
 
@@ -27,12 +27,17 @@ buildPythonPackage rec {
   jarHash = "sha256-x2KH6tnoG7sogtjrJvUaxy0PCEA8q/zneuI969oBOKo=";
   skeinJar = callPackage ./skeinjar.nix { inherit pname version jarHash; };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools_80
+    versioneer
+  ];
+
+  dependencies = [
     cryptography
     grpcio
     pyyaml
-  ]
-  ++ lib.optionals (!pythonOlder "3.12") [ setuptools ];
+  ];
+
   buildInputs = [ grpcio-tools ];
 
   preBuild = ''
@@ -52,8 +57,6 @@ buildPythonPackage rec {
       --replace-fail "distutils" "setuptools._distutils"
   '';
 
-  build-system = [ versioneer ];
-
   pythonImportsCheck = [ "skein" ];
 
   nativeCheckInputs = [ pytestCheckHook ];

From a188c597807154251a749adaff9da1fada6cfe90 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 03:06:05 +0200
Subject: [PATCH 1036/1209] python3Packages.pysmartapp: kill

Unused leaf, dropped from home-assistant in 2025.3.
---
 .../python-modules/pysmartapp/default.nix     | 46 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 48 deletions(-)
 delete mode 100644 pkgs/development/python-modules/pysmartapp/default.nix

diff --git a/pkgs/development/python-modules/pysmartapp/default.nix b/pkgs/development/python-modules/pysmartapp/default.nix
deleted file mode 100644
index c753f4dc9694..000000000000
--- a/pkgs/development/python-modules/pysmartapp/default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  httpsig,
-  pytest-asyncio,
-  pytestCheckHook,
-  setuptools,
-}:
-
-buildPythonPackage rec {
-  pname = "pysmartapp";
-  version = "0.3.5";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "andrewsayre";
-    repo = "pysmartapp";
-    tag = version;
-    hash = "sha256-RiRGOO5l5hcHllyDDGLtQHr51JOTZhAa/wK8BfMqmAY=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [ httpsig ];
-
-  nativeCheckInputs = [
-    pytest-asyncio
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [ "pysmartapp" ];
-
-  disabledTestPaths = [
-    # These tests are outdated
-    "tests/test_smartapp.py"
-  ];
-
-  meta = {
-    description = "Python implementation to work with SmartApp lifecycle events";
-    homepage = "https://github.com/andrewsayre/pysmartapp";
-    changelog = "https://github.com/andrewsayre/pysmartapp/releases/tag/${src.tag}";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fab ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 5ab94ba5bcf7..6a6b404bb7b1 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -489,6 +489,7 @@ mapAliases {
   pyside6-fluent-widgets = throw "pyside6-fluent-widgets has been removed, since it is unmaintained"; # added 2025-08-20
   pysidesix-frameless-window = throw "pysidesix-frameless-window has been removed, since it is unmaintained"; # added 2025-08-20
   pysmart-smartx = throw "'pysmart-smartx' has been renamed to/replaced by 'pysmart'"; # Converted to throw 2025-10-29
+  pysmartapp = throw "'pysmartapp' has been removed since it is deprecated and archived upstream."; # Added 2026-06-03
   pySmartDL = throw "'pySmartDL' has been renamed to/replaced by 'pysmartdl'"; # Converted to throw 2025-10-29
   pysmi-lextudio = throw "'pysmi-lextudio' has been renamed to/replaced by 'pysmi'"; # Converted to throw 2025-10-29
   pysnmp-lextudio = throw "'pysnmp-lextudio' has been renamed to/replaced by 'pysnmp'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0edcaff6d4b3..4b6e2007d35a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15538,8 +15538,6 @@ self: super: with self; {
 
   pysmart = callPackage ../development/python-modules/pysmart { };
 
-  pysmartapp = callPackage ../development/python-modules/pysmartapp { };
-
   pysmartdl = callPackage ../development/python-modules/pysmartdl { };
 
   pysmartthings = callPackage ../development/python-modules/pysmartthings { };

From 293e8b054d122d6c559012f9af41cfed4da3bff9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 03:09:51 +0200
Subject: [PATCH 1037/1209] python3Packages.mock-services: pin to setuptools 80

---
 pkgs/development/python-modules/mock-services/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mock-services/default.nix b/pkgs/development/python-modules/mock-services/default.nix
index 14158d4f6e3b..9e752ca75d9a 100644
--- a/pkgs/development/python-modules/mock-services/default.nix
+++ b/pkgs/development/python-modules/mock-services/default.nix
@@ -7,12 +7,13 @@
   funcsigs,
   requests-mock,
   pytestCheckHook,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
   pname = "mock-services";
   version = "0.3.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "peopledoc";
@@ -29,7 +30,9 @@ buildPythonPackage rec {
     })
   ];
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools_80 ];
+
+  dependencies = [
     attrs
     funcsigs
     requests-mock

From 08c17b3d486d591e6478bdfc35ad47fa3686e2e6 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Mon, 15 Jun 2026 02:34:05 +0300
Subject: [PATCH 1038/1209] pcre2: `finalAttrs`

does not change the eval
---
 pkgs/development/libraries/pcre2/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 503c9aacc910..11951e271162 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -8,12 +8,12 @@
   withJitSealloc ? !(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isAbiElfv1),
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "pcre2";
   version = "10.47";
 
   src = fetchurl {
-    url = "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
+    url = "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${finalAttrs.version}/pcre2-${finalAttrs.version}.tar.bz2";
     hash = "sha256-R/6MmUYSUNQviebo/a66naBXhV0G63/AjZygP9CNe8c=";
   };
 
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://www.pcre.org/";
-    changelog = "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-${version}";
+    changelog = "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-${finalAttrs.version}";
     description = "Perl Compatible Regular Expressions";
     license = lib.licenses.bsd3;
     maintainers = [ ];
@@ -54,6 +54,6 @@ stdenv.mkDerivation rec {
       "libpcre2-16"
       "libpcre2-32"
     ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "pcre" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "pcre" finalAttrs.version;
   };
-}
+})

From 5985f549584a93f543f141d5b22187091ce06c75 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Mon, 15 Jun 2026 02:36:52 +0300
Subject: [PATCH 1039/1209] pcre2: `__structuredAttrs`, `strictDeps`,
 `enableParallelBuilding`

`nix store make-content-addressed` gives the same output
before and after this change.
---
 pkgs/development/libraries/pcre2/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 11951e271162..d846f87c0e42 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -17,6 +17,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-R/6MmUYSUNQviebo/a66naBXhV0G63/AjZygP9CNe8c=";
   };
 
+  __structuredAttrs = true;
+  strictDeps = true;
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
   configureFlags = [

From e39e53c6c6a82f41bef75c5e0a3d01315d17bb88 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:15:51 +0100
Subject: [PATCH 1040/1209] python{313,314}Packages.matplotlib: work around
 `ld64` hardening issue

---
 .../python-modules/matplotlib/default.nix         | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index ab1d363fc6ab..bee69a777e5e 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -62,6 +62,9 @@
 
   # Reverse dependency
   sage,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 let
@@ -104,7 +107,12 @@ buildPythonPackage (finalAttrs: {
         --replace-fail libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
     '';
 
-  nativeBuildInputs = [ pkg-config ] ++ lib.optionals enableGtk3 [ gobject-introspection ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  ++ lib.optionals enableGtk3 [ gobject-introspection ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     ffmpeg-headless
@@ -160,6 +168,11 @@ buildPythonPackage (finalAttrs: {
     b_lto = false;
   };
 
+  # TODO: Clean up on `staging`.
+  env.${if stdenv.hostPlatform.isDarwin then "CC_LD" else null} = "lld";
+  env.${if stdenv.hostPlatform.isDarwin then "CXX_LD" else null} = "lld";
+  env.${if stdenv.hostPlatform.isDarwin then "OBJC_LD" else null} = "lld";
+
   passthru.tests = {
     inherit sage;
   };

From fc952632d96e506faa958a807771a6577b48cf1a Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:17:32 +0100
Subject: [PATCH 1041/1209] qt6.qtbase: work around `ld64` hardening issue

---
 .../libraries/qt-6/modules/qtbase/default.nix         | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index 7686093f4d75..e3f60553ee63 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -89,6 +89,9 @@
   # options
   qttranslations ? null,
   fetchpatch,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 let
@@ -197,7 +200,11 @@ stdenv.mkDerivation {
     cmake
     ninja
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ moveBuildTree ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    moveBuildTree
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
+  ];
 
   propagatedNativeBuildInputs = [
     lndir
@@ -312,6 +319,8 @@ stdenv.mkDerivation {
     # When this variable is not set, cmake tries to execute xcodebuild
     # to query the version.
     "-DQT_INTERNAL_XCODE_VERSION=0.1"
+    # TODO: Clean up on `staging`.
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ]
   ++ lib.optionals isCrossBuild [
     "-DQT_HOST_PATH=${pkgsBuildBuild.qt6.qtbase}"

From 89af4db9cfc5c1b13ba5b9e666683699f8179fab Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:24:46 +0100
Subject: [PATCH 1042/1209] wxwidgets_{3_1,3_2,3_3}: work around `ld64`
 hardening issue

---
 pkgs/by-name/wx/wxwidgets_3_1/package.nix | 26 +++++++++++++++++------
 pkgs/by-name/wx/wxwidgets_3_2/package.nix | 26 +++++++++++++++++------
 pkgs/by-name/wx/wxwidgets_3_3/package.nix | 26 +++++++++++++++++------
 3 files changed, 57 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/wx/wxwidgets_3_1/package.nix b/pkgs/by-name/wx/wxwidgets_3_1/package.nix
index 17b1d60e360f..bea53d1e25e1 100644
--- a/pkgs/by-name/wx/wxwidgets_3_1/package.nix
+++ b/pkgs/by-name/wx/wxwidgets_3_1/package.nix
@@ -23,6 +23,9 @@
   withWebKit ? stdenv.hostPlatform.isDarwin,
   webkitgtk_4_1,
   libpng,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,7 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./0002-support-webkitgtk-41.patch
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -89,12 +96,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   preConfigure = ''
     substituteInPlace configure --replace \
diff --git a/pkgs/by-name/wx/wxwidgets_3_2/package.nix b/pkgs/by-name/wx/wxwidgets_3_2/package.nix
index bc33af7fc265..ca05463f928f 100644
--- a/pkgs/by-name/wx/wxwidgets_3_2/package.nix
+++ b/pkgs/by-name/wx/wxwidgets_3_2/package.nix
@@ -29,6 +29,9 @@
   withMesa ? !stdenv.hostPlatform.isDarwin,
   withWebKit ? true,
   webkitgtk_4_1,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 let
   catch = fetchFromGitHub {
@@ -56,7 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-mYMUW3FnFkKHDQXb/k9UosSiWCPW7OQn+/orwq4Q95k=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -114,12 +121,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   preConfigure = ''
     cp -r ${catch}/* 3rdparty/catch/
diff --git a/pkgs/by-name/wx/wxwidgets_3_3/package.nix b/pkgs/by-name/wx/wxwidgets_3_3/package.nix
index 078dc6706c1d..8afa367df0fe 100644
--- a/pkgs/by-name/wx/wxwidgets_3_3/package.nix
+++ b/pkgs/by-name/wx/wxwidgets_3_3/package.nix
@@ -30,6 +30,9 @@
   withEGL ? true,
   withPrivateFonts ? false,
   webkitgtk_4_1,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -44,7 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-UL1NuByKFGMQ/dhjuWRdnWTgdy4+1cD9pSls3e1mur8=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -103,12 +110,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   postInstall = "
     pushd $out/include

From 2c0e8d977ae15f20f251167091b61e5a3e62bc27 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:25:47 +0100
Subject: [PATCH 1043/1209] python{313,314}Packages.pyobjc-core: work around
 `ld64` hardening issue

---
 pkgs/development/python-modules/pyobjc-core/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/pyobjc-core/default.nix b/pkgs/development/python-modules/pyobjc-core/default.nix
index e07a01289f74..278ad48196d8 100644
--- a/pkgs/development/python-modules/pyobjc-core/default.nix
+++ b/pkgs/development/python-modules/pyobjc-core/default.nix
@@ -4,6 +4,9 @@
   fetchFromGitHub,
   lib,
   setuptools,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 buildPythonPackage rec {
@@ -28,6 +31,9 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     darwin.DarwinTools # sw_vers
+
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [
@@ -36,6 +42,9 @@ buildPythonPackage rec {
     "-Wno-error=unused-command-line-argument"
   ];
 
+  # TODO: Clean up on `staging`.
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   pythonImportsCheck = [ "objc" ];
 
   meta = {

From 3b114d3460c13c07f259ee6ffb24e43de5f03277 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:27:13 +0100
Subject: [PATCH 1044/1209] glfw3: work around `ld64` hardening issue

---
 pkgs/by-name/gl/glfw3/package.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gl/glfw3/package.nix b/pkgs/by-name/gl/glfw3/package.nix
index 711406030b70..6ecf627adce1 100644
--- a/pkgs/by-name/gl/glfw3/package.nix
+++ b/pkgs/by-name/gl/glfw3/package.nix
@@ -20,6 +20,9 @@
   libxkbcommon,
   libdecor,
   withMinecraftPatch ? false,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 let
   version = "3.4";
@@ -58,7 +61,11 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    fixDarwinDylibNames
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
+  ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ wayland-scanner ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
@@ -86,6 +93,9 @@ stdenv.mkDerivation {
   cmakeFlags = [
     # Static linking isn't supported
     (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows) {

From 7a83e820ddc2dd54a2ff6038ffe5a2f7a4005fb8 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:28:51 +0100
Subject: [PATCH 1045/1209] qemu: work around `ld64` hardening issue

---
 pkgs/by-name/qe/qemu/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 5bd6c6e0f8c7..80362ffd6757 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -123,6 +123,9 @@
   minimal ? toolsOnly || userOnly,
   gitUpdater,
   qemu-utils, # for tests attribute
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 assert lib.assertMsg (
@@ -180,6 +183,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals hexagonSupport [ glib ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.sigtool
+
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
   ]
   ++ lib.optionals (!userOnly) [ dtc ];
 
@@ -425,6 +431,10 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
   '';
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   passthru = {
     qemu-system-i386 = "bin/qemu-system-i386";
     tests = lib.optionalAttrs (!toolsOnly) {

From 8746d3caee7a256a2a1638da3e357ae666a6f47d Mon Sep 17 00:00:00 2001
From: Matthew Donoughe <mdonoughe@pm.me>
Date: Mon, 16 Feb 2026 17:28:13 -0500
Subject: [PATCH 1046/1209] glibc: set default zonedir to match fhs

---
 pkgs/development/libraries/glibc/common.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 9b2946d019fb..533a4b453909 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -208,7 +208,12 @@ stdenv.mkDerivation (
 
     makeFlags =
       (args.makeFlags or [ ])
-      ++ [ "OBJCOPY=${stdenv.cc.targetPrefix}objcopy" ]
+      ++ [
+        "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
+        # zonedir does nothing on NixOS but is important for non-NixOS.
+        # See https://github.com/NixOS/nixpkgs/pull/491193
+        "zonedir=/usr/share/zoneinfo"
+      ]
       ++ lib.optionals (stdenv.cc.libc != null) [
         "BUILD_LDFLAGS=-Wl,-rpath,${stdenv.cc.libc}/lib"
         "OBJDUMP=${stdenv.cc.bintools.bintools}/bin/objdump"

From 85416f746581da86165a843a91d3b05ee1fb42e5 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Fri, 3 Jul 2026 22:25:01 +0200
Subject: [PATCH 1047/1209] python3{13,14}Packages.xarray: fix build with numpy
 => 2.5.0

---
 .../python-modules/xarray/default.nix           | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/development/python-modules/xarray/default.nix b/pkgs/development/python-modules/xarray/default.nix
index b0e9e537cd56..d9f1f5464274 100644
--- a/pkgs/development/python-modules/xarray/default.nix
+++ b/pkgs/development/python-modules/xarray/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -51,6 +52,22 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-BsgL+Xo9fTMLLdz5AfScnKGuBa76cE85LuUzB4ZNLiY=";
   };
 
+  patches = [
+    # Performance fix
+    (fetchpatch {
+      url = "https://github.com/pydata/xarray/commit/b8bfeca3275045ca82adc3401c38444b1ed12c4a.patch";
+      hash = "sha256-KzN45MqOBPMNEmoG+rb3iwrk/7XFLlTNktQf5uYBWNo=";
+    })
+    # Fix tests with numpy >= 2.5.0
+    (fetchpatch {
+      url = "https://github.com/pydata/xarray/commit/c3a398e856f7fcff1c18bc72bfd1ab9c64d5a2e7.patch";
+      excludes = [
+        "doc/whats-new.rst"
+      ];
+      hash = "sha256-TakZ9RrJHeRksT3oBe7AKyfrjZeZ4oSmbE8axh7EmGg=";
+    })
+  ];
+
   postPatch = ''
     # don't depend on pytest-mypy-plugins
     sed -i "/--mypy-/d" pyproject.toml

From 9fb8d43cff63c5c082da6697ab44670b55e7346d Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Fri, 3 Jul 2026 21:18:07 -0400
Subject: [PATCH 1048/1209] buildTypstPackage: enable strictDeps,
 __structuredAttrs

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/build-support/build-typst-package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/build-support/build-typst-package.nix b/pkgs/build-support/build-typst-package.nix
index 13e1ddd2537c..ead6d68a1395 100644
--- a/pkgs/build-support/build-typst-package.nix
+++ b/pkgs/build-support/build-typst-package.nix
@@ -40,6 +40,9 @@ lib.extendMkDerivation {
     {
       name = "typst-package-${finalAttrs.pname}-${finalAttrs.version}";
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       dontBuild = true;
 
       installPhase =

From a415c1c20d847a76c61305c731cfb1ff8786b430 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Sat, 4 Jul 2026 09:08:39 +0200
Subject: [PATCH 1049/1209] python313Packages.ttfautohint-py: remove outdated
 dependency to fix build

pkg_resources was removed from the ttfautohint-py source code.
It started causing dependency conflicts because python3Packages.fs
depends on setuptools 80.
---
 pkgs/development/python-modules/ttfautohint-py/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/development/python-modules/ttfautohint-py/default.nix b/pkgs/development/python-modules/ttfautohint-py/default.nix
index 69c0b33a9eb4..adcf961c5745 100644
--- a/pkgs/development/python-modules/ttfautohint-py/default.nix
+++ b/pkgs/development/python-modules/ttfautohint-py/default.nix
@@ -36,10 +36,6 @@ buildPythonPackage rec {
     distutils
   ];
 
-  dependencies = [
-    setuptools # for pkg_resources
-  ];
-
   buildInputs = [ ttfautohint ];
 
   nativeCheckInputs = [

From e0ac37b915947389138a4d8a63398d69361f850a Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Sat, 4 Jul 2026 09:08:39 +0200
Subject: [PATCH 1050/1209] python313Packages.gftools: remove outdated
 dependency to fix build

pkg_resources was removed from the source code.
It started causing dependency conflicts because python3Packages.fs
depends on setuptools 80.
---
 pkgs/development/python-modules/gftools/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/python-modules/gftools/default.nix b/pkgs/development/python-modules/gftools/default.nix
index 8bbc95076833..72bbfd772b87 100644
--- a/pkgs/development/python-modules/gftools/default.nix
+++ b/pkgs/development/python-modules/gftools/default.nix
@@ -158,7 +158,6 @@ buildPythonPackage rec {
     requests
     rich
     ruamel-yaml
-    setuptools
     skia-pathops
     statmake
     strictyaml

From 2278d8e20e1d47c8d2a92037731abb8a792b5f58 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Sat, 4 Jul 2026 09:08:39 +0200
Subject: [PATCH 1051/1209] jetbrains-mono: use python 3.13 gftools to fix
 build

'fs' is unsupported on Python 3.14 which breaks 'gftools' on 3.14.
---
 pkgs/by-name/je/jetbrains-mono/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/je/jetbrains-mono/package.nix b/pkgs/by-name/je/jetbrains-mono/package.nix
index 4461ab2bafef..5584347e5a2b 100644
--- a/pkgs/by-name/je/jetbrains-mono/package.nix
+++ b/pkgs/by-name/je/jetbrains-mono/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
-  python3Packages,
+  python313Packages,
 }:
 
 stdenvNoCC.mkDerivation rec {
@@ -19,7 +19,8 @@ stdenvNoCC.mkDerivation rec {
   env."PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION" = "python";
 
   nativeBuildInputs = [
-    python3Packages.gftools
+    # Currently broken on 3.14
+    python313Packages.gftools
   ];
 
   buildPhase = ''

From 8dde7499060a78f303eba49f02142ba8acc862fa Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Jul 2026 11:14:11 +0200
Subject: [PATCH 1052/1209] python3Packages.fints: relax lxml constraint

---
 pkgs/development/python-modules/fints/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/fints/default.nix b/pkgs/development/python-modules/fints/default.nix
index ff1fd5cd52a3..af03514a81bc 100644
--- a/pkgs/development/python-modules/fints/default.nix
+++ b/pkgs/development/python-modules/fints/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     hash = "sha256-ll2+PtcGQiY5nbQTKVetd2ecDBVSXgzWP4Vzzri1Trs=";
   };
 
+  pythonRelaxDeps = [ "lxml" ];
+
   pythonRemoveDeps = [ "enum-tools" ];
 
   build-system = [ setuptools ];

From 8870a8c226f3ce615a258cee034dc4b32fc2446c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 12:19:41 +0200
Subject: [PATCH 1053/1209] pretix-banktool: unpin fints_4

This was tested in production and not only is fints 5.x compatible, it is
also required to have support for newer formats and protocols that banks
require.
---
 pkgs/by-name/pr/pretix-banktool/package.nix | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/pr/pretix-banktool/package.nix b/pkgs/by-name/pr/pretix-banktool/package.nix
index 00634df8a597..f962b749a55b 100644
--- a/pkgs/by-name/pr/pretix-banktool/package.nix
+++ b/pkgs/by-name/pr/pretix-banktool/package.nix
@@ -4,14 +4,7 @@
   fetchFromGitHub,
 }:
 
-let
-  pythonPackages = python3Packages.overrideScope (
-    self: super: {
-      fints = self.fints_4;
-    }
-  );
-in
-pythonPackages.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pretix-banktool";
   version = "1.1.0";
   pyproject = true;
@@ -23,15 +16,17 @@ pythonPackages.buildPythonApplication (finalAttrs: {
     hash = "sha256-x6P+WqrOak5/gmMEmBkHrx6kPsbSOAXbKRbndFG3IJU=";
   };
 
-  build-system = with pythonPackages; [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = with pythonPackages; [
+  dependencies = with python3Packages; [
     click
     fints
     requests
     mt-940
   ];
 
+  pythonRelaxDeps = [ "fints" ];
+
   doCheck = false; # no tests
 
   pythonImportsCheck = [ "pretix_banktool" ];

From ef3904a59b78466dc769e1a214f226c1069efefc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 12:21:38 +0200
Subject: [PATCH 1054/1209] python3Packages.fints_4: drop

Only consumer was pretix-banktool, which now depends on fints 5.x.
---
 pkgs/development/python-modules/fints/4.nix | 53 ---------------------
 pkgs/top-level/python-aliases.nix           |  1 +
 pkgs/top-level/python-packages.nix          |  2 -
 3 files changed, 1 insertion(+), 55 deletions(-)
 delete mode 100644 pkgs/development/python-modules/fints/4.nix

diff --git a/pkgs/development/python-modules/fints/4.nix b/pkgs/development/python-modules/fints/4.nix
deleted file mode 100644
index 089e022842eb..000000000000
--- a/pkgs/development/python-modules/fints/4.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  setuptools,
-  fetchFromGitHub,
-  bleach,
-  mt-940,
-  pretix-banktool,
-  requests,
-  sepaxml,
-  pytestCheckHook,
-  pytest-mock,
-}:
-
-buildPythonPackage rec {
-  version = "4.2.4";
-  pname = "fints";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "raphaelm";
-    repo = "python-fints";
-    tag = "v${version}";
-    hash = "sha256-la5vpWBoZ7hZsAyjjCqHpFfOykDVosI/S9amox1dmzY=";
-  };
-
-  pythonRemoveDeps = [ "enum-tools" ];
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    bleach
-    mt-940
-    requests
-    sepaxml
-  ];
-
-  __darwinAllowLocalNetworking = true;
-
-  pythonImportsCheck = [ "fints" ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-mock
-  ];
-
-  meta = {
-    homepage = "https://github.com/raphaelm/python-fints/";
-    description = "Pure-python FinTS (formerly known as HBCI) implementation";
-    license = lib.licenses.lgpl3Only;
-    inherit (pretix-banktool.meta) maintainers;
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 6a6b404bb7b1..6254f0646181 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -223,6 +223,7 @@ mapAliases {
   fenics = throw "fenics has been removed, use fenics-dolfinx instead"; # added 2025-08-07
   filebrowser_safe = throw "'filebrowser_safe' has been renamed to/replaced by 'filebrowser-safe'"; # Converted to throw 2025-10-29
   filesplit = throw "filesplit has been removed, since it is unmaintained"; # added 2025-08-20
+  fints_4 = throw "fints_4 has been removed, migrate to fints"; # added 2026-06-04
   flake8-future-import = throw "'flake8-future-import' has been removed as it was unmaintained upstream"; # Added 2026-03-22
   flask-security-too = throw "'flask-security-too' has been renamed to/replaced by 'flask-security'"; # Converted to throw 2025-10-29
   flask-silk = throw "flask-silk was removed, as it is unmaintained since 2018."; # added 2025-05-25
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 746f0c3bb0d2..b17fb904a8e7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5731,8 +5731,6 @@ self: super: with self; {
 
   fints = callPackage ../development/python-modules/fints { };
 
-  fints_4 = callPackage ../development/python-modules/fints/4.nix { };
-
   finvizfinance = callPackage ../development/python-modules/finvizfinance { };
 
   fiona = callPackage ../development/python-modules/fiona { };

From 58faee2f3e93d1d6974accfd07fab08db10f2c96 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 4 Jul 2026 10:59:23 +0000
Subject: [PATCH 1055/1209] python3Packages.keras: disable failing test

---
 pkgs/development/python-modules/keras/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index 9de28fa56d6d..cfaa0ac635c7 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -130,6 +130,10 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTestPaths = [
+    # np.cross is deprecated for 2d arrays starting from numpy 2.5.0
+    # ValueError: Both input arrays must be (arrays of) 3-dimensional vectors, but they are 3 and 2 dimensional instead
+    "keras/src/ops/numpy_test.py::NumpyTwoInputOpsCorrectnessTest::test_cross"
+
     # Require unpackaged `grain`
     "keras/src/layers/preprocessing/data_layer_test.py"
     "keras/src/layers/preprocessing/discretization_test.py"

From 1dca7c9e94bb5bc91830e4e2266237f169079255 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 15:06:47 +0200
Subject: [PATCH 1056/1209] python3Packages.fastlite: pin setuptools 80 for
 pkg_resources

---
 pkgs/development/python-modules/fastlite/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fastlite/default.nix b/pkgs/development/python-modules/fastlite/default.nix
index c1c9efde7f3e..705585945d13 100644
--- a/pkgs/development/python-modules/fastlite/default.nix
+++ b/pkgs/development/python-modules/fastlite/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 
   # build-system
-  setuptools,
+  setuptools_80,
 
   # dependencies
   fastcore,
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   build-system = [
-    setuptools
+    setuptools_80
   ];
 
   dependencies = [

From d1fce43f43bb8ccf76e0926a2e486d4c28aaa9b0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 15:16:50 +0200
Subject: [PATCH 1057/1209] python3Packages.cirq-*: 1.6.1 -> 1.7.0

https://github.com/quantumlib/Cirq/releases/tag/v1.7.0
---
 .../python-modules/cirq-aqt/default.nix        |  6 +++++-
 .../python-modules/cirq-core/default.nix       | 18 ++++--------------
 .../python-modules/cirq-google/default.nix     |  2 ++
 .../python-modules/cirq-ionq/default.nix       |  6 +++++-
 .../python-modules/cirq-pasqal/default.nix     |  6 +++++-
 .../python-modules/cirq-web/default.nix        |  6 +++++-
 6 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/python-modules/cirq-aqt/default.nix b/pkgs/development/python-modules/cirq-aqt/default.nix
index 58ceb5c600b2..e14be31559b1 100644
--- a/pkgs/development/python-modules/cirq-aqt/default.nix
+++ b/pkgs/development/python-modules/cirq-aqt/default.nix
@@ -2,6 +2,7 @@
   buildPythonPackage,
   cirq-core,
   requests,
+  pytest-benchmark,
   pytestCheckHook,
   setuptools,
 }:
@@ -24,7 +25,10 @@ buildPythonPackage rec {
     requests
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-benchmark
+    pytestCheckHook
+  ];
 
   # cirq's importlib hook doesn't work here
   #pythonImportsCheck = [ "cirq_aqt" ];
diff --git a/pkgs/development/python-modules/cirq-core/default.nix b/pkgs/development/python-modules/cirq-core/default.nix
index 7ebedaaf9686..41adf3d10328 100644
--- a/pkgs/development/python-modules/cirq-core/default.nix
+++ b/pkgs/development/python-modules/cirq-core/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   # build-system
   setuptools,
@@ -31,6 +30,7 @@
   # tests
   freezegun,
   pytest-asyncio,
+  pytest-benchmark,
   pytestCheckHook,
 
   withContribRequires ? false,
@@ -38,29 +38,18 @@
 
 buildPythonPackage rec {
   pname = "cirq-core";
-  version = "1.6.1";
+  version = "1.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "quantumlib";
     repo = "cirq";
     tag = "v${version}";
-    hash = "sha256-M+ojGXJOnrBipjSA9hd3++yTS70kCjPru9FG/rm7zI8=";
+    hash = "sha256-OAyBYzMEFyVMlxN5UjrKk1x2rSayLyAIAC5h96JeqK0=";
   };
 
   sourceRoot = "${src.name}/${pname}";
 
-  patches = [
-    # Upstream PR: https://github.com/quantumlib/Cirq/pull/7761
-    (fetchpatch {
-      name = "python-3.14.patch";
-      url = "https://github.com/quantumlib/Cirq/commit/9aea3bad824cac77031c163d6d6f5cf3e01cfe80.patch";
-      stripLen = 1;
-      includes = [ "cirq/ops/linear_combinations_test.py" ];
-      hash = "sha256-Ggcaswrdx6mOfNOwlbWE2ix7aZWt3/Fljb4i1ow+lUU=";
-    })
-  ];
-
   pythonRelaxDeps = [ "matplotlib" ];
 
   build-system = [ setuptools ];
@@ -91,6 +80,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     freezegun
     pytest-asyncio
+    pytest-benchmark
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/cirq-google/default.nix b/pkgs/development/python-modules/cirq-google/default.nix
index 6737ce491da3..ab706085b038 100644
--- a/pkgs/development/python-modules/cirq-google/default.nix
+++ b/pkgs/development/python-modules/cirq-google/default.nix
@@ -5,6 +5,7 @@
   google-api-core,
   protobuf,
   freezegun,
+  pytest-benchmark,
   pytestCheckHook,
   typedunits,
 }:
@@ -32,6 +33,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     freezegun
+    pytest-benchmark
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/cirq-ionq/default.nix b/pkgs/development/python-modules/cirq-ionq/default.nix
index 8522bc23e0e3..21d95a5a7858 100644
--- a/pkgs/development/python-modules/cirq-ionq/default.nix
+++ b/pkgs/development/python-modules/cirq-ionq/default.nix
@@ -2,6 +2,7 @@
   buildPythonPackage,
   cirq-core,
   requests,
+  pytest-benchmark,
   pytestCheckHook,
   setuptools,
 }:
@@ -24,7 +25,10 @@ buildPythonPackage rec {
     requests
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-benchmark
+    pytestCheckHook
+  ];
 
   # cirq's importlib hook doesn't work here
   #pythonImportsCheck = [ "cirq_ionq" ];
diff --git a/pkgs/development/python-modules/cirq-pasqal/default.nix b/pkgs/development/python-modules/cirq-pasqal/default.nix
index db0e5d2455b5..82c792e7772b 100644
--- a/pkgs/development/python-modules/cirq-pasqal/default.nix
+++ b/pkgs/development/python-modules/cirq-pasqal/default.nix
@@ -2,6 +2,7 @@
   buildPythonPackage,
   cirq-core,
   requests,
+  pytest-benchmark,
   pytestCheckHook,
   setuptools,
 }:
@@ -24,7 +25,10 @@ buildPythonPackage rec {
     requests
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-benchmark
+    pytestCheckHook
+  ];
 
   # cirq's importlib hook doesn't work here
   #pythonImportsCheck = [ "cirq_pasqal" ];
diff --git a/pkgs/development/python-modules/cirq-web/default.nix b/pkgs/development/python-modules/cirq-web/default.nix
index 782aec95c4ef..c091bf20eedf 100644
--- a/pkgs/development/python-modules/cirq-web/default.nix
+++ b/pkgs/development/python-modules/cirq-web/default.nix
@@ -1,6 +1,7 @@
 {
   buildPythonPackage,
   cirq-core,
+  pytest-benchmark,
   pytestCheckHook,
   setuptools,
 }:
@@ -16,7 +17,10 @@ buildPythonPackage rec {
 
   dependencies = [ cirq-core ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-benchmark
+    pytestCheckHook
+  ];
 
   # cirq's importlib hook doesn't work here
   #pythonImportsCheck = [ "cirq_web" ];

From 25a7ae8e4c86afa2ed78af02b60bc0bc666897d3 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Fri, 3 Jul 2026 18:43:33 -0400
Subject: [PATCH 1058/1209] lib.platforms: move primary systems to the
 beginning of the list

---
 lib/systems/doubles.nix | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index 6c7457930e09..3970b69735a9 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -14,13 +14,16 @@ let
   inherit (lib.attrsets) matchAttrs;
 
   all = [
+    # our primary systems. at the top of the list for fastest matching
+    # inside check-meta
+    "x86_64-linux"
+    "aarch64-darwin"
+    "aarch64-linux"
+
     # Cygwin
     "i686-cygwin"
     "x86_64-cygwin"
 
-    # Darwin
-    "aarch64-darwin"
-
     # FreeBSD
     "i686-freebsd"
     "x86_64-freebsd"
@@ -37,8 +40,7 @@ let
     # JS
     "javascript-ghcjs"
 
-    # Linux
-    "aarch64-linux"
+    # Linux (excluding the primary two at the top)
     "arc-linux"
     "armv5tel-linux"
     "armv6l-linux"
@@ -61,7 +63,6 @@ let
     "riscv64-linux"
     "s390-linux"
     "s390x-linux"
-    "x86_64-linux"
 
     # MMIXware
     "mmix-mmixware"

From 2ec73a9c5870023fbebaca59baf972ffcc1343fd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 16:32:17 +0200
Subject: [PATCH 1059/1209] python3Packages.strct: pin setuptools 80 for
 pkg_resources

---
 pkgs/development/python-modules/strct/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/strct/default.nix b/pkgs/development/python-modules/strct/default.nix
index ff38db934034..dd481a5fb52a 100644
--- a/pkgs/development/python-modules/strct/default.nix
+++ b/pkgs/development/python-modules/strct/default.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
-  setuptools,
+  setuptools_80,
   pytestCheckHook,
   pytest-cov-stub,
   sortedcontainers,
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   # don't append .dev0 to version
   env.RELEASING_PROCESS = "1";
 
-  nativeBuildInputs = [ setuptools ];
+  nativeBuildInputs = [ setuptools_80 ];
 
   nativeCheckInputs = [
     pytestCheckHook

From ff8cd76c6ff85fb88ff7952e5c3ab53d1cf75daf Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 4 Jul 2026 15:07:26 +0100
Subject: [PATCH 1060/1209] python{313,314}Packages.pikepdf: fix build with
 Clang

---
 pkgs/development/python-modules/pikepdf/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index ef7b972ce3e8..3dc5a8698748 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -1,7 +1,9 @@
 {
   lib,
+  stdenv,
   attrs,
   buildPythonPackage,
+  clang-tools,
   cmake,
   fetchFromGitHub,
   hypothesis,
@@ -63,6 +65,13 @@ buildPythonPackage rec {
     nanobind
     ninja
     scikit-build-core
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    # Pick up the `clang-scan-deps` wrapper for CMake; see:
+    #
+    # * <https://github.com/NixOS/nixpkgs/issues/452260>
+    # * <https://github.com/NixOS/nixpkgs/pull/514323>
+    clang-tools
   ];
 
   dontUseCmakeConfigure = true;

From c79bfd86cb0a2914c78f6767678e6d06adbe29f6 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 4 Jul 2026 15:10:01 +0100
Subject: [PATCH 1061/1209] poppler: fix build with Clang

---
 pkgs/development/libraries/poppler/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index a993e864d200..19b690099e07 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -4,6 +4,7 @@
   fetchurl,
   fetchFromGitLab,
   cairo,
+  clang-tools,
   cmake,
   boost,
   curl,
@@ -81,6 +82,13 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!minimal) [
     glib # for glib-mkenums
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    # Pick up the `clang-scan-deps` wrapper for CMake; see:
+    #
+    # * <https://github.com/NixOS/nixpkgs/issues/452260>
+    # * <https://github.com/NixOS/nixpkgs/pull/514323>
+    clang-tools
   ];
 
   buildInputs = [

From b8aef9774fa389f6a2e6ead882c12efea4bf8e7f Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 4 Jul 2026 15:12:54 +0100
Subject: [PATCH 1062/1209] ldacbt: fix `pname`

Per the guidelines in `pkgs/README.md`.
---
 pkgs/by-name/ld/ldacbt/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ld/ldacbt/package.nix b/pkgs/by-name/ld/ldacbt/package.nix
index de766de0d615..007000dcbd24 100644
--- a/pkgs/by-name/ld/ldacbt/package.nix
+++ b/pkgs/by-name/ld/ldacbt/package.nix
@@ -5,7 +5,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "ldacBT";
+  pname = "ldacbt";
   version = "2.0.72";
 
   src = fetchFromGitHub {

From 3d2d83769d69847322e2fc806834aa6090b325e0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 16:37:48 +0200
Subject: [PATCH 1063/1209] platformio: disable failing test in overriden
 marshmallow

---
 pkgs/by-name/pl/platformio-core/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pl/platformio-core/package.nix b/pkgs/by-name/pl/platformio-core/package.nix
index f335bbe37d0d..13412ef77db5 100644
--- a/pkgs/by-name/pl/platformio-core/package.nix
+++ b/pkgs/by-name/pl/platformio-core/package.nix
@@ -24,7 +24,12 @@ let
           hash = "sha256-l5pEhv8D6jRlU24SlsGQEkXda/b7KUdP9mAqrZCbl38=";
         };
 
-        propagatedBuildInputs = with python3.pkgs; [ packaging ];
+        dependencies = with python3.pkgs; [ packaging ];
+
+        disabledTests = [
+          # 'year must be in 1..9999, not 292278994' instead of 'out of range'
+          "test_from_timestamp_with_overflow_value"
+        ];
       });
     };
   };

From d358a7ef59b2b5a5206850816aa8a2b2113f4432 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sat, 4 Jul 2026 16:42:30 +0200
Subject: [PATCH 1064/1209] python3Packages.nibabel: 5.3.3 -> 5.4.2

Changelog: https://github.com/nipy/nibabel/blob/5.4.2/Changelog
Diff: https://github.com/nipy/nibabel/compare/5.3.3...5.4.2
---
 .../python-modules/nibabel/default.nix        | 33 +++++++------------
 1 file changed, 11 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/python-modules/nibabel/default.nix b/pkgs/development/python-modules/nibabel/default.nix
index 0873da577050..01d931aaeabb 100644
--- a/pkgs/development/python-modules/nibabel/default.nix
+++ b/pkgs/development/python-modules/nibabel/default.nix
@@ -2,8 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch2,
-  pythonAtLeast,
   pythonOlder,
 
   # build-system
@@ -17,6 +15,9 @@
   typing-extensions,
 
   # optional-dependencies
+  backports-zstd,
+  indexed-gzip,
+  matplotlib,
   pydicom,
   pillow,
   h5py,
@@ -27,28 +28,21 @@
   pytest-doctestplus,
   pytest-httpserver,
   pytest-xdist,
-  pytest7CheckHook,
+  pytestCheckHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "nibabel";
-  version = "5.3.3";
+  version = "5.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nipy";
     repo = "nibabel";
     tag = finalAttrs.version;
-    hash = "sha256-Kdz7kCY5QnA9OiV/FPW1RerjP1GGLn+YaTwFpA0dJAM=";
+    hash = "sha256-QzkmSI0JGdIXLc3XSPZrGrBYSq98tLFrozNNopR/ytg=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/nipy/nibabel/commit/3f40a3bc0c4bd996734576a15785ad0f769a963a.patch?full_index=1";
-      hash = "sha256-URsxgP6Sd5IIOX20GtAYtWBWOhw+Hiuhgu1oa8o8NXk=";
-    })
-  ];
-
   build-system = [
     hatch-vcs
     hatchling
@@ -62,14 +56,14 @@ buildPythonPackage (finalAttrs: {
   ++ lib.optionals (pythonOlder "3.13") [ typing-extensions ];
 
   optional-dependencies = lib.fix (self: {
-    all = self.dicom ++ self.dicomfs ++ self.minc2 ++ self.spm ++ self.zstd;
+    all = self.dicomfs ++ self.indexed_gzip ++ self.minc2 ++ self.spm ++ self.zstd;
     dicom = [ pydicom ];
     dicomfs = [ pillow ] ++ self.dicom;
+    indexed_gzip = [ indexed-gzip ];
     minc2 = [ h5py ];
     spm = [ scipy ];
-    zstd = [
-      # TODO: pyzstd
-    ];
+    viewers = [ matplotlib ];
+    zstd = lib.optionals (pythonOlder "3.14") [ backports-zstd ];
   });
 
   nativeCheckInputs = [
@@ -78,15 +72,10 @@ buildPythonPackage (finalAttrs: {
     pytest-doctestplus
     pytest-httpserver
     pytest-xdist
-    pytest7CheckHook
+    pytestCheckHook
   ]
   ++ finalAttrs.passthru.optional-dependencies.all;
 
