nixVersions.nix_2_34: 2.34.7 -> 2.34.8 (#539074)

Notably, this has the fix for libcurl 8.21 and wakeup consumption.

Diff: https://github.com/NixOS/nix/compare/2.34.7...2.34.8

ci/OWNERS

@@ -182,10 +182,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/by-name/an/android*                     @NixOS/android
 
 # Python-related code and docs
-/doc/languages-frameworks/python.section.md   @mweinelt @natsukium
-/maintainers/scripts/update-python-libraries  @mweinelt @natsukium
-/pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
-/pkgs/development/interpreters/python         @mweinelt @natsukium
+/doc/languages-frameworks/python.section.md   @mweinelt
+/maintainers/scripts/update-python-libraries  @mweinelt
+/pkgs/by-name/up/update-python-libraries      @mweinelt
+/pkgs/development/interpreters/python         @mweinelt
 
 # CUDA
 /pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers

doc/hooks/index.md

@@ -34,6 +34,7 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
+openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md

doc/hooks/openmp-check-hook.section.md

@@ -0,0 +1,10 @@
+# openmpCheckPhaseHook {#setup-hook-omp-check}
+
+
+This hook can be used to setup a check phase that
+requires running a OpenMP application. It mostly
+serves to limit `OMP_NUM_THREADS` to avoid overloading
+build machines.
+
+This hook will not attempt to override an already existing
+definition of `OMP_NUM_THREADS` in the environment.