-  disabledTests = lib.optionals (pythonAtLeast "3.14") [
-    # https://github.com/nipy/nibabel/issues/1390
-    "test_deprecator_maker"
-  ];
-
   meta = {
     homepage = "https://nipy.org/nibabel";
     changelog = "https://github.com/nipy/nibabel/blob/${finalAttrs.version}/Changelog";

From 07cce70db5f949c031a59b43d658b06fbd4a78b8 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sat, 4 Jul 2026 16:44:17 +0200
Subject: [PATCH 1065/1209] python3Packages.nibabel: add `pythonImportsCheck`

---
 pkgs/development/python-modules/nibabel/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/nibabel/default.nix b/pkgs/development/python-modules/nibabel/default.nix
index 01d931aaeabb..ae8c93a4d742 100644
--- a/pkgs/development/python-modules/nibabel/default.nix
+++ b/pkgs/development/python-modules/nibabel/default.nix
@@ -76,6 +76,8 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ finalAttrs.passthru.optional-dependencies.all;
 
+  pythonImportsCheck = [ "nibabel" ];
+
   meta = {
     homepage = "https://nipy.org/nibabel";
     changelog = "https://github.com/nipy/nibabel/blob/${finalAttrs.version}/Changelog";

From 8f2f727a6786bede3b45b2ae637dc0b88299306d Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 4 Jul 2026 15:11:38 +0100
Subject: [PATCH 1066/1209] opencv: work around `ld64` hardening issue

---
 pkgs/development/libraries/opencv/4.x.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index d5ce326d29b6..28f66d07bef3 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -89,6 +89,9 @@
 
   bzip2,
   callPackage,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }@inputs:
 
 let
@@ -470,6 +473,10 @@ effectiveStdenv.mkDerivation {
   )
   ++ optionals enableCuda [
     cudaPackages.cuda_nvcc
+  ]
+  # TODO: Clean up on `staging`.
+  ++ optionals effectiveStdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   env = {
@@ -559,6 +566,10 @@ effectiveStdenv.mkDerivation {
   ]
   ++ optionals (enabledModules != [ ]) [
     (cmakeFeature "BUILD_LIST" (concatStringsSep "," enabledModules))
+  ]
+  # TODO: Clean up on `staging`.
+  ++ optionals effectiveStdenv.hostPlatform.isDarwin [
+    (cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   postBuild = optionalString enableDocs ''

From 41633c73d0a8547342e4aebaae574fe40a36b20b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 4 Jul 2026 15:47:11 +0100
Subject: [PATCH 1067/1209] ldacbt: restore previous little endian comment
 wording

This was made less clear in the rewrite.
---
 pkgs/by-name/ld/ldacbt/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ld/ldacbt/package.nix b/pkgs/by-name/ld/ldacbt/package.nix
index 007000dcbd24..67f5bc7eb8f8 100644
--- a/pkgs/by-name/ld/ldacbt/package.nix
+++ b/pkgs/by-name/ld/ldacbt/package.nix
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Sony LDAC Bluetooth decoder library (from AOSP via open-vela)";
     homepage = "https://github.com/open-vela/external_libldac";
     license = lib.licenses.asl20;
-    # LDAC bitstream format assumes LE; source has endian checks
+    # libldac code detects & #error's out on non-LE byte order
     platforms = lib.platforms.littleEndian;
     maintainers = with lib.maintainers; [ qweered ];
   };

From 5730d31289f61338bdb8cbe8a1e1138d3c3665cb Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 4 Jul 2026 15:47:11 +0100
Subject: [PATCH 1068/1209] ldacbt: use Meson to build

---
 pkgs/by-name/ld/ldacbt/meson.build | 52 +++++++++++++++++
 pkgs/by-name/ld/ldacbt/package.nix | 90 +++++-------------------------
 2 files changed, 67 insertions(+), 75 deletions(-)
 create mode 100644 pkgs/by-name/ld/ldacbt/meson.build

diff --git a/pkgs/by-name/ld/ldacbt/meson.build b/pkgs/by-name/ld/ldacbt/meson.build
new file mode 100644
index 000000000000..1bd0a8ca2e96
--- /dev/null
+++ b/pkgs/by-name/ld/ldacbt/meson.build
@@ -0,0 +1,52 @@
+project(
+  'ldacbt',
+  'c',
+  meson_version: '>=1.10.0',
+  version: files('VERSION'),
+)
+
+pkg = import('pkgconfig')
+
+cc = meson.get_compiler('c')
+dep_m = cc.find_library('m')
+
+lib = library(
+  'ldacBT',
+  'abr/src/ldacBT_abr.c',
+  'src/ldacBT.c',
+  'src/ldaclib.c',
+  include_directories: [
+    'abr/inc',
+    'inc',
+  ],
+  dependencies: [dep_m],
+  version: meson.project_version(),
+  install: true,
+)
+
+install_headers(
+  'abr/inc/ldacBT_abr.h',
+  'inc/ldacBT.h',
+  subdir: 'ldac',
+)
+
+pkg.generate(
+  lib,
+  name: 'ldacBT-enc',
+  description: 'LDAC Bluetooth encoder',
+  subdirs: 'ldac',
+)
+
+pkg.generate(
+  lib,
+  name: 'ldacBT-abr',
+  description: 'LDAC Bluetooth ABR library',
+  subdirs: 'ldac',
+)
+
+pkg.generate(
+  lib,
+  name: 'ldacBT-dec',
+  description: 'LDAC Bluetooth decoder',
+  subdirs: 'ldac',
+)
diff --git a/pkgs/by-name/ld/ldacbt/package.nix b/pkgs/by-name/ld/ldacbt/package.nix
index 67f5bc7eb8f8..532babd3cbf5 100644
--- a/pkgs/by-name/ld/ldacbt/package.nix
+++ b/pkgs/by-name/ld/ldacbt/package.nix
@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  meson,
+  ninja,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -24,87 +26,25 @@ stdenv.mkDerivation (finalAttrs: {
     ./0001-abr-drop-support-for-dynamic-loading-libldac.patch
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-O2 -fPIC -fno-merge-constants -Wall -Iinc -Isrc -Iabr/inc";
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  mesonBuildType = "release";
+
+  # The upstream build system is tied to AOSP, so we use our own Meson
+  # definitions to replace it.
+  postPatch = ''
+    ln -s ${./meson.build} meson.build
 
-  # Verify finalAttrs.version matches LDACBT_LIB_VER_* in upstream source.
-  # Guards against silent version drift when the pinned commit changes.
-  preBuild = ''
     awk -v want=${finalAttrs.version} '
       /^#define LDACBT_LIB_VER_/ { v = v sep ($3+0); sep = "." }
       END {
         if (v != want) { print "version mismatch: package says " want ", source reports " v > "/dev/stderr"; exit 1 }
+        print v
       }
-    ' src/ldacBT_api.c
-  '';
-
-  # Upstream ships AOSP build files and a gcc/ makefile that only knows
-  # about the in-tree layout. Compile and link directly; the entire
-  # library is two umbrella translation units.
-  buildPhase = ''
-    runHook preBuild
-
-    soname=libldacBT.so.${lib.versions.major finalAttrs.version}
-    sofile=libldacBT.so.${finalAttrs.version}
-
-    $CC -shared -Wl,-soname,$soname src/ldaclib.c src/ldacBT.c abr/src/ldacBT_abr.c -lm -o $sofile
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 -t $out/lib $sofile
-    ln -s $sofile $out/lib/$soname
-    ln -s $sofile $out/lib/libldacBT.so
-
-    install -Dm644 inc/ldacBT.h $dev/include/ldac/ldacBT.h
-    install -Dm644 abr/inc/ldacBT_abr.h $dev/include/ldac/ldacBT_abr.h
-
-    mkdir -p $dev/lib/pkgconfig
-    cat > $dev/lib/pkgconfig/ldacBT-dec.pc <<EOF
-    prefix=$out
-    exec_prefix=\''${prefix}
-    libdir=$out/lib
-    includedir=$dev/include/ldac
-
-    Name: ldacBT-dec
-    Description: LDAC Bluetooth decoder
-    Version: ${finalAttrs.version}
-    Libs: -L\''${libdir} -lldacBT
-    Libs.private: -lm
-    Cflags: -I\''${includedir}
-    EOF
-
-    cat > $dev/lib/pkgconfig/ldacBT-enc.pc <<EOF
-    prefix=$out
-    exec_prefix=\''${prefix}
-    libdir=$out/lib
-    includedir=$dev/include/ldac
-
-    Name: ldacBT-enc
-    Description: LDAC Bluetooth encoder
-    Version: ${finalAttrs.version}
-    Libs: -L\''${libdir} -lldacBT
-    Libs.private: -lm
-    Cflags: -I\''${includedir}
-    EOF
-
-    cat > $dev/lib/pkgconfig/ldacBT-abr.pc <<EOF
-    prefix=$out
-    exec_prefix=\''${prefix}
-    libdir=$out/lib
-    includedir=$dev/include/ldac
-
-    Name: ldacBT-abr
-    Description: LDAC Bluetooth ABR library
-    Version: ${finalAttrs.version}
-    Libs: -L\''${libdir} -lldacBT
-    Libs.private: -lm
-    Cflags: -I\''${includedir}
-    EOF
-
-    runHook postInstall
+    ' src/ldacBT_api.c > VERSION
   '';
 
   meta = {

From 7bcbc4e9f5368a0c12084e65b95cc58186e9b581 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 4 Jul 2026 15:47:11 +0100
Subject: [PATCH 1069/1209] ldacbt: fix the build on Darwin

---
 .../make-byte-order-checks-portable.patch     | 55 +++++++++++++++++++
 pkgs/by-name/ld/ldacbt/package.nix            |  4 ++
 2 files changed, 59 insertions(+)
 create mode 100644 pkgs/by-name/ld/ldacbt/make-byte-order-checks-portable.patch

diff --git a/pkgs/by-name/ld/ldacbt/make-byte-order-checks-portable.patch b/pkgs/by-name/ld/ldacbt/make-byte-order-checks-portable.patch
new file mode 100644
index 000000000000..c357bed9881c
--- /dev/null
+++ b/pkgs/by-name/ld/ldacbt/make-byte-order-checks-portable.patch
@@ -0,0 +1,55 @@
+diff --git a/src/ldacBT_internal.c b/src/ldacBT_internal.c
+index 94458854fe..ca9df42c72 100644
+--- a/src/ldacBT_internal.c
++++ b/src/ldacBT_internal.c
+@@ -241,7 +241,7 @@
+             char *p_pcm_8 = (char *)pbuff;
+             char *p_lch_8 = (char *)ap_pcm[0];
+             char *p_rch_8 = (char *)ap_pcm[1];
+-#if __BYTE_ORDER == __LITTLE_ENDIAN
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+             for (i = 0; i < nsmpl; i++) {
+                 *p_lch_8++ = p_pcm_8[0];
+                 *p_lch_8++ = p_pcm_8[1];
+@@ -252,24 +252,24 @@
+                 *p_rch_8++ = p_pcm_8[2];
+                 p_pcm_8+=3;
+             }
+-#else   /* __BYTE_ORDER */
++#else   /* __BYTE_ORDER__ */
+ #error unsupported byte order
+-#endif  /* #if __BYTE_ORDER == __LITTLE_ENDIAN */
++#endif  /* #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ */
+         }
+         else if ( fmt == LDACBT_SMPL_FMT_S32 ){
+             char *p_pcm_8 = (char *)pbuff;
+             char *p_lch_8 = (char *)ap_pcm[0];
+             char *p_rch_8 = (char *)ap_pcm[1];
+-#if __BYTE_ORDER == __LITTLE_ENDIAN
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+             for (i = 0; i < nsmpl; i++) {
+                 *p_lch_8++ = p_pcm_8[0]; *p_lch_8++ = p_pcm_8[1]; *p_lch_8++ = p_pcm_8[2]; *p_lch_8++ = p_pcm_8[3];
+                 p_pcm_8+=4;
+                 *p_rch_8++ = p_pcm_8[0]; *p_rch_8++ = p_pcm_8[1]; *p_rch_8++ = p_pcm_8[2]; *p_rch_8++ = p_pcm_8[3];
+                 p_pcm_8+=4;
+             }
+-#else   /* __BYTE_ORDER */
++#else   /* __BYTE_ORDER__ */
+ #error unsupported byte order
+-#endif  /* #if __BYTE_ORDER == __LITTLE_ENDIAN */
++#endif  /* #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ */
+         }
+         else if ( fmt == LDACBT_SMPL_FMT_F32 ){
+             float *p_pcm = (float *)pbuff;
+diff --git a/src/ldacBT_internal.h b/src/ldacBT_internal.h
+index 70dac607e7..170d14be7d 100644
+--- a/src/ldacBT_internal.h
++++ b/src/ldacBT_internal.h
+@@ -9,7 +9,6 @@
+ 
+ #include <stdlib.h>
+ #include <string.h>
+-#include <endian.h>
+ #ifdef ANDROID
+ #include <stdint.h>
+ #include <unistd.h>
diff --git a/pkgs/by-name/ld/ldacbt/package.nix b/pkgs/by-name/ld/ldacbt/package.nix
index 532babd3cbf5..62ade6e1b577 100644
--- a/pkgs/by-name/ld/ldacbt/package.nix
+++ b/pkgs/by-name/ld/ldacbt/package.nix
@@ -24,6 +24,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./0001-abr-drop-support-for-dynamic-loading-libldac.patch
+
+    # Darwin doesn’t have `<endian.h>`; use the predefined GCC/Clang
+    # macros instead.
+    ./make-byte-order-checks-portable.patch
   ];
 
   nativeBuildInputs = [

From e1dc830f54929baf820cb5a7fe8de8e920dc246e Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Sat, 4 Jul 2026 12:07:02 -0500
Subject: [PATCH 1070/1209] awscli2: relax urllib3 version constraint

---
 pkgs/by-name/aw/awscli2/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/aw/awscli2/package.nix b/pkgs/by-name/aw/awscli2/package.nix
index be8022c2300a..c7056f3d61c2 100644
--- a/pkgs/by-name/aw/awscli2/package.nix
+++ b/pkgs/by-name/aw/awscli2/package.nix
@@ -75,6 +75,7 @@ py.pkgs.buildPythonApplication rec {
       --replace-fail 'prompt-toolkit>=3.0.24,<3.0.52' 'prompt-toolkit>=3.0.24' \
       --replace-fail 'ruamel_yaml>=0.15.0,<=0.19.1' 'ruamel_yaml>=0.15.0' \
       --replace-fail 'ruamel_yaml_clib>=0.2.0,<=0.2.15' 'ruamel_yaml_clib>=0.2.0' \
+      --replace-fail 'urllib3>=1.25.4,<=2.6.3' 'urllib3>=1.25.4' \
       --replace-fail 'wcwidth<0.3.0' 'wcwidth>=0.3.0'
 
     substituteInPlace requirements-base.txt \

From 5ee94d0c8f074cb1effde3997ddc2cccbbddc331 Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Sat, 4 Jul 2026 12:20:53 -0500
Subject: [PATCH 1071/1209] awscli2: use standard-format CA bundle for awscrt

---
 pkgs/by-name/aw/awscli2/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/aw/awscli2/package.nix b/pkgs/by-name/aw/awscli2/package.nix
index c7056f3d61c2..c30ddabf05f2 100644
--- a/pkgs/by-name/aw/awscli2/package.nix
+++ b/pkgs/by-name/aw/awscli2/package.nix
@@ -86,7 +86,7 @@ py.pkgs.buildPythonApplication rec {
     # through PYTHONPATH
     sed -i '/pip>=/d' requirements/bootstrap.txt
 
-    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt awscli/botocore/cacert.pem
+    ln -sf ${cacert}/etc/ssl/certs/ca-no-trust-rules-bundle.crt awscli/botocore/cacert.pem
   '';
 
   nativeBuildInputs = [

From 33a24068654d0ad1ed412cedc352d524a2ce2294 Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Sat, 4 Jul 2026 12:20:54 -0500
Subject: [PATCH 1072/1209] python3Packages.botocore: use standard-format CA
 bundle for awscrt

---
 pkgs/development/python-modules/botocore/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 810b95dfb660..706731f2dcf4 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   };
 
   postPatch = ''
-    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt botocore/cacert.pem
+    ln -sf ${cacert}/etc/ssl/certs/ca-no-trust-rules-bundle.crt botocore/cacert.pem
   '';
 
   build-system = [

From 353395589e940085048c8c94aa2431b70deaecd6 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 4 Jul 2026 18:10:44 +0100
Subject: [PATCH 1073/1209] python{313,314}Packages.pendulum: fix the build on
 Darwin

---
 .../python-modules/pendulum/default.nix       | 12 +++---
 .../pendulum/delete-obsolete-cargo-toml.patch | 39 +++++++++++++++++++
 2 files changed, 46 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/development/python-modules/pendulum/delete-obsolete-cargo-toml.patch

diff --git a/pkgs/development/python-modules/pendulum/default.nix b/pkgs/development/python-modules/pendulum/default.nix
index 662acb08c292..0ca5fd267f9e 100644
--- a/pkgs/development/python-modules/pendulum/default.nix
+++ b/pkgs/development/python-modules/pendulum/default.nix
@@ -7,9 +7,6 @@
   # build-system
   rustPlatform,
 
-  # native dependencies
-  iconv,
-
   # dependencies
   python-dateutil,
   tzdata,
@@ -31,6 +28,13 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-zpBymeYhCy+yu6RPhOuN5xOVk6928hd3+oRsfiBPPuY=";
   };
 
+  patches = [
+    # Fix the build on Darwin.
+    #
+    # <https://github.com/python-pendulum/pendulum/pull/979>
+    ./delete-obsolete-cargo-toml.patch
+  ];
+
   cargoRoot = "rust";
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
@@ -43,8 +47,6 @@ buildPythonPackage (finalAttrs: {
     rustPlatform.cargoSetupHook
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ iconv ];
-
   dependencies = [
     python-dateutil
     tzdata
diff --git a/pkgs/development/python-modules/pendulum/delete-obsolete-cargo-toml.patch b/pkgs/development/python-modules/pendulum/delete-obsolete-cargo-toml.patch
new file mode 100644
index 000000000000..5e841e26145f
--- /dev/null
+++ b/pkgs/development/python-modules/pendulum/delete-obsolete-cargo-toml.patch
@@ -0,0 +1,39 @@
+From dd0c442ab1f50f19dde95875b39a6a4463e6e835 Mon Sep 17 00:00:00 2001
+From: Emily <hello@emily.moe>
+Date: Sat, 4 Jul 2026 18:18:19 +0100
+Subject: [PATCH] Delete obsolete `.cargo/config.toml`
+
+Maturin adds these flags by itself, but the presence of this file can
+seemingly cause them to not get added at all in some environments,
+likely related to them using their own `.cargo/config.toml` file.
+
+This was possibly caused by
+<https://github.com/PyO3/maturin/commit/74baa6714808eae61ac330c972d22a9122f9b190>,
+as we noticed it when bumping Maturin past that commit in
+Nixpkgs. Removing the file fixes the macOS build in our environment.
+---
+ rust/.cargo/config.toml | 15 ---------------
+ 1 file changed, 15 deletions(-)
+ delete mode 100644 rust/.cargo/config.toml
+
+diff --git a/rust/.cargo/config.toml b/rust/.cargo/config.toml
+deleted file mode 100644
+index f0ba8af4..00000000
+--- a/rust/.cargo/config.toml
++++ /dev/null
+@@ -1,15 +0,0 @@
+-[build]
+-rustflags = []
+-
+-# see https://pyo3.rs/main/building_and_distribution.html#macos
+-[target.x86_64-apple-darwin]
+-rustflags = [
+-  "-C", "link-arg=-undefined",
+-  "-C", "link-arg=dynamic_lookup",
+-]
+-
+-[target.aarch64-apple-darwin]
+-rustflags = [
+-  "-C", "link-arg=-undefined",
+-  "-C", "link-arg=dynamic_lookup",
+-]

From 406454f1d956dce0146a509e6a1eceada458660d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 19:38:09 +0200
Subject: [PATCH 1074/1209] python3Packages.rq: 2.9.1 -> 2.10

https://github.com/rq/rq/releases/tag/v2.10
---
 pkgs/development/python-modules/rq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rq/default.nix b/pkgs/development/python-modules/rq/default.nix
index 0efb763e3694..40457b6271dc 100644
--- a/pkgs/development/python-modules/rq/default.nix
+++ b/pkgs/development/python-modules/rq/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rq";
-  version = "2.9.1";
+  version = "2.10";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
     owner = "rq";
     repo = "rq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-arPz/+T8+NneiTur17BQehMiIIpHqqR8M8nw5LWu56o=";
+    hash = "sha256-D5K9N5egGdysskfyjriANgytHWK0E+JMvyEpJt9QJyo=";
   };
 
   build-system = [ hatchling ];

From 8e5b3d3b3c98ae7c2cdc7f8b4a1b21deaeadc168 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 19:40:55 +0200
Subject: [PATCH 1075/1209] python3Packages.django-rq: 4.1-unstable-2026-05-28
 -> 4.1.1

https://github.com/rq/django-rq/releases/tag/v4.1.1
---
 .../python-modules/django-rq/default.nix          | 12 ++++--------
 .../django-rq/redis-py-8.0-compat.patch           | 15 ---------------
 2 files changed, 4 insertions(+), 23 deletions(-)
 delete mode 100644 pkgs/development/python-modules/django-rq/redis-py-8.0-compat.patch

diff --git a/pkgs/development/python-modules/django-rq/default.nix b/pkgs/development/python-modules/django-rq/default.nix
index 330e28aca47c..990743f247e0 100644
--- a/pkgs/development/python-modules/django-rq/default.nix
+++ b/pkgs/development/python-modules/django-rq/default.nix
@@ -16,20 +16,16 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "django-rq";
-  version = "4.1-unstable-2026-05-28";
+  version = "4.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rq";
     repo = "django-rq";
-    rev = "39539ab680cf6a23073f4907b5e7332226494784";
-    hash = "sha256-Yrc0HQmCsrdTs66RZwwmZQraxB5/eJG8dOPcVn53rjA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pp8/7pMG4CHEe+jsmZ9euAV8eEMW0Hh4ecTTHnP6DiE=";
   };
 
-  patches = [
-    ./redis-py-8.0-compat.patch
-  ];
-
   build-system = [ hatchling ];
 
   dependencies = [
@@ -65,7 +61,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Simple app that provides django integration for RQ (Redis Queue)";
     homepage = "https://github.com/rq/django-rq";
-    # changelog = "https://github.com/rq/django-rq/releases/tag/${finalAttrs.src.tag}";
+    changelog = "https://github.com/rq/django-rq/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hexa ];
   };
diff --git a/pkgs/development/python-modules/django-rq/redis-py-8.0-compat.patch b/pkgs/development/python-modules/django-rq/redis-py-8.0-compat.patch
deleted file mode 100644
index e74181ad2be6..000000000000
--- a/pkgs/development/python-modules/django-rq/redis-py-8.0-compat.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/tests/utils.py b/tests/utils.py
-index 90ba1d4..e320a58 100644
---- a/tests/utils.py
-+++ b/tests/utils.py
-@@ -38,6 +38,10 @@ def get_queue_index(name='default'):
-         if q.name == name:
-             # assert that the connection is correct
-             pool_kwargs = q.connection.connection_pool.connection_kwargs
-+            pool_kwargs.pop("maint_notifications_config", None)
-+            pool_kwargs.pop("maint_notifications_pool_handler", None)
-+            connection_kwargs.pop("maint_notifications_config", None)
-+            connection_kwargs.pop("maint_notifications_pool_handler", None)
-             if not _is_buggy_retry(pool_kwargs) or not _is_buggy_retry(connection_kwargs):
-                 assert pool_kwargs == connection_kwargs
-             else:

From cedb384656946f108e086369407fa1ff9dd220ac Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:08:37 +0200
Subject: [PATCH 1076/1209] python3Packages.aiohasupervisor: 0.4.3 -> 0.5.0

https://github.com/home-assistant-libs/python-supervisor-client/releases/tag/0.5.0
---
 .../python-modules/aiohasupervisor/default.nix      | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/aiohasupervisor/default.nix b/pkgs/development/python-modules/aiohasupervisor/default.nix
index f9a93a152ce4..4486fd239130 100644
--- a/pkgs/development/python-modules/aiohasupervisor/default.nix
+++ b/pkgs/development/python-modules/aiohasupervisor/default.nix
@@ -6,6 +6,7 @@
   fetchFromGitHub,
   mashumaro,
   orjson,
+  pyprojectVersionPatchHook,
   pytest-aiohttp,
   pytest-cov-stub,
   pytest-timeout,
@@ -16,23 +17,25 @@
 
 buildPythonPackage rec {
   pname = "aiohasupervisor";
-  version = "0.4.3";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "python-supervisor-client";
     tag = version;
-    hash = "sha256-h22y62f+pdoHYKqPeKNGFkVS7/IMWbxaAoDLomwAB40=";
+    hash = "sha256-qIj3kiKSo0aUj7b250c39FqxU3jV6uegmBlxR6wOkQ8=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail 'version = "0.0.0"' 'version = "${version}"' \
-      --replace-fail "setuptools>=68.0,<82.1" "setuptools" \
-      --replace-fail ', "wheel>=0.40,<0.47"' ""
+      --replace-fail "setuptools>=68.0,<82.1" "setuptools"
   '';
 
+  nativeBuildInputs = [
+    pyprojectVersionPatchHook
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [

From bb405c51233ba6960e5de06e2922e62b36b2c81d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:09:05 +0200
Subject: [PATCH 1077/1209] python3Packages.aiohomeconnect: 0.36.1 -> 0.38.0

https://github.com/MartinHjelmare/aiohomeconnect/blob/v0.38.0/CHANGELOG.md
---
 pkgs/development/python-modules/aiohomeconnect/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohomeconnect/default.nix b/pkgs/development/python-modules/aiohomeconnect/default.nix
index d63da6a8ba14..b74efa64abf4 100644
--- a/pkgs/development/python-modules/aiohomeconnect/default.nix
+++ b/pkgs/development/python-modules/aiohomeconnect/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiohomeconnect";
-  version = "0.36.1";
+  version = "0.38.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MartinHjelmare";
     repo = "aiohomeconnect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dzDNwqAYS1Sqhcd9koNTtSkXZ/t78WC/YIKOaA4uqzI=";
+    hash = "sha256-KJlkJXxbTSA1j/lvCAsIEheF5h2HQpJXVmiM3dyINPw=";
   };
 
   build-system = [ setuptools ];

From ad5e2c1859eb8f8031844eb564641ae0c994e4c7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:09:42 +0200
Subject: [PATCH 1078/1209] python3Packages.aiolifx: 1.2.1 -> 1.2.2

https://github.com/aiolifx/aiolifx/releases/tag/1.2.2
---
 pkgs/development/python-modules/aiolifx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiolifx/default.nix b/pkgs/development/python-modules/aiolifx/default.nix
index d1525f12f6a1..a568be21e4ec 100644
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "aiolifx";
-  version = "1.2.1";
+  version = "1.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aiolifx";
     repo = "aiolifx";
     tag = version;
-    hash = "sha256-9FTsY/VFfzLlDEjF8ueBQxr30YasdQwei1/KfHiXwMo=";
+    hash = "sha256-v2001UY12HTi1pgugfRQSUg1R6uZAfVpwCASZZW9S0o=";
   };
 
   build-system = [ setuptools ];

From b78f42cc7ea7ec565cae3e0a264a4a31fc0c3da6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:09:56 +0200
Subject: [PATCH 1079/1209] python3Packages.aiolifx-themes: 1.0.3 -> 1.0.4

https://github.com/Djelibeybi/aiolifx-themes/releases/tag/v1.0.4
---
 pkgs/development/python-modules/aiolifx-themes/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiolifx-themes/default.nix b/pkgs/development/python-modules/aiolifx-themes/default.nix
index 517e10840aba..d710bc1c8947 100644
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiolifx-themes";
-  version = "1.0.3";
+  version = "1.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Djelibeybi";
     repo = "aiolifx-themes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y92ze+zrkz+fxQNFFSR5V9sPJMN0/dfIRwT6UhXo0+U=";
+    hash = "sha256-FTQu8dvm3myRsMC2SKlvIk0MkRIuDPVv5Zxnw5IrPv4=";
   };
 
   build-system = [ poetry-core ];

From 0418d89a0bc7b934f36b17a69c33db8ebe703451 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:10:17 +0200
Subject: [PATCH 1080/1209] python3Packages.aiopnsense: 1.0.8 -> 1.1.0

https://github.com/Snuffy2/aiopnsense/releases/tag/v1.1.0
---
 pkgs/development/python-modules/aiopnsense/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiopnsense/default.nix b/pkgs/development/python-modules/aiopnsense/default.nix
index 19541f5a3c3d..5b897b2be04b 100644
--- a/pkgs/development/python-modules/aiopnsense/default.nix
+++ b/pkgs/development/python-modules/aiopnsense/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiopnsense";
-  version = "1.0.8";
+  version = "1.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.14";
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Snuffy2";
     repo = "aiopnsense";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pJVYbf81/vZRi5elhNhiscXrEqDRLiIrik8N9GcR6yQ=";
+    hash = "sha256-Ffp0CTYqqeeB8462luTvpa2dp2QOxztkipretBqaKig=";
   };
 
   build-system = [ setuptools ];

From 56df41ce7361778703ec21dcfc57156028a5ee86 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:10:37 +0200
Subject: [PATCH 1081/1209] python3Packages.aioshelly: 13.26.1 -> 13.26.2

https://github.com/home-assistant-libs/aioshelly/releases/tag/13.26.2
---
 pkgs/development/python-modules/aioshelly/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index 26f029c5a745..d911ebfa39e0 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aioshelly";
-  version = "13.26.1";
+  version = "13.26.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "aioshelly";
     tag = finalAttrs.version;
-    hash = "sha256-mOqHHgyx1Eevhr8BHkfFQa7g6x7vt9KJe4E72fr9HPg=";
+    hash = "sha256-LNMFFi3afbDFezr32zr85lNX1TIdo8BF04yDfc2AIA0=";
   };
 
   build-system = [ setuptools ];

From c0dbdfe671062b886548a2b1dc8b54a7d2d46174 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:10:55 +0200
Subject: [PATCH 1082/1209] python3Packages.bluetooth-adapters: 2.3.0 -> 2.4.0

https://github.com/Bluetooth-Devices/bluetooth-adapters/releases/tag/v2.4.0
---
 .../development/python-modules/bluetooth-adapters/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bluetooth-adapters/default.nix b/pkgs/development/python-modules/bluetooth-adapters/default.nix
index 2dc949d75601..7810ccf8b764 100644
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bluetooth-adapters";
-  version = "2.3.0";
+  version = "2.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "bluetooth-adapters";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r/qDwlIVa7VBkhepmuFqwtlJ7WYUTiYRKikhURTgLH8=";
+    hash = "sha256-d1vHb1WvsumlvilwuV6yfTwMXViLqeosSSM3LijIGYY=";
   };
 
   outputs = [

From 09cbb5781871e613e2da4cdfda0fe3e0a504cff0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:11:34 +0200
Subject: [PATCH 1083/1209] python3Packages.dbus-fast: 5.0.17 -> 5.0.22

https://github.com/Bluetooth-Devices/dbus-fast/releases/tag/v5.0.22
---
 pkgs/development/python-modules/dbus-fast/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index 3c2836d28232..6a4ed61a01d9 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "dbus-fast";
-  version = "5.0.17";
+  version = "5.0.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "dbus-fast";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wZ4ufGua56weOuaOkyjBIzDex/gjmLeAczYzeLQRFwo=";
+    hash = "sha256-tYgsaXOo1zYjWebcWZyGIIbYHCJApwhRnuYcHOP+ZUs=";
   };
 
   postPatch = ''

From d46de7684d8a11a0fcb0859cd68a40e2e4f6122c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:11:47 +0200
Subject: [PATCH 1084/1209] python3Packages.forecast-solar: 5.0.0 -> 5.0.1

https://github.com/home-assistant-libs/forecast_solar/releases/tag/v5.0.1
---
 pkgs/development/python-modules/forecast-solar/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/forecast-solar/default.nix b/pkgs/development/python-modules/forecast-solar/default.nix
index f8edb6cee3cd..616961728241 100644
--- a/pkgs/development/python-modules/forecast-solar/default.nix
+++ b/pkgs/development/python-modules/forecast-solar/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "forecast-solar";
-  version = "5.0.0";
+  version = "5.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "forecast_solar";
     tag = "v${version}";
-    hash = "sha256-gFa1jq4Dq6fWqL/3eY+OGcJU+T+R6TZs8CX1ynnW+pU=";
+    hash = "sha256-fvmi5kwVAScVlGpxutjH8nl0lJx/VnQEVoj9a1UY7r4=";
   };
 
   build-system = [ poetry-core ];

From 2b94a3ae45c30024e962dbb360430298dc578365 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:12:59 +0200
Subject: [PATCH 1085/1209] python3Packages.habluetooth: 6.8.1 -> 6.26.5

https://github.com/Bluetooth-Devices/habluetooth/blob/v6.26.5/CHANGELOG.md
---
 pkgs/development/python-modules/habluetooth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/habluetooth/default.nix b/pkgs/development/python-modules/habluetooth/default.nix
index 8ede59b6de0d..1bf121660201 100644
--- a/pkgs/development/python-modules/habluetooth/default.nix
+++ b/pkgs/development/python-modules/habluetooth/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "habluetooth";
-  version = "6.8.1";
+  version = "6.26.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "habluetooth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a6qYBCN4nlJ0KRqGSbE6D5YySrvhi2kqAArMKa5A6sM=";
+    hash = "sha256-IM3M4fWTdD4wT3UsNiLZq7QX3p9pf+lR3x84vuOICMM=";
   };
 
   build-system = [

From eb22b856d1d0d35f75ebf991f9163b8d1d314b13 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 3 Jul 2026 16:37:54 +0100
Subject: [PATCH 1086/1209] swiftPackages.swift{,NoSwiftDriver}: work around
 `ld64` hardening issue

---
 .../development/compilers/swift/swiftpm/default.nix |  5 +++++
 .../development/compilers/swift/wrapper/default.nix | 13 +++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/pkgs/development/compilers/swift/swiftpm/default.nix b/pkgs/development/compilers/swift/swiftpm/default.nix
index 9d8e414b72c9..2d5db28d68c7 100644
--- a/pkgs/development/compilers/swift/swiftpm/default.nix
+++ b/pkgs/development/compilers/swift/swiftpm/default.nix
@@ -135,6 +135,11 @@ let
           # so we don't have to account for that scenario.
           "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
         ];
+
+        # TODO: Clean up on `staging`.
+        env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+          NIX_LDFLAGS = "-headerpad_max_install_names";
+        };
       }
     );
 
diff --git a/pkgs/development/compilers/swift/wrapper/default.nix b/pkgs/development/compilers/swift/wrapper/default.nix
index e446bec66868..0bd4a818da6d 100644
--- a/pkgs/development/compilers/swift/wrapper/default.nix
+++ b/pkgs/development/compilers/swift/wrapper/default.nix
@@ -5,6 +5,10 @@
   useSwiftDriver ? true,
   swift-driver,
   clang,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
+  writeShellScriptBin,
 }:
 
 stdenv.mkDerivation (
@@ -90,6 +94,15 @@ stdenv.mkDerivation (
           cp "$input" "$out/nix-support/$(basename "$input")"
         done
       fi
+    ''
+    # TODO: Clean up on `staging`.
+    + lib.optionalString stdenv.targetPlatform.isDarwin ''
+      printf "NIX_SWIFTFLAGS_COMPILE+=' -use-ld=lld -tools-directory %s'\n" \
+        ${writeShellScriptBin "ld" ''
+          exec ${lib.getExe' llvmPackages.lld "ld64.lld"} "$@"
+        ''}/bin \
+        >> $out/nix-support/setup-hook
+      printf '%s\n' ${lib.getBin llvmPackages.lld} >> $out/nix-support/propagated-build-inputs
     '';
 
     passthru = {

From b70af925f2d5cda466c203a79dc487ec3a2b4ddc Mon Sep 17 00:00:00 2001
From: Hraban <hraban@0brg.net>
Date: Sat, 4 Jul 2026 15:43:45 -0400
Subject: [PATCH 1087/1209] sbcl: 2.6.5 -> 2.6.6

---
 pkgs/development/compilers/sbcl/default.nix |  2 +-
 pkgs/top-level/all-packages.nix             | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 73d3cc08df88..78938c21cfc9 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -30,8 +30,8 @@ let
     "2.4.10".sha256 = "sha256-zus5a2nSkT7uBIQcKva+ylw0LOFGTD/j5FPy3hDF4vg=";
     # By unofficial and very loose convention we keep the latest version of
     # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.6.4".sha256 = "sha256-O6U+ZUtg/rfE9QRmGZ1tUmDyZhxxG6ItS3cLZVQA1Xs=";
     "2.6.5".sha256 = "sha256-kex19kclLtbmrq6bGhP0fHxs/ZtoSI3Gnxpv6lrMtEA=";
+    "2.6.6".sha256 = "sha256-plp6MIEqr1SSXRGSubnoEPUnx5kRxgALdUgQWu99o0s=";
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 63838e08073a..985a71a778cd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7537,14 +7537,6 @@ with pkgs;
     ];
   };
 
-  sbcl_2_6_4 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.6.4"; };
-    faslExt = "fasl";
-    flags = [
-      "--dynamic-space-size"
-      "3000"
-    ];
-  };
   sbcl_2_6_5 = wrapLisp {
     pkg = callPackage ../development/compilers/sbcl { version = "2.6.5"; };
     faslExt = "fasl";
@@ -7553,7 +7545,15 @@ with pkgs;
       "3000"
     ];
   };
-  sbcl = sbcl_2_6_5;
+  sbcl_2_6_6 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.6.6"; };
+    faslExt = "fasl";
+    flags = [
+      "--dynamic-space-size"
+      "3000"
+    ];
+  };
+  sbcl = sbcl_2_6_6;
 
   sbclPackages = recurseIntoAttrs sbcl.pkgs;
 

From d15b45bb338629e08d6830d37650ba33febed81f Mon Sep 17 00:00:00 2001
From: Hraban <hraban@0brg.net>
Date: Sat, 4 Jul 2026 15:46:19 -0400
Subject: [PATCH 1088/1209] sbcl: add iolib and stumpwm to passthru.tests

---
 pkgs/development/compilers/sbcl/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 78938c21cfc9..112349190c1f 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -7,7 +7,9 @@
   coreutils,
   fetchurl,
   ps,
+  sbclPackages, # for passthru.tests
   strace,
+  stumpwm, # for passthru.tests
   texinfo,
   which,
   writableTmpDirAsHomeHook,
@@ -308,6 +310,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   __darwinAllowLocalNetworking = true;
 
+  passthru.tests = {
+    inherit stumpwm;
+    inherit (sbclPackages) iolib;
+  };
+
   meta = {
     # Broken since 2025-09-05 https://hydra.nixos.org/job/nixpkgs/staging-next/sbcl.x86_64-darwin
     broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64;

From 775a8eb8c7cca1de2fa23709069abec6b8a12a38 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:13:11 +0200
Subject: [PATCH 1089/1209] python3Packages.hassil: 3.7.0 -> 3.8.0

https://github.com/home-assistant/hassil/blob/v3.8.0/CHANGELOG.md
---
 pkgs/development/python-modules/hassil/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hassil/default.nix b/pkgs/development/python-modules/hassil/default.nix
index 0d90983c8a07..f9f31cf9ed68 100644
--- a/pkgs/development/python-modules/hassil/default.nix
+++ b/pkgs/development/python-modules/hassil/default.nix
@@ -16,7 +16,7 @@
 
 let
   pname = "hassil";
-  version = "3.7.0";
+  version = "3.8.0";
 in
 buildPythonPackage rec {
   inherit pname version;
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "home-assistant";
     repo = "hassil";
     tag = "v${version}";
-    hash = "sha256-C3nx8w0y4RsHq9txwdSfgS9BMcY4TyZiBOq4QIq5w+0=";
+    hash = "sha256-b+ykT6P9yG8jZZN92K76uBaKTJpV6lkcqP3AAYbj3dU=";
   };
 
   build-system = [ setuptools ];

From edcf0ce1ae3e69d497c54ef02506fee7d6ffce81 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:13:36 +0200
Subject: [PATCH 1090/1209] python3Packages.hole: 0.9.1 -> 0.9.2

https://github.com/home-assistant-ecosystem/python-hole/releases/tag/0.9.2
---
 pkgs/development/python-modules/hole/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hole/default.nix b/pkgs/development/python-modules/hole/default.nix
index da6316841658..fd3bb35cd59c 100644
--- a/pkgs/development/python-modules/hole/default.nix
+++ b/pkgs/development/python-modules/hole/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hole";
-  version = "0.9.1";
+  version = "0.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
     repo = "python-hole";
     tag = finalAttrs.version;
-    hash = "sha256-rIKb6GeULi2ooNtWD2a23JQxO9HkXiUYy0AroYeVeKU=";
+    hash = "sha256-j9fwetfxc0HG+Ly+MpRYL3jDHAwtt+Ls3tUcizHuUrg=";
   };
 
   build-system = [ hatchling ];

From f1aa936fdc319b5533da4816cc7711272cbeabf9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:13:51 +0200
Subject: [PATCH 1091/1209] python3Packages.infrared-protocols: 5.8.1 -> 6.3.1

https://github.com/home-assistant-libs/infrared-protocols/releases/tag/6.3.1
---
 .../development/python-modules/infrared-protocols/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/infrared-protocols/default.nix b/pkgs/development/python-modules/infrared-protocols/default.nix
index e5a79ea3d0ff..839e13159529 100644
--- a/pkgs/development/python-modules/infrared-protocols/default.nix
+++ b/pkgs/development/python-modules/infrared-protocols/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "infrared-protocols";
-  version = "5.8.1";
+  version = "6.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "infrared-protocols";
     tag = finalAttrs.version;
-    hash = "sha256-CSVnH+U/dqp5vjA4eWEJEFT0LZgaAG3OC1rcgyKIcJE=";
+    hash = "sha256-6kyb0a0cCwVSS4evDGg0Z7wLGhDUHnLeXUJ9PW+fhHk=";
   };
 
   build-system = [ setuptools ];

From b717ae01fc2f39ac509a3eb1833151eeef9d4305 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:14:33 +0200
Subject: [PATCH 1092/1209] python3Packages.iometer: 1.0.1 -> 1.0.2

https://github.com/iometer-gmbh/iometer.py/releases/tag/v1.0.2
---
 pkgs/development/python-modules/iometer/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/iometer/default.nix b/pkgs/development/python-modules/iometer/default.nix
index 932fe4fc0e8d..25cf8f9c137f 100644
--- a/pkgs/development/python-modules/iometer/default.nix
+++ b/pkgs/development/python-modules/iometer/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iometer";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iometer-gmbh";
     repo = "iometer.py";
-    tag = finalAttrs.version;
-    hash = "sha256-ksf/nZHv4/JRHo5OrFp6lgPF62DD37ELFfUVkL+TDEo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-50tq+z1+8CX58Yj6GztYXStHMG+IncOHDgwK8WhxVcQ=";
   };
 
   build-system = [ poetry-core ];

From e4bd9afcf22ae932357be92bab9b2a749c4fa2a0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:14:49 +0200
Subject: [PATCH 1093/1209] python3Packages.mozart-api: 5.3.1.108.2 ->
 6.2.0.44.1

https://github.com/bang-olufsen/mozart-open-api/releases/tag/6.2.0.44.1
---
 pkgs/development/python-modules/mozart-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mozart-api/default.nix b/pkgs/development/python-modules/mozart-api/default.nix
index 105d1a22ac13..ace3c790d240 100644
--- a/pkgs/development/python-modules/mozart-api/default.nix
+++ b/pkgs/development/python-modules/mozart-api/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mozart-api";
-  version = "5.3.1.108.2";
+  version = "6.2.0.44.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "mozart_api";
     inherit (finalAttrs) version;
-    hash = "sha256-ilUSGgc4m6iMBUuSI7qt7c4DAE8cOPTzLGeQ4JQAB8U=";
+    hash = "sha256-HJKxw49hGjVedjpCzxfbL8v6b6MXXqE96hlL5U64r5Y=";
   };
 
   build-system = [ poetry-core ];

From ee88915476247f90b3d10a1c3ed2052b27483917 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:15:34 +0200
Subject: [PATCH 1094/1209] python3Packages.music-assistant-models: 1.1.115 ->
 1.1.139

https://github.com/music-assistant/models/releases/tag/1.1.139
---
 .../python-modules/music-assistant-models/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/music-assistant-models/default.nix b/pkgs/development/python-modules/music-assistant-models/default.nix
index 7f2b91bb4c1d..46790c8fc467 100644
--- a/pkgs/development/python-modules/music-assistant-models/default.nix
+++ b/pkgs/development/python-modules/music-assistant-models/default.nix
@@ -23,14 +23,14 @@ buildPythonPackage (finalAttrs: {
   pname = "music-assistant-models";
   # Must be compatible with music-assistant-client package
   # nixpkgs-update: no auto update
-  version = "1.1.115";
+  version = "1.1.139";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "models";
     tag = finalAttrs.version;
-    hash = "sha256-oEXL0B8JNH4PcltpES375ov7QGs+gtYKlMGr1B7BlKY=";
+    hash = "sha256-AT+R0Sor3aDqydGfT8gJfk9/rEpqEOad5ytnGnW7B1U=";
   };
 
   postPatch = ''

From 0dae454d3d23346fca6108d7d24a389f50e67a76 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:15:44 +0200
Subject: [PATCH 1095/1209] python3Packages.music-assistant-client: 1.3.5 ->
 1.3.6

https://github.com/music-assistant/client/releases/tag/1.3.6
---
 .../python-modules/music-assistant-client/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/music-assistant-client/default.nix b/pkgs/development/python-modules/music-assistant-client/default.nix
index 5aa9a2dfcef5..09542f5c3e59 100644
--- a/pkgs/development/python-modules/music-assistant-client/default.nix
+++ b/pkgs/development/python-modules/music-assistant-client/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "music-assistant-client";
-  version = "1.3.5";
+  version = "1.3.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "client";
     tag = version;
-    hash = "sha256-1yJTn8gnEFkoWGQHItpdO77ltE1Ai5z9hmJvakxyi24=";
+    hash = "sha256-uK3suOFhRJT6ji5ksdH3Y4iO9ysdbyZWVNTThJvGiGc=";
   };
 
   postPatch = ''

From d0ffe1dad99ab670910687479f85f0881bd55dad Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:15:59 +0200
Subject: [PATCH 1096/1209] python3Packages.ouman-eh-800-api: 0.5.0 -> 1.0.0

https://github.com/Markus98/ouman-eh-800-api/releases/tag/v1.0.0
---
 pkgs/development/python-modules/ouman-eh-800-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ouman-eh-800-api/default.nix b/pkgs/development/python-modules/ouman-eh-800-api/default.nix
index e84d768dce1a..05e87357b57c 100644
--- a/pkgs/development/python-modules/ouman-eh-800-api/default.nix
+++ b/pkgs/development/python-modules/ouman-eh-800-api/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ouman-eh-800-api";
-  version = "0.5.0";
+  version = "1.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Markus98";
     repo = "ouman-eh-800-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1CEn44Uw+OH4DXcATt6qvsi3Ce4ghorWyS7lBhO2lH4=";
+    hash = "sha256-lY6aC2d31M4I5O1J9vIBH83MMiJ941cMixTsGP5I0OM=";
   };
 
   postPatch = ''

From b50c0d30061437d0dc2171dbb4d824fb3fe7dd41 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:16:13 +0200
Subject: [PATCH 1097/1209] python3Packages.pajgps-api: 0.3.1 -> 0.4.0

https://github.com/skipperro/pajgps-api/releases/tag/0.4.0
---
 pkgs/development/python-modules/pajgps-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pajgps-api/default.nix b/pkgs/development/python-modules/pajgps-api/default.nix
index 88acca389028..a3b2b2423fd7 100644
--- a/pkgs/development/python-modules/pajgps-api/default.nix
+++ b/pkgs/development/python-modules/pajgps-api/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pajgps-api";
-  version = "0.3.1";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "skipperro";
     repo = "pajgps-api";
     tag = finalAttrs.version;
-    hash = "sha256-OJbWF5KcqyRud0Sfx7rME+mXIjiZQD9UxD3vpeV6RWY=";
+    hash = "sha256-7NVr75ss9vUjyn0Yz+bpZVdN4gDx4gvpdDV1bWLKOIQ=";
   };
 
   build-system = [ hatchling ];

From 55f2e0c89ff2a2b262bb4a21590791a0cc3680fc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:16:31 +0200
Subject: [PATCH 1098/1209] python3Packages.py-ccm15: 0.1.2 -> 1.1.2

https://github.com/ocalvo/py-ccm15/releases/tag/v1.1.2
---
 pkgs/development/python-modules/py-ccm15/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/py-ccm15/default.nix b/pkgs/development/python-modules/py-ccm15/default.nix
index d6371c1e012b..ace59fce7e14 100644
--- a/pkgs/development/python-modules/py-ccm15/default.nix
+++ b/pkgs/development/python-modules/py-ccm15/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "py-ccm15";
-  version = "0.1.2";
+  version = "1.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     # Therefore it should not be marked unstable
     # upstream issue: https://github.com/ocalvo/py-ccm15/issues/10
     tag = "v${version}";
-    hash = "sha256-QfitJzCFk0gnlcCvvKzuI4fS1lVm79q4xaDZFKKt458=";
+    hash = "sha256-qEowsu7ebnD5eCR7SiWEqLwR3yqoqOnuw4wSQm4rmHQ=";
   };
 
   build-system = [ setuptools ];

From 53126f8f1a03c0abde75958c3589ac92cd40bde4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:16:49 +0200
Subject: [PATCH 1099/1209] python3Packages.py-synologydsm-api: 2.10.1 ->
 2.10.2

https://github.com/mib1185/py-synologydsm-api/releases/tag/v2.10.2
---
 .../development/python-modules/py-synologydsm-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/py-synologydsm-api/default.nix b/pkgs/development/python-modules/py-synologydsm-api/default.nix
index 2129c2f1e523..02db8b9fae26 100644
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.10.1";
+  version = "2.10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     tag = "v${version}";
-    hash = "sha256-3NfI+wth0UTBbByFIsUgyyu7SCmbpNu8necNl7KOAxY=";
+    hash = "sha256-LILtlgUCSL+107axBZOIjqbS4kAXWLxt9936tpvW3XA=";
   };
 
   build-system = [ setuptools ];

From a9276eb47e9548a5380af343c15a9a6cb96542f9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:17:37 +0200
Subject: [PATCH 1100/1209] python3Packages.pyanglianwater: 3.2.3 -> 3.2.4

https://github.com/pantherale0/pyanglianwater/releases/tag/3.2.4
---
 pkgs/development/python-modules/pyanglianwater/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyanglianwater/default.nix b/pkgs/development/python-modules/pyanglianwater/default.nix
index 311e81b2f1a6..becb9af2a267 100644
--- a/pkgs/development/python-modules/pyanglianwater/default.nix
+++ b/pkgs/development/python-modules/pyanglianwater/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyanglianwater";
-  version = "3.2.3";
+  version = "3.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pantherale0";
     repo = "pyanglianwater";
     tag = version;
-    hash = "sha256-hXHkRiKnv59TW1Wr2aJcMvW65SQbkfSokGjh9AvmN3s=";
+    hash = "sha256-AkdWWiw1FMs/uuJNSocMBpReXY2mrxouQfWuu4ntRWY=";
   };
 
   build-system = [ setuptools ];

From f86232f8a9d2925d8dc080489d07f21321131597 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:23:10 +0200
Subject: [PATCH 1101/1209] python3Packages.pygti: 0.10.0 -> 1.1.1

https://github.com/vigonotion/pygti/releases/tag/v1.1.1
---
 .../python-modules/pygti/default.nix          | 22 ++++++++++++-------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/pygti/default.nix b/pkgs/development/python-modules/pygti/default.nix
index a9ee409a15ae..f557ffef4610 100644
--- a/pkgs/development/python-modules/pygti/default.nix
+++ b/pkgs/development/python-modules/pygti/default.nix
@@ -2,28 +2,34 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools-scm,
+  hatchling,
+  hatch-vcs,
   aiohttp,
+  pydantic,
   pytz,
   voluptuous,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pygti";
-  version = "0.10.0";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vigonotion";
     repo = "pygti";
-    tag = version;
-    hash = "sha256-2T4Yw4XEOkv+IWyB4Xa2dPu929VH0tLeUjQ5S8EVXz0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-B+jz91xoN7GiU4PnJTG5Kt1eA4ST63d+ZEgRrr9Xio8=";
   };
 
-  build-system = [ setuptools-scm ];
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
 
   dependencies = [
     aiohttp
+    pydantic
     pytz
     voluptuous
   ];
@@ -38,10 +44,10 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/vigonotion/pygti/releases/tag/${src.tag}";
+    changelog = "https://github.com/vigonotion/pygti/releases/tag/${finalAttrs.src.tag}";
     description = "Access public transport information in Hamburg, Germany";
     homepage = "https://github.com/vigonotion/pygti";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

From 9ddc67a89ebac61626e6f8dcc1e911c9b1343ce8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:26:38 +0200
Subject: [PATCH 1102/1209] python3Packages.fido2: 2.1.1 -> 2.2.1

https://github.com/Yubico/python-fido2/releases/tag/2.2.1
---
 .../python-modules/fido2/default.nix            | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/fido2/default.nix b/pkgs/development/python-modules/fido2/default.nix
index f279e558460d..6329cfb442ef 100644
--- a/pkgs/development/python-modules/fido2/default.nix
+++ b/pkgs/development/python-modules/fido2/default.nix
@@ -8,14 +8,14 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fido2";
-  version = "2.1.1";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-8TefhFhwzH/GTH8HMjw85B6MlsNwVOeeCs1WMLP+xaw=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-hXh0KKlMP46vcvD/MK+6mDtVmhsbeVyTMYyBtK1AYsQ=";
   };
 
   build-system = [ poetry-core ];
@@ -28,7 +28,10 @@ buildPythonPackage rec {
     pcsc = [ pyscard ];
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   pytestFlags = [
     "-v"
@@ -40,8 +43,8 @@ buildPythonPackage rec {
   meta = {
     description = "Provides library functionality for FIDO 2.0, including communication with a device over USB";
     homepage = "https://github.com/Yubico/python-fido2";
-    changelog = "https://github.com/Yubico/python-fido2/releases/tag/${version}";
+    changelog = "https://github.com/Yubico/python-fido2/releases/tag/${finalAttrs.version}";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ prusnak ];
   };
-}
+})

From 00ab60e03a7329a951bbabd1ca943dd2f4b8c307 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:31:49 +0200
Subject: [PATCH 1103/1209] python3Packages.tinyhtml: init 1.3.0

New dependency for pyicloud.
---
 .../python-modules/tinyhtml/default.nix       | 51 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 53 insertions(+)
 create mode 100644 pkgs/development/python-modules/tinyhtml/default.nix

diff --git a/pkgs/development/python-modules/tinyhtml/default.nix b/pkgs/development/python-modules/tinyhtml/default.nix
new file mode 100644
index 000000000000..1b41c1802129
--- /dev/null
+++ b/pkgs/development/python-modules/tinyhtml/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  jinja2,
+  pandas,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "tinyhtml";
+  version = "1.3.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "niklasf";
+    repo = "python-tinyhtml";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1DPQFszrNsGNEpEl4c1SNdnNfwi3bcHzCrOWdu+dTGA=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pandas
+    jinja2
+  ];
+
+  # https://github.com/niklasf/python-tinyhtml/blob/master/tox.ini
+  checkPhase = ''
+    runHook preCheck
+    python -m doctest README.rst
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "tinyhtml"
+  ];
+
+  meta = {
+    description = "Tiny library to safely render compact HTML5 from Python expressions";
+    homepage = "https://github.com/niklasf/python-tinyhtml";
+    changelog = "https://github.com/niklasf/python-tinyhtml/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 54ed7f7ed900..f8abd21d0af1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -20029,6 +20029,8 @@ self: super: with self; {
 
   tinygrad = callPackage ../development/python-modules/tinygrad { };
 
+  tinyhtml = callPackage ../development/python-modules/tinyhtml { };
+
   tinyhtml5 = callPackage ../development/python-modules/tinyhtml5 { };
 
   tinyio = callPackage ../development/python-modules/tinyio { };

From 469497c7cad018d50eaec4553a42b792fd1f9c7b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:35:05 +0200
Subject: [PATCH 1104/1209] python3Packages.pyicloud: 2.4.1 -> 2.6.5

https://github.com/timlaing/pyicloud/releases/tag/2.6.5
---
 .../python-modules/pyicloud/default.nix       | 22 ++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pyicloud/default.nix b/pkgs/development/python-modules/pyicloud/default.nix
index b5ab00d1a7aa..6b5464f6ee97 100644
--- a/pkgs/development/python-modules/pyicloud/default.nix
+++ b/pkgs/development/python-modules/pyicloud/default.nix
@@ -7,27 +7,32 @@
   fido2,
   keyring,
   keyrings-alt,
+  protobuf,
+  pydantic,
   pytest-mock,
   pytest-socket,
   pytestCheckHook,
   pythonAtLeast,
   requests,
+  rich,
   setuptools,
   setuptools-scm,
   srp,
+  tinyhtml,
+  typer,
   tzlocal,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "pyicloud";
-  version = "2.4.1";
+  version = "2.6.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "timlaing";
     repo = "pyicloud";
     tag = finalAttrs.version;
-    hash = "sha256-6Z5YhEqRzThQM5nHG0o+q4Rm/+A/ss3N6RDRz6mPJm4=";
+    hash = "sha256-wlBVQPGGt8Q6EeLceORfRn+MtRKtmum+z3WAG6ZR+2Q=";
   };
 
   build-system = [
@@ -41,16 +46,27 @@ buildPythonPackage (finalAttrs: {
     fido2
     keyring
     keyrings-alt
+    protobuf
+    pydantic
     requests
     srp
+    tinyhtml
     tzlocal
   ];
 
+  optional-dependencies = {
+    cli = [
+      rich
+      typer
+    ];
+  };
+
   nativeCheckInputs = [
     pytest-mock
     pytest-socket
     pytestCheckHook
-  ];
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   pythonImportsCheck = [ "pyicloud" ];
 

From f9eb1857548c7a7c9a8e4db3d5e3e46d8ee1a258 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:36:49 +0200
Subject: [PATCH 1105/1209] python3Packages.pyipma: 3.0.9 -> 3.0.10

https://github.com/dgomes/pyipma/releases/tag/v3.0.10
---
 .../python-modules/pyipma/default.nix           | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pyipma/default.nix b/pkgs/development/python-modules/pyipma/default.nix
index 628254991592..a37899a50f7d 100644
--- a/pkgs/development/python-modules/pyipma/default.nix
+++ b/pkgs/development/python-modules/pyipma/default.nix
@@ -12,16 +12,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyipma";
-  version = "3.0.9";
+  version = "3.0.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dgomes";
     repo = "pyipma";
-    tag = version;
-    hash = "sha256-1EUOkNwNoZQEetJ5v6httas0S0a3bHLv/lDRXQsT/Ds=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-f1V+8So8TmR9Cu2fjD3B7EqeJd9e1G9cgCNytGul2Eo=";
   };
 
   build-system = [ setuptools ];
@@ -41,6 +41,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pyipma" ];
 
+  disabledTests = [
+    # Test requires network access
+    "test_retrieve_returns_json_response_from_api"
+  ];
+
   disabledTestPaths = [
     # Tests require network access
     "tests/test_auxiliar.py"
@@ -51,8 +56,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library to retrieve information from Instituto Português do Mar e Atmosfera";
     homepage = "https://github.com/dgomes/pyipma";
-    changelog = "https://github.com/dgomes/pyipma/releases/tag/${src.tag}";
+    changelog = "https://github.com/dgomes/pyipma/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From a8dcc967a6fc5b6c9c4193ab5729bd34ee433218 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:37:19 +0200
Subject: [PATCH 1106/1209] python3Packages.pylamarzocco: 2.3.0 -> 2.4.2

https://github.com/zweckj/pylamarzocco/releases/tag/v2.4.2
---
 pkgs/development/python-modules/pylamarzocco/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pylamarzocco/default.nix b/pkgs/development/python-modules/pylamarzocco/default.nix
index 8b437d940b47..b9a5e7642000 100644
--- a/pkgs/development/python-modules/pylamarzocco/default.nix
+++ b/pkgs/development/python-modules/pylamarzocco/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pylamarzocco";
-  version = "2.3.0";
+  version = "2.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zweckj";
     repo = "pylamarzocco";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DNlUdnJjaYUfz8X8UmzqjHwj+WGmRQZQGDkHUjrAJ7E=";
+    hash = "sha256-9wqSF67MNxnGvDDDVY9epI3hoV8M20L3Fyz80/x8G74=";
   };
 
   build-system = [ setuptools ];

From b1c4d5455094467ec7975e5bd031767b745300fc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:41:09 +0200
Subject: [PATCH 1107/1209] python3Packages.pymodbus: 3.12.1 -> 3.13.1

https://github.com/pymodbus-dev/pymodbus/releases/tag/v3.13.1
---
 pkgs/development/python-modules/pymodbus/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pymodbus/default.nix b/pkgs/development/python-modules/pymodbus/default.nix
index 9837885ecb5f..148015d169bb 100644
--- a/pkgs/development/python-modules/pymodbus/default.nix
+++ b/pkgs/development/python-modules/pymodbus/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pymodbus";
-  version = "3.12.1";
+  version = "3.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymodbus-dev";
     repo = "pymodbus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ISfAqZu6BSuXoISo8me7Z7BjvoEj6c2KgvuScjEiqd4=";
+    hash = "sha256-gaCD3bhwBXF08vn3v9OU2mT1WJycrqgtxUC8sRLmZ8Y=";
   };
 
   __darwinAllowLocalNetworking = true;

From 22fcb50a338b77e5dfebe897806c76d0c547aa52 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:44:01 +0200
Subject: [PATCH 1108/1209] python3Packages.pyoverkiz: 1.20.6 -> 2.0.3

https://github.com/iMicknl/python-overkiz-api/releases/tag/v2.0.3
---
 .../python-modules/pyoverkiz/default.nix        | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index 6a45385fbc15..28d49bf3d6f1 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -5,9 +5,9 @@
   backoff,
   boto3,
   buildPythonPackage,
+  cattrs,
   fetchFromGitHub,
   hatchling,
-  pyhumps,
   pytest-asyncio,
   pytestCheckHook,
   warrant-lite,
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyoverkiz";
-  version = "1.20.6";
+  version = "2.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Zbz4l5bPvFQaek6/Nbn+PzAzLS3l2PyetuxOBVsuLPk=";
+    hash = "sha256-kKaT9YimH9o5yI7x9T9TSrcvwKEQ5M/HRnZp5S4xbGE=";
   };
 
   build-system = [ hatchling ];
@@ -31,11 +31,16 @@ buildPythonPackage (finalAttrs: {
     aiohttp
     attrs
     backoff
-    boto3
-    pyhumps
-    warrant-lite
+    cattrs
   ];
 
+  optional-dependencies = {
+    nexity = [
+      boto3
+      warrant-lite
+    ];
+  };
+
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook

From 623a75125d25d86b1f255cc7c719e10297c9c55f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:50:55 +0200
Subject: [PATCH 1109/1209] python3Packages.pyrate-limiter: 4.1.0 -> 4.4.0

https://github.com/vutran1710/PyrateLimiter/blob/v4.4.0/CHANGELOG.md
---
 pkgs/development/python-modules/pyrate-limiter/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyrate-limiter/default.nix b/pkgs/development/python-modules/pyrate-limiter/default.nix
index 5de57d7bd3dc..c5649cd22864 100644
--- a/pkgs/development/python-modules/pyrate-limiter/default.nix
+++ b/pkgs/development/python-modules/pyrate-limiter/default.nix
@@ -14,6 +14,7 @@
   redis,
 
   # test
+  aiohttp,
   pytestCheckHook,
   pytest-asyncio,
   pytest-xdist,
@@ -22,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "pyrate-limiter";
-  version = "4.1.0";
+  version = "4.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vutran1710";
     repo = "PyrateLimiter";
     tag = "v${version}";
-    hash = "sha256-2gWbabdRqwWiC4xbMx/VGBwwMcygVMKJswXgd4Ia+xE=";
+    hash = "sha256-DT4WyGrayI12Sid6yLOit68vW/YT4cHsRYjd4oo0/J8=";
   };
 
   build-system = [
@@ -55,6 +56,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    aiohttp
     filelock
     pytestCheckHook
     pytest-asyncio

From a572026926448b4a90c66db5d8d92e8af3062e44 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:51:35 +0200
Subject: [PATCH 1110/1209] python3Packages.pyrisco: 0.7.0 -> 0.8.0

https://github.com/OnFreund/pyrisco/releases/tag/v0.8.0
---
 pkgs/development/python-modules/pyrisco/default.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pyrisco/default.nix b/pkgs/development/python-modules/pyrisco/default.nix
index 4559253b2535..6ee8a07eca81 100644
--- a/pkgs/development/python-modules/pyrisco/default.nix
+++ b/pkgs/development/python-modules/pyrisco/default.nix
@@ -4,25 +4,29 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
+  setuptools-scm,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "pyrisco";
-  version = "0.7.0";
+  version = "0.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "OnFreund";
     repo = "pyrisco";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-moFKikAIBLWfkpADjNKqZd3jAg5LPapubB1pGmx8OPo=";
+    hash = "sha256-tzCwimkSLazD6LtimFUcRjOvnvSlYY1MpJLZ2u4WgUg=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [ aiohttp ];
 
-  # Project has no tests
+  # All tests require cloud access
   doCheck = false;
 
   pythonImportsCheck = [ "pyrisco" ];

From f95391fe1a47f778bb403f6c58ae59b624771618 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:53:17 +0200
Subject: [PATCH 1111/1209] python3Packages.pysmlight: 0.3.2 -> 0.5.2

https://github.com/smlight-tech/pysmlight/releases/tag/v0.5.2
---
 pkgs/development/python-modules/pysmlight/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pysmlight/default.nix b/pkgs/development/python-modules/pysmlight/default.nix
index 2885145690aa..f2a57047a682 100644
--- a/pkgs/development/python-modules/pysmlight/default.nix
+++ b/pkgs/development/python-modules/pysmlight/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pysmlight";
-  version = "0.3.2";
+  version = "0.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "smlight-tech";
     repo = "pysmlight";
     tag = "v${version}";
-    hash = "sha256-LsHxHHBTJCeB78y2Zv4ESzMwBDH2DB49uGyrmO8IVo0=";
+    hash = "sha256-zqb2rfY3JDnIhlaevqX+/ppX5YhB8xUeIrrM4OQKEq0=";
   };
 
   build-system = [

From 81c75463f739d481369ce817aef19e9962ab64bf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:54:04 +0200
Subject: [PATCH 1112/1209] python3Packages.python-bsblan: 6.0.1 -> 6.1.5

https://github.com/liudger/python-bsblan/releases/tag/v6.1.5
---
 pkgs/development/python-modules/python-bsblan/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-bsblan/default.nix b/pkgs/development/python-modules/python-bsblan/default.nix
index 9ddb062c5429..3df45379234a 100644
--- a/pkgs/development/python-modules/python-bsblan/default.nix
+++ b/pkgs/development/python-modules/python-bsblan/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-bsblan";
-  version = "6.0.1";
+  version = "6.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "liudger";
     repo = "python-bsblan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4ds/zYedmdLA7zLe2KoJ4DMzHJC8459KjZIJlHrfWEQ=";
+    hash = "sha256-D3uhEk4VK9kpuwPh3R+oswMaQZQfuTIUwvUnb5HAMFM=";
   };
 
   postPatch = ''

From 1d174aa07371520be0e82a04db0c87192970d7ca Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:54:20 +0200
Subject: [PATCH 1113/1209] python3Packages.python-duco-connectivity: 0.5.0 ->
 0.7.1

https://github.com/ronaldvdmeer/python-duco-connectivity/releases/tag/v0.7.1
---
 .../python-modules/python-duco-connectivity/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-duco-connectivity/default.nix b/pkgs/development/python-modules/python-duco-connectivity/default.nix
index 987422109bdd..aef185b4713f 100644
--- a/pkgs/development/python-modules/python-duco-connectivity/default.nix
+++ b/pkgs/development/python-modules/python-duco-connectivity/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-duco-connectivity";
-  version = "0.5.0";
+  version = "0.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ronaldvdmeer";
     repo = "python-duco-connectivity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AH8EhC0v8GDNvPSUaTownV9d4upvKRiO//2sipGHz9g=";
+    hash = "sha256-Txm7l7fVkEcUIX2J5CEF3OLLgTiT9O/xva0tSCCMZpI=";
   };
 
   build-system = [ setuptools ];

From 1654579d3479a09df4b7cfb9ca39725fc3999751 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:56:12 +0200
Subject: [PATCH 1114/1209] python3Packages.python-openevse-http: 0.3.4 ->
 1.0.1

https://github.com/firstof9/python-openevse-http/releases/tag/1.0.1
---
 .../python-modules/python-openevse-http/default.nix    | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/python-openevse-http/default.nix b/pkgs/development/python-modules/python-openevse-http/default.nix
index f33bdd102a93..962cb637c979 100644
--- a/pkgs/development/python-modules/python-openevse-http/default.nix
+++ b/pkgs/development/python-modules/python-openevse-http/default.nix
@@ -9,21 +9,25 @@
   pytestCheckHook,
   pytest-asyncio,
   setuptools,
+  setuptools-scm,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "python-openevse-http";
-  version = "0.3.4";
+  version = "1.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firstof9";
     repo = "python-openevse-http";
     tag = finalAttrs.version;
-    hash = "sha256-H5kRn8TmTpaX1qf94N2l1qOm03upFzHFistZDLFu/Zs=";
+    hash = "sha256-X87nS/h+Lh//rf8pNrlX22HOpT3Bz/6QgWBfQEaDQP8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [
     aiohttp

From 48e3e73837552dd56b5d7b32f70a6a2d18ce11b0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 20:57:44 +0200
Subject: [PATCH 1115/1209] python3Packages.pylitterbot: 2025.4.0 -> 2025.6.0

https://github.com/natekspencer/pylitterbot/releases/tag/2025.6.0
---
 pkgs/development/python-modules/pylitterbot/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pylitterbot/default.nix b/pkgs/development/python-modules/pylitterbot/default.nix
index 2a6a0b952371..69dc994c5b91 100644
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@@ -1,9 +1,11 @@
 {
   lib,
   aiohttp,
+  aiointercept,
   aioresponses,
   buildPythonPackage,
   deepdiff,
+  fastmcp,
   fetchFromGitHub,
   hatchling,
   pycognito,
@@ -18,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pylitterbot";
-  version = "2025.4.0";
+  version = "2025.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "natekspencer";
     repo = "pylitterbot";
     tag = finalAttrs.version;
-    hash = "sha256-k10QYIdV8EFGR/366IZ6OaXbK+kEcaz3Awdwu116zHA=";
+    hash = "sha256-shn218uasWtZidnmhAVU0bG9BVfrN/0Gy1iy01LGfrc=";
   };
 
   build-system = [
@@ -34,8 +36,10 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = [
+    aiointercept
     aiohttp
     deepdiff
+    fastmcp
     pycognito
     pyjwt
   ];

From 29c43253bb348051213e4fb886facb75164a01b1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:02:07 +0200
Subject: [PATCH 1116/1209] python3Packages.pywmspro: 0.3.5 -> 0.4.1

https://github.com/mback2k/pywmspro/releases/tag/0.4.1
---
 pkgs/development/python-modules/pywmspro/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pywmspro/default.nix b/pkgs/development/python-modules/pywmspro/default.nix
index 39209509a011..3e84f4f90a6d 100644
--- a/pkgs/development/python-modules/pywmspro/default.nix
+++ b/pkgs/development/python-modules/pywmspro/default.nix
@@ -4,19 +4,20 @@
   fetchFromGitHub,
   hatchling,
   hatch-vcs,
+  aiofiles,
   aiohttp,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "pywmspro";
-  version = "0.3.5";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mback2k";
     repo = "pywmspro";
     tag = finalAttrs.version;
-    hash = "sha256-01jXkSZfmBIzrz0B/4/KLcAU4jUQGDfle4sE4saraJo=";
+    hash = "sha256-gpAAGrM/dLSD7rCbYM9O3hVCvDb0QA0joZG7h+jTfCg=";
   };
 
   build-system = [
@@ -24,7 +25,10 @@ buildPythonPackage (finalAttrs: {
     hatch-vcs
   ];
 
-  dependencies = [ aiohttp ];
+  dependencies = [
+    aiofiles
+    aiohttp
+  ];
 
   # Package has no tests
   doCheck = false;

From e1f0f62e3a78697e9690a37e4f90ff310e5cff01 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:14:12 +0200
Subject: [PATCH 1117/1209] python3Packages.pyshark: fix python 3.14 compat

---
 .../python-modules/pyshark/default.nix        | 13 +++++--
 .../python-modules/pyshark/py314-compat.patch | 37 +++++++++++++++++++
 2 files changed, 46 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/python-modules/pyshark/py314-compat.patch

diff --git a/pkgs/development/python-modules/pyshark/default.nix b/pkgs/development/python-modules/pyshark/default.nix
index 64db47763f55..1a6e2c043989 100644
--- a/pkgs/development/python-modules/pyshark/default.nix
+++ b/pkgs/development/python-modules/pyshark/default.nix
@@ -29,10 +29,6 @@ buildPythonPackage (finalAttrs: {
   version = "0.6";
   pyproject = true;
 
-  # Almost all tests fail with:
-  # RuntimeError: There is no current event loop in thread 'MainThread'
-  disabled = pythonAtLeast "3.14";
-
   src = fetchFromGitHub {
     owner = "KimiNewt";
     repo = "pyshark";
@@ -58,6 +54,8 @@ buildPythonPackage (finalAttrs: {
     (replaceVars ./hardcode-tshark-path.patch {
       tshark = lib.getExe' wireshark-cli "tshark";
     })
+    # Compat for Python 3.14 asyncio changes
+    ./py314-compat.patch
   ];
 
   sourceRoot = "${finalAttrs.src.name}/src";
@@ -81,6 +79,13 @@ buildPythonPackage (finalAttrs: {
     # KeyError: 'Packet of index 0 does not exist in capture'
     "test_getting_packet_summary"
   ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # _pickle.PicklingError: logger cannot be pickled
+    "test_iterate_empty_psml_capture"
+    # configparser.NoSectionError: No section: 'tshark'
+    # Path is mocked, and yet...
+    "test_get_tshark_path"
+  ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # fails on darwin
     # _pickle.PicklingError: logger cannot be pickled
diff --git a/pkgs/development/python-modules/pyshark/py314-compat.patch b/pkgs/development/python-modules/pyshark/py314-compat.patch
new file mode 100644
index 000000000000..e1f457e168ed
--- /dev/null
+++ b/pkgs/development/python-modules/pyshark/py314-compat.patch
@@ -0,0 +1,37 @@
+diff --git a/src/pyshark/capture/capture.py b/src/pyshark/capture/capture.py
+index b7aef6e..8967398 100644
+--- a/src/pyshark/capture/capture.py
++++ b/src/pyshark/capture/capture.py
+@@ -182,25 +182,16 @@ class Capture:
+                 asyncio.set_event_loop(self.eventloop)
+         else:
+             try:
+-                self.eventloop = asyncio.get_event_loop_policy().get_event_loop()
++                self.eventloop = asyncio.get_running_loop()
+             except RuntimeError:
+-                if threading.current_thread() != threading.main_thread():
+-                    # Ran not in main thread, make a new eventloop
++                try:
++                    # Python <3.14: may return an existing non-running loop.
++                    self.eventloop = asyncio.get_event_loop()
++                except RuntimeError:
++                    # Python 3.14+: no loop exists for this thread.
+                     self.eventloop = asyncio.new_event_loop()
+                     asyncio.set_event_loop(self.eventloop)
+-                else:
+-                    raise
+-            if os.name == "posix" and isinstance(threading.current_thread(), threading._MainThread):
+-                # The default child watchers (ThreadedChildWatcher) attach_loop method is empty!
+-                # While using pyshark with ThreadedChildWatcher, asyncio could raise a ChildProcessError
+-                # "Unknown child process pid %d, will report returncode 255"
+-                # This led to a TSharkCrashException in _cleanup_subprocess.
+-                # Using the SafeChildWatcher fixes this issue, but it is slower.
+-                # SafeChildWatcher O(n) -> large numbers of processes are slow
+-                # ThreadedChildWatcher O(1) -> independent of process number
+-                # asyncio.get_child_watcher().attach_loop(self.eventloop)
+-                asyncio.set_child_watcher(asyncio.SafeChildWatcher())
+-                asyncio.get_child_watcher().attach_loop(self.eventloop)
++
+ 
+     def _packets_from_tshark_sync(self, packet_count=None, existing_process=None):
+         """Returns a generator of packets.

From 59b69fec06011b1e3a1fb41e3543755bbc0e0ab4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:15:42 +0200
Subject: [PATCH 1118/1209] python3Packages.rf-protocols: 4.2.0 -> 4.3.0

https://github.com/home-assistant-libs/rf-protocols/releases/tag/4.3.0
---
 pkgs/development/python-modules/rf-protocols/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rf-protocols/default.nix b/pkgs/development/python-modules/rf-protocols/default.nix
index 089bc108991e..4b6da5258243 100644
--- a/pkgs/development/python-modules/rf-protocols/default.nix
+++ b/pkgs/development/python-modules/rf-protocols/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rf-protocols";
-  version = "4.2.0";
+  version = "4.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "rf-protocols";
     tag = finalAttrs.version;
-    hash = "sha256-F0pvEg+Cns3czK/yI6M0hpgRpk67jUgRKqgzCBYmgUY=";
+    hash = "sha256-g2e+iQXBaoGO1Yv5v+xpiM+beecErI58Ua5/FODg8Bo=";
   };
 
   build-system = [ setuptools ];

From 339dd180967884ee4166eb7d69afbbdd2948e616 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:15:59 +0200
Subject: [PATCH 1119/1209] python3Packages.python-roborock: 5.14.0 -> 5.25.0

https://github.com/Python-roborock/python-roborock/blob/v5.25.0/CHANGELOG.md
---
 .../python-roborock/default.nix               | 20 ++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index cf262e14980a..b6a949eb1c7f 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -15,23 +15,26 @@
   pycryptodome,
   pycryptodomex,
   pyrate-limiter,
+  pyshark,
   pytest-asyncio,
   pytestCheckHook,
+  pyyaml,
   vacuum-map-parser-roborock,
   click-shell,
   syrupy,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "python-roborock";
-  version = "5.14.0";
+  version = "5.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Python-roborock";
     repo = "python-roborock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SqFU7hhcykP/VSSiPLQPi62iAkgcSw6vwmXq+FpIt9w=";
+    hash = "sha256-Uj7rr9vAdZBseeePQU1/3bILwsI0P2CDy1bGu6R90Cg=";
   };
 
   pythonRelaxDeps = [
@@ -44,24 +47,31 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     aiohttp
     aiomqtt
-    click
     construct
     paho-mqtt
     protobuf
     pycryptodome
     pyrate-limiter
     vacuum-map-parser-roborock
-    click-shell
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ pycryptodomex ];
 
+  optional-dependencies.cli = [
+    click
+    click-shell
+    pyyaml
+    pyshark
+  ];
+
   nativeCheckInputs = [
     aioresponses
     freezegun
     pytest-asyncio
     pytestCheckHook
     syrupy
-  ];
+    writableTmpDirAsHomeHook
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   __darwinAllowLocalNetworking = true;
 

From 2374f9f46ba28ff1e108dfe1ea23e0ff9acb4335 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:16:56 +0200
Subject: [PATCH 1120/1209] python3Packages.teltasync: 0.3.1 -> 0.4.0

https://codeberg.org/dmho/teltasync/releases/tag/v0.4.0
---
 pkgs/development/python-modules/teltasync/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/teltasync/default.nix b/pkgs/development/python-modules/teltasync/default.nix
index 08cb9bf63f5a..e5c8bae9dc26 100644
--- a/pkgs/development/python-modules/teltasync/default.nix
+++ b/pkgs/development/python-modules/teltasync/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "teltasync";
-  version = "0.3.1";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "dmho";
     repo = "teltasync";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TXVdOT0EAwza/rgLPjMnBUCuq+2PwLoRAXvYTz2CT+0=";
+    hash = "sha256-xR4Rh2TnnsXAqicRDBQyhwpUh5zl5cWS6BuyxY/RFsE=";
   };
 
   postPatch = ''

From 100551c8fa5e7cdb563d8cf91189613faf9894bf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:17:19 +0200
Subject: [PATCH 1121/1209] python3Packages.serialx: 1.8.1 -> 1.8.2

https://github.com/puddly/serialx/releases/tag/v1.8.2
---
 pkgs/development/python-modules/serialx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/serialx/default.nix b/pkgs/development/python-modules/serialx/default.nix
index 51eb4c20331c..70659e705a6c 100644
--- a/pkgs/development/python-modules/serialx/default.nix
+++ b/pkgs/development/python-modules/serialx/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "serialx";
-  version = "1.8.1";
+  version = "1.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "puddly";
     repo = "serialx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-89lRB96lit4XxPhACnZ3Lv01G0IcddlwyPTttrWwsLQ=";
+    hash = "sha256-/Bx8TnO3h+Pk/Tg5YSYO96cK5PfJVwqRG0qdLJntNpQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {

From 02adfaa8c5095f9041fd4d8914253b4d50c94b5d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:17:49 +0200
Subject: [PATCH 1122/1209] python3Packages.thinqconnect: 1.0.12 -> 1.0.13

https://github.com/thinq-connect/pythinqconnect/blob/1.0.13/RELEASE_NOTES.md
---
 pkgs/development/python-modules/thinqconnect/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/thinqconnect/default.nix b/pkgs/development/python-modules/thinqconnect/default.nix
index f4c881de90aa..d8b1a1a566a9 100644
--- a/pkgs/development/python-modules/thinqconnect/default.nix
+++ b/pkgs/development/python-modules/thinqconnect/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "thinqconnect";
-  version = "1.0.12";
+  version = "1.0.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thinq-connect";
     repo = "pythinqconnect";
     tag = version;
-    hash = "sha256-LOIqh/f9NiaBpkJqre1TejdUN0gbguSM3s8faGPcf54=";
+    hash = "sha256-0efPQ0fvBLi+Bp+JbBMRJPYFqRKBVpPQFyQ9rvHpEnY=";
   };
 
   build-system = [ setuptools ];

From 34d5ffdb69d5c8e8915f5a16ff839e5f4ec90c4a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:18:19 +0200
Subject: [PATCH 1123/1209] python3Packages.uiprotect: 10.17.0 -> 15.4.1

https://github.com/uilibs/uiprotect/blob/v15.4.1/CHANGELOG.md
---
 pkgs/development/python-modules/uiprotect/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/uiprotect/default.nix b/pkgs/development/python-modules/uiprotect/default.nix
index 44222a54167b..815ad685f6b0 100644
--- a/pkgs/development/python-modules/uiprotect/default.nix
+++ b/pkgs/development/python-modules/uiprotect/default.nix
@@ -39,14 +39,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "uiprotect";
-  version = "10.17.0";
+  version = "15.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "uilibs";
     repo = "uiprotect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q02gSnEruUM1sF4LnMWwqNRzbFhZRRxTZ3pAuRb+XDc=";
+    hash = "sha256-qsGLheVKhIM1aEq/KRsclf3ZQtRhtX/S8cQ5Aem8dEw=";
   };
 
   build-system = [ poetry-core ];

From aac448cca57ff52c428c46a431711f7a979eb6cb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:19:16 +0200
Subject: [PATCH 1124/1209] python3Packages.yoto-api: 3.2.0 -> 4.3.1

https://github.com/cdnninja/yoto_api/releases/tag/v4.3.1
---
 pkgs/development/python-modules/yoto-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/yoto-api/default.nix b/pkgs/development/python-modules/yoto-api/default.nix
index 23b105fde225..e311ec216acc 100644
--- a/pkgs/development/python-modules/yoto-api/default.nix
+++ b/pkgs/development/python-modules/yoto-api/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "yoto-api";
-  version = "3.2.0";
+  version = "4.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cdnninja";
     repo = "yoto_api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pzU+qResc+fqC1nhwbCYNNXKrD1aAjXZujjgL/5AGkc=";
+    hash = "sha256-Hy2OE8jol/ttZ1MsIC4EzkYa72DINwcjsHflo8+a7xo=";
   };
 
   build-system = [ setuptools ];

From a8c131e4b86ccda790d074c5473974a3060255dd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:24:30 +0200
Subject: [PATCH 1125/1209] python3Packages.zigpy: 1.5.1 -> 2.0.0

https://github.com/zigpy/zigpy/releases/tag/2.0.0
---
 pkgs/development/python-modules/zigpy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zigpy/default.nix b/pkgs/development/python-modules/zigpy/default.nix
index 8ca48443feba..a8b5e8ce172c 100644
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "zigpy";
-  version = "1.5.1";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "zigpy";
     tag = finalAttrs.version;
-    hash = "sha256-AbVVv/3a/FZuk+VWLereCF7NEwu4u8HjZrsXsfarSZA=";
+    hash = "sha256-EQ77zEitOV3m+Jc/UrRpWFHrQm+4qA+jdBrHd4dCySg=";
   };
 
   postPatch = ''

From c3a8d36e3f759ff88ef619e694c830a91b28147f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:24:59 +0200
Subject: [PATCH 1126/1209] python3Packages.opuslib-next: init at 1.3.0

Native bindings to libopus; new dependency for voip-utils.
---
 .../python-modules/opuslib-next/ctypes.patch  | 13 +++++
 .../python-modules/opuslib-next/default.nix   | 54 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 3 files changed, 69 insertions(+)
 create mode 100644 pkgs/development/python-modules/opuslib-next/ctypes.patch
 create mode 100644 pkgs/development/python-modules/opuslib-next/default.nix

diff --git a/pkgs/development/python-modules/opuslib-next/ctypes.patch b/pkgs/development/python-modules/opuslib-next/ctypes.patch
new file mode 100644
index 000000000000..6d380643d021
--- /dev/null
+++ b/pkgs/development/python-modules/opuslib-next/ctypes.patch
@@ -0,0 +1,13 @@
+diff --git a/opuslib_next/api/__init__.py b/opuslib_next/api/__init__.py
+index dc498b2..b2ded08 100644
+--- a/opuslib_next/api/__init__.py
++++ b/opuslib_next/api/__init__.py
+@@ -15,7 +15,7 @@ __copyright__ = "Copyright (c) 2025, Kalicyh"
+ __license__ = "BSD 3-Clause License"
+ 
+ 
+-lib_location = find_library("opus")
++lib_location = "@libopus@"
+ 
+ if lib_location is None:
+     # find opus library in macOS
diff --git a/pkgs/development/python-modules/opuslib-next/default.nix b/pkgs/development/python-modules/opuslib-next/default.nix
new file mode 100644
index 000000000000..3d4a30b96c0f
--- /dev/null
+++ b/pkgs/development/python-modules/opuslib-next/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  libopus,
+  pytestCheckHook,
+  replaceVars,
+  stdenv,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "opuslib-next";
+  version = "1.3.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "kalicyh";
+    repo = "opuslib-next";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rR1tsijKUBUH3bZZSISsx1JUO35TZevcTcfPtoQow/E=";
+  };
+
+  patches = [
+    (replaceVars ./ctypes.patch {
+      libopus = "${lib.getLib libopus}/lib/libopus${stdenv.hostPlatform.extensions.sharedLibrary}";
+    })
+  ];
+
+  build-system = [
+    hatchling
+  ];
+
+  buildInputs = [
+    libopus
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "opuslib_next"
+  ];
+
+  meta = {
+    description = "Python bindings to the libopus, IETF low-delay audio codec";
+    homepage = "https://github.com/kalicyh/opuslib-next";
+    changelog = "https://github.com/kalicyh/opuslib-next/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f8abd21d0af1..d09e8b6a49b1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12250,6 +12250,8 @@ self: super: with self; {
 
   opuslib = callPackage ../development/python-modules/opuslib { };
 
+  opuslib-next = callPackage ../development/python-modules/opuslib-next { };
+
   opytimark = callPackage ../development/python-modules/opytimark { };
 
   oracledb = callPackage ../development/python-modules/oracledb { };

From d7a978afee7fbe7e114a35b9076b80bf6a791488 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:26:41 +0200
Subject: [PATCH 1127/1209] python3Packages.voip-utils: 0.3.5 -> 0.4.0

https://github.com/home-assistant-libs/voip-utils/blob/v0.4.0/CHANGELOG.md
---
 pkgs/development/python-modules/voip-utils/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/voip-utils/default.nix b/pkgs/development/python-modules/voip-utils/default.nix
index 8bc955822ca7..ead77fa7f2a7 100644
--- a/pkgs/development/python-modules/voip-utils/default.nix
+++ b/pkgs/development/python-modules/voip-utils/default.nix
@@ -3,20 +3,20 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
-  opuslib,
+  opuslib-next,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "voip-utils";
-  version = "0.3.5";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "voip-utils";
     tag = "v${version}";
-    hash = "sha256-/HSbtP9UAGOs4aZmdinijCMe16HtBH7YuhFM7h158lc=";
+    hash = "sha256-kvuNqiBjcDQ53X6LbnOp2WNh8QOu+ExjhfgKWBoSsH0=";
   };
 
   postPatch = ''
@@ -26,9 +26,9 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  pythonRelaxDeps = [ "opuslib" ];
+  pythonRelaxDeps = [ "opuslib-next" ];
 
-  dependencies = [ opuslib ];
+  dependencies = [ opuslib-next ];
 
   pythonImportsCheck = [ "voip_utils" ];
 

From 4ed00d743f26bd67b62663687d48171deeda7fb4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:32:46 +0200
Subject: [PATCH 1128/1209] python3Packages.zipgy-ziggurat: init at 1.0.1

---
 .../python-modules/zigpy-ziggurat/default.nix | 63 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 65 insertions(+)
 create mode 100644 pkgs/development/python-modules/zigpy-ziggurat/default.nix

diff --git a/pkgs/development/python-modules/zigpy-ziggurat/default.nix b/pkgs/development/python-modules/zigpy-ziggurat/default.nix
new file mode 100644
index 000000000000..802656960311
--- /dev/null
+++ b/pkgs/development/python-modules/zigpy-ziggurat/default.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  aiohttp,
+  mashumaro,
+  pyprojectVersionPatchHook,
+  pytest-asyncio,
+  pytestCheckHook,
+  zigpy,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "zigpy-ziggurat";
+  version = "1.0.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "zigpy";
+    repo = "zigpy-ziggurat";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/yOj4ktxEmfFCiZwJVrYqY0PXnZUi8/LwuaUgxTfBCs=";
+  };
+
+  postPatch = ''
+    # finds version 0.0.1 instead of 1.0.1
+    substituteInPlace pyproject.toml \
+      --replace-fail ', "setuptools-git-versioning<3"' ""
+  '';
+
+  nativeBuildInputs = [
+    pyprojectVersionPatchHook
+  ];
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    aiohttp
+    mashumaro
+    zigpy
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "zigpy_ziggurat"
+  ];
+
+  meta = {
+    description = "Zigpy radio library for communicating with the Ziggurat stack";
+    homepage = "https://github.com/zigpy/zigpy-ziggurat";
+    changelog = "https://github.com/zigpy/zigpy-ziggurat/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d09e8b6a49b1..b68f61638724 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -22297,6 +22297,8 @@ self: super: with self; {
 
   zigpy-zigate = callPackage ../development/python-modules/zigpy-zigate { };
 
+  zigpy-ziggurat = callPackage ../development/python-modules/zigpy-ziggurat { };
+
   zigpy-znp = callPackage ../development/python-modules/zigpy-znp { };
 
   zimports = callPackage ../development/python-modules/zimports { };

From 59e83d0157ab2021768a284f98ec116b3f548b96 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:39:53 +0200
Subject: [PATCH 1129/1209] python3Packages.zigpy-xbee: disable tests

For now until the linekd PR is merged and released.
---
 pkgs/development/python-modules/zigpy-xbee/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/zigpy-xbee/default.nix b/pkgs/development/python-modules/zigpy-xbee/default.nix
index 661d641efc75..d58a27f82ded 100644
--- a/pkgs/development/python-modules/zigpy-xbee/default.nix
+++ b/pkgs/development/python-modules/zigpy-xbee/default.nix
@@ -37,6 +37,10 @@ buildPythonPackage rec {
     zigpy
   ];
 
+  # lacking zigpy 2.0 compat
+  # https://github.com/zigpy/zigpy-xbee/pull/179
+  doCheck = false;
+
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook

From 6a3b74f6fd8d63b974cc929224633adf25aefbcf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:43:25 +0200
Subject: [PATCH 1130/1209] python3Packages.zha: 1.4.1 -> 2.0.0

https://github.com/zigpy/zha/releases/tag/2.0.0

Moves tests into passthru.tests to escape infinite recursion with
zha-quirks.
---
 .../python-modules/zha/default.nix            | 25 +++++++++++++------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/zha/default.nix b/pkgs/development/python-modules/zha/default.nix
index 2b08a84c8f94..3e0278b6749f 100644
--- a/pkgs/development/python-modules/zha/default.nix
+++ b/pkgs/development/python-modules/zha/default.nix
@@ -1,30 +1,32 @@
 {
   lib,
+  attrs,
   bellows,
   buildPythonPackage,
   fetchFromGitHub,
   freezegun,
+  frozendict,
   looptime,
   pyprojectVersionPatchHook,
-  pyserial,
-  pyserial-asyncio-fast,
   pytest-asyncio_0,
   pytest-timeout,
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
   setuptools,
-  zha-quirks,
   zigpy,
   zigpy-deconz,
   zigpy-xbee,
   zigpy-zigate,
+  zigpy-ziggurat,
   zigpy-znp,
+  zha,
+  zha-quirks,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "zha";
-  version = "1.4.1";
+  version = "2.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -33,7 +35,7 @@ buildPythonPackage (finalAttrs: {
     owner = "zigpy";
     repo = "zha";
     tag = finalAttrs.version;
-    hash = "sha256-Jf8k/4z7eERiV2jwDzhV990sLBebasEKe5/0WbX1hYc=";
+    hash = "sha256-cLE30i+3dqmtasHZKgW16zThMwWbZ8wh/GFtrgWmpfE=";
   };
 
   postPatch = ''
@@ -50,14 +52,14 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = [
+    attrs
     bellows
-    pyserial
-    pyserial-asyncio-fast
-    zha-quirks
+    frozendict
     zigpy
     zigpy-deconz
     zigpy-xbee
     zigpy-zigate
+    zigpy-ziggurat
     zigpy-znp
   ];
 
@@ -68,10 +70,13 @@ buildPythonPackage (finalAttrs: {
     pytest-timeout
     pytest-xdist
     pytestCheckHook
+    zha-quirks
   ];
 
   pythonImportsCheck = [ "zha" ];
 
+  doCheck = false; # infinite recursion with zhaquirks
+
   disabledTests = [
     # Tests are long-running and often keep hanging
     "test_check_available_no_basic_cluster_handler"
@@ -100,6 +105,10 @@ buildPythonPackage (finalAttrs: {
     "test_gateway_startup_failure" # Failed first attempt, passed second, flaky
   ];
 
+  passthru.tests = {
+    pytest = zha.overridePythonAttrs { doCheck = true; };
+  };
+
   meta = {
     description = "Zigbee Home Automation";
     homepage = "https://github.com/zigpy/zha";

From 02a3689d45d87a81563df787d2ab94e7090133f6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 21:48:49 +0200
Subject: [PATCH 1131/1209] python3Packages.zha-quirks: 1.2.0 -> 2.1.0

https://github.com/zigpy/zha-device-handlers/releases/tag/2.1.0
---
 pkgs/development/python-modules/zha-quirks/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zha-quirks/default.nix b/pkgs/development/python-modules/zha-quirks/default.nix
index 90a188eec7ce..33f0197e5b8b 100644
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@@ -8,12 +8,13 @@
   pythonOlder,
   setuptools,
   time-machine,
+  zha,
   zigpy,
 }:
 
 buildPythonPackage rec {
   pname = "zha-quirks";
-  version = "1.2.0";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -22,7 +23,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha-device-handlers";
     tag = version;
-    hash = "sha256-mDcvVwqzSmszaJDahzkRNteiO4C/eU+BqTdBpWj5yGw=";
+    hash = "sha256-VSMGUeLx8oQ8kfGj48hcceNQTEAP98svz1MCvw5KiVc=";
   };
 
   postPatch = ''
@@ -35,6 +36,7 @@ buildPythonPackage rec {
 
   dependencies = [
     aiohttp
+    zha
     zigpy
   ];
 

From 62df2853f9f279916310509c85e1231d0c770bf1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:09:53 +0200
Subject: [PATCH 1132/1209] python3Packages.pyomie: 1.1.1 -> 1.1.3

https://github.com/luuuis/pyomie/releases/tag/v1.1.3
---
 pkgs/development/python-modules/pyomie/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pyomie/default.nix b/pkgs/development/python-modules/pyomie/default.nix
index 3709034e38d2..5c4e69d73407 100644
--- a/pkgs/development/python-modules/pyomie/default.nix
+++ b/pkgs/development/python-modules/pyomie/default.nix
@@ -15,19 +15,22 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyomie";
-  version = "1.1.1";
+  version = "1.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "luuuis";
     repo = "pyomie";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BOaOClTXeoRxWb2aJKN6+lQRCLAShvHPXsUZBbH0mno=";
+    hash = "sha256-gsCPqKBzQ0nA47WT30PesGuJ4/jicYsFXl04KQ8H/KQ=";
   };
 
   build-system = [ poetry-core ];
 
-  pythonRelaxDeps = [ "typer" ];
+  pythonRelaxDeps = [
+    "click"
+    "typer"
+  ];
 
   dependencies = [
     aiohttp

From 8a923ecfff3ee3c771656b26cc621330502f856f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:11:23 +0200
Subject: [PATCH 1133/1209] python3Packages.python-pooldose: 0.9.1 -> 0.9.6

https://github.com/lmaertin/python-pooldose/blob/0.9.6/CHANGELOG.md
---
 pkgs/development/python-modules/python-pooldose/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-pooldose/default.nix b/pkgs/development/python-modules/python-pooldose/default.nix
index 033965d23f33..98514cb947d5 100644
--- a/pkgs/development/python-modules/python-pooldose/default.nix
+++ b/pkgs/development/python-modules/python-pooldose/default.nix
@@ -8,18 +8,19 @@
   pytest-asyncio,
   pytestCheckHook,
   setuptools,
+  websockets,
 }:
 
 buildPythonPackage rec {
   pname = "python-pooldose";
-  version = "0.9.1";
+  version = "0.9.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lmaertin";
     repo = "python-pooldose";
     tag = version;
-    hash = "sha256-1WHNiVPquL/D5lpN27iXSA2cWU+VjCPIcW9Th65axVA=";
+    hash = "sha256-eSFe3PRKhVMuwJ7XUHRec8nPilSxGUQ1T2k2loLubUg=";
   };
 
   build-system = [ setuptools ];
@@ -28,6 +29,7 @@ buildPythonPackage rec {
     aiofiles
     aiohttp
     getmac
+    websockets
   ];
 
   pythonImportsCheck = [ "pooldose" ];

From 8c49ee78b81ce19df32bf06624241eee6ec04014 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:11:42 +0200
Subject: [PATCH 1134/1209] python3Packages.vsure: 2.6.9 -> 2.8.0

https://github.com/persandstrom/python-verisure#version-history
---
 pkgs/development/python-modules/vsure/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/vsure/default.nix b/pkgs/development/python-modules/vsure/default.nix
index 65c2463df0e9..f372bacd3055 100644
--- a/pkgs/development/python-modules/vsure/default.nix
+++ b/pkgs/development/python-modules/vsure/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "vsure";
-  version = "2.6.9";
+  version = "2.8.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-BdUQB7usj1UwMS4AewUtaWWTl1otamCviX2MF/+x9ic=";
+    hash = "sha256-FC2aRsfxBGO8HaEHGJWweKgZzz8UG/03oB/E+hOAe/w=";
   };
 
   build-system = [ setuptools ];

From 6f8e12d2907fc42ea6bc0ea45c33888ab7316b27 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:25:45 +0200
Subject: [PATCH 1135/1209] python3Packages.knx-telegram-store: init at 0.4.0

---
 .../knx-telegram-store/default.nix            | 61 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 63 insertions(+)
 create mode 100644 pkgs/development/python-modules/knx-telegram-store/default.nix

diff --git a/pkgs/development/python-modules/knx-telegram-store/default.nix b/pkgs/development/python-modules/knx-telegram-store/default.nix
new file mode 100644
index 000000000000..cdbda0cf2b4b
--- /dev/null
+++ b/pkgs/development/python-modules/knx-telegram-store/default.nix
@@ -0,0 +1,61 @@
+{
+  aiosqlite,
+  asyncpg,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  pytest-asyncio,
+  pytestCheckHook,
+  pytest-cov-stub,
+  setuptools,
+  sqlalchemy,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "knx-telegram-store";
+  version = "0.4.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "XKNX";
+    repo = "knx-telegram-store";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-t4Bmm5n9+XSBiR2Rvm6UKAKweH9fQuZwaNqG1W2q3Co=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  optional-dependencies = {
+    postgres = [
+      asyncpg
+      sqlalchemy
+    ];
+    sqlite = [
+      aiosqlite
+      sqlalchemy
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+  ]
+  ++ finalAttrs.passthru.optional-dependencies.sqlite;
+
+  pythonImportsCheck = [
+    "knx_telegram_store"
+  ];
+
+  meta = {
+    description = "Standalone, host-agnostic Python library for KNX telegram persistence";
+    homepage = "https://github.com/XKNX/knx-telegram-store";
+    changelog = "https://github.com/XKNX/knx-telegram-store/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b68f61638724..33a6856db31c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8633,6 +8633,8 @@ self: super: with self; {
 
   knx-frontend = callPackage ../development/python-modules/knx-frontend { };
 
+  knx-telegram-store = callPackage ../development/python-modules/knx-telegram-store { };
+
   kokoro = callPackage ../development/python-modules/kokoro { };
 
   kombu = callPackage ../development/python-modules/kombu { };

From 4da5c8f6d4b24246f796683a8c56d853bd0c7a80 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:52:03 +0200
Subject: [PATCH 1136/1209] home-assistant.intents: 2026.6.1 -> 2026.6.24

https://github.com/OHF-Voice/intents-package/releases/tag/2026.6.24
---
 pkgs/servers/home-assistant/intents.nix | 23 +++--------------------
 1 file changed, 3 insertions(+), 20 deletions(-)

diff --git a/pkgs/servers/home-assistant/intents.nix b/pkgs/servers/home-assistant/intents.nix
index 98b12fd38dbb..d61c4c01aa6b 100644
--- a/pkgs/servers/home-assistant/intents.nix
+++ b/pkgs/servers/home-assistant/intents.nix
@@ -19,37 +19,20 @@
   pytestCheckHook,
 }:
 
-let
-  intents = fetchFromGitHub {
-    owner = "OHF-Voice";
-    repo = "intents";
-    rev = "4178d174018d408209879c44e98aa150335a1656";
-    hash = "sha256-xMH3lZaI4sSvicSMFaGCeYlcr5SrhA8nB/krrN0kyQo=";
-  };
-in
-
 buildPythonPackage (finalAttrs: {
   pname = "home-assistant-intents";
-  version = "2026.6.1";
+  version = "2026.6.24";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "OHF-Voice";
     repo = "intents-package";
     # https://github.com/OHF-Voice/intents-package/issues/14
-    tag = "2026.5.5";
+    tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-R6PPZSiDiFvB+lNxyuIHwMIgpQvVI0oqrucnw4jnYNU=";
+    hash = "sha256-fuVS+s3l/oStgrRdeLzHrzCr9cmFesq6sYV8EgNNsIo=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail '2026.5.5' '2026.6.1'
-
-    rm -rf intents
-    ln -sf ${intents} intents
-  '';
-
   build-system = [
     setuptools
 

From c2520f5d00c805ca3ec00c980ae53bfdf9caecf2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:12:45 +0200
Subject: [PATCH 1137/1209] home-assistant: 2026.6.4 -> 2026.7.1

https://www.home-assistant.io/blog/2026/07/01/release-20267/
https://github.com/home-assistant/core/releases/tag/2026.7.1
---
 .../home-assistant/component-packages.nix     | 201 +++++++++++-------
 pkgs/servers/home-assistant/default.nix       |   6 +-
 pkgs/servers/home-assistant/frontend.nix      |   4 +-
 .../patches/static-follow-symlinks.patch      |  16 +-
 4 files changed, 138 insertions(+), 89 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index ee46cfa8c7c5..5e596553f08b 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2026.6.4";
+  version = "2026.7.1";
   components = {
     "3_day_blinds" =
       ps: with ps; [
@@ -42,10 +42,6 @@
       ps: with ps; [
         accuweather
       ];
-    "acer_projector" =
-      ps: with ps; [
-        serialx
-      ];
     "acmeda" =
       ps: with ps; [
         aiopulse
@@ -245,10 +241,6 @@
     "amp_motorization" =
       ps: with ps; [
       ];
-    "ampio" =
-      ps: with ps; [
-        asmog
-      ];
     "analytics" =
       ps: with ps; [
         aiohasupervisor
@@ -369,6 +361,9 @@
       ps: with ps; [
         sharp-aquos-rc
       ];
+    "aqvify" =
+      ps: with ps; [
+      ]; # missing inputs: pyaqvify
     "aranet" =
       ps: with ps; [
         aioesphomeapi
@@ -422,7 +417,7 @@
       ps: with ps; [
         aiohasupervisor
         paho-mqtt
-      ];
+      ]; # missing inputs: arwn-client
     "aseko_pool_live" =
       ps: with ps; [
         aioaseko
@@ -454,10 +449,6 @@
       ps: with ps; [
         pyatag
       ];
-    "aten_pe" =
-      ps: with ps; [
-        atenpdu
-      ];
     "atlanticcityelectric" =
       ps: with ps; [
       ];
@@ -551,9 +542,8 @@
         serialx
         zeroconf
       ];
-    "avion" =
+    "avosdim" =
       ps: with ps; [
-        avion
       ];
     "awair" =
       ps: with ps; [
@@ -643,10 +633,6 @@
       ps: with ps; [
         pybbox
       ];
-    "beewi_smartclim" =
-      ps: with ps; [
-        beewi-smartclim
-      ];
     "bge" =
       ps: with ps; [
       ];
@@ -905,6 +891,9 @@
     "button" =
       ps: with ps; [
       ];
+    "bwt" =
+      ps: with ps; [
+      ];
     "caldav" =
       ps: with ps; [
         caldav
@@ -1005,6 +994,32 @@
       ps: with ps; [
         pychannels
       ];
+    "chef_iq" =
+      ps: with ps; [
+        aioesphomeapi
+        aiohasupervisor
+        aioruuvigateway
+        aioshelly
+        aiousbwatcher
+        bleak
+        bleak-esphome
+        bleak-retry-connector
+        bluetooth-adapters
+        bluetooth-auto-recovery
+        bluetooth-data-tools
+        dbus-fast
+        esphome-dashboard-api
+        ha-ffmpeg
+        habluetooth
+        hassil
+        home-assistant-intents
+        ifaddr
+        mutagen
+        pymicro-vad
+        pyspeex-noise
+        serialx
+        zeroconf
+      ]; # missing inputs: chefiq-ble
     "chess_com" =
       ps: with ps; [
         chess-com-api
@@ -1029,10 +1044,6 @@
       ps: with ps; [
         python-citybikes
       ];
-    "clementine" =
-      ps: with ps; [
-        python-clementine-remote
-      ];
     "clickatell" =
       ps: with ps; [
       ];
@@ -1114,7 +1125,7 @@
       ];
     "command_line" =
       ps: with ps; [
-        jsonpath
+        jsonpath-python
       ];
     "compensation" =
       ps: with ps; [
@@ -1567,6 +1578,10 @@
       ps: with ps; [
         aioecowitt
       ];
+    "edifier_infrared" =
+      ps: with ps; [
+        infrared-protocols
+      ];
     "edimax" =
       ps: with ps; [
         pyedimax
@@ -1615,10 +1630,6 @@
       ps: with ps; [
         elgato
       ];
-    "eliqonline" =
-      ps: with ps; [
-        eliqonline
-      ];
     "elkm1" =
       ps: with ps; [
         elkm1-lib
@@ -1675,6 +1686,9 @@
     "energie_vanons" =
       ps: with ps; [
       ];
+    "energieleser" =
+      ps: with ps; [
+      ]; # missing inputs: energieleser
     "energy" =
       ps: with ps; [
         fnv-hash-fast
@@ -1707,6 +1721,9 @@
       ps: with ps; [
         enturclient
       ];
+    "envertech_evt800" =
+      ps: with ps; [
+      ]; # missing inputs: pyenvertechevt800
     "environment_canada" =
       ps: with ps; [
         env-canada
@@ -2276,7 +2293,6 @@
       ];
     "gitter" =
       ps: with ps; [
-        gitterpy
       ];
     "glances" =
       ps: with ps; [
@@ -2441,14 +2457,15 @@
       ps: with ps; [
         greenplanet-energy-api
       ];
+    "greencell" =
+      ps: with ps; [
+        aiohasupervisor
+        paho-mqtt
+      ]; # missing inputs: greencell_client
     "greeneye_monitor" =
       ps: with ps; [
         greeneye-monitor
       ];
-    "greenwave" =
-      ps: with ps; [
-        greenwavereality
-      ];
     "group" =
       ps: with ps; [
       ];
@@ -2531,6 +2548,9 @@
     "heiwa" =
       ps: with ps; [
       ];
+    "helty" =
+      ps: with ps; [
+      ]; # missing inputs: pyhelty
     "heos" =
       ps: with ps; [
         pyheos
@@ -2977,6 +2997,9 @@
       ps: with ps; [
         aioimmich
       ];
+    "imou" =
+      ps: with ps; [
+      ]; # missing inputs: pyimouapi
     "improv_ble" =
       ps: with ps; [
         aioesphomeapi
@@ -3120,6 +3143,9 @@
       ps: with ps; [
         ha-iotawattpy
       ];
+    "iotorero" =
+      ps: with ps; [
+      ];
     "iotty" =
       ps: with ps; [
         iottycloud
@@ -3212,8 +3238,7 @@
       ];
     "itach" =
       ps: with ps; [
-        pyitachip2ir
-      ];
+      ]; # missing inputs: pyitachip2ir2
     "itunes" =
       ps: with ps; [
       ];
@@ -3358,6 +3383,10 @@
       ps: with ps; [
         kiwiki-client
       ];
+    "klik_aan_klik_uit" =
+      ps: with ps; [
+        rf-protocols
+      ];
     "kmtronic" =
       ps: with ps; [
         pykmtronic
@@ -3367,12 +3396,16 @@
         knocki
       ];
     "knx" =
-      ps: with ps; [
+      ps:
+      with ps;
+      [
         home-assistant-frontend
         knx-frontend
+        knx-telegram-store
         xknx
         xknxproject
-      ];
+      ]
+      ++ knx-telegram-store.optional-dependencies.sqlite;
     "kodi" =
       ps: with ps; [
         pykodi
@@ -3723,9 +3756,6 @@
         psutil-home-assistant
         sqlalchemy
       ];
-    "logentries" =
-      ps: with ps; [
-      ];
     "logger" =
       ps: with ps; [
       ];
@@ -3945,6 +3975,9 @@
       ps: with ps; [
         python-melcloud
       ];
+    "melcloud_home" =
+      ps: with ps; [
+      ]; # missing inputs: aiomelcloudhome
     "melissa" =
       ps: with ps; [
         py-melissa-climate
@@ -4023,18 +4056,6 @@
       ps: with ps; [
         pycsspeechtts
       ];
-    "microsoft_face" =
-      ps: with ps; [
-        pyturbojpeg
-      ];
-    "microsoft_face_detect" =
-      ps: with ps; [
-        pyturbojpeg
-      ];
-    "microsoft_face_identify" =
-      ps: with ps; [
-        pyturbojpeg
-      ];
     "miele" =
       ps: with ps; [
         pymiele
@@ -4274,7 +4295,6 @@
       ];
     "msteams" =
       ps: with ps; [
-        pymsteams
       ];
     "mta" =
       ps: with ps; [
@@ -4418,6 +4438,9 @@
       ps: with ps; [
         neurio
       ];
+    "nexen" =
+      ps: with ps; [
+      ];
     "nexia" =
       ps: with ps; [
         nexia
@@ -4886,6 +4909,7 @@
         universal-silabs-flasher
         zeroconf
         zha
+        zha-quirks
       ];
     "otp" =
       ps: with ps; [
@@ -4900,9 +4924,12 @@
         ourgroceries
       ];
     "overkiz" =
-      ps: with ps; [
+      ps:
+      with ps;
+      [
         pyoverkiz
-      ];
+      ]
+      ++ pyoverkiz.optional-dependencies.nexity;
     "overseerr" =
       ps: with ps; [
         aiohasupervisor
@@ -5504,7 +5531,11 @@
     "raspberry_pi" =
       ps: with ps; [
         aiohasupervisor
+        aiousbwatcher
+        ha-silabs-firmware-client
         psutil-home-assistant
+        serialx
+        universal-silabs-flasher
       ];
     "raspyrfm" =
       ps: with ps; [
@@ -5592,7 +5623,7 @@
       ];
     "rest" =
       ps: with ps; [
-        jsonpath
+        jsonpath-python
         xmltodict
       ];
     "rest_command" =
@@ -5807,7 +5838,7 @@
     "scrape" =
       ps: with ps; [
         beautifulsoup4
-        jsonpath
+        jsonpath-python
         lxml
         xmltodict
       ];
@@ -5821,10 +5852,6 @@
     "script" =
       ps: with ps; [
       ];
-    "scsgate" =
-      ps: with ps; [
-        scsgate
-      ];
     "search" =
       ps: with ps; [
       ];
@@ -6297,6 +6324,9 @@
       ];
     "srp_energy" =
       ps: with ps; [
+        fnv-hash-fast
+        psutil-home-assistant
+        sqlalchemy
         srpenergy
       ];
     "ssdp" =
@@ -6406,7 +6436,7 @@
       ];
     "swisscom" =
       ps: with ps; [
-      ];
+      ]; # missing inputs: python-swisscom-internet-box
     "switch" =
       ps: with ps; [
       ];
@@ -6446,6 +6476,29 @@
       ];
     "switchbot_cloud" =
       ps: with ps; [
+        aiohasupervisor
+        aiousbwatcher
+        bleak
+        bleak-retry-connector
+        bluetooth-adapters
+        bluetooth-auto-recovery
+        bluetooth-data-tools
+        cronsim
+        dbus-fast
+        ha-ffmpeg
+        habluetooth
+        hass-nabucasa
+        hassil
+        home-assistant-intents
+        matter-ble-proxy
+        matter-python-client
+        mutagen
+        openai
+        pymicro-vad
+        pyspeex-noise
+        pyturbojpeg
+        securetar
+        serialx
         switchbot-api
       ];
     "switcher_kis" =
@@ -6718,10 +6771,6 @@
         pytibber
         sqlalchemy
       ];
-    "tikteck" =
-      ps: with ps; [
-        tikteck
-      ];
     "tile" =
       ps: with ps; [
         pytile
@@ -7018,10 +7067,6 @@
       ps: with ps; [
         unifi-discovery
       ];
-    "unifiled" =
-      ps: with ps; [
-        unifiled
-      ];
     "unifiprotect" =
       ps: with ps; [
         uiprotect
@@ -7314,6 +7359,9 @@
       ps: with ps; [
         aiowatttime
       ];
+    "wattwaechter" =
+      ps: with ps; [
+      ]; # missing inputs: aio-wattwaechter
     "waze_travel_time" =
       ps: with ps; [
         pywaze
@@ -7686,6 +7734,7 @@
         serialx
         universal-silabs-flasher
         zha
+        zha-quirks
       ];
     "zhong_hong" =
       ps: with ps; [
@@ -7792,6 +7841,7 @@
     "aprs"
     "apsystems"
     "aquacell"
+    "aqualogic"
     "aranet"
     "arcam_fmj"
     "arve"
@@ -7947,6 +7997,7 @@
     "econet"
     "ecovacs"
     "ecowitt"
+    "edifier_infrared"
     "edl21"
     "efergy"
     "egauge"
@@ -7974,6 +8025,7 @@
     "enocean"
     "enphase_envoy"
     "environment_canada"
+    "envisalink"
     "epic_games_store"
     "epion"
     "epson"
@@ -8213,6 +8265,7 @@
     "kiosker"
     "kira"
     "kitchen_sink"
+    "klik_aan_klik_uit"
     "kmtronic"
     "knocki"
     "knx"
@@ -8259,7 +8312,6 @@
     "locative"
     "lock"
     "logbook"
-    "logentries"
     "logger"
     "lojack"
     "london_air"
@@ -8305,9 +8357,6 @@
     "mfi"
     "microbees"
     "microsoft"
-    "microsoft_face"
-    "microsoft_face_detect"
-    "microsoft_face_identify"
     "miele"
     "mikrotik"
     "mill"
@@ -8559,6 +8608,7 @@
     "ruuvitag_ble"
     "rympro"
     "sabnzbd"
+    "saj"
     "samsung_infrared"
     "samsungtv"
     "sanix"
@@ -8748,6 +8798,7 @@
     "ukraine_alarm"
     "unifi"
     "unifi_access"
+    "unifi_direct"
     "unifi_discovery"
     "unifiprotect"
     "universal"
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index b5ebfba471e3..49d422039124 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -270,7 +270,7 @@ let
   extraBuildInputs = extraPackages python3Packages;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2026.6.4";
+  hassVersion = "2026.7.1";
 
 in
 python3Packages.buildPythonApplication rec {
@@ -291,13 +291,13 @@ python3Packages.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-NeqJT2CW8A0VfUJ2yrR+KGmmQMK8q0Wdag43rUBBoWU=";
+    hash = "sha256-3QQ4zDbhr6wD0AR7QOnG3mfbtKYcesCF9qrFwRleQfU=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-7Y26vN0oskJBgijtm9RZcvHw/xBEH3IsI8hezgsOVr0=";
+    hash = "sha256-++Hb/ZXXhqnf7wOzmi5kmENFHqhLavZFJijRFMQu9Lg=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index f0950cfe0265..b984654efa37 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -8,7 +8,7 @@ buildPythonPackage (finalAttrs: {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20260527.7";
+  version = "20260624.4";
   format = "wheel";
 
   src = fetchPypi {
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-zYm8K3HJnAkT41S6TmGvj8V8zpt7tb4pRtWCiB9PEXw=";
+    hash = "sha256-mC3+BGVT9sDlHhj2aNeqh0YMehE3BAAT8SfMOQKv4/E=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/patches/static-follow-symlinks.patch b/pkgs/servers/home-assistant/patches/static-follow-symlinks.patch
index 079b07f970aa..8dce29af3c21 100644
--- a/pkgs/servers/home-assistant/patches/static-follow-symlinks.patch
+++ b/pkgs/servers/home-assistant/patches/static-follow-symlinks.patch
@@ -1,25 +1,23 @@
 diff --git a/homeassistant/components/http/static.py b/homeassistant/components/http/static.py
-index 29c5840a4bf..463c723df91 100644
+index 40405a8734d..754edffb910 100644
 --- a/homeassistant/components/http/static.py
 +++ b/homeassistant/components/http/static.py
-@@ -7,6 +7,7 @@ from pathlib import Path
- from typing import Final
+@@ -5,6 +5,7 @@ from pathlib import Path
+ from typing import Final, override
  
  from aiohttp.hdrs import CACHE_CONTROL, CONTENT_TYPE
 +from aiohttp.typedefs import PathLike
  from aiohttp.web import FileResponse, Request, StreamResponse
  from aiohttp.web_fileresponse import CONTENT_TYPES, FALLBACK_CONTENT_TYPE
  from aiohttp.web_urldispatcher import StaticResource
-@@ -21,6 +22,12 @@ RESPONSE_CACHE: LRU[tuple[str, Path], tuple[Path, str]] = LRU(512)
+@@ -20,6 +21,10 @@ _GUESSER = CONTENT_TYPES.guess_file_type
+ 
  class CachingStaticResource(StaticResource):
      """Static Resource handler that will add cache headers."""
- 
 +    def __init__(self, prefix: str, directory: PathLike, **kwargs):
 +        """Allow static files to be hosted behind symlinks."""
 +        kwargs.update({"follow_symlinks": True})
 +        super().__init__(prefix, directory, **kwargs)
-+
-+
+ 
+     @override
      async def _handle(self, request: Request) -> StreamResponse:
-         """Wrap base handler to cache file path resolution and content type guess."""
-         rel_url = request.match_info["filename"]

From 9af14666abe972cb52ee8f3e3a6ed6cd63f1e93d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:53:43 +0200
Subject: [PATCH 1138/1209] python3Packages.homeassistant-stubs: 2026.6.4 ->
 2026.7.1

https://github.com/KapJI/homeassistant-stubs/releases/tag/2026.7.1
---
 pkgs/servers/home-assistant/stubs.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index d56ddb56f4ce..e8f663e4afdc 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2026.6.4";
+  version = "2026.7.1";
   pyproject = true;
 
   disabled = python.version != home-assistant.python3Packages.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     tag = version;
-    hash = "sha256-nfBY+nXBv0ZrXXr0Be/0xttYMncx7NmMPbAbx6D00SU=";
+    hash = "sha256-pk6SGLbTLhA94Pg2FdWWRDNHbXif3EGGZzfDfziSFyY=";
   };
 
   build-system = [

From 5534c1822f32e63b5e12c194bf73c2d889cf3195 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:53:02 +0200
Subject: [PATCH 1139/1209] 
 home-assistant.pythonPackages.pytest-home-assistant-custom-component:
 0.13.340 -> 0.13.345

---
 .../home-assistant/pytest-homeassistant-custom-component.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
index d6049a3f5f86..da0e2cc1bb76 100644
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.340";
+  version = "0.13.345";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     tag = version;
-    hash = "sha256-08hshNdSbOJSu/uJVBeZSxksYaCSZo7KjwwyaooqNGo=";
+    hash = "sha256-Px4uPBn/drE9gbpszJDMwlaHNWk/dLvdmgqcgY770V0=";
   };
 
   build-system = [ setuptools ];

From 25f693af07b6266266734860076bb20995600e6a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:47:19 +0200
Subject: [PATCH 1140/1209] python3Packages.asmog: drop

Dead leaf package, previous home-assistant dependency.
---
 .../python-modules/asmog/default.nix          | 39 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 41 deletions(-)
 delete mode 100644 pkgs/development/python-modules/asmog/default.nix

diff --git a/pkgs/development/python-modules/asmog/default.nix b/pkgs/development/python-modules/asmog/default.nix
deleted file mode 100644
index de2165d63e3f..000000000000
--- a/pkgs/development/python-modules/asmog/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  aiohttp,
-  async-timeout,
-  buildPythonPackage,
-  fetchPypi,
-  setuptools,
-}:
-
-buildPythonPackage (finalAttrs: {
-  pname = "asmog";
-  version = "0.0.6";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit (finalAttrs) pname version;
-    hash = "sha256-k8dC3g2oY/b4w4m7Y/HUy/6/3Tm1kntx9tjoyXqDaJE=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    aiohttp
-    async-timeout
-  ];
-
-  # Project doesn't ship the tests
-  # https://github.com/kstaniek/python-ampio-smog-api/issues/2
-  doCheck = false;
-
-  pythonImportsCheck = [ "asmog" ];
-
-  meta = {
-    description = "Python module for Ampio Smog Sensors";
-    homepage = "https://github.com/kstaniek/python-ampio-smog-api";
-    license = with lib.licenses; [ asl20 ];
-    maintainers = with lib.maintainers; [ fab ];
-  };
-})
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 6254f0646181..294519faca6c 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -91,6 +91,7 @@ mapAliases {
   apkit = throw "apkit was removed because it is unmaintained upstream and different from apkit on PyPI"; # added 2025-09-13
   APScheduler = throw "'APScheduler' has been renamed to/replaced by 'apscheduler'"; # Converted to throw 2025-10-29
   argon2_cffi = throw "'argon2_cffi' has been renamed to/replaced by 'argon2-cffi'"; # Converted to throw 2025-10-29
+  asmog = throw "'asmog' has been removed because the service it polled is offline and the library has been unmaintained since 2019"; # Added 2026-06-04
   aspy-refactor-imports = throw "'aspy-refactor-imports' has been renamed to/replaced by 'classify-imports'"; # Added 2026-05-22
   aspy-yaml = throw "'aspy-yaml' has been removed because the upstream repository was archived in 2020"; # Added 2026-06-04
   astropy-extension-helpers = extension-helpers; # Added 2025-10-15
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 33a6856db31c..91fbce963263 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1142,8 +1142,6 @@ self: super: with self; {
 
   asks = callPackage ../development/python-modules/asks { };
 
-  asmog = callPackage ../development/python-modules/asmog { };
-
   asn1 = callPackage ../development/python-modules/asn1 { };
 
   asn1ate = callPackage ../development/python-modules/asn1ate { };

From 0bf73bb576be44370b5612f6104452812b6dbe1f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:48:59 +0200
Subject: [PATCH 1141/1209] python3Packages.avion: drop

---
 .../python-modules/avion/default.nix          | 49 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 51 deletions(-)
 delete mode 100644 pkgs/development/python-modules/avion/default.nix

diff --git a/pkgs/development/python-modules/avion/default.nix b/pkgs/development/python-modules/avion/default.nix
deleted file mode 100644
index 1135c20bd08e..000000000000
--- a/pkgs/development/python-modules/avion/default.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  lib,
-  bluepy,
-  buildPythonPackage,
-  csrmesh,
-  fetchPypi,
-  pycryptodome,
-  requests,
-  setuptools,
-}:
-
-buildPythonPackage (finalAttrs: {
-  pname = "avion";
-  version = "0.10";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit (finalAttrs) pname version;
-    hash = "sha256-v/0NwFmxDZ9kEOx5qs5L9sKzOg/kto79syctg0Ah+30=";
-  };
-
-  postPatch = ''
-    # https://github.com/mjg59/python-avion/pull/16
-    substituteInPlace setup.py \
-      --replace "bluepy>==1.1.4" "bluepy>=1.1.4"
-  '';
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    bluepy
-    csrmesh
-    pycryptodome
-    requests
-  ];
-
-  # Module has no test
-  doCheck = false;
-
-  # bluepy/uuids.json is not found
-  # pythonImportsCheck = [ "avion" ];
-
-  meta = {
-    description = "Python API for controlling Avi-on Bluetooth dimmers";
-    homepage = "https://github.com/mjg59/python-avion";
-    license = with lib.licenses; [ gpl3Plus ];
-    maintainers = with lib.maintainers; [ fab ];
-  };
-})
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 294519faca6c..ccd8fae3ad31 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -106,6 +106,7 @@ mapAliases {
   audio-metadata = throw "'audio-metadata' has been removed as it's unmaintained since 2020"; # Added 2026-03-12
   autotrash = throw "'autotrash' has been renamed to/replaced by 'super.pkgs.autotrash'"; # Converted to throw 2025-10-29
   av_13 = throw "'av_13' has been renamed to/replaced by 'av'"; # Added 2026-02-01
+  avion = throw "'avion' has been removed since it depended on the unmaintained bluepy library"; # Added 2026-06-04
   avro3k = throw "'avro3k' was removed because it's unmaintained since 2014"; # added 2026-06-18
   awesome-slugify = throw "'awesome-slugify' has been removed as it was unmaintained upstream"; # Added 2026-06-14
   Babel = throw "'Babel' has been renamed to/replaced by 'babel'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 91fbce963263..caae5e10ec99 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1397,8 +1397,6 @@ self: super: with self; {
 
   avidtools = callPackage ../development/python-modules/avidtools { };
 
-  avion = callPackage ../development/python-modules/avion { };
-
   avro = callPackage ../development/python-modules/avro { };
 
   avro-python3 = callPackage ../development/python-modules/avro-python3 { };

From d56caf53cfbae2e23a3d8c0d755cb278c18e5a4d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:50:40 +0200
Subject: [PATCH 1142/1209] python3Packages.beewe-smartclim: drop

---
 .../beewi-smartclim/default.nix               | 40 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 42 deletions(-)
 delete mode 100644 pkgs/development/python-modules/beewi-smartclim/default.nix

diff --git a/pkgs/development/python-modules/beewi-smartclim/default.nix b/pkgs/development/python-modules/beewi-smartclim/default.nix
deleted file mode 100644
index 083894116408..000000000000
--- a/pkgs/development/python-modules/beewi-smartclim/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  btlewrap,
-  bluepy,
-}:
-
-buildPythonPackage rec {
-  pname = "beewi-smartclim";
-  version = "0.0.10";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "alemuro";
-    repo = "beewi_smartclim";
-    tag = version;
-    hash = "sha256-xdr545Q4DFhup2BCMZZ1WYWgt97qT6oipIHWcsp90+A=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    btlewrap
-    bluepy
-  ];
-
-  # No tests available
-  doCheck = false;
-
-  pythonImportsCheck = [ "beewi_smartclim" ];
-
-  meta = {
-    description = "Library to read data from BeeWi SmartClim sensor using Bluetooth LE";
-    homepage = "https://github.com/alemuro/beewi_smartclim";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.jamiemagee ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index ccd8fae3ad31..2b36eb2686bf 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -119,6 +119,7 @@ mapAliases {
   beancount_docverif = throw "'beancount_docverif' has been renamed to/replaced by 'beancount-docverif'"; # Converted to throw 2025-10-29
   beets-stable = lib.warn "beets-stable was aliased to beets, since upstream releases are frequent nowadays" self.beets; # added 2025-10-16
   beets-unstable = lib.warn "beets-unstable was aliased to beets, since upstream releases are frequent nowadays" self.beets; # added 2025-10-16
+  beewi-smartclim = throw "'beetwi-smartclim' was removed because it depends on the unmaintained bluepy library"; # Added 2026-06-04
   betterproto-fw = throw "'betterproto-fw' has been removed as it is not longer required by fireworks-ai"; # Added 2026-06-09
   bimmer-connected = throw "'bimmer-connected' was removed because BMW started blocking third parties"; # added 2026-03-30
   bip_utils = throw "'bip_utils' has been renamed to/replaced by 'bip-utils'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index caae5e10ec99..7b034b231911 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2062,8 +2062,6 @@ self: super: with self; {
     disableAllPlugins = true;
   };
 
-  beewi-smartclim = callPackage ../development/python-modules/beewi-smartclim { };
-
   before-after = callPackage ../development/python-modules/before-after { };
 
   behave = callPackage ../development/python-modules/behave { };

From 4f9d1c7a0a42b3939be3ef9938b67572b2b24d76 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:55:00 +0200
Subject: [PATCH 1143/1209] python3Packages.atenpdu: drop

---
 .../python-modules/atenpdu/default.nix        | 41 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 43 deletions(-)
 delete mode 100644 pkgs/development/python-modules/atenpdu/default.nix

diff --git a/pkgs/development/python-modules/atenpdu/default.nix b/pkgs/development/python-modules/atenpdu/default.nix
deleted file mode 100644
index 2cfd06220afe..000000000000
--- a/pkgs/development/python-modules/atenpdu/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  async-timeout,
-  pysnmp,
-  poetry-core,
-}:
-
-buildPythonPackage rec {
-  pname = "atenpdu";
-  version = "0.7.2";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-+UQVCizqpyVe7nuQUYwSBOtiTwW+0LVH1HaaucnIg9k=";
-  };
-
-  build-system = [ poetry-core ];
-
-  dependencies = [
-    async-timeout
-    pysnmp
-  ];
-
-  # Module has no test
-  doCheck = false;
-
-  pythonImportsCheck = [ "atenpdu" ];
-
-  meta = {
-    description = "Python interface to control ATEN PE PDUs";
-    homepage = "https://github.com/mtdcr/pductl";
-    changelog = "https://github.com/mtdcr/pductl/releases/tag/${version}";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fab ];
-    mainProgram = "pductl";
-    broken = lib.versionAtLeast pysnmp.version "7";
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 2b36eb2686bf..31d5669dacc0 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -101,6 +101,7 @@ mapAliases {
   async_stagger = throw "'async_stagger' has been renamed to/replaced by 'async-stagger'"; # Converted to throw 2025-10-29
   asyncio-nats-client = throw "'asyncio-nats-client' has been renamed to/replaced by 'nats-py'"; # Converted to throw 2025-10-29
   asyncstdlib-fw = throw "'asyncstdlib-fw' has been removed as it is not longer required by fireworks-ai"; # Added 2026-06-09
+  atenpdu = throw "'atenpdu' has been removed, since it had was broken and unmaintained in home-assistant"; # Added 2026-06-04
   atsim_potentials = throw "'atsim_potentials' has been renamed to/replaced by 'atsim-potentials'"; # Converted to throw 2025-10-29
   aubio = throw "'aubio' only direct user LedFX switched to a fork named 'aubio-ledfx', hence the aubio package has been replaced."; # Added 2026-04-20
   audio-metadata = throw "'audio-metadata' has been removed as it's unmaintained since 2020"; # Added 2026-03-12
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7b034b231911..5be6c8531a35 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1260,8 +1260,6 @@ self: super: with self; {
 
   atc-ble = callPackage ../development/python-modules/atc-ble { };
 
-  atenpdu = callPackage ../development/python-modules/atenpdu { };
-
   atlassian-python-api = callPackage ../development/python-modules/atlassian-python-api { };
 
   atom = callPackage ../development/python-modules/atom { };

From 182c0a75bf7f4b18ae1852af29a585588dd52fb5 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:56:21 +0200
Subject: [PATCH 1144/1209] python3Packages.python-clementine-remote: drop

---
 .../python-clementine-remote/default.nix      | 41 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 43 deletions(-)
 delete mode 100644 pkgs/development/python-modules/python-clementine-remote/default.nix

diff --git a/pkgs/development/python-modules/python-clementine-remote/default.nix b/pkgs/development/python-modules/python-clementine-remote/default.nix
deleted file mode 100644
index 00abc62b2075..000000000000
--- a/pkgs/development/python-modules/python-clementine-remote/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  protobuf,
-}:
-
-buildPythonPackage rec {
-  pname = "python-clementine-remote";
-  version = "1.0.3";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "jjmontesl";
-    repo = "python-clementine-remote";
-    tag = version;
-    hash = "sha256-tPaxRBvt+tW4yV5Ap3YxMQxK3o7BJF3nP/wzBJeDgic=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [ protobuf ];
-
-  # Project has no tests
-  doCheck = false;
-
-  env = {
-    # https://github.com/jjmontesl/python-clementine-remote/pull/7
-    PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION = "python";
-  };
-
-  pythonImportsCheck = [ "clementineremote" ];
-
-  meta = {
-    description = "Python library and CLI for the Clementine Music Player remote protocol";
-    homepage = "https://github.com/jjmontesl/python-clementine-remote";
-    license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.jamiemagee ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 31d5669dacc0..505da33ae12a 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -512,6 +512,7 @@ mapAliases {
   pytestquickcheck = throw "'pytestquickcheck' has been renamed to/replaced by 'pytest-quickcheck'"; # Converted to throw 2025-10-29
   pytestrunner = throw "'pytestrunner' has been renamed to/replaced by 'pytest-runner'"; # Converted to throw 2025-10-29
   python-bring-api = throw "python-bring-api was removed because Home Assistant switched to bring-api"; # added 2025-10-03
+  python-clementine-remote = throw "'python-clementine-remote' was removed because Home Assistant droppped the integration"; # Added 2026-06-04
   python-ethtool = throw "'python-ethtool' has been renamed to/replaced by 'ethtool'"; # Converted to throw 2025-10-29
   python-igraph = throw "'python-igraph' has been renamed to/replaced by 'igraph'"; # Converted to throw 2025-10-29
   python-jsonrpc-server = throw "python-jsonrpc-server has been removed because it was no longer used by anything"; # added 2025-11-11
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5be6c8531a35..302a451ea574 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16093,8 +16093,6 @@ self: super: with self; {
 
   python-citybikes = callPackage ../development/python-modules/python-citybikes { };
 
-  python-clementine-remote = callPackage ../development/python-modules/python-clementine-remote { };
-
   python-code-minimap = callPackage ../development/python-modules/python-code-minimap { };
 
   python-codon-tables = callPackage ../development/python-modules/python-codon-tables { };

From 7ed81b51f3885802342390b66ddcf75b82f29915 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:57:48 +0200
Subject: [PATCH 1145/1209] python3Packages.eliqonline: drop

---
 .../python-modules/eliqonline/default.nix     | 38 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 40 deletions(-)
 delete mode 100644 pkgs/development/python-modules/eliqonline/default.nix

diff --git a/pkgs/development/python-modules/eliqonline/default.nix b/pkgs/development/python-modules/eliqonline/default.nix
deleted file mode 100644
index 06135070f86d..000000000000
--- a/pkgs/development/python-modules/eliqonline/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  lib,
-  aiohttp,
-  buildPythonPackage,
-  docopt,
-  fetchPypi,
-  pyyaml,
-}:
-
-buildPythonPackage rec {
-  pname = "eliqonline";
-  version = "1.2.2";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "hOUN4cA4pKVioIrfJM02GOnZdDRc7xbNtvHfoD3//bM=";
-  };
-
-  propagatedBuildInputs = [
-    aiohttp
-    docopt
-    pyyaml
-  ];
-
-  # Project has no tests
-  doCheck = false;
-
-  pythonImportsCheck = [ "eliqonline" ];
-
-  meta = {
-    description = "Python client to the Eliq Online API";
-    mainProgram = "eliqonline";
-    homepage = "https://github.com/molobrakos/eliqonline";
-    license = lib.licenses.lgpl3Only;
-    maintainers = with lib.maintainers; [ fab ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 505da33ae12a..8b966abac3cc 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -208,6 +208,7 @@ mapAliases {
   EasyProcess = throw "'EasyProcess' has been renamed to/replaced by 'easyprocess'"; # Converted to throw 2025-10-29
   editdistance-s = throw "editdistance-s has been removed since it was added solely for the identity package, which has moved on to ukkonen"; # added 2025-08-04
   elegy = throw "elegy has been removed because it has transitively been marked as broken since 2023."; # Added 2025-10-11
+  eliqonline = throw "'eligonline' was removed because Home Assistant dropped the integation"; # Added 2026-06-04
   email_validator = throw "'email_validator' has been renamed to/replaced by 'email-validator'"; # Converted to throw 2025-10-29
   emailthreads = throw "'emailthreads' has been removed because the upstream repository was archived in 2024"; # Added 2026-04-09
   enocean = throw "'enocean' was removed because Home Assistant switched to 'enocean-async'"; # added 2026-03-31
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 302a451ea574..93d20ed2c91f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5133,8 +5133,6 @@ self: super: with self; {
 
   eliot = callPackage ../development/python-modules/eliot { };
 
-  eliqonline = callPackage ../development/python-modules/eliqonline { };
-
   elkm1-lib = callPackage ../development/python-modules/elkm1-lib { };
 
   elkoep-aio-mqtt = callPackage ../development/python-modules/elkoep-aio-mqtt { };

From e9d6b4dd4707d6e270cee018564a8b64926dd5f7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 22:59:20 +0200
Subject: [PATCH 1146/1209] python3Packages.gitterpy: drop

---
 .../python-modules/gitterpy/default.nix       | 34 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 --
 3 files changed, 1 insertion(+), 36 deletions(-)
 delete mode 100644 pkgs/development/python-modules/gitterpy/default.nix

diff --git a/pkgs/development/python-modules/gitterpy/default.nix b/pkgs/development/python-modules/gitterpy/default.nix
deleted file mode 100644
index ee35d962d1d8..000000000000
--- a/pkgs/development/python-modules/gitterpy/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  setuptools,
-  requests,
-}:
-
-buildPythonPackage rec {
-  pname = "gitterpy";
-  version = "0.1.7";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-nmZ6sVjrHRLfvXMr/fYiN+a4Wly87YKwAR+heP/sNkE=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [ requests ];
-
-  # Package has no tests
-  doCheck = false;
-
-  pythonImportsCheck = [ "gitterpy" ];
-
-  meta = {
-    description = "Python interface for the Gitter API";
-    homepage = "https://github.com/MichaelYusko/GitterPy";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.jamiemagee ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 8b966abac3cc..9010ec4ff87b 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -256,6 +256,7 @@ mapAliases {
   ghidra-bridge = throw "'ghidra-bridge' has been removed as it was unmaintained upstream"; # Added 2026-04-05
   github3_py = throw "'github3_py' has been renamed to/replaced by 'github3-py'"; # Converted to throw 2025-10-29
   GitPython = throw "'GitPython' has been renamed to/replaced by 'gitpython'"; # Converted to throw 2025-10-29
+  gitterpy = throw "'gitterpy' was removed. The service was migrated to Matrix"; # Added 2026-06-04
   google_api_python_client = throw "'google_api_python_client' has been renamed to/replaced by 'google-api-python-client'"; # Converted to throw 2025-10-29
   googleapis_common_protos = throw "'googleapis_common_protos' has been renamed to/replaced by 'googleapis-common-protos'"; # Converted to throw 2025-10-29
   gotrue = throw "'gotrue' has been replaced by 'supabase-auth'"; # Added 2026-03-08
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 93d20ed2c91f..f242801c9c0b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6513,8 +6513,6 @@ self: super: with self; {
 
   gitpython = callPackage ../development/python-modules/gitpython { };
 
-  gitterpy = callPackage ../development/python-modules/gitterpy { };
-
   giturlparse = callPackage ../development/python-modules/giturlparse { };
 
   glad = callPackage ../development/python-modules/glad { };

From 23e93485308191ccc5809486ef45aad9fede4caa Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:00:21 +0200
Subject: [PATCH 1147/1209] python3Packages.greenwavereality: drop

---
 .../greenwavereality/default.nix              | 40 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 42 deletions(-)
 delete mode 100644 pkgs/development/python-modules/greenwavereality/default.nix

diff --git a/pkgs/development/python-modules/greenwavereality/default.nix b/pkgs/development/python-modules/greenwavereality/default.nix
deleted file mode 100644
index b49b9cd01a94..000000000000
--- a/pkgs/development/python-modules/greenwavereality/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  setuptools,
-  requests,
-  xmltodict,
-  urllib3,
-}:
-
-buildPythonPackage rec {
-  pname = "greenwavereality";
-  version = "0.5.1";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-bNTO9qHoOe3A7TYiUwLBVq4eWyGoIfCoguizM1hKk/Y=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    requests
-    xmltodict
-    urllib3
-  ];
-
-  # Module has no tests
-  doCheck = false;
-
-  pythonImportsCheck = [ "greenwavereality" ];
-
-  meta = {
-    description = "Control of Greenwave Reality Lights";
-    homepage = "https://github.com/dfiel/greenwavereality";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.jamiemagee ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 9010ec4ff87b..2b9c33ab593d 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -267,6 +267,7 @@ mapAliases {
   gradient_statsd = throw "'gradient_statsd' has been renamed to/replaced by 'gradient-statsd'"; # Converted to throw 2025-10-29
   grapheme = throw "'grapheme' has been removed as it is unmaintained upstream. Consider using 'graphemeu' instead."; # Converted to throw 2025-12-22
   grappelli_safe = throw "'grappelli_safe' has been renamed to/replaced by 'grappelli-safe'"; # Converted to throw 2025-10-29
+  greenwavereality = throw "'greenwavereality' has been removed because Home Assistant dropped support"; # Added 2026-06-04
   groestlcoin_hash = throw "'groestlcoin_hash' has been renamed to/replaced by 'groestlcoin-hash'"; # Converted to throw 2025-10-29
   grpc_google_iam_v1 = throw "'grpc_google_iam_v1' has been renamed to/replaced by 'grpc-google-iam-v1'"; # Converted to throw 2025-10-29
   gtimelog = throw "'gtimelog' has been renamed to/replaced by 'gtimelog'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f242801c9c0b..49843885a9af 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6919,8 +6919,6 @@ self: super: with self; {
 
   greenplanet-energy-api = callPackage ../development/python-modules/greenplanet-energy-api { };
 
-  greenwavereality = callPackage ../development/python-modules/greenwavereality { };
-
   gremlinpython = callPackage ../development/python-modules/gremlinpython { };
 
   grep-ast = callPackage ../development/python-modules/grep-ast { };

From 27204b5a4f55ce5b48fa8da3f47ab8993b5414e7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 01:05:11 +0200
Subject: [PATCH 1148/1209] spraycharles: drop msteams support

---
 pkgs/by-name/sp/spraycharles/drop-teams.patch | 61 +++++++++++++++++++
 pkgs/by-name/sp/spraycharles/package.nix      |  5 +-
 2 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/sp/spraycharles/drop-teams.patch

diff --git a/pkgs/by-name/sp/spraycharles/drop-teams.patch b/pkgs/by-name/sp/spraycharles/drop-teams.patch
new file mode 100644
index 000000000000..2d876e005cf5
--- /dev/null
+++ b/pkgs/by-name/sp/spraycharles/drop-teams.patch
@@ -0,0 +1,61 @@
+diff --git a/spraycharles/lib/analyze.py b/spraycharles/lib/analyze.py
+index 537f6db..424f87e 100755
+--- a/spraycharles/lib/analyze.py
++++ b/spraycharles/lib/analyze.py
+@@ -4,7 +4,7 @@ from enum import Enum
+ from rich.table import Table
+ 
+ from spraycharles.lib.logger import console, logger
+-from spraycharles.lib.utils import discord, slack, teams, SMBStatus, SprayResult, HookSvc
++from spraycharles.lib.utils import discord, slack, SMBStatus, SprayResult, HookSvc
+ 
+ 
+ class Analyzer:
+@@ -210,8 +210,6 @@ class Analyzer:
+                     pass
+                 case HookSvc.SLACK:
+                     slack(self.webhook, self.host)
+-                case HookSvc.TEAMS:
+-                    teams(self.webhook, self.host)
+                 case HookSvc.DISCORD:
+                     discord(self.webhook, self.host)
+                 case _:
+diff --git a/spraycharles/lib/utils/__init__.py b/spraycharles/lib/utils/__init__.py
+index 59eda99..3615e4c 100644
+--- a/spraycharles/lib/utils/__init__.py
++++ b/spraycharles/lib/utils/__init__.py
+@@ -1,4 +1,4 @@
+-from spraycharles.lib.utils.notify import discord, teams, slack, HookSvc
++from spraycharles.lib.utils.notify import discord, slack, HookSvc
+ from spraycharles.lib.utils.ntlm_challenger import main as ntlm_challenger
+ from spraycharles.lib.utils.smbstatus import SMBStatus
+ from spraycharles.lib.utils.sprayresult import SprayResult
+diff --git a/spraycharles/lib/utils/notify.py b/spraycharles/lib/utils/notify.py
+index f39d10d..f0d62f9 100644
+--- a/spraycharles/lib/utils/notify.py
++++ b/spraycharles/lib/utils/notify.py
+@@ -1,12 +1,10 @@
+ from enum import Enum
+-import pymsteams
+ from discord_webhook import DiscordWebhook
+ import requests
+ 
+ 
+ class HookSvc(str, Enum):
+     SLACK   = "Slack"
+-    TEAMS   = "Teams"
+     DISCORD = "Discord"
+ 
+ 
+@@ -18,12 +16,6 @@ def slack(webhook, host):
+     response.raise_for_status()  # Raises an error for bad responses
+ 
+ 
+-def teams(webhook, host):
+-    notify = pymsteams.connectorcard(webhook)
+-    notify.text(f"Credentials guessed for host: {host}")
+-    notify.send()
+-
+-
+ def discord(webhook, host):
+     notify = DiscordWebhook(
diff --git a/pkgs/by-name/sp/spraycharles/package.nix b/pkgs/by-name/sp/spraycharles/package.nix
index c2619145884f..db30ac90c2d3 100644
--- a/pkgs/by-name/sp/spraycharles/package.nix
+++ b/pkgs/by-name/sp/spraycharles/package.nix
@@ -18,13 +18,16 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   pythonRelaxDeps = true;
 
+  # https://github.com/Tw1sm/spraycharles/pull/34
+  pythonRemoveDeps = [ "pymsteams" ];
+  patches = [ ./drop-teams.patch ];
+
   build-system = with python3.pkgs; [ poetry-core ];
 
   dependencies = with python3.pkgs; [
     discord-webhook
     impacket
     numpy
-    pymsteams
     pyyaml
     requests
     requests-ntlm

From d830c6fa45822ad4581d16caa235a8be6ba883be Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:01:55 +0200
Subject: [PATCH 1149/1209] python3Packages.pymsteams: drop

---
 .../python-modules/pymsteams/default.nix      | 41 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 43 deletions(-)
 delete mode 100644 pkgs/development/python-modules/pymsteams/default.nix

diff --git a/pkgs/development/python-modules/pymsteams/default.nix b/pkgs/development/python-modules/pymsteams/default.nix
deleted file mode 100644
index a9032180e048..000000000000
--- a/pkgs/development/python-modules/pymsteams/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  requests,
-  setuptools,
-  setuptools-scm,
-}:
-
-buildPythonPackage rec {
-  pname = "pymsteams";
-  version = "0.2.5";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "rveachkc";
-    repo = "pymsteams";
-    tag = version;
-    hash = "sha256-Ze25mcXCRaon6qzWzcltD8kwJTfrG2w5jMswXymmKo4=";
-  };
-
-  build-system = [
-    setuptools
-    setuptools-scm
-  ];
-
-  dependencies = [ requests ];
-
-  # Tests require network access
-  doCheck = false;
-
-  pythonImportsCheck = [ "pymsteams" ];
-
-  meta = {
-    description = "Python module to interact with Microsoft Teams";
-    homepage = "https://github.com/rveachkc/pymsteams";
-    changelog = "https://github.com/rveachkc/pymsteams/releases/tag/${version}";
-    license = with lib.licenses; [ asl20 ];
-    maintainers = with lib.maintainers; [ fab ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 2b9c33ab593d..73395bcf1e1c 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -467,6 +467,7 @@ mapAliases {
   pylit = throw "'pylit' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-29
   pymc3 = throw "'pymc3' has been renamed to/replaced by 'pymc'"; # Converted to throw 2025-10-29
   pymelcloud = throw "'pymelcloud' has been renamed to/replaced by 'python-melcloud'"; # Converted to throw 2025-10-29
+  pymsteams = throw "'pymsteams' was removed because API used was discontinued"; # Added 2026-06-04
   PyMVGLive = throw "'PyMVGLive' has been renamed to/replaced by 'pymvglive'"; # Converted to throw 2025-10-29
   pymyq = throw "'pymyq' has been renamed to/replaced by 'python-myq'"; # Converted to throw 2025-10-29
   pymystem3 = throw "'pymystem3' has been removed because it is broken and unmaintained"; # Added 2026-04-19
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 49843885a9af..b190442f28d4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14824,8 +14824,6 @@ self: super: with self; {
 
   pymssql = callPackage ../development/python-modules/pymssql { krb5-c = pkgs.krb5; };
 
-  pymsteams = callPackage ../development/python-modules/pymsteams { };
-
   pymumble = callPackage ../development/python-modules/pymumble { };
 
   pymunk = callPackage ../development/python-modules/pymunk { };

From c51f749570fe1a7c442c3aa2ca72375e54ee0d5e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:03:02 +0200
Subject: [PATCH 1150/1209] python3Packages.scsgate: drop

---
 .../python-modules/scsgate/default.nix        | 40 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 42 deletions(-)
 delete mode 100644 pkgs/development/python-modules/scsgate/default.nix

diff --git a/pkgs/development/python-modules/scsgate/default.nix b/pkgs/development/python-modules/scsgate/default.nix
deleted file mode 100644
index f61d14a5d418..000000000000
--- a/pkgs/development/python-modules/scsgate/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pyserial,
-  pyyaml,
-  setuptools,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "scsgate";
-  version = "0.1.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "flavio";
-    repo = "scsgate";
-    tag = version;
-    hash = "sha256-wVzXKOKljENAKppod+guqm+0XMPenLgOsZzMQVTBo+k=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    pyserial
-    pyyaml
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pythonImportsCheck = [ "scsgate" ];
-
-  meta = {
-    description = "Python module to interact with SCSGate";
-    homepage = "https://github.com/flavio/scsgate";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.jamiemagee ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 73395bcf1e1c..855687174fb6 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -587,6 +587,7 @@ mapAliases {
   scikitimage = throw "'scikitimage' has been renamed to/replaced by 'scikit-image'"; # Converted to throw 2025-10-29
   scikitlearn = throw "'scikitlearn' has been renamed to/replaced by 'scikit-learn'"; # Converted to throw 2025-10-29
   scrapy-fake-useragent = throw "scrapy-fake-useragent has been removed because it is incompatible with scrapy >= 2.14"; # Added 2026-01-14
+  scsgate = throw "'scsgate' has been removed because Home Assistant dropped the integration"; # Added 2026-06-04
   seaserv = throw "seaserv has been removed as it is unmaintained"; # Added 2025-08-21
   sentry-sdk_2 = throw "'sentry-sdk_2' has been renamed to/replaced by 'sentry-sdk'"; # Converted to throw 2025-10-29
   setuptools_dso = throw "'setuptools_dso' has been renamed to/replaced by 'setuptools-dso'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b190442f28d4..dbe56081de0a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17954,8 +17954,6 @@ self: super: with self; {
 
   scs = callPackage ../development/python-modules/scs { };
 
-  scsgate = callPackage ../development/python-modules/scsgate { };
-
   scspell = callPackage ../development/python-modules/scspell { };
 
   scverse-misc = callPackage ../development/python-modules/scverse-misc { };

From 5d783f96acee7495f8d8ff4f2a22092cde03cc87 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:03:56 +0200
Subject: [PATCH 1151/1209] python3Packages.tikteck: drop

---
 .../python-modules/tikteck/default.nix        | 40 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 42 deletions(-)
 delete mode 100644 pkgs/development/python-modules/tikteck/default.nix

diff --git a/pkgs/development/python-modules/tikteck/default.nix b/pkgs/development/python-modules/tikteck/default.nix
deleted file mode 100644
index fdc1aeadd4fe..000000000000
--- a/pkgs/development/python-modules/tikteck/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  setuptools,
-  bluepy,
-  pycryptodome,
-}:
-
-buildPythonPackage rec {
-  pname = "tikteck";
-  version = "0.4";
-  pyproject = true;
-
-  # github doesn't have any tags unfortunately
-  src = fetchPypi {
-    pname = "tikteck";
-    inherit version;
-    hash = "sha256-KEbGT2RXLFMQ49gltOYcbE+ebJ1kiXzhT0DIeVXsSJM=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    bluepy
-    pycryptodome
-  ];
-
-  pythonImportsCheck = [ "tikteck" ];
-
-  # no upstream tests exist
-  doCheck = false;
-
-  meta = {
-    description = "Control Tikteck Bluetooth LED bulbs";
-    homepage = "https://github.com/mjg59/python-tikteck";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ ethancedwards8 ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 855687174fb6..cddbcf297f5a 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -645,6 +645,7 @@ mapAliases {
   TheanoWithCuda = throw "'TheanoWithCuda' has been renamed to/replaced by 'theanoWithCuda'"; # Converted to throw 2025-10-29
   TheanoWithoutCuda = throw "'TheanoWithoutCuda' has been renamed to/replaced by 'theanoWithoutCuda'"; # Converted to throw 2025-10-29
   threadpool = throw "'threadpool' has been removed, since it is obsolete"; # Added 2026-01-09
+  tikteck = throw "'tikteck' has been removed because Home Assistant dropped its integration"; # Added 2026-06-04
   tikzplotlib = throw "tikzplotlib was removed because it is incompatible with recent versions of matplotlib and webcolors"; # added 2025-11-11
   torchtnt-nightly = throw "'torchtnt-nightly' was only needed as a test dependency for 'torcheval', but these tests are no longer run"; # added 2025-11-12
   torchtrune = throw "'torchtune' weas removed because it is unmaintained"; # added 2026-07-02
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dbe56081de0a..354ca785e8fc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -19951,8 +19951,6 @@ self: super: with self; {
 
   tika-client = callPackage ../development/python-modules/tika-client { };
 
-  tikteck = callPackage ../development/python-modules/tikteck { };
-
   tiktoken = callPackage ../development/python-modules/tiktoken { };
 
   tiledb = callPackage ../development/python-modules/tiledb { inherit (pkgs) tiledb; };

From 8734999bb67a0153995f9f16223bcae481905d27 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:04:48 +0200
Subject: [PATCH 1152/1209] python3Packages.unifiled: drop

---
 .../python-modules/unifiled/default.nix       | 36 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 --
 3 files changed, 1 insertion(+), 38 deletions(-)
 delete mode 100644 pkgs/development/python-modules/unifiled/default.nix

diff --git a/pkgs/development/python-modules/unifiled/default.nix b/pkgs/development/python-modules/unifiled/default.nix
deleted file mode 100644
index c05ebcab4c7d..000000000000
--- a/pkgs/development/python-modules/unifiled/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  requests,
-  urllib3,
-}:
-
-buildPythonPackage rec {
-  pname = "unifiled";
-  version = "1.1";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "florisvdk";
-    repo = "unifiled";
-    rev = "v${version}";
-    sha256 = "1nmqxxhwa0isxdb889nhbp7w4axj1mcrwd3pr9d8nhpw4yj9h3vq";
-  };
-
-  propagatedBuildInputs = [
-    requests
-    urllib3
-  ];
-
-  # Project doesn't have any tests
-  doCheck = false;
-  pythonImportsCheck = [ "unifiled" ];
-
-  meta = {
-    description = "Python module for Ubiquiti Unifi LED controller";
-    homepage = "https://github.com/florisvdk/unifiled";
-    license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [ fab ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index cddbcf297f5a..74df22eebf25 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -666,6 +666,7 @@ mapAliases {
   ufoLib2 = throw "'ufoLib2' has been renamed to/replaced by 'ufolib2'"; # Converted to throw 2025-10-29
   unicode-slugify = throw "'unicode-slugify' has been removed becaues it was broken and unmaintained. Consider using 'python-slugify' instead."; # added 2025-10-05
   unifi = throw "'unifi' has been removed as upstream was archived in 2017"; # Added 2025-08-25
+  unifiled = throw "'unifiled' has been removed because Home Assistant dropped the integration"; # Added 2026-06-04
   unittest-data-provider = throw "'unittest-data-provider' has been removed as it was unused, unmaintained, and upstream suggests 'pytest parameterize' instead."; # Added 2026-05-22
   update_checker = throw "'update_checker' has been renamed to/replaced by 'update-checker'"; # Converted to throw 2025-10-29
   uranium = throw "'uranium' has been removed, as it was unmaintained in nixpkgs"; # Added 2026-05-22
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 354ca785e8fc..1a0513a04e7e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -21195,8 +21195,6 @@ self: super: with self; {
 
   unifi-discovery = callPackage ../development/python-modules/unifi-discovery { };
 
-  unifiled = callPackage ../development/python-modules/unifiled { };
-
   unify = callPackage ../development/python-modules/unify { };
 
   unique-log-filter = callPackage ../development/python-modules/unique-log-filter { };

From 7e1a19b3e449247339044b708696b9ae093add5c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:32:58 +0200
Subject: [PATCH 1153/1209] python3Packages.msmart-ng: 2026.4.1 -> 2026.7.0

https://github.com/mill1000/midea-msmart/releases/tag/2026.7.0
---
 pkgs/development/python-modules/msmart-ng/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/msmart-ng/default.nix b/pkgs/development/python-modules/msmart-ng/default.nix
index 8f34f1202213..bacb4048217f 100644
--- a/pkgs/development/python-modules/msmart-ng/default.nix
+++ b/pkgs/development/python-modules/msmart-ng/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "msmart-ng";
-  version = "2026.4.1";
+  version = "2026.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mill1000";
     repo = "midea-msmart";
     tag = version;
-    hash = "sha256-kWKdNu5IxBly+4SMIFYF1V3s5stpTbYvvcXpVtG51vM=";
+    hash = "sha256-OW5++yd+o2KqaFWTo/RiLjK1HO2l9WSDxkiX3lYtaUs=";
   };
 
   build-system = [

From 3088f4f8452b3972bfe68835b9b68cd68063bc02 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:33:34 +0200
Subject: [PATCH 1154/1209] home-assistant-custom-components.midea_ac: 2026.4.0
 -> 2026.7.0

https://github.com/mill1000/midea-ac-py/releases/tag/2026.7.0
---
 .../home-assistant/custom-components/midea_ac/package.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix b/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
index 8565ff7b7d1f..e6fc1d55e28d 100644
--- a/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "mill1000";
   domain = "midea_ac";
-  version = "2026.4.0";
+  version = "2026.7.0";
 
   src = fetchFromGitHub {
     owner = "mill1000";
     repo = "midea-ac-py";
     tag = version;
-    hash = "sha256-XYajDvp7K1pBlVhT553Rqa8Hi/mA8AWwchTUN4PZ+iw=";
+    hash = "sha256-lZfhZRvKdeisjQAHjYxPsyS2YL486wLtuf4ERw57vZ4=";
   };
 
   dependencies = [ msmart-ng ];

From 727dd56e5120159ff36ba287c5cef63f3ca8db37 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:34:22 +0200
Subject: [PATCH 1155/1209] home-assistant-custom-components.bodymiscale:
 2026.5.6 -> 2026.7.0

https://github.com/dckiller51/bodymiscale/compare/2026.5.6...2026.7.0
---
 .../home-assistant/custom-components/bodymiscale/package.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/bodymiscale/package.nix b/pkgs/servers/home-assistant/custom-components/bodymiscale/package.nix
index 76a7492c91a6..2b944d5846e6 100644
--- a/pkgs/servers/home-assistant/custom-components/bodymiscale/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/bodymiscale/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "dckiller51";
   domain = "bodymiscale";
-  version = "2026.5.6";
+  version = "2026.7.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     rev = version;
-    hash = "sha256-IUGQrUVaDw4XlxFGzYsSeg4Y1UxQgbOECL6OiB3cdsg=";
+    hash = "sha256-xBxK5V+DwXkoaC0D5HNlH2hHn+W2KUJAZ7rk0KxIy4U=";
   };
 
   dependencies = [

From 71951d55ce81e219c44b9de8a367d4ef205445d5 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:36:20 +0200
Subject: [PATCH 1156/1209] home-assistant-custom-components.battery_notes:
 3.4.7 -> 3.4.8

https://github.com/andrew-codechimp/HA-Battery-Notes/releases/tag/3.4.8
---
 .../custom-components/battery_notes/package.nix               | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix b/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
index cd7fab37282d..da76ab824d4b 100644
--- a/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "andrew-codechimp";
   domain = "battery_notes";
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HA-Battery-Notes";
     tag = version;
-    hash = "sha256-28yWBODUDJXSmuHgBI5+kLsPjpRM2OxUQnU1nGz83v0=";
+    hash = "sha256-Kc4ATfEEi8SRvl10msLotmBa3/RNff2yD4moRPsk8j8=";
   };
 
   # has no tests

From e09dfb3124c1db62d38d4460702e52010bc996e6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:36:37 +0200
Subject: [PATCH 1157/1209] home-assistant-custom-components.blitzortung: 1.5.0
 -> 1.7.0

https://github.com/mrk-its/homeassistant-blitzortung/releases/tag/v1.7.0
---
 .../home-assistant/custom-components/blitzortung/package.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
index 3982a1142782..102ba62329cd 100644
--- a/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "mrk-its";
   domain = "blitzortung";
-  version = "1.5.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "mrk-its";
     repo = "homeassistant-blitzortung";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hed7XBBV7LID12Md0FWA0KkAjEH0RB7MQ1XJOm0W3sw=";
+    hash = "sha256-8/KIPOmQdaaSFFrjliBBNjboPx8ewzG9/W/grBuex6s=";
   };
 
   dependencies = [

From d5976d0cbeef822f0fdf3733a585eaadbc295385 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:36:54 +0200
Subject: [PATCH 1158/1209] 
 home-assistant-custom-components.blueprints-updater: 2.9.1 -> 2.9.2

https://github.com/luuquangvu/blueprints-updater/releases/tag/2.9.2
---
 .../custom-components/blueprints-updater/package.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
index 7bc24178269c..088de13e9478 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent rec {
   owner = "luuquangvu";
   domain = "blueprints_updater";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "blueprints-updater";
     tag = version;
-    hash = "sha256-OGQ6lE14w84C88QJv5w+mNBGg7gbCtqb9nde47FkL6A=";
+    hash = "sha256-b6DBrG1c7reIomg9/ZrQgDig976PAbCKIl9AfA/RtmY=";
   };
 
   patches = [

From 5cd05ae4d09629e0764d5c2618f71428b03d2e33 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:37:03 +0200
Subject: [PATCH 1159/1209] home-assistant-custom-components.browser-mod:
 2.13.5 -> 3.0.0

https://github.com/thomasloven/hass-browser_mod/blob/v3.0.0/CHANGELOG.md
---
 .../custom-components/browser-mod/package.nix               | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
index 9b9a4bb81b55..66c811fa989f 100644
--- a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "thomasloven";
   domain = "browser_mod";
-  version = "2.13.5";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-browser_mod";
     tag = "v${version}";
-    hash = "sha256-uVMefvOiw0CMcpOSo8dJn4NazZxACvPscV4GqtyQXSY=";
+    hash = "sha256-s9b5JeMyT7pYyHWJtuqw2xVHrmU98kG5dBE4aBsJ+u8=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildHomeAssistantComponent rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-eX7dyDxcaPMhTOAhAbcw7beP3cwBKRz457OZgp3LRAA=";
+    hash = "sha256-p+1yRZVyo/EunNjBkdkl8xajZO4U7KpdIu1GzU7L8gE=";
   };
 
   npmBuildScript = "build";

From c398fb5993f4bddb8cd7687ef896fb050a171214 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:37:14 +0200
Subject: [PATCH 1160/1209] home-assistant-custom-components.elegoo_printer:
 2.9.0 -> 2.10.1

https://github.com/danielcherubini/elegoo-homeassistant/releases/tag/v2.10.1
---
 .../custom-components/elegoo_printer/package.nix              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix b/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
index b22b77df6c7e..a76ec8273dcf 100644
--- a/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
@@ -19,13 +19,13 @@
 buildHomeAssistantComponent rec {
   owner = "danielcherubini";
   domain = "elegoo_printer";
-  version = "2.9.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "danielcherubini";
     repo = "elegoo-homeassistant";
     tag = "v${version}";
-    hash = "sha256-lKRi90H48w9jndljoSyaHY4cVh4/qEkGGOkEs5GVk1o=";
+    hash = "sha256-8L4uJC9TmZ4lkEAQzDUd2txAGPveA/3iiIYzguLtOSA=";
   };
 
   dependencies = [

From c2c8ccee43325da1483b24c9848b6e25f8fecf79 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:37:18 +0200
Subject: [PATCH 1161/1209] home-assistant-custom-components.goodwe: 0.9.9.30
 -> 0.9.9.31

https://github.com/mletenay/home-assistant-goodwe-inverter/releases/tag/v0.9.9.31
---
 .../home-assistant/custom-components/goodwe/package.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/goodwe/package.nix b/pkgs/servers/home-assistant/custom-components/goodwe/package.nix
index 7c969d1423dc..90117352a044 100644
--- a/pkgs/servers/home-assistant/custom-components/goodwe/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/goodwe/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "mletenay";
   domain = "goodwe";
-  version = "0.9.9.30";
+  version = "0.9.9.31";
 
   src = fetchFromGitHub {
     owner = "mletenay";
     repo = "home-assistant-goodwe-inverter";
     tag = "v${version}";
-    hash = "sha256-/R0HBR1369gjjdCInbFzUaBEclw4PJDmgRGHtlUNvCA=";
+    hash = "sha256-aq3m1+XBE0f/+r3RiSXU1XFq+vUwKs0phis2B34c/8w=";
   };
 
   dependencies = [

From 83cf8f1c7e6f9efd950ac7577836a10ba284ce90 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:38:36 +0200
Subject: [PATCH 1162/1209] home-assistant-custom-components.octopus_energy:
 18.3.1 -> 18.3.2

https://github.com/BottlecapDave/HomeAssistant-OctopusEnergy/releases/tag/v18.3.2
---
 .../custom-components/octopus_energy/package.nix              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
index 2c76e6733ecd..75f5ea66d66e 100644
--- a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "BottlecapDave";
   domain = "octopus_energy";
-  version = "18.3.1";
+  version = "18.3.2";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HomeAssistant-OctopusEnergy";
     tag = "v${version}";
-    hash = "sha256-5Cjaq4DIe11hx/goKxGDSj6zyOb3H16s8KqlFRzhOYs=";
+    hash = "sha256-KSnpebEUzp25PsBMFqCajdnTINk51hdswmV9rGtG+3Q=";
   };
 
   dependencies = [ pydantic ];

From b28b22d08a9989dcda0172744f57cca1aaefa4d2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:39:40 +0200
Subject: [PATCH 1163/1209] home-assistant-custom-components.oref_alert: 6.20.1
 -> 6.20.2

https://github.com/amitfin/oref_alert/releases/tag/v6.20.2
---
 .../home-assistant/custom-components/oref_alert/package.nix   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
index 6e396bbd4a97..b8bd319c3465 100644
--- a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
@@ -15,13 +15,13 @@
 buildHomeAssistantComponent rec {
   owner = "amitfin";
   domain = "oref_alert";
-  version = "6.20.1";
+  version = "6.20.2";
 
   src = fetchFromGitHub {
     owner = "amitfin";
     repo = "oref_alert";
     tag = "v${version}";
-    hash = "sha256-O4A4Aiddq4YzPx5g9akCepWjEeFdlwTWe5xkPtAmuYE=";
+    hash = "sha256-jDrSFIFlp9BVytIVUiW3lAKAmG6N0NYS0TaUxQC26eE=";
   };
 
   # Do not publish cards, currently broken, attempting to write to nix store.

From 7cb0c7cdafaa89a038bbebe40e80c65a6e3a037b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:40:06 +0200
Subject: [PATCH 1164/1209] home-assistant-custom-components.smarthq: 1.1.0 ->
 1.2.1

https://github.com/geappliances/geappliances-smarthq-integration/releases/tag/v1.2.1
---
 .../home-assistant/custom-components/smarthq/package.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/smarthq/package.nix b/pkgs/servers/home-assistant/custom-components/smarthq/package.nix
index 301fa4e15907..496dc54787cf 100644
--- a/pkgs/servers/home-assistant/custom-components/smarthq/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/smarthq/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "geappliances";
   domain = "smarthq";
-  version = "1.1.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "geappliances";
     repo = "geappliances-smarthq-integration";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LTLlkl4Mh0nSZfNVyLEItVPnQkM1nnDkPjsM98otp3w=";
+    hash = "sha256-8DAnALqtFuMfEXF4Kcu/RMmcK2LS7TLrvgrFP+Jwo/4=";
   };
 
   dependencies = [

From 7e02f4a9bc2de1690e6cb3e491dffc72b9ccd4db Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:40:31 +0200
Subject: [PATCH 1165/1209] home-assistant-custom-components.tibber_local:
 2026.6.1 -> 2026.6.2

https://github.com/marq24/ha-tibber-pulse-local/releases/tag/2026.6.2
---
 .../home-assistant/custom-components/tibber_local/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix b/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix
index abf556d2a04e..1268d9cc704f 100644
--- a/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "marq24";
   domain = "tibber_local";
-  version = "2026.6.1";
+  version = "2026.6.2";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "ha-tibber-pulse-local";
     tag = version;
-    hash = "sha256-HalEHJg3+6D+3TXVsfdlxL3HvSqXUcaSrW1owtRPff8=";
+    hash = "sha256-Mssjizh9DcA6fldwl6QmmgG8aOVwvF5d0akqrkArM5g=";
   };
 
   dependencies = [

From 2a3a587e5ef6e2c138495752020f77cdd08ada83 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:40:44 +0200
Subject: [PATCH 1166/1209] home-assistant-custom-components.tuya_local:
 2026.6.2 -> 2026.6.4

https://github.com/make-all/tuya-local/releases/tag/2026.6.4
---
 .../home-assistant/custom-components/tuya_local/package.nix   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
index 8b3a1edde7ec..26b653c45218 100644
--- a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "make-all";
   domain = "tuya_local";
-  version = "2026.6.2";
+  version = "2026.6.4";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "tuya-local";
     tag = version;
-    hash = "sha256-4897QCslPQ/5Rt1U6EcapUav7XMa65i+5aXbMyv9mxE=";
+    hash = "sha256-VJ2c8wegviirCT+hygg9LKPN5ZLqxfkQl6zayaXZRU0=";
   };
 
   dependencies = [

From 564df92d33660a013eeb1136a4a0347acf4d7ef9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:41:41 +0200
Subject: [PATCH 1167/1209] home-assistant-custom-lovelace-modules.bubble-card:
 3.2.3 -> 3.2.4

https://github.com/Clooos/bubble-card/releases/tag/v3.2.4
---
 .../custom-lovelace-modules/bubble-card/package.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix
index ae5928dad353..faa21902dcf0 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage rec {
   pname = "bubble-card";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "Clooos";
     repo = "Bubble-Card";
     rev = "v${version}";
-    hash = "sha256-X6Oh+0VcVSvr2JydMqWVzYFonxdsewi0lrrFVXtb/BA=";
+    hash = "sha256-ofGIq6DLA2VQj5Gm/Dc+DZfwWZI3frAFzXO7MJDM610=";
   };
 
   npmDepsHash = "sha256-jyw8U99R7M3JJwu30ADefAitm4lWWVHEwq108gWZpfg=";

From fdb568506576c045bb3d5e7aea805b617884f2b6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:41:51 +0200
Subject: [PATCH 1168/1209] 
 home-assistant-custom-lovelace-modules.auto-entities: 2.5.0 -> 2.6.0

https://github.com/Lint-Free-Technology/lovelace-auto-entities/releases/tag/v2.6.0
---
 .../custom-lovelace-modules/auto-entities/package.nix       | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
index fe7d1471398d..be780fcdfe2b 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "auto-entities";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "Lint-Free-Technology";
     repo = "lovelace-auto-entities";
     tag = "v${version}";
-    hash = "sha256-qKhxVLD4NbkCzpUNX5UkjEjLOMQ7ZvHHLVLTrcunTPQ=";
+    hash = "sha256-2lIeFtskvUq1ZrHinCXrv/VBtI06tZn7YwRAMvBm/uk=";
   };
 
-  npmDepsHash = "sha256-Z+9Lp1AzrY2I+unpBxdbr9rkfcIe/dDblB3MDSd2D8w=";
+  npmDepsHash = "sha256-XZcb5gFRGiC4Xj97ExDtRFXWRHbyWEOIp7spUzoS9EA=";
 
   installPhase = ''
     runHook preInstall

From c6faa10ccc3bbdc32f60df3df4a17c9369d909ad Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:42:09 +0200
Subject: [PATCH 1169/1209] home-assistant-custom-lovelace-modules.card-mod:
 4.2.1 -> 4.2.1-202604

https://github.com/thomasloven/lovelace-card-mod/compare/v4.2.1...v4.2.1-202604
---
 .../custom-lovelace-modules/card-mod/package.nix            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/card-mod/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/card-mod/package.nix
index a2bb31a69988..19f30f3ba278 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/card-mod/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/card-mod/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "lovelace-card-mod";
-  version = "4.2.1";
+  version = "4.2.1-202604";
 
   src = fetchFromGitHub {
     owner = "thomasloven";
     repo = "lovelace-card-mod";
     rev = "v${version}";
-    hash = "sha256-16aA9VaSuWZ1i9UBGp9vb7N1H5vfcLOiqppjPoqphM0=";
+    hash = "sha256-56nGxdA1RTkXZpcuQ6LOuRtGoBjTQtH2jKCN3omZCN0=";
   };
 
-  npmDepsHash = "sha256-tJsEGsVTmU1Hakumv9dsurwHpJ791wwRYpoAi2uAclA=";
+  npmDepsHash = "sha256-RZP3zWz7ZHob/QySF/6XTYOYuulGZUBQXG79fHHJfug=";
 
   installPhase = ''
     runHook preInstall

From 044905feced47ea5a38ec85efcf6b55cb7b7e949 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:43:27 +0200
Subject: [PATCH 1170/1209] 
 home-assistant-custom-lovelace-modules.custom-sidebar: 15.0.0 -> 16.0.0

https://github.com/elchininet/custom-sidebar/releases/tag/v16.0.0
---
 .../custom-lovelace-modules/custom-sidebar/package.nix      | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
index 6079608c0499..d5041e4d3e38 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
@@ -12,20 +12,20 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "custom-sidebar";
-  version = "15.0.0";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "elchininet";
     repo = "custom-sidebar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0bS760GfIO/LdQD6lNEKhiIW5lyCu35cTi0g3GaGQ5M=";
+    hash = "sha256-ST7wgxl9bpsHvguYbZQYYWO1KkinSrNCrbugVBJGvJo=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-zmWZhOx1Pl7O5T5vNdff/nZC1juwm66YOVIMjuNoBYg=";
+    hash = "sha256-SbjE9u2RZ8M6GHxk7NkvyihGDiO6v/1LHywvaP8OcQM=";
   };
 
   nativeBuildInputs = [

From 06b8a87db754d7367af0ca1cc5b00d90cdab3b9d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:43:54 +0200
Subject: [PATCH 1171/1209] home-assistant-custom-lovelace-modules.kiosk-mode:
 14.0.0 -> 14.0.1

https://github.com/nemesisre/kiosk-mode/compare/v14.0.0...v14.0.1
---
 .../custom-lovelace-modules/kiosk-mode/package.nix          | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/kiosk-mode/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/kiosk-mode/package.nix
index 8e677fc86fef..67a4a32f276f 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/kiosk-mode/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/kiosk-mode/package.nix
@@ -12,20 +12,20 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kiosk-mode";
-  version = "14.0.0";
+  version = "14.0.1";
 
   src = fetchFromGitHub {
     owner = "nemesisre";
     repo = "kiosk-mode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FWSWG+tWRDGHDd9uvVmD8vGlHkJ9tf02S+8RWGAu+10=";
+    hash = "sha256-eQ2dYXmx4nnk/1bbTayPezPyghBo5UbNWf3USY20ePg=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-Ci1RENFsJwWBEUUSKbAvbRGTHn2rfIOXLsdGKamzRRE=";
+    hash = "sha256-bCtk+cqWnYvPo4VsvLaN+m0LIlP8jgb951aIf1emGZg=";
   };
 
   nativeBuildInputs = [

From cf5bd1ee7e0ff757c35cfbe89e5bfec7f72441e9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:44:12 +0200
Subject: [PATCH 1172/1209] 
 home-assistant-custom-lovelace-modules.material-you-utilities: 2.1.16 ->
 2.1.19

https://github.com/Nerwyn/material-you-utilities/releases/tag/2.1.19
---
 .../material-you-utilities/package.nix                      | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
index af26077a697e..605580201fd5 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "material-you-utilities";
-  version = "2.1.16";
+  version = "2.1.19";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "material-you-utilities";
     tag = version;
-    hash = "sha256-s8VVV2KmiJ3auQPRwVRWHonYlVWkExC3quRANfW295U=";
+    hash = "sha256-9eOn5E4lYzhfZSl7dmb3UNEkgU+hv7UFfmh6r6IX13M=";
   };
 
-  npmDepsHash = "sha256-D18gwO8zO7lKbaRhj+QaeGzkE7zqXc3KGvz9am4rrFY=";
+  npmDepsHash = "sha256-6WGpuiMDzlx0Pm6C9mPtCVXHDDp4JWk3jMu6XNetiYE=";
 
   installPhase = ''
     runHook preInstall

From 1348a2529535cfaf9431570414ae856572da1e5a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:44:45 +0200
Subject: [PATCH 1173/1209] 
 home-assistant-custom-lovelace-modules.multiple-entity-row: 4.5.1 -> 4.6.1

https://github.com/benct/lovelace-multiple-entity-row/blob/v4.6.1/CHANGELOG.md
---
 .../custom-lovelace-modules/multiple-entity-row/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/multiple-entity-row/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/multiple-entity-row/package.nix
index 3ff0c62aa1e1..d328337101ae 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/multiple-entity-row/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/multiple-entity-row/package.nix
@@ -10,18 +10,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "multiple-entity-row";
-  version = "4.5.1";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "benct";
     repo = "lovelace-multiple-entity-row";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CXRgXyH1NUg7ssQhenqP0tXr1m2qOkHna3Rf30K3SjI=";
+    hash = "sha256-zRFBeYicjBxKeEneKg2/JRDlF6BlblKQ03z5aqfBtfc=";
   };
 
   offlineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-8YIcQhbYf0e2xO620zVHEk/0sssBmzF/jCq+2za+D6E=";
+    hash = "sha256-F3ghw+TXg66FSf5SLb7umantSRky9ABpZu7ftqWT+7M=";
   };
 
   nativeBuildInputs = [

From 13f2b9dd128fe1911ae2d816d593d64b75c52d37 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:45:36 +0200
Subject: [PATCH 1174/1209] 
 home-assistant-custom-lovelace-modules.scheduler-card: 4.0.18 -> 4.0.19

https://github.com/nielsfaber/scheduler-card/releases/tag/v4.0.19
---
 .../custom-lovelace-modules/scheduler-card/package.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/scheduler-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/scheduler-card/package.nix
index bed6bf456383..4d10ecad0bc5 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/scheduler-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/scheduler-card/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage rec {
   pname = "scheduler-card";
-  version = "4.0.18";
+  version = "4.0.19";
 
   src = fetchFromGitHub {
     owner = "nielsfaber";
     repo = "scheduler-card";
     tag = "v${version}";
-    hash = "sha256-hxoVds650qcwiwi/9n62A6/jS6AmuaIEssBOU6H8GHo=";
+    hash = "sha256-fHU5qhBbtSkEtHDQacgd6R1U+NV55VtPqfX8M56uUnw=";
   };
 
   postPatch = ''

From 6c54d08dbf1253181d687c49c1756478c2837c03 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Jul 2026 23:46:06 +0200
Subject: [PATCH 1175/1209] 
 home-assistant-custom-lovelace-modules.xiaomi-vacuum-map-card: 2.3.2 -> 2.4.1

https://github.com/PiotrMachowski/lovelace-xiaomi-vacuum-map-card/compare/v2.3.2...v2.4.1
---
 .../xiaomi-vacuum-map-card/package.nix                        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/xiaomi-vacuum-map-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/xiaomi-vacuum-map-card/package.nix
index 0f5624aa41b3..dc368cdb291e 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/xiaomi-vacuum-map-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/xiaomi-vacuum-map-card/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage rec {
   pname = "lovelace-xiaomi-vacuum-map-card";
-  version = "2.3.2";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "PiotrMachowski";
     repo = "lovelace-xiaomi-vacuum-map-card";
     tag = "v${version}";
-    hash = "sha256-3329L+2Su2XvrKQIKa5btJz3CQWgS+c8qHD/9vxuEbM=";
+    hash = "sha256-dkVBHtKezXr/X8Akij3LwRFn85FlN3YD6x8/z97YuTA=";
   };
 
   npmDepsHash = "sha256-vLxmzqDSmB+6VKjiwG5WH9FUvn0NlVHo9TBmbx5UkG0=";

From 2d05a1c42284413ef9a06e0b174b278aabf931c8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 00:11:56 +0200
Subject: [PATCH 1176/1209] 
 home-assistant-custom-lovelace-modules.advanced-camera-card: make src fod
 reproducible

---
 .../advanced-camera-card/gitinfo.patch        | 37 +++++++++++++++++++
 .../advanced-camera-card/package.nix          | 11 +++++-
 2 files changed, 46 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/gitinfo.patch

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/gitinfo.patch b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/gitinfo.patch
new file mode 100644
index 000000000000..19b178b4629d
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/gitinfo.patch
@@ -0,0 +1,37 @@
+diff --git a/rollup.config.js b/rollup.config.js
+index 9a8b5a17..cb0b7e62 100644
+--- a/rollup.config.js
++++ b/rollup.config.js
+@@ -1,4 +1,5 @@
+ import commonjs from '@rollup/plugin-commonjs';
++import fs from 'node:fs';
+ import image from '@rollup/plugin-image';
+ import json from '@rollup/plugin-json';
+ import { nodeResolve } from '@rollup/plugin-node-resolve';
+@@ -27,11 +28,16 @@ const serveopts = {
+   },
+ };
+ 
++const hasDotGit = fs.existsSync('git');
++const gitInfoPlugin = hasDotGit
++  ? [gitInfo.default({ enableBuildDate: true, updateVersion: false })]
++  : [];
++
+ /**
+  * @type {import('rollup').RollupOptions['plugins']}
+  */
+ const plugins = [
+-  gitInfo.default({ enableBuildDate: true, updateVersion: false }),
++  ...gitInfoPlugin,
+   styles({
+     modules: false,
+     // Behavior of inject mode, without actually injecting style
+@@ -55,7 +61,7 @@ const plugins = [
+     inlineSources: dev,
+     exclude: ['dist/**', 'tests/**/*.test.ts'],
+   }),
+-  json({ exclude: 'package.json' }),
++  json({ exclude: hasDotGit ? 'package.json' : undefined }),
+   replace({
+     preventAssignment: true,
+     values: {
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
index c8a14915f633..042ccb0f8436 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
@@ -16,16 +16,23 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "dermotduffy";
     repo = "advanced-camera-card";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GHSyDdKGgPPMbcPIqlQbRA0V8gPd1YsId8gqPF0VgTs=";
-    leaveDotGit = true; # gitInfo plugin
+    hash = "sha256-NdWP2nYzDEzmO4DpwVUpn3/KsungKNOzOQf8FxZ4fGw=";
   };
 
   patches = [
     # Remove after upstream updates to Yarn 4.14
     # https://github.com/dermotduffy/advanced-camera-card/blob/main/package.json#L201
     ./yarn-4.14-support.patch
+
+    # Drop hard dependency on .git repo during build
+    ./gitinfo.patch
   ];
 
+  postPatch = ''
+    substituteInPlace package.json \
+      --replace-fail "0.0.0-dev" "${finalAttrs.version}"
+  '';
+
   missingHashes = ./missing-hashes.json;
 
   offlineCache = yarn-berry_4.fetchYarnBerryDeps {

From 9ed506a2afc2cd429415cbccae5e88594c7d46cc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 00:15:18 +0200
Subject: [PATCH 1177/1209] home-assistant-custom-components.emporia_vue:
 0.12.1 -> 0.12.2

https://github.com/magico13/ha-emporia-vue/releases/tag/v0.12.2
---
 .../home-assistant/custom-components/emporia_vue/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/emporia_vue/package.nix b/pkgs/servers/home-assistant/custom-components/emporia_vue/package.nix
index cda6f31556be..f97477297b8f 100644
--- a/pkgs/servers/home-assistant/custom-components/emporia_vue/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/emporia_vue/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "magico13";
   domain = "emporia_vue";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "magico13";
     repo = "ha-emporia-vue";
     rev = "v${version}";
-    hash = "sha256-kdTM5keDxRNz46uwq+tXIv7Hz80lxmbQVVzk7bmRm1w=";
+    hash = "sha256-3S9ko1CN8eM3xVl91bwfLnRwU5T5bgXnY6slQ3u8Lk4=";
   };
 
   dependencies = [
@@ -22,6 +22,7 @@ buildHomeAssistantComponent rec {
   ];
 
   ignoreVersionRequirement = [
+    "boto3"
     "pyemvue"
   ];
 

From 01f5d3f2771fa9e033e3fe0e32e229ad66ddb146 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 00:22:16 +0200
Subject: [PATCH 1178/1209] home-assistant-custom-components.spook: 4.0.1 ->
 5.0.0

https://github.com/frenck/spook/releases/tag/v5.0.0
---
 .../custom-components/spook/package.nix       |  4 +-
 .../remove-sub-integration-symlink-hack.patch | 60 ++-----------------
 2 files changed, 7 insertions(+), 57 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/spook/package.nix b/pkgs/servers/home-assistant/custom-components/spook/package.nix
index 2a4af86c8896..c081c4ab4459 100644
--- a/pkgs/servers/home-assistant/custom-components/spook/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/spook/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "frenck";
   domain = "spook";
-  version = "4.0.1";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     tag = "v${version}";
-    hash = "sha256-0IihrhATgraGmuMRnrbGTUrtlXAR+CooENSIKSWIknY=";
+    hash = "sha256-tIVEI5oZcvI0uyCQfajb1WVldkx7aQF8gV0UBWYPUnI=";
   };
 
   patches = [ ./remove-sub-integration-symlink-hack.patch ];
diff --git a/pkgs/servers/home-assistant/custom-components/spook/remove-sub-integration-symlink-hack.patch b/pkgs/servers/home-assistant/custom-components/spook/remove-sub-integration-symlink-hack.patch
index 30a30d7166fa..05d0ecc8e42b 100644
--- a/pkgs/servers/home-assistant/custom-components/spook/remove-sub-integration-symlink-hack.patch
+++ b/pkgs/servers/home-assistant/custom-components/spook/remove-sub-integration-symlink-hack.patch
@@ -1,17 +1,8 @@
 diff --git a/custom_components/spook/__init__.py b/custom_components/spook/__init__.py
-index 1abc79d..68d48d1 100644
+index 4223fac..6891ee9 100644
 --- a/custom_components/spook/__init__.py
 +++ b/custom_components/spook/__init__.py
-@@ -22,8 +22,6 @@ from .services import SpookServiceManager
- from .util import (
-     async_forward_setup_entry,
-     async_setup_all_entity_ids_cache_invalidation,
--    link_sub_integrations,
--    unlink_sub_integrations,
- )
- 
- if TYPE_CHECKING:
-@@ -35,48 +33,6 @@ if TYPE_CHECKING:
+@@ -33,49 +33,6 @@ if TYPE_CHECKING:
  
  async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
      """Set up from a config entry."""
@@ -57,53 +48,12 @@ index 1abc79d..68d48d1 100644
 -            severity=ir.IssueSeverity.WARNING,
 -            translation_key="restart_required",
 -        )
- 
+-
      # Forward async_setup_entry to ectoplasms
      await async_forward_setup_entry(hass, entry)
-@@ -131,4 +87,3 @@ async def async_unload_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
+ 
+@@ -117,4 +74,3 @@ async def async_unload_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
  
  async def async_remove_entry(hass: HomeAssistant, _: ConfigEntry) -> None:
      """Remove a config entry."""
 -    await hass.async_add_executor_job(unlink_sub_integrations, hass)
-diff --git a/custom_components/spook/util.py b/custom_components/spook/util.py
-index 6aea27c..1437913 100644
---- a/custom_components/spook/util.py
-+++ b/custom_components/spook/util.py
-@@ -284,37 +284,6 @@ async def async_forward_platform_entry_setups_to_ectoplasm(
-     )
- 
- 
--def link_sub_integrations(hass: HomeAssistant) -> bool:
--    """Link Spook sub integrations."""
--    LOGGER.debug("Linking up Spook sub integrations")
--
--    changes = False
--    for manifest in Path(__file__).parent.rglob("integrations/*/manifest.json"):
--        LOGGER.debug("Linking Spook sub integration: %s", manifest.parent.name)
--        dest = Path(hass.config.config_dir) / "custom_components" / manifest.parent.name
--        if not dest.exists():
--            src = (
--                Path(hass.config.config_dir)
--                / "custom_components"
--                / DOMAIN
--                / "integrations"
--                / manifest.parent.name
--            )
--            dest.symlink_to(src)
--            changes = True
--    return changes
--
--
--def unlink_sub_integrations(hass: HomeAssistant) -> None:
--    """Unlink Spook sub integrations."""
--    LOGGER.debug("Unlinking Spook sub integrations")
--    for manifest in Path(__file__).parent.rglob("integrations/*/manifest.json"):
--        LOGGER.debug("Unlinking Spook sub integration: %s", manifest.parent.name)
--        dest = Path(hass.config.config_dir) / "custom_components" / manifest.parent.name
--        if dest.exists():
--            dest.unlink()
--
--
- @callback
- def async_get_all_area_ids(hass: HomeAssistant) -> set[str]:
-     """Return all area IDs, known to Home Assistant."""

From 6b35d3fb1ad4332f9e4060f9306370b4a4d3143a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 00:24:33 +0200
Subject: [PATCH 1179/1209] home-assistant-custom-components.systemair: 1.0.25
 -> 1.0.26

https://github.com/AN3Orik/systemair/releases/tag/v1.0.26
---
 .../custom-components/systemair/package.nix              | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/systemair/package.nix b/pkgs/servers/home-assistant/custom-components/systemair/package.nix
index 8439babb6985..a03c7c5d83e6 100644
--- a/pkgs/servers/home-assistant/custom-components/systemair/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/systemair/package.nix
@@ -10,20 +10,15 @@
 buildHomeAssistantComponent rec {
   owner = "AN3Orik";
   domain = "systemair";
-  version = "1.0.25";
+  version = "1.0.26";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "systemair";
     tag = "v${version}";
-    hash = "sha256-K8Boix6muKsaNOpIw2WothjREbawHeKprHnW8RerxRg=";
+    hash = "sha256-tY/5gEjMCbrVwIyEsWWsB/ePju9+8wgbi23XLdCVKrA=";
   };
 
-  postPatch = ''
-    substituteInPlace custom_components/systemair/manifest.json \
-      --replace-fail "pymodbus==" "pymodbus>="
-  '';
-
   dependencies = [
     pymodbus
     async-timeout

From a82fdbef78b041161c816483fbe32d539d18bd0e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 00:34:21 +0200
Subject: [PATCH 1180/1209] 
 home-assistant-custom-lovelace-modules.custom-brand-icons: 2026.06.4 ->
 2026.07.0

https://github.com/elax46/custom-brand-icons/releases/tag/2026.07.0
---
 .../custom-lovelace-modules/custom-brand-icons/package.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
index 0b09a638cb71..8c8a48490df4 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "custom-brand-icons";
-  version = "2026.06.4";
+  version = "2026.07.0";
 
   src = fetchFromGitHub {
     owner = "elax46";
     repo = "custom-brand-icons";
     tag = finalAttrs.version;
-    hash = "sha256-9wipxsj4KcwgPDo6nanMrSpuDAMAAM72EQISkTOczbs=";
+    hash = "sha256-fmvWUt3Q+9ydvHB7t8z3/9mCLuF/llpoUo6e8K2rn/g=";
   };
 
   npmDepsHash = "sha256-ZTl9+vXEBR3pvksaLWof8y1WnoL2tAL3KuPzZn7VjjE=";

From ba224f14b0e34098f24c5e9fa2a3576d5632d1a3 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 5 Jul 2026 15:35:48 +1000
Subject: [PATCH 1181/1209] gfxstream: work around `ld64` hardening issue

---
 pkgs/by-name/gf/gfxstream/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/gf/gfxstream/package.nix b/pkgs/by-name/gf/gfxstream/package.nix
index 5ec352798319..42f9ba41d58f 100644
--- a/pkgs/by-name/gf/gfxstream/package.nix
+++ b/pkgs/by-name/gf/gfxstream/package.nix
@@ -13,6 +13,8 @@
   vulkan-headers,
   vulkan-loader,
   libx11,
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -41,6 +43,10 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     python3
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
   buildInputs = [
     aemu
@@ -60,6 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
       "-framework QuartzCore"
       "-needed-lvulkan"
     ];
+    # TODO: Clean up on `staging`.
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
   };
 
   # dlopens libvulkan.

From e9476ccf50f57b944d0c95b403d8d14a2277fbb7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 5 Jul 2026 08:54:43 +0200
Subject: [PATCH 1182/1209] home-assistant.intents: drop an outdated comment

Co-authored-by: dotlambda <nix@dotlambda.de>
---
 pkgs/servers/home-assistant/intents.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/intents.nix b/pkgs/servers/home-assistant/intents.nix
index d61c4c01aa6b..c8538c72df77 100644
--- a/pkgs/servers/home-assistant/intents.nix
+++ b/pkgs/servers/home-assistant/intents.nix
@@ -27,7 +27,6 @@ buildPythonPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "OHF-Voice";
     repo = "intents-package";
-    # https://github.com/OHF-Voice/intents-package/issues/14
     tag = finalAttrs.version;
     fetchSubmodules = true;
     hash = "sha256-fuVS+s3l/oStgrRdeLzHrzCr9cmFesq6sYV8EgNNsIo=";

From 71e1e9ad3d15958129e6c2988efd4e024b237cc6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 5 Jul 2026 09:56:11 +0300
Subject: [PATCH 1183/1209] nixos/tests/installer: fix

Since #528209 split procps into outputs, the nix-env invocation
started trying to install said outputs, which are not available
in the closure by accident like procps itself was.

Switch to using hello as the "example package", as it is very
unlikely to randomly grow more outputs and break things,
and also add it to extraDependencies to ensure it's available
to be installed.
---
 nixos/tests/installer.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index e3d184c42a15..930d3afc203d 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -41,7 +41,7 @@ let
         documentation.enable = false;
 
         # To ensure that we can rebuild the grub configuration on the nixos-rebuild
-        system.extraDependencies = with pkgs; [ stdenvNoCC ];
+        system.extraDependencies = with pkgs; [ stdenvNoCC hello ];
 
         boot.initrd.systemd.enable = ${boolToString systemdStage1};
 
@@ -278,14 +278,14 @@ let
           target.succeed("nix-store --verify --check-contents >&2")
 
       with subtest("Check whether the channel works"):
-          target.succeed("nix-env -iA nixos.procps >&2")
-          assert ".nix-profile" in target.succeed("type -tP ps | tee /dev/stderr")
+          target.succeed("nix-env -iA nixos.hello >&2")
+          assert ".nix-profile" in target.succeed("type -tP hello | tee /dev/stderr")
 
       with subtest(
           "Check that the daemon works, and that non-root users can run builds "
           "(this will build a new profile generation through the daemon)"
       ):
-          target.succeed("su alice -l -c 'nix-env -iA nixos.procps' >&2")
+          target.succeed("su alice -l -c 'nix-env -iA nixos.hello' >&2")
 
       with subtest("Configure system with writable Nix store on next boot"):
           # we're not using copy_from_host here because the installer image
@@ -744,6 +744,7 @@ let
                   desktop-file-utils
                   docbook5
                   docbook_xsl_ns
+                  hello
                   kbd.dev
                   kmod.dev
                   libarchive.dev

From 30b3f88e8a5f35698bb3961800ad2fe9ae65e408 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 5 Jul 2026 09:12:37 +0200
Subject: [PATCH 1184/1209] libnice: fixup build on darwin broken by PR #532624

---
 pkgs/by-name/li/libnice/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index da06d966edbc..8551229f2208 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -38,7 +38,9 @@ stdenv.mkDerivation (finalAttrs: {
     # Bumps the gupnp_igd_dep version requested to 1.6
     # https://gitlab.freedesktop.org/libnice/libnice/-/merge_requests/255
     ./gupnp-igd-bump.patch
-
+  ]
+  # TODO: investigate what's wrong
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
     (fetchpatch {
       name = "freebsd.patch";
       url = "https://gitlab.freedesktop.org/libnice/libnice/-/commit/479f0813a571ff035bf00de679db452a0441125b.patch";

From 0344b2eec2bd8f21788347616f5294998970b774 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 5 Jul 2026 11:23:09 +0300
Subject: [PATCH 1185/1209] python3Packages.asyncssh: 2.22.0 -> 2.24.0

---
 pkgs/development/python-modules/asyncssh/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/asyncssh/default.nix b/pkgs/development/python-modules/asyncssh/default.nix
index 26277b500225..a9a4c4c9de93 100644
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@@ -6,6 +6,7 @@
   fetchPypi,
   fido2,
   gssapi,
+  ifaddr,
   libnacl,
   libsodium,
   nettle,
@@ -20,12 +21,12 @@
 
 buildPythonPackage rec {
   pname = "asyncssh";
-  version = "2.22.0";
+  version = "2.24.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w85ysBvk+XtA5ihE3ThCJ+X/WkAaN5MAfEL4alyOtTc=";
+    hash = "sha256-QGTFkOWc4ujYKi9m018xINdlgotN9ePb+we0qMJGhsk=";
   };
 
   build-system = [ setuptools ];
@@ -41,6 +42,7 @@ buildPythonPackage rec {
   optional-dependencies = {
     bcrypt = [ bcrypt ];
     fido2 = [ fido2 ];
+    ifaddr = [ ifaddr ];
     gssapi = [ gssapi ];
     libnacl = [ libnacl ];
     pkcs11 = [ python-pkcs11 ];
@@ -78,8 +80,8 @@ buildPythonPackage rec {
     "test_connect_timeout_exceeded"
     # Fails in the sandbox
     "test_forward_remote"
-    # (2.21.0) SFTP copy ends up with an empty file
-    "test_copy_max_requests"
+    # Seems weirdly filesystem specific
+    "test_put_name_too_long"
   ];
 
   pythonImportsCheck = [ "asyncssh" ];

From a2904ce42c3c5b6581a0dadffbcfcd27078ddcb5 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 5 Jul 2026 11:16:30 +0300
Subject: [PATCH 1186/1209] python3Packages.numpy: 2.5.0 -> 2.5.1

Diff: https://github.com/numpy/numpy/compare/v2.5.0...v2.5.1

Changelog: https://github.com/numpy/numpy/releases/tag/v2.5.1
---
 pkgs/development/python-modules/numpy/2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index e097ad7bb298..b7c7d6798901 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -37,7 +37,7 @@ assert blas.isILP64 == lapack.isILP64;
 
 buildPythonPackage (finalAttrs: {
   pname = "numpy";
-  version = "2.5.0";
+  version = "2.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
     repo = "numpy";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-RiC1dLoDamK5B2VzHBL0V//K/Vix25q11wNGcl3Witk=";
+    hash = "sha256-IriSrnGAZHvJ7m97s12BydNQZDZunCVtRgj/iSgw5Vc=";
   };
 
   postPatch = ''

From 16d53dfcf676b94f771cb967aafb8abdb88b8bcd Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Fri, 24 Apr 2026 13:11:41 +0200
Subject: [PATCH 1187/1209] postgresql: move postgresqlWithPackages to separate
 file

Moves the function to a separate file and makes it callPackage-able. Now
that buildEnv also supports finalAttrs, the finalPackage construct can
also be rewritten that way.

This gives us clear separation of concern between the package builder in
generic.nix and wrapper.nix.
---
 pkgs/servers/sql/postgresql/generic.nix | 77 +------------------------
 pkgs/servers/sql/postgresql/wrapper.nix | 71 +++++++++++++++++++++++
 2 files changed, 72 insertions(+), 76 deletions(-)
 create mode 100644 pkgs/servers/sql/postgresql/wrapper.nix

diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index fef9f9b11f7b..c4e17fa1ec11 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -39,7 +39,6 @@ let
       removeReferencesTo,
 
       # passthru
-      buildEnv,
       buildPackages,
       newScope,
       nixosTests,
@@ -542,10 +541,7 @@ let
           in
           import ./ext.nix newSelf newSuper;
 
-        withPackages = postgresqlWithPackages {
-          inherit buildEnv lib makeBinaryWrapper;
-          postgresql = finalAttrs.finalPackage;
-        };
+        withPackages = self.callPackage ./wrapper.nix { postgresql = finalAttrs.finalPackage; };
 
         pg_config = buildPackages.callPackage ./pg_config.nix {
           inherit (finalAttrs) finalPackage;
@@ -604,77 +600,6 @@ let
       };
     });
 
-  postgresqlWithPackages =
-    {
-      postgresql,
-      buildEnv,
-      lib,
-      makeBinaryWrapper,
-    }:
-    f:
-    let
-      installedExtensions = f postgresql.pkgs;
-      recurse = postgresqlWithPackages {
-        inherit
-          buildEnv
-          lib
-          makeBinaryWrapper
-          postgresql
-          ;
-      };
-      finalPackage = buildEnv {
-        pname = "${postgresql.pname}-and-plugins";
-        inherit (postgresql) version;
-        paths = installedExtensions ++ [
-          # consider keeping in-sync with `postBuild` below
-          postgresql
-          postgresql.man # in case user installs this into environment
-        ];
-
-        pathsToLink = [
-          "/"
-          "/bin"
-          "/share/postgresql/extension"
-          # Unbreaks Omnigres' build system
-          "/share/postgresql/timezonesets"
-          "/share/postgresql/tsearch_data"
-        ];
-
-        derivationArgs = {
-          strictDeps = true;
-          nativeBuildInputs = [ makeBinaryWrapper ];
-          postBuild =
-            let
-              args = lib.concatMap (ext: ext.wrapperArgs or [ ]) installedExtensions;
-            in
-            ''
-              wrapProgram "$out/bin/postgres" ${lib.concatStringsSep " " args}
-            '';
-        };
-
-        passthru = {
-          inherit installedExtensions;
-          inherit (postgresql)
-            pkgs
-            psqlSchema
-            ;
-
-          pg_config = postgresql.pg_config.override {
-            outputs = {
-              out = finalPackage;
-              man = finalPackage;
-            };
-          };
-
-          withJIT = recurse (_: installedExtensions ++ [ postgresql.jit ]);
-          withoutJIT = recurse (_: lib.remove postgresql.jit installedExtensions);
-
-          withPackages = f': recurse (ps: installedExtensions ++ f' ps);
-        };
-      };
-    in
-    finalPackage;
-
 in
 # passed by <major>.nix
 versionArgs:
diff --git a/pkgs/servers/sql/postgresql/wrapper.nix b/pkgs/servers/sql/postgresql/wrapper.nix
new file mode 100644
index 000000000000..2f81cc546588
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/wrapper.nix
@@ -0,0 +1,71 @@
+{
+  buildEnv,
+  callPackage,
+  lib,
+  makeBinaryWrapper,
+  postgresql,
+}:
+f:
+let
+  installedExtensions = f postgresql.pkgs;
+  recurse = import ./wrapper.nix {
+    # explicitly listed in case they were overridden
+    inherit
+      buildEnv
+      callPackage
+      lib
+      makeBinaryWrapper
+      postgresql
+      ;
+  };
+in
+buildEnv (finalAttrs: {
+  pname = "${postgresql.pname}-and-plugins";
+  inherit (postgresql) version;
+  paths = installedExtensions ++ [
+    # consider keeping in-sync with `postBuild` below
+    postgresql
+    postgresql.man # in case user installs this into environment
+  ];
+
+  pathsToLink = [
+    "/"
+    "/bin"
+    "/share/postgresql/extension"
+    # Unbreaks Omnigres' build system
+    "/share/postgresql/timezonesets"
+    "/share/postgresql/tsearch_data"
+  ];
+
+  derivationArgs = {
+    strictDeps = true;
+    nativeBuildInputs = [ makeBinaryWrapper ];
+    postBuild =
+      let
+        args = lib.concatMap (ext: ext.wrapperArgs or [ ]) installedExtensions;
+      in
+      ''
+        wrapProgram "$out/bin/postgres" ${lib.concatStringsSep " " args}
+      '';
+  };
+
+  passthru = {
+    inherit installedExtensions;
+    inherit (postgresql)
+      pkgs
+      psqlSchema
+      ;
+
+    pg_config = postgresql.pg_config.override {
+      outputs = {
+        out = finalAttrs.finalPackage;
+        man = finalAttrs.finalPackage;
+      };
+    };
+
+    withJIT = recurse (_: installedExtensions ++ [ postgresql.jit ]);
+    withoutJIT = recurse (_: lib.remove postgresql.jit installedExtensions);
+
+    withPackages = f': recurse (ps: installedExtensions ++ f' ps);
+  };
+})

From 4160692646efbc1816ee74e5ee35f5eef6711b77 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Fri, 24 Apr 2026 13:19:28 +0200
Subject: [PATCH 1188/1209] postgresql: flatten generic.nix

Removes all the indentation in generic.nix, which is possible because
we're not calling the generic function recursively anymore anyway.
---
 pkgs/servers/sql/postgresql/14.nix      |    2 +-
 pkgs/servers/sql/postgresql/15.nix      |    2 +-
 pkgs/servers/sql/postgresql/16.nix      |    2 +-
 pkgs/servers/sql/postgresql/17.nix      |    2 +-
 pkgs/servers/sql/postgresql/18.nix      |    2 +-
 pkgs/servers/sql/postgresql/19.nix      |    2 +-
 pkgs/servers/sql/postgresql/default.nix |    2 +-
 pkgs/servers/sql/postgresql/generic.nix | 1110 +++++++++++------------
 8 files changed, 557 insertions(+), 567 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/14.nix b/pkgs/servers/sql/postgresql/14.nix
index 184d0a7b3b73..04c9628ceb66 100644
--- a/pkgs/servers/sql/postgresql/14.nix
+++ b/pkgs/servers/sql/postgresql/14.nix
@@ -1,4 +1,4 @@
-import ./generic.nix {
+{
   version = "14.23";
   rev = "refs/tags/REL_14_23";
   hash = "sha256-fjoboaUhrHFDqusmIXzSS5ZnIpSRHO9+qcqvkchl2dM=";
diff --git a/pkgs/servers/sql/postgresql/15.nix b/pkgs/servers/sql/postgresql/15.nix
index 633131478a21..084b353c00ec 100644
--- a/pkgs/servers/sql/postgresql/15.nix
+++ b/pkgs/servers/sql/postgresql/15.nix
@@ -1,4 +1,4 @@
-import ./generic.nix {
+{
   version = "15.18";
   rev = "refs/tags/REL_15_18";
   hash = "sha256-tw1zzgLXx7Jr4bi8rMKRmTJzOSQFGvrP2nHr9FcVrjs=";
diff --git a/pkgs/servers/sql/postgresql/16.nix b/pkgs/servers/sql/postgresql/16.nix
index 22027d48d97c..83fa3acab5d1 100644
--- a/pkgs/servers/sql/postgresql/16.nix
+++ b/pkgs/servers/sql/postgresql/16.nix
@@ -1,4 +1,4 @@
-import ./generic.nix {
+{
   version = "16.14";
   rev = "refs/tags/REL_16_14";
   hash = "sha256-g2+OdB2dGIKBSFJ24Z3Yy7oRAFywNMSVDdWfnsaeJJQ=";
diff --git a/pkgs/servers/sql/postgresql/17.nix b/pkgs/servers/sql/postgresql/17.nix
index c5298a23de81..0f5eb20d649c 100644
--- a/pkgs/servers/sql/postgresql/17.nix
+++ b/pkgs/servers/sql/postgresql/17.nix
@@ -1,4 +1,4 @@
-import ./generic.nix {
+{
   version = "17.10";
   rev = "refs/tags/REL_17_10";
   hash = "sha256-3ZAqlT3R8ywhNH13oqz2VUbSwpOJ2JaICbxZ29awaMw=";
diff --git a/pkgs/servers/sql/postgresql/18.nix b/pkgs/servers/sql/postgresql/18.nix
index 4d70b2474f27..1bccfcc412a0 100644
--- a/pkgs/servers/sql/postgresql/18.nix
+++ b/pkgs/servers/sql/postgresql/18.nix
@@ -1,4 +1,4 @@
-import ./generic.nix {
+{
   version = "18.4";
   rev = "refs/tags/REL_18_4";
   hash = "sha256-Ac/Dqcj8vjcW3my5vsnKaMiQqTq/HPtUzckJ3SMyrfA=";
diff --git a/pkgs/servers/sql/postgresql/19.nix b/pkgs/servers/sql/postgresql/19.nix
index 50862f58f4ab..9ee9780fbfa5 100644
--- a/pkgs/servers/sql/postgresql/19.nix
+++ b/pkgs/servers/sql/postgresql/19.nix
@@ -1,4 +1,4 @@
-import ./generic.nix {
+{
   version = "19beta1";
   rev = "refs/tags/REL_19_BETA1";
   hash = "sha256-thvbttX8wwGLf5tMJRHl86Xv8OgINzahoqB/AzAdtMI=";
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 7fe28ef140fd..c8c57ec7ae76 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -23,7 +23,7 @@ let
       version: path:
       let
         attrName = if jitSupport then "${version}_jit" else version;
-        postgresql = import path { inherit self; };
+        postgresql = self.callPackage ./generic.nix (import path // { inherit self; });
         attrValue = if jitSupport then postgresql.withJIT else postgresql;
       in
       self.lib.nameValuePair attrName attrValue
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index c4e17fa1ec11..8332f4d4e2de 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -1,608 +1,598 @@
+{
+  # utils
+  stdenv,
+  fetchFromGitHub,
+  fetchurl,
+  lib,
+  replaceVars,
+
+  # source specification
+  hash,
+  muslPatches ? { },
+  rev,
+  version,
+
+  # runtime dependencies
+  darwin,
+  freebsd,
+  glibc,
+  libuuid,
+  libxml2,
+  lz4,
+  openssl,
+  readline,
+  tzdata,
+  zlib,
+  zstd,
+
+  # build dependencies
+  bison,
+  docbook-xsl-nons,
+  docbook_xml_dtd_45,
+  flex,
+  libxslt,
+  makeBinaryWrapper,
+  pkg-config,
+  removeReferencesTo,
+
+  # passthru
+  buildPackages,
+  newScope,
+  nixosTests,
+  self,
+  testers,
+
+  # Block size
+  # Changing the block size will break on-disk database compatibility. See:
+  # https://www.postgresql.org/docs/current/install-make.html#CONFIGURE-OPTION-WITH-BLOCKSIZE
+  withBlocksize ? null,
+  withWalBlocksize ? null,
+
+  # bonjour
+  bonjourSupport ? false,
+
+  # Curl
+  curlSupport ? lib.versionAtLeast version "18" && lib.meta.availableOn stdenv.hostPlatform curl,
+  curl,
+
+  # GSSAPI
+  gssSupport ? with stdenv.hostPlatform; !isWindows,
+  libkrb5,
+
+  # icu
+  icuSupport ? true,
+  icu,
+
+  # JIT
+  jitSupport ? stdenv.hostPlatform.canExecute stdenv.buildPlatform,
+  llvmPackages,
+  nukeReferences,
+  overrideCC,
+
+  # LDAP
+  ldapSupport ? false,
+  openldap,
+
+  # NLS
+  nlsSupport ? false,
+  gettext,
+
+  # NUMA
+  numaSupport ? lib.versionAtLeast version "18" && lib.meta.availableOn stdenv.hostPlatform numactl,
+  numactl,
+
+  # PAM
+  pamSupport ? lib.meta.availableOn stdenv.hostPlatform linux-pam,
+  linux-pam,
+
+  # PL/Perl
+  perlSupport ?
+    lib.meta.availableOn stdenv.hostPlatform perl
+    # configure tries to call the perl executable for the version
+    && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
+  perl,
+
+  # PL/Python
+  pythonSupport ?
+    lib.meta.availableOn stdenv.hostPlatform python3
+    # configure tries to call the python executable
+    && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
+  python3,
+
+  # PL/Tcl
+  tclSupport ?
+    lib.meta.availableOn stdenv.hostPlatform tcl
+    # configure fails with:
+    #   configure: error: file 'tclConfig.sh' is required for Tcl
+    && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
+  tcl,
+
+  # SELinux
+  selinuxSupport ? false,
+  libselinux,
+
+  # Systemd
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
+
+  # Uring
+  uringSupport ? lib.versionAtLeast version "18" && lib.meta.availableOn stdenv.hostPlatform liburing,
+  liburing,
+}@args:
 let
+  atLeast = lib.versionAtLeast version;
+  olderThan = lib.versionOlder version;
+  lz4Enabled = atLeast "14";
+  zstdEnabled = atLeast "15";
 
-  generic =
-    # utils
-    {
-      stdenv,
-      fetchFromGitHub,
-      fetchurl,
-      lib,
-      replaceVars,
+  dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary;
 
-      # source specification
-      hash,
-      muslPatches ? { },
-      rev,
-      version,
+  stdenv' =
+    if !stdenv.cc.isClang then
+      overrideCC llvmPackages.stdenv (
+        llvmPackages.stdenv.cc.override {
+          # LLVM bintools are not used by default, but are needed to make -flto work below.
+          bintools = buildPackages."llvmPackages_${lib.versions.major llvmPackages.release_version}".bintools;
+        }
+      )
+    else
+      stdenv;
+in
+stdenv'.mkDerivation (finalAttrs: {
+  inherit version;
+  pname = "postgresql";
 
-      # runtime dependencies
-      darwin,
-      freebsd,
-      glibc,
-      libuuid,
-      libxml2,
-      lz4,
-      openssl,
-      readline,
-      tzdata,
-      zlib,
-      zstd,
+  src = fetchFromGitHub {
+    owner = "postgres";
+    repo = "postgres";
+    # rev, not tag, on purpose: allows updating when new versions
+    # are "stamped" a few days before release (tag).
+    inherit hash rev;
+  };
 
-      # build dependencies
-      bison,
-      docbook-xsl-nons,
-      docbook_xml_dtd_45,
-      flex,
-      libxslt,
-      makeBinaryWrapper,
-      pkg-config,
-      removeReferencesTo,
+  __structuredAttrs = true;
 
-      # passthru
-      buildPackages,
-      newScope,
-      nixosTests,
-      self,
-      testers,
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "lib"
+    "man"
+  ]
+  ++ lib.optionals jitSupport [ "jit" ]
+  ++ lib.optionals perlSupport [ "plperl" ]
+  ++ lib.optionals pythonSupport [ "plpython3" ]
+  ++ lib.optionals tclSupport [ "pltcl" ];
 
-      # Block size
-      # Changing the block size will break on-disk database compatibility. See:
-      # https://www.postgresql.org/docs/current/install-make.html#CONFIGURE-OPTION-WITH-BLOCKSIZE
-      withBlocksize ? null,
-      withWalBlocksize ? null,
+  outputChecks = {
+    out = {
+      disallowedReferences = [
+        "dev"
+        "doc"
+        "man"
+      ]
+      ++ lib.optionals jitSupport [ "jit" ];
+      disallowedRequisites = [
+        stdenv'.cc
+        llvmPackages.llvm.out
+        llvmPackages.llvm.lib
+      ]
+      ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
+    };
 
-      # bonjour
-      bonjourSupport ? false,
-
-      # Curl
-      curlSupport ? lib.versionAtLeast version "18" && lib.meta.availableOn stdenv.hostPlatform curl,
-      curl,
-
-      # GSSAPI
-      gssSupport ? with stdenv.hostPlatform; !isWindows,
-      libkrb5,
-
-      # icu
-      icuSupport ? true,
-      icu,
-
-      # JIT
-      jitSupport ? stdenv.hostPlatform.canExecute stdenv.buildPlatform,
-      llvmPackages,
-      nukeReferences,
-      overrideCC,
-
-      # LDAP
-      ldapSupport ? false,
-      openldap,
-
-      # NLS
-      nlsSupport ? false,
-      gettext,
-
-      # NUMA
-      numaSupport ? lib.versionAtLeast version "18" && lib.meta.availableOn stdenv.hostPlatform numactl,
-      numactl,
-
-      # PAM
-      pamSupport ? lib.meta.availableOn stdenv.hostPlatform linux-pam,
-      linux-pam,
-
-      # PL/Perl
-      perlSupport ?
-        lib.meta.availableOn stdenv.hostPlatform perl
-        # configure tries to call the perl executable for the version
-        && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
-      perl,
-
-      # PL/Python
-      pythonSupport ?
-        lib.meta.availableOn stdenv.hostPlatform python3
-        # configure tries to call the python executable
-        && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
-      python3,
-
-      # PL/Tcl
-      tclSupport ?
-        lib.meta.availableOn stdenv.hostPlatform tcl
-        # configure fails with:
-        #   configure: error: file 'tclConfig.sh' is required for Tcl
-        && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
-      tcl,
-
-      # SELinux
-      selinuxSupport ? false,
-      libselinux,
-
-      # Systemd
-      systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
-      systemdLibs,
-
-      # Uring
-      uringSupport ? lib.versionAtLeast version "18" && lib.meta.availableOn stdenv.hostPlatform liburing,
-      liburing,
-    }@args:
-    let
-      atLeast = lib.versionAtLeast version;
-      olderThan = lib.versionOlder version;
-      lz4Enabled = atLeast "14";
-      zstdEnabled = atLeast "15";
-
-      dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary;
-
-      stdenv' =
-        if !stdenv.cc.isClang then
-          overrideCC llvmPackages.stdenv (
-            llvmPackages.stdenv.cc.override {
-              # LLVM bintools are not used by default, but are needed to make -flto work below.
-              bintools = buildPackages."llvmPackages_${lib.versions.major llvmPackages.release_version}".bintools;
-            }
-          )
-        else
-          stdenv;
-    in
-    stdenv'.mkDerivation (finalAttrs: {
-      inherit version;
-      pname = "postgresql";
-
-      src = fetchFromGitHub {
-        owner = "postgres";
-        repo = "postgres";
-        # rev, not tag, on purpose: allows updating when new versions
-        # are "stamped" a few days before release (tag).
-        inherit hash rev;
-      };
-
-      __structuredAttrs = true;
-
-      outputs = [
+    lib = {
+      disallowedReferences = [
         "out"
         "dev"
         "doc"
-        "lib"
         "man"
       ]
-      ++ lib.optionals jitSupport [ "jit" ]
-      ++ lib.optionals perlSupport [ "plperl" ]
-      ++ lib.optionals pythonSupport [ "plpython3" ]
-      ++ lib.optionals tclSupport [ "pltcl" ];
-
-      outputChecks = {
-        out = {
-          disallowedReferences = [
-            "dev"
-            "doc"
-            "man"
-          ]
-          ++ lib.optionals jitSupport [ "jit" ];
-          disallowedRequisites = [
-            stdenv'.cc
-            llvmPackages.llvm.out
-            llvmPackages.llvm.lib
-          ]
-          ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
-        };
-
-        lib = {
-          disallowedReferences = [
-            "out"
-            "dev"
-            "doc"
-            "man"
-          ]
-          ++ lib.optionals jitSupport [ "jit" ];
-          disallowedRequisites = [
-            stdenv'.cc
-            llvmPackages.llvm.out
-            llvmPackages.llvm.lib
-          ]
-          ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
-        };
-
-        doc = {
-          disallowedReferences = [
-            "out"
-            "dev"
-            "man"
-          ]
-          ++ lib.optionals jitSupport [ "jit" ];
-        };
-
-        man = {
-          disallowedReferences = [
-            "out"
-            "dev"
-            "doc"
-          ]
-          ++ lib.optionals jitSupport [ "jit" ];
-        };
-      }
-      // lib.optionalAttrs jitSupport {
-        jit = {
-          disallowedReferences = [
-            "dev"
-            "doc"
-            "man"
-          ];
-          disallowedRequisites = [
-            stdenv'.cc
-            llvmPackages.llvm.out
-          ]
-          ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
-        };
-      };
-
-      strictDeps = true;
-
-      buildInputs = [
-        zlib
-        readline
-        openssl
-        libxml2
-        libuuid
+      ++ lib.optionals jitSupport [ "jit" ];
+      disallowedRequisites = [
+        stdenv'.cc
+        llvmPackages.llvm.out
+        llvmPackages.llvm.lib
       ]
-      ++ lib.optionals icuSupport [ icu ]
-      ++ lib.optionals jitSupport [ llvmPackages.llvm ]
-      ++ lib.optionals lz4Enabled [ lz4 ]
-      ++ lib.optionals zstdEnabled [ zstd ]
-      ++ lib.optionals systemdSupport [ systemdLibs ]
-      ++ lib.optionals uringSupport [ liburing ]
-      ++ lib.optionals curlSupport [ curl ]
-      ++ lib.optionals numaSupport [ numactl ]
-      ++ lib.optionals gssSupport [ libkrb5 ]
-      ++ lib.optionals pamSupport [ linux-pam ]
-      ++ lib.optionals perlSupport [ perl ]
-      ++ lib.optionals ldapSupport [ openldap ]
-      ++ lib.optionals selinuxSupport [ libselinux ]
-      ++ lib.optionals nlsSupport [ gettext ];
+      ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
+    };
 
-      nativeBuildInputs = [
-        bison
-        docbook-xsl-nons
-        docbook_xml_dtd_45
-        flex
-        libxml2
-        libxslt
-        makeBinaryWrapper
-        perl
-        pkg-config
-        removeReferencesTo
+    doc = {
+      disallowedReferences = [
+        "out"
+        "dev"
+        "man"
       ]
-      ++ lib.optionals jitSupport [
-        llvmPackages.llvm.dev
-        nukeReferences
+      ++ lib.optionals jitSupport [ "jit" ];
+    };
+
+    man = {
+      disallowedReferences = [
+        "out"
+        "dev"
+        "doc"
+      ]
+      ++ lib.optionals jitSupport [ "jit" ];
+    };
+  }
+  // lib.optionalAttrs jitSupport {
+    jit = {
+      disallowedReferences = [
+        "dev"
+        "doc"
+        "man"
       ];
+      disallowedRequisites = [
+        stdenv'.cc
+        llvmPackages.llvm.out
+      ]
+      ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
+    };
+  };
 
-      enableParallelBuilding = true;
+  strictDeps = true;
 
-      separateDebugInfo = true;
+  buildInputs = [
+    zlib
+    readline
+    openssl
+    libxml2
+    libuuid
+  ]
+  ++ lib.optionals icuSupport [ icu ]
+  ++ lib.optionals jitSupport [ llvmPackages.llvm ]
+  ++ lib.optionals lz4Enabled [ lz4 ]
+  ++ lib.optionals zstdEnabled [ zstd ]
+  ++ lib.optionals systemdSupport [ systemdLibs ]
+  ++ lib.optionals uringSupport [ liburing ]
+  ++ lib.optionals curlSupport [ curl ]
+  ++ lib.optionals numaSupport [ numactl ]
+  ++ lib.optionals gssSupport [ libkrb5 ]
+  ++ lib.optionals pamSupport [ linux-pam ]
+  ++ lib.optionals perlSupport [ perl ]
+  ++ lib.optionals ldapSupport [ openldap ]
+  ++ lib.optionals selinuxSupport [ libselinux ]
+  ++ lib.optionals nlsSupport [ gettext ];
 
-      buildFlags = [ "world" ];
+  nativeBuildInputs = [
+    bison
+    docbook-xsl-nons
+    docbook_xml_dtd_45
+    flex
+    libxml2
+    libxslt
+    makeBinaryWrapper
+    perl
+    pkg-config
+    removeReferencesTo
+  ]
+  ++ lib.optionals jitSupport [
+    llvmPackages.llvm.dev
+    nukeReferences
+  ];
 
-      env = {
-        # libpgcommon.a and libpgport.a contain all paths returned by pg_config and are linked
-        # into all binaries. However, almost no binaries actually use those paths. The following
-        # flags will remove unused sections from all shared libraries and binaries - including
-        # those paths. This avoids a lot of circular dependency problems with different outputs,
-        # and allows splitting them cleanly.
-        CFLAGS = "-fdata-sections -ffunction-sections -flto";
+  enableParallelBuilding = true;
 
-        # This flag was introduced upstream in:
-        # https://github.com/postgres/postgres/commit/b6c7cfac88c47a9194d76f3d074129da3c46545a
-        # It causes errors when linking against libpq.a in pkgsStatic:
-        #   undefined reference to `pg_encoding_to_char'
-        # Unsetting the flag fixes it. The upstream reasoning to introduce it is about the risk
-        # to have initdb load a libpq.so from a different major version and how to avoid that.
-        # This doesn't apply to us with Nix.
-        NIX_CFLAGS_COMPILE = "-UUSE_PRIVATE_ENCODING_FUNCS";
-      }
-      // lib.optionalAttrs perlSupport { PERL = lib.getExe perl; }
-      // lib.optionalAttrs pythonSupport { PYTHON = lib.getExe python3; }
-      // lib.optionalAttrs tclSupport { TCLSH = "${lib.getBin tcl}/bin/tclsh"; };
+  separateDebugInfo = true;
 
-      configureFlags =
-        let
-          inherit (lib) withFeature;
-        in
+  buildFlags = [ "world" ];
+
+  env = {
+    # libpgcommon.a and libpgport.a contain all paths returned by pg_config and are linked
+    # into all binaries. However, almost no binaries actually use those paths. The following
+    # flags will remove unused sections from all shared libraries and binaries - including
+    # those paths. This avoids a lot of circular dependency problems with different outputs,
+    # and allows splitting them cleanly.
+    CFLAGS = "-fdata-sections -ffunction-sections -flto";
+
+    # This flag was introduced upstream in:
+    # https://github.com/postgres/postgres/commit/b6c7cfac88c47a9194d76f3d074129da3c46545a
+    # It causes errors when linking against libpq.a in pkgsStatic:
+    #   undefined reference to `pg_encoding_to_char'
+    # Unsetting the flag fixes it. The upstream reasoning to introduce it is about the risk
+    # to have initdb load a libpq.so from a different major version and how to avoid that.
+    # This doesn't apply to us with Nix.
+    NIX_CFLAGS_COMPILE = "-UUSE_PRIVATE_ENCODING_FUNCS";
+  }
+  // lib.optionalAttrs perlSupport { PERL = lib.getExe perl; }
+  // lib.optionalAttrs pythonSupport { PYTHON = lib.getExe python3; }
+  // lib.optionalAttrs tclSupport { TCLSH = "${lib.getBin tcl}/bin/tclsh"; };
+
+  configureFlags =
+    let
+      inherit (lib) withFeature;
+    in
+    [
+      "--with-openssl"
+      "--with-libxml"
+      (withFeature icuSupport "icu")
+      "--sysconfdir=/etc"
+      "--with-system-tzdata=${tzdata}/share/zoneinfo"
+      "--enable-debug"
+      (lib.optionalString systemdSupport "--with-systemd")
+      (if stdenv.hostPlatform.isFreeBSD then "--with-uuid=bsd" else "--with-uuid=e2fs")
+      (withFeature perlSupport "perl")
+    ]
+    ++ lib.optionals (withBlocksize != null) [ "--with-blocksize=${toString withBlocksize}" ]
+    ++ lib.optionals (withWalBlocksize != null) [ "--with-wal-blocksize=${toString withWalBlocksize}" ]
+    ++ lib.optionals lz4Enabled [ "--with-lz4" ]
+    ++ lib.optionals zstdEnabled [ "--with-zstd" ]
+    ++ lib.optionals uringSupport [ "--with-liburing" ]
+    ++ lib.optionals curlSupport [ "--with-libcurl" ]
+    ++ lib.optionals numaSupport [ "--with-libnuma" ]
+    ++ lib.optionals gssSupport [ "--with-gssapi" ]
+    ++ lib.optionals pythonSupport [ "--with-python" ]
+    ++ lib.optionals jitSupport [ "--with-llvm" ]
+    ++ lib.optionals pamSupport [ "--with-pam" ]
+    # This can be removed once v17 is removed. v18+ ships with it.
+    ++ lib.optionals (stdenv'.hostPlatform.isDarwin && atLeast "16" && olderThan "18") [
+      "LDFLAGS_EX_BE=-Wl,-export_dynamic"
+    ]
+    # some version of this flag is required in all cross configurations
+    # since it cannot be automatically detected
+    ++
+      lib.optionals
+        (
+          (!stdenv'.hostPlatform.isDarwin)
+          && (!(stdenv'.buildPlatform.canExecute stdenv.hostPlatform))
+          && atLeast "16"
+        )
         [
-          "--with-openssl"
-          "--with-libxml"
-          (withFeature icuSupport "icu")
-          "--sysconfdir=/etc"
-          "--with-system-tzdata=${tzdata}/share/zoneinfo"
-          "--enable-debug"
-          (lib.optionalString systemdSupport "--with-systemd")
-          (if stdenv.hostPlatform.isFreeBSD then "--with-uuid=bsd" else "--with-uuid=e2fs")
-          (withFeature perlSupport "perl")
+          "LDFLAGS_EX_BE=-Wl,--export-dynamic"
         ]
-        ++ lib.optionals (withBlocksize != null) [ "--with-blocksize=${toString withBlocksize}" ]
-        ++ lib.optionals (withWalBlocksize != null) [ "--with-wal-blocksize=${toString withWalBlocksize}" ]
-        ++ lib.optionals lz4Enabled [ "--with-lz4" ]
-        ++ lib.optionals zstdEnabled [ "--with-zstd" ]
-        ++ lib.optionals uringSupport [ "--with-liburing" ]
-        ++ lib.optionals curlSupport [ "--with-libcurl" ]
-        ++ lib.optionals numaSupport [ "--with-libnuma" ]
-        ++ lib.optionals gssSupport [ "--with-gssapi" ]
-        ++ lib.optionals pythonSupport [ "--with-python" ]
-        ++ lib.optionals jitSupport [ "--with-llvm" ]
-        ++ lib.optionals pamSupport [ "--with-pam" ]
-        # This can be removed once v17 is removed. v18+ ships with it.
-        ++ lib.optionals (stdenv'.hostPlatform.isDarwin && atLeast "16" && olderThan "18") [
-          "LDFLAGS_EX_BE=-Wl,-export_dynamic"
-        ]
-        # some version of this flag is required in all cross configurations
-        # since it cannot be automatically detected
-        ++
-          lib.optionals
-            (
-              (!stdenv'.hostPlatform.isDarwin)
-              && (!(stdenv'.buildPlatform.canExecute stdenv.hostPlatform))
-              && atLeast "16"
-            )
-            [
-              "LDFLAGS_EX_BE=-Wl,--export-dynamic"
-            ]
-        ++ lib.optionals ldapSupport [ "--with-ldap" ]
-        ++ lib.optionals tclSupport [ "--with-tcl" ]
-        ++ lib.optionals selinuxSupport [ "--with-selinux" ]
-        ++ lib.optionals nlsSupport [ "--enable-nls" ]
-        ++ lib.optionals bonjourSupport [ "--with-bonjour" ]
-        # Configure needs a little help to find `nm` when cross-compiling.
-        ++ lib.optionals (atLeast "19") [ "NM=${stdenv'.cc}/bin/${stdenv'.cc.targetPrefix}nm" ];
+    ++ lib.optionals ldapSupport [ "--with-ldap" ]
+    ++ lib.optionals tclSupport [ "--with-tcl" ]
+    ++ lib.optionals selinuxSupport [ "--with-selinux" ]
+    ++ lib.optionals nlsSupport [ "--enable-nls" ]
+    ++ lib.optionals bonjourSupport [ "--with-bonjour" ]
+    # Configure needs a little help to find `nm` when cross-compiling.
+    ++ lib.optionals (atLeast "19") [ "NM=${stdenv'.cc}/bin/${stdenv'.cc.targetPrefix}nm" ];
 
-      patches = [
-        (
-          if atLeast "16" then
-            ./patches/relative-to-symlinks-16+.patch
-          else
-            ./patches/relative-to-symlinks.patch
-        )
-        (
-          if atLeast "15" then
-            ./patches/empty-pg-config-view-15+.patch
-          else
-            ./patches/empty-pg-config-view.patch
-        )
-        ./patches/less-is-more.patch
-        ./patches/paths-for-split-outputs.patch
-        ./patches/paths-with-postgresql-suffix.patch
+  patches = [
+    (
+      if atLeast "16" then
+        ./patches/relative-to-symlinks-16+.patch
+      else
+        ./patches/relative-to-symlinks.patch
+    )
+    (
+      if atLeast "15" then
+        ./patches/empty-pg-config-view-15+.patch
+      else
+        ./patches/empty-pg-config-view.patch
+    )
+    ./patches/less-is-more.patch
+    ./patches/paths-for-split-outputs.patch
+    ./patches/paths-with-postgresql-suffix.patch
 
-        (replaceVars ./patches/locale-binary-path.patch {
-          locale = "${
-            if stdenv.hostPlatform.isDarwin then
-              darwin.adv_cmds
-            else if stdenv.hostPlatform.isFreeBSD then
-              freebsd.locale
-            else
-              lib.getBin stdenv.cc.libc
-          }/bin/locale";
-        })
-      ]
-      ++ lib.optionals stdenv'.hostPlatform.isMusl (
-        # Using fetchurl instead of fetchpatch on purpose: https://github.com/NixOS/nixpkgs/issues/240141
-        map fetchurl (lib.attrValues muslPatches)
-      )
-      ++ lib.optionals stdenv'.hostPlatform.isLinux [
-        ./patches/socketdir-in-run-13+.patch
-      ]
-      ++ lib.optionals (stdenv'.hostPlatform.isDarwin && olderThan "16") [
-        ./patches/export-dynamic-darwin-15-.patch
-      ];
+    (replaceVars ./patches/locale-binary-path.patch {
+      locale = "${
+        if stdenv.hostPlatform.isDarwin then
+          darwin.adv_cmds
+        else if stdenv.hostPlatform.isFreeBSD then
+          freebsd.locale
+        else
+          lib.getBin stdenv.cc.libc
+      }/bin/locale";
+    })
+  ]
+  ++ lib.optionals stdenv'.hostPlatform.isMusl (
+    # Using fetchurl instead of fetchpatch on purpose: https://github.com/NixOS/nixpkgs/issues/240141
+    map fetchurl (lib.attrValues muslPatches)
+  )
+  ++ lib.optionals stdenv'.hostPlatform.isLinux [
+    ./patches/socketdir-in-run-13+.patch
+  ]
+  ++ lib.optionals (stdenv'.hostPlatform.isDarwin && olderThan "16") [
+    ./patches/export-dynamic-darwin-15-.patch
+  ];
 
-      installTargets = [ "install-world" ];
+  installTargets = [ "install-world" ];
 
-      postPatch = ''
-        substituteInPlace "src/Makefile.global.in" --subst-var out
-        substituteInPlace "src/common/config_info.c" --subst-var dev
-        cat ${./pg_config.env.mk} >> src/common/Makefile
-      ''
-      # This test always fails on hardware with >1 NUMA node: the sysfs
-      # dirs providing information about the topology are hidden in the sandbox,
-      # so postgres assumes there's only a single node `0`. However,
-      # the test checks on which NUMA nodes the allocated pages are which is >1
-      # on such hardware. This in turn triggers a safeguard in the view
-      # which breaks the test.
-      # Manual tests confirm that the testcase behaves properly outside of the
-      # Nix sandbox.
-      + lib.optionalString (atLeast "18") ''
-        substituteInPlace src/test/regress/parallel_schedule \
-          --replace-fail numa ""
-      '';
+  postPatch = ''
+    substituteInPlace "src/Makefile.global.in" --subst-var out
+    substituteInPlace "src/common/config_info.c" --subst-var dev
+    cat ${./pg_config.env.mk} >> src/common/Makefile
+  ''
+  # This test always fails on hardware with >1 NUMA node: the sysfs
+  # dirs providing information about the topology are hidden in the sandbox,
+  # so postgres assumes there's only a single node `0`. However,
+  # the test checks on which NUMA nodes the allocated pages are which is >1
+  # on such hardware. This in turn triggers a safeguard in the view
+  # which breaks the test.
+  # Manual tests confirm that the testcase behaves properly outside of the
+  # Nix sandbox.
+  + lib.optionalString (atLeast "18") ''
+    substituteInPlace src/test/regress/parallel_schedule \
+      --replace-fail numa ""
+  '';
 
-      postInstall = ''
-        moveToOutput "bin/ecpg" "$dev"
-        moveToOutput "lib/pgxs" "$dev"
-      ''
-      + lib.optionalString (stdenv'.buildPlatform.canExecute stdenv'.hostPlatform) ''
-        mkdir -p "$dev/nix-support"
-        "$out/bin/pg_config" > "$dev/nix-support/pg_config.expected"
-      ''
-      + ''
-          rm "$out/bin/pg_config"
-          make -C src/common pg_config.env
-          substituteInPlace src/common/pg_config.env \
-            --replace-fail "$out" "@out@" \
-            --replace-fail "$man" "@man@"
-          install -D src/common/pg_config.env "$dev/nix-support/pg_config.env"
+  postInstall = ''
+    moveToOutput "bin/ecpg" "$dev"
+    moveToOutput "lib/pgxs" "$dev"
+  ''
+  + lib.optionalString (stdenv'.buildPlatform.canExecute stdenv'.hostPlatform) ''
+    mkdir -p "$dev/nix-support"
+    "$out/bin/pg_config" > "$dev/nix-support/pg_config.expected"
+  ''
+  + ''
+      rm "$out/bin/pg_config"
+      make -C src/common pg_config.env
+      substituteInPlace src/common/pg_config.env \
+        --replace-fail "$out" "@out@" \
+        --replace-fail "$man" "@man@"
+      install -D src/common/pg_config.env "$dev/nix-support/pg_config.env"
 
-        # postgres exposes external symbols get_pkginclude_path and similar. Those
-        # can't be stripped away by --gc-sections/LTO, because they could theoretically
-        # be used by dynamically loaded modules / extensions. To avoid circular dependencies,
-        # references to -dev, -doc and -man are removed here. References to -lib must be kept,
-        # because there is a realistic use-case for extensions to locate the /lib directory to
-        # load other shared modules.
-        remove-references-to -t "$dev" -t "$doc" -t "$man" "$out/bin/postgres"
+    # postgres exposes external symbols get_pkginclude_path and similar. Those
+    # can't be stripped away by --gc-sections/LTO, because they could theoretically
+    # be used by dynamically loaded modules / extensions. To avoid circular dependencies,
+    # references to -dev, -doc and -man are removed here. References to -lib must be kept,
+    # because there is a realistic use-case for extensions to locate the /lib directory to
+    # load other shared modules.
+    remove-references-to -t "$dev" -t "$doc" -t "$man" "$out/bin/postgres"
 
-        if [ -z "''${dontDisableStatic:-}" ]; then
-          # Remove static libraries in case dynamic are available.
-          for i in $lib/lib/*.a; do
-            name="$(basename "$i")"
-            ext="${stdenv'.hostPlatform.extensions.sharedLibrary}"
-            if [ -e "$lib/lib/''${name%.a}$ext" ] || [ -e "''${i%.a}$ext" ]; then
-              rm "$i"
-            fi
-          done
+    if [ -z "''${dontDisableStatic:-}" ]; then
+      # Remove static libraries in case dynamic are available.
+      for i in $lib/lib/*.a; do
+        name="$(basename "$i")"
+        ext="${stdenv'.hostPlatform.extensions.sharedLibrary}"
+        if [ -e "$lib/lib/''${name%.a}$ext" ] || [ -e "''${i%.a}$ext" ]; then
+          rm "$i"
         fi
+      done
+    fi
 
-        # The remaining static libraries are libpgcommon.a, libpgport.a and related.
-        # Those are only used when building e.g. extensions, so go to $dev.
-        moveToOutput "lib/*.a" "$dev"
-      ''
-      + lib.optionalString jitSupport ''
-        # In the case of JIT support, prevent useless dependencies on header files
-        find "$out/lib" -iname '*.bc' -type f -exec nuke-refs '{}' +
+    # The remaining static libraries are libpgcommon.a, libpgport.a and related.
+    # Those are only used when building e.g. extensions, so go to $dev.
+    moveToOutput "lib/*.a" "$dev"
+  ''
+  + lib.optionalString jitSupport ''
+    # In the case of JIT support, prevent useless dependencies on header files
+    find "$out/lib" -iname '*.bc' -type f -exec nuke-refs '{}' +
 
-        # Stop lib depending on the -dev output of llvm
-        remove-references-to -t ${llvmPackages.llvm.dev} "$out/lib/llvmjit${dlSuffix}"
+    # Stop lib depending on the -dev output of llvm
+    remove-references-to -t ${llvmPackages.llvm.dev} "$out/lib/llvmjit${dlSuffix}"
 
-        moveToOutput "lib/bitcode" "$jit"
-        moveToOutput "lib/llvmjit*" "$jit"
-      ''
-      + lib.optionalString stdenv'.hostPlatform.isDarwin ''
-        # The darwin specific Makefile for PGXS contains a reference to the postgres
-        # binary. Some extensions (here: postgis), which are able to set bindir correctly
-        # to their own output for installation, will then fail to find "postgres" during linking.
-        substituteInPlace "$dev/lib/pgxs/src/Makefile.port" \
-          --replace-fail '-bundle_loader $(bindir)/postgres' "-bundle_loader $out/bin/postgres"
-      ''
-      + lib.optionalString perlSupport ''
-        moveToOutput "lib/*plperl*" "$plperl"
-        moveToOutput "share/postgresql/extension/*plperl*" "$plperl"
-      ''
-      + lib.optionalString pythonSupport ''
-        moveToOutput "lib/*plpython3*" "$plpython3"
-        moveToOutput "share/postgresql/extension/*plpython3*" "$plpython3"
-      ''
-      + lib.optionalString tclSupport ''
-        moveToOutput "lib/*pltcl*" "$pltcl"
-        moveToOutput "share/postgresql/extension/*pltcl*" "$pltcl"
-      '';
+    moveToOutput "lib/bitcode" "$jit"
+    moveToOutput "lib/llvmjit*" "$jit"
+  ''
+  + lib.optionalString stdenv'.hostPlatform.isDarwin ''
+    # The darwin specific Makefile for PGXS contains a reference to the postgres
+    # binary. Some extensions (here: postgis), which are able to set bindir correctly
+    # to their own output for installation, will then fail to find "postgres" during linking.
+    substituteInPlace "$dev/lib/pgxs/src/Makefile.port" \
+      --replace-fail '-bundle_loader $(bindir)/postgres' "-bundle_loader $out/bin/postgres"
+  ''
+  + lib.optionalString perlSupport ''
+    moveToOutput "lib/*plperl*" "$plperl"
+    moveToOutput "share/postgresql/extension/*plperl*" "$plperl"
+  ''
+  + lib.optionalString pythonSupport ''
+    moveToOutput "lib/*plpython3*" "$plpython3"
+    moveToOutput "share/postgresql/extension/*plpython3*" "$plpython3"
+  ''
+  + lib.optionalString tclSupport ''
+    moveToOutput "lib/*pltcl*" "$pltcl"
+    moveToOutput "share/postgresql/extension/*pltcl*" "$pltcl"
+  '';
 
-      postFixup = lib.optionalString stdenv'.hostPlatform.isGnu ''
-        # initdb needs access to "locale" command from glibc.
-        wrapProgram $out/bin/initdb --prefix PATH ":" ${glibc.bin}/bin
-      '';
+  postFixup = lib.optionalString stdenv'.hostPlatform.isGnu ''
+    # initdb needs access to "locale" command from glibc.
+    wrapProgram $out/bin/initdb --prefix PATH ":" ${glibc.bin}/bin
+  '';
 
-      # Running tests as "install check" to work around SIP issue on macOS:
-      # https://www.postgresql.org/message-id/flat/4D8E1BC5-BBCF-4B19-8226-359201EA8305%40gmail.com
-      # Also see <nixpkgs>/doc/stdenv/platform-notes.chapter.md
-      doCheck = false;
-      doInstallCheck =
-        # Tests currently can't be run on darwin, because of a Nix bug:
-        # https://github.com/NixOS/nix/issues/12548
-        # https://git.lix.systems/lix-project/lix/issues/691
-        # The error appears as this in the initdb logs:
-        #   FATAL:  could not create shared memory segment: Cannot allocate memory
-        # Don't let yourself be fooled when trying to remove this condition: Running
-        # the tests works fine most of the time. But once the tests (or any package using
-        # postgresqlTestHook) fails on the same machine for a few times, enough IPC objects
-        # will be stuck around, and any future builds with the tests enabled *will* fail.
-        !(stdenv'.hostPlatform.isDarwin)
-        &&
-          # Regression tests currently fail in pkgsMusl because of a difference in EXPLAIN output.
-          !(stdenv'.hostPlatform.isMusl)
-        &&
-          # Modifying block sizes is expected to break regression tests.
-          # https://www.postgresql.org/message-id/E1TJOeZ-000717-Lg%40wrigleys.postgresql.org
-          (withBlocksize == null && withWalBlocksize == null);
-      installCheckTarget = "check-world";
+  # Running tests as "install check" to work around SIP issue on macOS:
+  # https://www.postgresql.org/message-id/flat/4D8E1BC5-BBCF-4B19-8226-359201EA8305%40gmail.com
+  # Also see <nixpkgs>/doc/stdenv/platform-notes.chapter.md
+  doCheck = false;
+  doInstallCheck =
+    # Tests currently can't be run on darwin, because of a Nix bug:
+    # https://github.com/NixOS/nix/issues/12548
+    # https://git.lix.systems/lix-project/lix/issues/691
+    # The error appears as this in the initdb logs:
+    #   FATAL:  could not create shared memory segment: Cannot allocate memory
+    # Don't let yourself be fooled when trying to remove this condition: Running
+    # the tests works fine most of the time. But once the tests (or any package using
+    # postgresqlTestHook) fails on the same machine for a few times, enough IPC objects
+    # will be stuck around, and any future builds with the tests enabled *will* fail.
+    !(stdenv'.hostPlatform.isDarwin)
+    &&
+      # Regression tests currently fail in pkgsMusl because of a difference in EXPLAIN output.
+      !(stdenv'.hostPlatform.isMusl)
+    &&
+      # Modifying block sizes is expected to break regression tests.
+      # https://www.postgresql.org/message-id/E1TJOeZ-000717-Lg%40wrigleys.postgresql.org
+      (withBlocksize == null && withWalBlocksize == null);
+  installCheckTarget = "check-world";
 
-      passthru = {
-        inherit dlSuffix;
+  passthru = {
+    inherit dlSuffix;
 
-        psqlSchema = lib.versions.major version;
+    psqlSchema = lib.versions.major version;
 
-        withJIT =
-          if jitSupport then
-            finalAttrs.finalPackage.withPackages (_: [ finalAttrs.finalPackage.jit ])
-          else
-            null;
-        withoutJIT = finalAttrs.finalPackage.withPackages (_: [ ]);
+    withJIT =
+      if jitSupport then
+        finalAttrs.finalPackage.withPackages (_: [ finalAttrs.finalPackage.jit ])
+      else
+        null;
+    withoutJIT = finalAttrs.finalPackage.withPackages (_: [ ]);
 
-        pkgs =
-          let
-            scope = {
-              inherit
-                jitSupport
-                pythonSupport
-                perlSupport
-                tclSupport
-                ;
-              inherit (llvmPackages) llvm;
-              postgresql = finalAttrs.finalPackage;
-              stdenv = stdenv';
-              postgresqlTestExtension = newSuper.callPackage ./postgresqlTestExtension.nix { };
-              postgresqlBuildExtension = newSuper.callPackage ./postgresqlBuildExtension.nix { };
-            };
-            newSelf = self // scope;
-            newSuper = {
-              callPackage = newScope (scope // finalAttrs.finalPackage.pkgs);
-            };
-          in
-          import ./ext.nix newSelf newSuper;
-
-        withPackages = self.callPackage ./wrapper.nix { postgresql = finalAttrs.finalPackage; };
-
-        pg_config = buildPackages.callPackage ./pg_config.nix {
-          inherit (finalAttrs) finalPackage;
-          outputs = {
-            out = lib.getOutput "out" finalAttrs.finalPackage;
-            man = lib.getOutput "man" finalAttrs.finalPackage;
-          };
+    pkgs =
+      let
+        scope = {
+          inherit
+            jitSupport
+            pythonSupport
+            perlSupport
+            tclSupport
+            ;
+          inherit (llvmPackages) llvm;
+          postgresql = finalAttrs.finalPackage;
+          stdenv = stdenv';
+          postgresqlTestExtension = newSuper.callPackage ./postgresqlTestExtension.nix { };
+          postgresqlBuildExtension = newSuper.callPackage ./postgresqlBuildExtension.nix { };
         };
-
-        tests = {
-          postgresql = nixosTests.postgresql.postgresql.passthru.override finalAttrs.finalPackage;
-          postgresql-replication = nixosTests.postgresql.postgresql-replication.passthru.override finalAttrs.finalPackage;
-          postgresql-tls-client-cert = nixosTests.postgresql.postgresql-tls-client-cert.passthru.override finalAttrs.finalPackage;
-          postgresql-wal-receiver = nixosTests.postgresql.postgresql-wal-receiver.passthru.override finalAttrs.finalPackage;
-          pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-        }
-        // lib.optionalAttrs jitSupport {
-          postgresql-jit = nixosTests.postgresql.postgresql-jit.passthru.override finalAttrs.finalPackage;
+        newSelf = self // scope;
+        newSuper = {
+          callPackage = newScope (scope // finalAttrs.finalPackage.pkgs);
         };
+      in
+      import ./ext.nix newSelf newSuper;
+
+    withPackages = self.callPackage ./wrapper.nix { postgresql = finalAttrs.finalPackage; };
+
+    pg_config = buildPackages.callPackage ./pg_config.nix {
+      inherit (finalAttrs) finalPackage;
+      outputs = {
+        out = lib.getOutput "out" finalAttrs.finalPackage;
+        man = lib.getOutput "man" finalAttrs.finalPackage;
       };
+    };
 
-      meta = {
-        homepage = "https://www.postgresql.org";
-        description = "Powerful, open source object-relational database system";
-        license = lib.licenses.postgresql;
-        changelog = "https://www.postgresql.org/docs/release/${finalAttrs.version}/";
-        teams = [ lib.teams.postgres ];
-        pkgConfigModules = [
-          "libecpg"
-          "libecpg_compat"
-          "libpgtypes"
-          "libpq"
-        ];
-        platforms = lib.platforms.unix;
+    tests = {
+      postgresql = nixosTests.postgresql.postgresql.passthru.override finalAttrs.finalPackage;
+      postgresql-replication = nixosTests.postgresql.postgresql-replication.passthru.override finalAttrs.finalPackage;
+      postgresql-tls-client-cert = nixosTests.postgresql.postgresql-tls-client-cert.passthru.override finalAttrs.finalPackage;
+      postgresql-wal-receiver = nixosTests.postgresql.postgresql-wal-receiver.passthru.override finalAttrs.finalPackage;
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    }
+    // lib.optionalAttrs jitSupport {
+      postgresql-jit = nixosTests.postgresql.postgresql-jit.passthru.override finalAttrs.finalPackage;
+    };
+  };
 
-        broken =
-          # JIT support doesn't work with cross-compilation. It is attempted to build LLVM-bytecode
-          # (`%.bc` is the corresponding `make(1)`-rule) for each sub-directory in `backend/` for
-          # the JIT apparently, but with a $(CLANG) that can produce binaries for the build, not the
-          # host-platform.
-          #
-          # I managed to get a cross-build with JIT support working with
-          # `depsBuildBuild = [ llvmPackages.clang ] ++ buildInputs`, but considering that the
-          # resulting LLVM IR isn't platform-independent this doesn't give you much.
-          # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
-          # a query, postgres would coredump with `Illegal instruction`.
-          #
-          # Note: This is "host canExecute build" on purpose, since this is about the LLVM that is called
-          # to do JIT at **runtime**.
-          (jitSupport && !stdenv.hostPlatform.canExecute stdenv.buildPlatform)
-          # While PostgreSQL claims to support static builds, it does not do so in a way that
-          # would work properly and consistently in pkgsStatic. The server heavily depends on
-          # the ability to load shared modules at runtime, but dlopen() is stubbed out in static
-          # musl builds. The important part is, that the separate libpq package builds in pkgsStatic.
-          || stdenv.hostPlatform.isStatic;
-      };
-    });
+  meta = {
+    homepage = "https://www.postgresql.org";
+    description = "Powerful, open source object-relational database system";
+    license = lib.licenses.postgresql;
+    changelog = "https://www.postgresql.org/docs/release/${finalAttrs.version}/";
+    teams = [ lib.teams.postgres ];
+    pkgConfigModules = [
+      "libecpg"
+      "libecpg_compat"
+      "libpgtypes"
+      "libpq"
+    ];
+    platforms = lib.platforms.unix;
 
-in
-# passed by <major>.nix
-versionArgs:
-# passed by default.nix
-{ self, ... }@defaultArgs:
-self.callPackage generic (defaultArgs // versionArgs)
+    broken =
+      # JIT support doesn't work with cross-compilation. It is attempted to build LLVM-bytecode
+      # (`%.bc` is the corresponding `make(1)`-rule) for each sub-directory in `backend/` for
+      # the JIT apparently, but with a $(CLANG) that can produce binaries for the build, not the
+      # host-platform.
+      #
+      # I managed to get a cross-build with JIT support working with
+      # `depsBuildBuild = [ llvmPackages.clang ] ++ buildInputs`, but considering that the
+      # resulting LLVM IR isn't platform-independent this doesn't give you much.
+      # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
+      # a query, postgres would coredump with `Illegal instruction`.
+      #
+      # Note: This is "host canExecute build" on purpose, since this is about the LLVM that is called
+      # to do JIT at **runtime**.
+      (jitSupport && !stdenv.hostPlatform.canExecute stdenv.buildPlatform)
+      # While PostgreSQL claims to support static builds, it does not do so in a way that
+      # would work properly and consistently in pkgsStatic. The server heavily depends on
+      # the ability to load shared modules at runtime, but dlopen() is stubbed out in static
+      # musl builds. The important part is, that the separate libpq package builds in pkgsStatic.
+      || stdenv.hostPlatform.isStatic;
+  };
+})

From 97a8d845517ba547c82a7d6f2c87fc7718aef70b Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Fri, 24 Apr 2026 14:45:43 +0200
Subject: [PATCH 1189/1209] orioledb: init at 17.20

---
 pkgs/by-name/or/orioledb/extension.nix | 46 ++++++++++++++++++++++++
 pkgs/by-name/or/orioledb/package.nix   | 50 ++++++++++++++++++++++++++
 2 files changed, 96 insertions(+)
 create mode 100644 pkgs/by-name/or/orioledb/extension.nix
 create mode 100644 pkgs/by-name/or/orioledb/package.nix

diff --git a/pkgs/by-name/or/orioledb/extension.nix b/pkgs/by-name/or/orioledb/extension.nix
new file mode 100644
index 000000000000..c77b03cb0bb1
--- /dev/null
+++ b/pkgs/by-name/or/orioledb/extension.nix
@@ -0,0 +1,46 @@
+{
+  curl,
+  fetchFromGitHub,
+  lib,
+  postgresql,
+  postgresqlBuildExtension,
+  postgresqlTestExtension,
+  python3,
+}:
+
+postgresqlBuildExtension (finalAttrs: {
+  pname = "orioledb";
+  # SQL extension version is 1.8, official version is beta16-pre-3
+  version = "1.8-beta16-pre-3";
+
+  src = fetchFromGitHub {
+    owner = "orioledb";
+    repo = "orioledb";
+    tag = "beta16-pre-3";
+    hash = "sha256-nBLyc9VFETRo75HfBSLmQ13a6Vcc9rlSCp06y/SnDqQ=";
+  };
+
+  buildInputs = postgresql.buildInputs ++ [
+    curl
+  ];
+
+  nativeBuildInputs = [
+    python3
+  ];
+
+  makeFlags = [ "USE_PGXS=1" ];
+
+  meta =
+    # Inheriting maintainers from `postgresql` is only OK to do,
+    # because it's the orioledb-specific fork of PostgreSQL.
+    # Once these patches are upstreamed and the extension can
+    # run on stock PG, this meta section needs to be adjusted.
+    assert postgresql.pname == "orioledb-postgres";
+    {
+      inherit (postgresql.meta) description maintainers;
+      license = lib.licenses.OR [
+        lib.licenses.asl20
+        lib.licenses.postgresql
+      ];
+    };
+})
diff --git a/pkgs/by-name/or/orioledb/package.nix b/pkgs/by-name/or/orioledb/package.nix
new file mode 100644
index 000000000000..85fbfee5ab66
--- /dev/null
+++ b/pkgs/by-name/or/orioledb/package.nix
@@ -0,0 +1,50 @@
+{
+  fetchFromGitHub,
+  lib,
+  postgresql_17,
+}:
+
+let
+  orioledb-postgres = postgresql_17.overrideAttrs (
+    finalAttrs: oldAttrs: {
+      pname = "orioledb-postgres";
+      version = "17.20";
+
+      src = fetchFromGitHub {
+        owner = "orioledb";
+        repo = "postgres";
+        tag = "patches17_20";
+        hash = "sha256-3dC00fFpD8fJDKed37oQvILMtA3GKBsWo1GEdUQzXzQ=";
+      };
+
+      # Configure extracts the patch version from the git tag. This
+      # is required by the extension build to verify it builds against
+      # the correctly patched postgresql version.
+      postPatch = oldAttrs.postPatch or "" + ''
+        substituteInPlace configure \
+          --replace-fail "git describe --tags --exact-match" "echo '${finalAttrs.src.tag}'"
+      '';
+
+      # orioledb seems to have made pg_rewind extensible somehow. For that reason,
+      # there is now a header file in the -dev output for it. Until reported otherwise
+      # we'll just strip that reference to avoid a cycle between outputs.
+      postInstall = oldAttrs.postInstall or "" + ''
+        remove-references-to -t "$dev"  -t "$doc" -t "$man" "$out/bin/pg_rewind"
+      '';
+
+      meta = {
+        inherit (oldAttrs.meta)
+          license
+          pkgConfigModules
+          platforms
+          broken
+          ;
+        description = "Cloud-native storage engine for PostgreSQL";
+        maintainers = [
+          lib.maintainers.wolfgangwalther
+        ];
+      };
+    }
+  );
+in
+orioledb-postgres.withPackages (pkgs: [ (pkgs.callPackage ./extension.nix { }) ])

From b1f5afb266528b0c7fd1f090bdfe6e612af91d18 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 12:16:04 +0200
Subject: [PATCH 1190/1209] python3Packages.yalexs: disable failing test

This is test only, newer version break compat with home-assistant.
---
 pkgs/development/python-modules/yalexs/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/yalexs/default.nix b/pkgs/development/python-modules/yalexs/default.nix
index a429afaae31e..f84f8ced4678 100644
--- a/pkgs/development/python-modules/yalexs/default.nix
+++ b/pkgs/development/python-modules/yalexs/default.nix
@@ -60,6 +60,11 @@ buildPythonPackage rec {
     requests-mock
   ];
 
+  disabledTests = [
+    # aiohttp api breakage, remove when bumping to 9.2.8 or newer
+    "test__raise_response_exceptions"
+  ];
+
   pythonImportsCheck = [ "yalexs" ];
 
   meta = {

From ad687d5638a19e9218fbddbf971a61085335c3f3 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 12:28:05 +0200
Subject: [PATCH 1191/1209] python3Packages.bleak-esphome: fix
 bluetooth-adapters compat

They made BluetoothAdapters an abstract class and bleak-esphome didn't
get the memo yet.
---
 .../bluetooth-adapters-2.4.0-compat.patch     | 21 +++++++++++++++++++
 .../python-modules/bleak-esphome/default.nix  |  4 ++++
 2 files changed, 25 insertions(+)
 create mode 100644 pkgs/development/python-modules/bleak-esphome/bluetooth-adapters-2.4.0-compat.patch

diff --git a/pkgs/development/python-modules/bleak-esphome/bluetooth-adapters-2.4.0-compat.patch b/pkgs/development/python-modules/bleak-esphome/bluetooth-adapters-2.4.0-compat.patch
new file mode 100644
index 000000000000..7eccf5dc5228
--- /dev/null
+++ b/pkgs/development/python-modules/bleak-esphome/bluetooth-adapters-2.4.0-compat.patch
@@ -0,0 +1,21 @@
+diff --git a/tests/conftest.py b/tests/conftest.py
+index 55defbe..551d19e 100644
+--- a/tests/conftest.py
++++ b/tests/conftest.py
+@@ -9,7 +9,7 @@ from aioesphomeapi import (
+     ReconnectLogic,
+ )
+ from bleak_retry_connector import BleakSlotManager
+-from bluetooth_adapters import BluetoothAdapters
++from bluetooth_adapters import get_adapters
+ from habluetooth import (
+     BluetoothManager,
+     set_manager,
+@@ -20,7 +20,7 @@ from zeroconf import Zeroconf
+ @pytest.fixture(scope="session", autouse=True)
+ def manager():
+     slot_manager = BleakSlotManager()
+-    bluetooth_adapters = BluetoothAdapters()
++    bluetooth_adapters = get_adapters()
+     set_manager(BluetoothManager(bluetooth_adapters, slot_manager))
+ 
diff --git a/pkgs/development/python-modules/bleak-esphome/default.nix b/pkgs/development/python-modules/bleak-esphome/default.nix
index 7b6869cf7729..3e934714e5b0 100644
--- a/pkgs/development/python-modules/bleak-esphome/default.nix
+++ b/pkgs/development/python-modules/bleak-esphome/default.nix
@@ -29,6 +29,10 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-S4tYL/fq7wMjq81WRftZ1A+RVxs7kGpaM/TfVBNBgaI=";
   };
 
+  patches = [
+    ./bluetooth-adapters-2.4.0-compat.patch
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "setuptools>=75.8.2" setuptools

From 57b0f811ac9fa5954fd4409446c353e901d2bb2b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 14:03:46 +0200
Subject: [PATCH 1192/1209] python3Packages.airos: pin setuptools 80

---
 pkgs/development/python-modules/airos/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/airos/default.nix b/pkgs/development/python-modules/airos/default.nix
index 14adc63dab3c..e1462f243025 100644
--- a/pkgs/development/python-modules/airos/default.nix
+++ b/pkgs/development/python-modules/airos/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  setuptools,
+  setuptools_80,
   aiohttp,
   mashumaro,
   aiofiles,
@@ -26,7 +26,7 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-/A9bP7wc+N0Jz/jJLvKHqVPjF3ddHjVKWlSN8tqGHIw=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     aiohttp

From 8c795b0c8e5bed2a23f4c833f3def9545a5d7c66 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 14:17:50 +0200
Subject: [PATCH 1193/1209] python3Packages.asyncssh: disable failing test

This was dropped in the last update but still keeps failing for me on
ZFS.
---
 pkgs/development/python-modules/asyncssh/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/asyncssh/default.nix b/pkgs/development/python-modules/asyncssh/default.nix
index a9a4c4c9de93..57caf4fc3b30 100644
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@@ -82,6 +82,8 @@ buildPythonPackage rec {
     "test_forward_remote"
     # Seems weirdly filesystem specific
     "test_put_name_too_long"
+    # SFTP copy ends up with an empty file on ZFS
+    "test_copy_max_requests"
   ];
 
   pythonImportsCheck = [ "asyncssh" ];

From 4e3177c33124d6155b683d405ac0d26ceaccbb09 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 16:02:53 +0200
Subject: [PATCH 1194/1209] python3Packages.azure-identity: 1.25.1 -> 1.25.3

https://github.com/Azure/azure-sdk-for-python/blob/azure-identity_1.25.3/sdk/identity/azure-identity/CHANGELOG.md
---
 pkgs/development/python-modules/azure-identity/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/azure-identity/default.nix b/pkgs/development/python-modules/azure-identity/default.nix
index 5511129685b8..ef006d39cabf 100644
--- a/pkgs/development/python-modules/azure-identity/default.nix
+++ b/pkgs/development/python-modules/azure-identity/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "azure-identity";
-  version = "1.25.1";
+  version = "1.25.3";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_identity";
     inherit version;
-    hash = "sha256-h8qDKIg95gNkQ+HDe0Do3I+3SJgkD2EHHgnS42k2FFY=";
+    hash = "sha256-qyPA1jAV9QtjDvbGzzlecmL0Oc4G5dB6ZOh0xyT42eY=";
   };
 
   build-system = [ setuptools ];

From f6ebd7fd78e3d46521613d9c0b447a41b4c6ba4a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 16:25:18 +0200
Subject: [PATCH 1195/1209] python3Packages.buienrader: fix setuptools 82
 compat

---
 .../python-modules/buienradar/default.nix     |  5 ++++
 .../buienradar/setuptools-82-compat.patch     | 30 +++++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/development/python-modules/buienradar/setuptools-82-compat.patch

diff --git a/pkgs/development/python-modules/buienradar/default.nix b/pkgs/development/python-modules/buienradar/default.nix
index 1c6bbdb29d0b..03fd6a688f7c 100644
--- a/pkgs/development/python-modules/buienradar/default.nix
+++ b/pkgs/development/python-modules/buienradar/default.nix
@@ -25,6 +25,11 @@ buildPythonPackage rec {
     hash = "sha256-DTdxzBe9fBOH5fHME++oq62xMtBKnjY7BCevwjl8VZ8=";
   };
 
+  patches = [
+    # https://github.com/mjj4791/python-buienradar/pull/26
+    ./setuptools-82-compat.patch
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/buienradar/setuptools-82-compat.patch b/pkgs/development/python-modules/buienradar/setuptools-82-compat.patch
new file mode 100644
index 000000000000..aff0bdafbcc2
--- /dev/null
+++ b/pkgs/development/python-modules/buienradar/setuptools-82-compat.patch
@@ -0,0 +1,30 @@
+Author: Martin Weinelt <hexa@darmstadt.ccc.de>
+Date:   Sun Jul 5 16:24:28 2026 +0200
+
+    Make compatible with setuptools 82
+    
+    This migrates the version retrieval to the stdlib importlib library.
+
+diff --git a/buienradar/__main__.py b/buienradar/__main__.py
+index b0838c1..b556374 100755
+--- a/buienradar/__main__.py
++++ b/buienradar/__main__.py
+@@ -19,8 +19,8 @@ Usage:
+ """
+ import logging
+ import sys
++from importlib.metadata import version
+ 
+-import pkg_resources
+ from docopt import docopt
+ 
+ from .buienradar import get_data, parse_data
+@@ -30,7 +30,7 @@ from .constants import CONTENT, MESSAGE, RAINCONTENT, SUCCESS
+ def main(argv=sys.argv[1:]):
+     """Parse argument and start main program."""
+     args = docopt(__doc__, argv=argv,
+-                  version=pkg_resources.require('buienradar')[0].version)
++                  version=version('buienradar'))
+ 
+     level = logging.ERROR
+     if args['-v']:

From 93ecd7d9a0dda086cc3799e53ae1053a2dbfee13 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 16:38:25 +0200
Subject: [PATCH 1196/1209] python3Packaegs.aioimaplib: fix pyopenssl 26 compat

---
 pkgs/development/python-modules/aioimaplib/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/aioimaplib/default.nix b/pkgs/development/python-modules/aioimaplib/default.nix
index f26dc63ec141..dc7cf465bd5b 100644
--- a/pkgs/development/python-modules/aioimaplib/default.nix
+++ b/pkgs/development/python-modules/aioimaplib/default.nix
@@ -29,6 +29,10 @@ buildPythonPackage rec {
     ./event-loop.patch
   ];
 
+  postPatch = ''
+    sed -i "/crypto.X509Extension/,+1d" tests/ssl_cert.py
+  '';
+
   build-system = [ poetry-core ];
 
   nativeCheckInputs = [
@@ -43,6 +47,7 @@ buildPythonPackage rec {
   disabledTests = [
     # TimeoutError
     "test_idle_start__exits_queue_get_without_timeout_error"
+    "test_client_can_connect_to_server_over_ssl"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # Comparison to magic strings

From 51e9ae967e6499fa162541a7d6d9f693fd375f08 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 16:43:11 +0200
Subject: [PATCH 1197/1209] python3Packages.mill-local: pin setuptools 80

---
 pkgs/development/python-modules/mill-local/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mill-local/default.nix b/pkgs/development/python-modules/mill-local/default.nix
index c171dbf4a157..7006bb79bc9d 100644
--- a/pkgs/development/python-modules/mill-local/default.nix
+++ b/pkgs/development/python-modules/mill-local/default.nix
@@ -4,7 +4,7 @@
   async-timeout,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     hash = "sha256-t6nZ6KXX5GFIcdNIXyFxYtSjOuuUJmCekaBITNgcIkU=";
   };
 
-  buildInputs = [ setuptools ];
+  buildInputs = [ setuptools_80 ];
 
   dependencies = [
     aiohttp

From 64d17fbb7da9bfa0dd7e515766c59d717fafbc84 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 17:08:11 +0200
Subject: [PATCH 1198/1209] python3Packages.roombapy: remove amqtt test
 dependency

This seems to have been removed and now it causes issues, because amqtt
fails to build.
---
 pkgs/development/python-modules/roombapy/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/roombapy/default.nix b/pkgs/development/python-modules/roombapy/default.nix
index 6f34f8375feb..5f3117a1d155 100644
--- a/pkgs/development/python-modules/roombapy/default.nix
+++ b/pkgs/development/python-modules/roombapy/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  amqtt,
   buildPythonPackage,
   click,
   fetchFromGitHub,
@@ -43,7 +42,6 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    amqtt
     pytest-asyncio
     pytestCheckHook
   ];

From 8ec2af787e8e137320db110768ad33f629f14bb3 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 17:32:29 +0200
Subject: [PATCH 1199/1209] python3Package.pystiebeleltron: disable failing
 tests

These tests have not been ported to a modern pymodbus version yet.
---
 pkgs/development/python-modules/pystiebeleltron/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/pystiebeleltron/default.nix b/pkgs/development/python-modules/pystiebeleltron/default.nix
index 6583c95f29e9..1e9ba577a4fb 100644
--- a/pkgs/development/python-modules/pystiebeleltron/default.nix
+++ b/pkgs/development/python-modules/pystiebeleltron/default.nix
@@ -31,6 +31,11 @@ buildPythonPackage rec {
     pytest-mock
   ];
 
+  disabledTestPaths = [
+    # mock server is not compatible with pymodbus 3.13
+    "test/test_pystiebeleltron.py"
+  ];
+
   pythonImportsCheck = [ "pystiebeleltron" ];
 
   meta = {

From c450b5df7af955737a1aa2589c2783dc57dca040 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 17:33:00 +0200
Subject: [PATCH 1200/1209] python3Packages.pymodbus: prune unused inputs

---
 pkgs/development/python-modules/pymodbus/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/development/python-modules/pymodbus/default.nix b/pkgs/development/python-modules/pymodbus/default.nix
index 148015d169bb..fc0afe74e614 100644
--- a/pkgs/development/python-modules/pymodbus/default.nix
+++ b/pkgs/development/python-modules/pymodbus/default.nix
@@ -2,10 +2,7 @@
   lib,
   aiohttp,
   buildPythonPackage,
-  click,
   fetchFromGitHub,
-  prompt-toolkit,
-  pygments,
   pymodbus-repl,
   pyserial,
   pytest-asyncio,
@@ -16,7 +13,6 @@
   setuptools,
   sqlalchemy,
   twisted,
-  typer,
 }:
 
 buildPythonPackage (finalAttrs: {

From e7fb9508f2c69fe66c7d44380e405e667c23a4b5 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 13:16:53 +0200
Subject: [PATCH 1201/1209] home-assistant: adjust test dependencies

---
 pkgs/servers/home-assistant/tests.nix | 34 ++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index d4ac5634c5da..a78551cb3eaa 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   home-assistant,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -15,10 +16,12 @@ let
       "frontend"
       "stream"
     ];
+    analytics = getComponentDeps "homeassistant_hardware";
     anthropic = getComponentDeps "ai_task" ++ getComponentDeps "openai_conversation";
     assist_pipeline = getComponentDeps "frontend";
     automation = getComponentDeps "frontend" ++ getComponentDeps "mobile_app";
     axis = getComponentDeps "deconz";
+    backup = getComponentDeps "homeassistant_hardware";
     bluetooth = getComponentDeps "switchbot";
     braviatv = getComponentDeps "ssdp";
     bthome = getComponentDeps "frontend";
@@ -28,6 +31,7 @@ let
     emulated_hue = [
       defusedxml
     ];
+    esphome = getComponentDeps "homeassistant_hardware";
     gardena_bluetooth = getComponentDeps "husqvarna_automower_ble";
     go2rtc = [
       tqdm
@@ -44,7 +48,11 @@ let
     homeassistant_sky_connect = getComponentDeps "zha";
     homeassistant_yellow = getComponentDeps "zha";
     homekit = getComponentDeps "frontend";
-    http = getComponentDeps "cloud" ++ getComponentDeps "frontend";
+    http = concatMap getComponentDeps [
+      "cloud"
+      "frontend"
+      "homeassistant_hardware"
+    ];
     intelliclima = getComponentDeps "intellifire";
     logbook = getComponentDeps "alexa";
     lovelace = getComponentDeps "frontend" ++ [
@@ -54,9 +62,11 @@ let
     mastodon = concatMap getComponentDeps [
       "stream"
     ];
+    matter = getComponentDeps "homeassistant_hardware";
     miele = getComponentDeps "cloud";
     mobile_app = getComponentDeps "frontend";
     mopeka = getComponentDeps "switchbot";
+    mqtt = getComponentDeps "homeassistant_hardware";
     nest = [
       av
     ];
@@ -65,8 +75,14 @@ let
       pymetno
       radios
       rpi-bad-power
-    ];
+    ]
+    ++ getComponentDeps "homeassistant_hardware"
+    ++ getComponentDeps "usb";
     open_router = getComponentDeps "ai_task";
+    osoenergy = [
+      # loguru wants to write into HOME
+      writableTmpDirAsHomeHook
+    ];
     raspberry_pi = [
       rpi-bad-power
     ];
@@ -91,10 +107,14 @@ let
     yolink = getComponentDeps "cloud";
     zeroconf = getComponentDeps "shelly";
     zha = getComponentDeps "deconz" ++ getComponentDeps "frontend";
-    zwave_js = getComponentDeps "frontend";
+    zwave_js = getComponentDeps "frontend" ++ getComponentDeps "homeassistant_hardware";
   };
 
   extraDisabledTestPaths = {
+    bluetooth = [
+      # [2026.7.1] Fails to replace HCI device after advertisement became stale
+      "tests/components/bluetooth/test_manager.py::test_switching_adapters_based_on_stale_with_discovered_interval"
+    ];
     influxdb = [
       # These tests fail because they check for the number of warnings in the
       # logs and there is an extra warning in the logs:
@@ -122,6 +142,10 @@ let
   };
 
   extraDisabledTests = {
+    bsblan = [
+      # [2026.7.1] outdated snapshot
+      "test_diagnostics"
+    ];
     conversation = lib.optionals stdenv.hostPlatform.isAarch64 [
       # intent fixture mismatch on aarch64
       "test_error_no_device_on_floor"
@@ -139,6 +163,10 @@ let
       # https://github.com/home-assistant/core/pull/172909
       "test_upload_image_device_not_in_range"
     ];
+    smlight = [
+      # [2026.7.1] outdated snapshot
+      "test_entry_diagnostics"
+    ];
     teslemetry = [
       # [2026.6.4] http://github.com/home-assistant/core/commit/a33a92982af19e682a0d0fa7bec0cb16929c00d1
       "test_sensors"

From 8765851bab58e8a4c2ebd76343b37a9eca510007 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 17:35:59 +0200
Subject: [PATCH 1202/1209] tests.home-assistant-components: use lib.genAttrs
 to construct tests

---
 pkgs/servers/home-assistant/tests.nix | 50 +++++++++++++--------------
 1 file changed, 24 insertions(+), 26 deletions(-)

diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index a78551cb3eaa..bb7452f8bdd5 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -182,36 +182,34 @@ let
     ];
   };
 in
-lib.listToAttrs (
-  map (
-    component:
-    lib.nameValuePair component (
-      home-assistant.overridePythonAttrs (old: {
-        pname = "homeassistant-test-${component}";
-        pyproject = false;
+lib.genAttrs home-assistant.supportedComponentsWithTests (
+  component:
+  home-assistant.overridePythonAttrs (old: {
+    pname = "homeassistant-test-${component}";
+    pyproject = false;
 
-        dontBuild = true;
-        dontInstall = true;
+    dontBuild = true;
+    dontInstall = true;
 
-        nativeCheckInputs =
-          old.requirementsTest
-          ++ home-assistant.getPackages component home-assistant.python3Packages
-          ++ extraCheckInputs.${component} or [ ];
+    nativeCheckInputs =
+      old.requirementsTest
+      ++ home-assistant.getPackages component home-assistant.python3Packages
+      ++ extraCheckInputs.${component} or [ ];
 
-        disabledTests = extraDisabledTests.${component} or [ ];
-        disabledTestPaths = extraDisabledTestPaths.${component} or [ ];
+    disabledTests = extraDisabledTests.${component} or [ ];
+    disabledTestPaths = extraDisabledTestPaths.${component} or [ ];
 
-        # components are more often racy than the core
-        dontUsePytestXdist = true;
+    # components are more often racy than the core
+    dontUsePytestXdist = true;
 
-        enabledTestPaths = [ "tests/components/${component}" ];
+    enabledTestPaths = [ "tests/components/${component}" ];
 
-        meta = old.meta // {
-          broken = lib.elem component [ ];
-          # upstream only tests on Linux, so do we.
-          platforms = lib.platforms.linux;
-        };
-      })
-    )
-  ) home-assistant.supportedComponentsWithTests
+    pytestFlags = [ "-vvv" ];
+
+    meta = old.meta // {
+      broken = lib.elem component [ ];
+      # upstream only tests on Linux, so do we.
+      platforms = lib.platforms.linux;
+    };
+  })
 )

From c0dd26dd3de1d8b514b2c116e5a889fdaf9727f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 5 Jul 2026 16:53:21 -0700
Subject: [PATCH 1203/1209] imagemagick: 7.1.2-26 -> 7.1.2-27

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-26...7.1.2-27

Changelog: https://github.com/ImageMagick/Website/blob/main/docs/changelog/index.md
---
 pkgs/by-name/im/imagemagick/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/im/imagemagick/package.nix b/pkgs/by-name/im/imagemagick/package.nix
index 80b5314f5a31..918d97c640fa 100644
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -89,13 +89,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-26";
+  version = "7.1.2-27";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-Nl4C5XLwwQviy+GsLgNfbq+Ed6gWsI/ozB3BzM8bkV8=";
+    hash = "sha256-QCC2CO2zkhwlEWymwF739uSNuS7QCqqGIJnF/LtYzVc=";
   };
 
   outputs = [
@@ -209,7 +209,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.imagemagick.org/";
-    changelog = "https://github.com/ImageMagick/Website/blob/main/ChangeLog.md";
+    changelog = "https://github.com/ImageMagick/Website/blob/main/docs/changelog/index.md";
     description = "Software suite to create, edit, compose, or convert bitmap images";
     pkgConfigModules = [
       "ImageMagick"

From 0c409ea61899f8fde15d13417a422285670d619c Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 6 Jul 2026 16:02:31 +0300
Subject: [PATCH 1204/1209] python3Packages.fastapi: use finalAttrs pattern

---
 pkgs/development/python-modules/fastapi/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index e7c8a426fae7..6e0eedc3d4a9 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -38,7 +38,7 @@
   pydantic-extra-types,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fastapi";
   version = "0.136.3";
   pyproject = true;
@@ -46,7 +46,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tiangolo";
     repo = "fastapi";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-lfmk8ZveKPukEEfwWq2mKtWmOHAtVzGuE5BsOskDzh0=";
   };
 
@@ -116,7 +116,7 @@ buildPythonPackage rec {
     pytest-timeout
   ]
   ++ anyio.optional-dependencies.trio
-  ++ optional-dependencies.all;
+  ++ finalAttrs.finalPackage.passthru.optional-dependencies.all;
 
   disabledTests = [
     # Coverage test
@@ -134,10 +134,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "fastapi" ];
 
   meta = {
-    changelog = "https://github.com/fastapi/fastapi/releases/tag/${src.tag}";
+    changelog = "https://github.com/fastapi/fastapi/releases/tag/${finalAttrs.src.tag}";
     description = "Web framework for building APIs";
     homepage = "https://github.com/fastapi/fastapi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ wd15 ];
   };
-}
+})

From 40d7bc5a60a5fd585a5818977c9f25ac0dbcef98 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 6 Jul 2026 16:02:46 +0300
Subject: [PATCH 1205/1209] python3Packages.fastapi: 0.136.3 -> 0.139.0

Diff: https://github.com/tiangolo/fastapi/compare/0.136.3...0.139.0

Changelog: https://github.com/fastapi/fastapi/releases/tag/0.139.0
---
 pkgs/development/python-modules/fastapi/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 6e0eedc3d4a9..af0831bb11ca 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -27,7 +27,7 @@
 
   # optional-dependencies
   fastapi-cli,
-  httpx,
+  httpx2,
   jinja2,
   itsdangerous,
   python-multipart,
@@ -40,14 +40,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastapi";
-  version = "0.136.3";
+  version = "0.139.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tiangolo";
     repo = "fastapi";
     tag = finalAttrs.version;
-    hash = "sha256-lfmk8ZveKPukEEfwWq2mKtWmOHAtVzGuE5BsOskDzh0=";
+    hash = "sha256-c4balkkmBv7zKRQnYRpRohVjP23m0HvtdiVrJtgNKYo=";
   };
 
   build-system = [ pdm-backend ];
@@ -63,7 +63,7 @@ buildPythonPackage (finalAttrs: {
   optional-dependencies = {
     all = [
       fastapi-cli
-      httpx
+      httpx2
       jinja2
       python-multipart
       itsdangerous
@@ -78,7 +78,7 @@ buildPythonPackage (finalAttrs: {
     standard = [
       fastapi-cli
       # FIXME package fastar
-      httpx
+      httpx2
       jinja2
       python-multipart
       email-validator
@@ -90,7 +90,7 @@ buildPythonPackage (finalAttrs: {
     ++ uvicorn.optional-dependencies.standard;
     standard-no-fastapi-cloud-cli = [
       fastapi-cli
-      httpx
+      httpx2
       jinja2
       python-multipart
       email-validator

From 22ab7ac180af00130df05c8fc03e65df72d42f4c Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 6 Jul 2026 16:14:35 +0300
Subject: [PATCH 1206/1209] python3Packages.fastapi: set strictDeps &
 __structuredAttrs

---
 pkgs/development/python-modules/fastapi/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index af0831bb11ca..60dbe8fbfaf0 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage (finalAttrs: {
   pname = "fastapi";
   version = "0.139.0";
   pyproject = true;
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "tiangolo";

From e8cca2d616c390662270d70ea3b71223cad7ed42 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 6 Jul 2026 15:19:07 +0200
Subject: [PATCH 1207/1209] python314Packages.aiocache: disable flaky test

---
 pkgs/development/python-modules/aiocache/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/aiocache/default.nix b/pkgs/development/python-modules/aiocache/default.nix
index c4af88bf2cbf..a5bfc179135c 100644
--- a/pkgs/development/python-modules/aiocache/default.nix
+++ b/pkgs/development/python-modules/aiocache/default.nix
@@ -77,6 +77,9 @@ buildPythonPackage rec {
 
     # TypeError: object MagicMock can't be used in 'await' expression
     "tests/ut/backends/test_redis.py::TestRedisBackend::test_close"
+
+    # flaky, see https://github.com/aio-libs/aiocache/issues/587
+    "tests/acceptance/test_lock.py::TestRedLock::test_locking_dogpile"
   ];
 
   __darwinAllowLocalNetworking = true;

From c9bccd97ca86a84cb4cce385a85e0141fa2dff9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Sun, 25 May 2025 20:58:21 +0000
Subject: [PATCH 1208/1209] glog: Enable generation of pkg-config .pc file so
 dependents can find it

glog 0.7.0 changed the default to off:
https://github.com/google/glog/commit/e1f424a7e29c5ca493cfa07a59c4ca859b680f14
---
 pkgs/by-name/gl/glog/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gl/glog/package.nix b/pkgs/by-name/gl/glog/package.nix
index cfe37529d3b3..ef5fb3be4277 100644
--- a/pkgs/by-name/gl/glog/package.nix
+++ b/pkgs/by-name/gl/glog/package.nix
@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
     # consumers of the CMake config file to fail at the configuration step.
     # Explicitly disabling unwind support sidesteps the issue.
     "-DWITH_UNWIND=OFF"
+    # Enable pkg-config support so that a `.pc` file is generated.
+    "-DWITH_PKGCONFIG=ON"
   ];
 
   doCheck = true;

From 353ed9b9b2ddfedeb5da8c35ee518117739685e3 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 5 Jul 2026 23:50:25 +0300
Subject: [PATCH 1209/1209] python3Packages.numpy: set passthru.tests to
 important dependent packages

Per https://github.com/NixOS/nixpkgs/pull/538638#issuecomment-4885771895
---
 pkgs/development/python-modules/numpy/2.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index e097ad7bb298..4af4511fdc81 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -22,7 +22,11 @@
   openmpCheckPhaseHook,
 
   # Reverse dependency
+  astropy,
+  numba,
+  pandas,
   sage,
+  xarray,
 
   # tests
   hypothesis,
@@ -202,7 +206,17 @@ buildPythonPackage (finalAttrs: {
     coreIncludeInnerDir = "${python.sitePackages}/numpy/_core/include";
     coreIncludeDir = "${finalAttrs.finalPackage}/${finalAttrs.finalPackage.passthru.coreIncludeInnerDir}";
     tests = {
-      inherit sage;
+      # NOTE: It is important to check these central dependent packages when
+      # issuing Numpy PRs and especially version bumps (even minor version
+      # bumps) - evidently these have caused issues in staging-next in the
+      # past.
+      inherit
+        astropy
+        numba
+        pandas
+        sage
+        xarray
+        ;
     };
   };