doc/languages-frameworks/gnome.section.md

@@ -105,7 +105,7 @@ Given the requirements above, the package expression would become messy quickly:
 }
 ```
 
-Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that automate this. They work in conjunction with other setup hooks that populate environment variables, and will then wrap all executables in `bin` and `libexec` directories using said variables.
+Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that automate this. They work in conjunction with other setup hooks that populate environment variables, and will then wrap all executables in `bin` and `libexec` directories using said variables. If a package has multiple outputs, these hooks will work on `outputBin` by default, or on the outputs listed in `wrapGAppsInOutputs` if set.
 
 - [`wrapGAppsHook3`]{#ssec-gnome-hooks-wrapgappshook3} for GTK 3 apps. For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure.
 - [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4} for GTK 4 apps. Same as `wrapGAppsHook3` but replaces `gtk3` with `gtk4`.

doc/preface.chapter.md

@@ -42,7 +42,7 @@ shows the status of tests for the `nixpkgs-unstable` channel.
 
 The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
 which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
+`x86_64-linux`, `aarch64-linux`, and `aarch64-darwin`.
 The binaries are made available via a [binary cache](https://cache.nixos.org).
 
 The current Nix expressions of the channels are available in the

doc/redirects.json

@@ -1127,6 +1127,9 @@
   "x86_64-darwin-26.05": [
     "release-notes.html#x86_64-darwin-26.05"
   ],
+  "x86_64-darwin-26.11": [
+    "release-notes.html#x86_64-darwin-26.11"
+  ],
   "zip-files": [
     "index.html#zip-files"
   ],
@@ -2914,6 +2917,9 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
+  "setup-hook-omp-check": [
+    "index.html#setup-hook-omp-check"
+  ],
   "ninja": [
     "index.html#ninja"
   ],

doc/release-notes/rl-2611.section.md

@@ -10,6 +10,17 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- []{#x86_64-darwin-26.11}
+
+  Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
+  We will no longer build packages for the platform or support building them from source.
+
+  The Nixpkgs 26.05 stable branch will still maintain platform support and binaries will be built until it goes out of support at the end of 2026.
+  Users of `x86_64-darwin` will receive an error message explaining how to switch to 26.05.
+
+  By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
+  We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
+
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.

doc/stdenv/cross-compilation.chapter.md

@@ -50,7 +50,7 @@ The exact schema these fields follow is a bit ill-defined due to a long and conv
 
 `system`
 
-: This is a two-component shorthand for the platform. Examples of this would be "x86_64-darwin" and "i686-linux"; see `lib.systems.doubles` for more. The first component corresponds to the CPU architecture of the platform and the second to the operating system of the platform (`[cpu]-[os]`). This format has built-in support in Nix, such as the `builtins.currentSystem` impure string.
+: This is a two-component shorthand for the platform. Examples of this would be "aarch64-darwin" and "i686-linux"; see `lib.systems.doubles` for more. The first component corresponds to the CPU architecture of the platform and the second to the operating system of the platform (`[cpu]-[os]`). This format has built-in support in Nix, such as the `builtins.currentSystem` impure string.
 
 `config`
 

doc/using/platform-support.chapter.md

@@ -29,8 +29,7 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 | `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
 | `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
 | `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌\*                     |
-| `x86_64-apple-darwin`                 | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌\*                     |
+| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌                       |
 | `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
 | `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None | ❌             | ❌             | ❌                  | ✔️                      |
 | `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
@@ -45,5 +44,3 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 | `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
 | `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
 | `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-
-\* - Cross compiling is only supported on Darwin hosts.

flake.nix

@@ -220,17 +220,25 @@
         evaluation. Evaluating the attribute value tends to require a significant
         amount of computation, even considering lazy evaluation.
       */
-      legacyPackages = forAllSystems (
-        system:
-        (import ./. {
-          inherit system;
-          overlays = import ./pkgs/top-level/impure-overlays.nix ++ [
-            (final: prev: {
-              lib = prev.lib.extend libVersionInfoOverlay;
-            })
-          ];
-        })
-      );
+      legacyPackages =
+        let
+          # We include `x86_64-darwin` here to ensure that users get a
+          # good error message for the 26.11 deprecation of the platform,
+          # while excluding it from `lib.systems.flakeExposed` so that we
+          # don’t break `nix flake check` for downstream users.
+          forAllSystems' = lib.genAttrs (lib.systems.flakeExposed ++ [ "x86_64-darwin" ]);
+        in
+        forAllSystems' (
+          system:
+          (import ./. {
+            inherit system;
+            overlays = import ./pkgs/top-level/impure-overlays.nix ++ [
+              (final: prev: {
+                lib = prev.lib.extend libVersionInfoOverlay;
+              })
+            ];
+          })
+        );
 
       /**
         Optional modules that can be imported into a NixOS configuration.

lib/systems/doubles.nix

@@ -14,14 +14,16 @@ let
   inherit (lib.attrsets) matchAttrs;
 
   all = [
+    # our primary systems. at the top of the list for fastest matching
+    # inside check-meta
+    "x86_64-linux"
+    "aarch64-darwin"
+    "aarch64-linux"
+
     # Cygwin
     "i686-cygwin"
     "x86_64-cygwin"
 
-    # Darwin
-    "x86_64-darwin"
-    "aarch64-darwin"
-
     # FreeBSD
     "i686-freebsd"
     "x86_64-freebsd"
@@ -38,8 +40,7 @@ let
     # JS
     "javascript-ghcjs"
 
-    # Linux
-    "aarch64-linux"
+    # Linux (excluding the primary two at the top)
     "arc-linux"
     "armv5tel-linux"
     "armv6l-linux"
@@ -62,7 +63,6 @@ let
     "riscv64-linux"
     "s390-linux"
     "s390x-linux"
-    "x86_64-linux"
 
     # MMIXware
     "mmix-mmixware"

lib/systems/examples.nix

@@ -332,12 +332,6 @@ rec {
     platform = { };
   };
 
-  x86_64-darwin = {
-    config = "x86_64-apple-darwin";
-    xcodePlatform = "MacOSX";
-    platform = { };
-  };
-
   #
   # UEFI
   #

lib/systems/flake-systems.nix

@@ -11,7 +11,6 @@
   "x86_64-linux"
   # Tier 2
   "aarch64-linux"
-  "x86_64-darwin"
   # Tier 3
   "armv6l-linux"
   "armv7l-linux"

lib/tests/systems.nix

@@ -127,7 +127,6 @@ lib.runTests (
     ];
     testx86_64 = mseteq x86_64 [
       "x86_64-linux"
-      "x86_64-darwin"
       "x86_64-freebsd"
       "x86_64-genode"
       "x86_64-redox"
@@ -145,7 +144,6 @@ lib.runTests (
       "x86_64-cygwin"
     ];
     testdarwin = mseteq darwin [
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
     testfreebsd = mseteq freebsd [

maintainers/scripts/haskell/hydra-report.hs

@@ -272,7 +272,7 @@ instance FromJSON JobMaintainers where
 -- @@
 --  fromList
 --    [ ("arion.aarch64-linux", ["rob22"])
---    , ("conduit.x86_64-darwin", ["snoyb", "webber"])
+--    , ("conduit.aarch64-darwin", ["snoyb", "webber"])
 --    ]
 -- @@
 type MaintainerMap = Map JobName (NonEmpty Text)
@@ -404,15 +404,13 @@ platformIcon :: Platform -> Text
 platformIcon (Platform x) = case x of
    "x86_64-linux" -> "🐧"
    "aarch64-linux" -> "📱"
-   "x86_64-darwin" -> "🍎"
-   "aarch64-darwin" -> "🍏"
+   "aarch64-darwin" -> "🍎"
    _ -> x
 
 platformIsOS :: OS -> Platform -> Bool
 platformIsOS os (Platform x) = case (os, x) of
    (Linux, "x86_64-linux") -> True
    (Linux, "aarch64-linux") -> True
-   (Darwin, "x86_64-darwin") -> True
    (Darwin, "aarch64-darwin") -> True
    _ -> False
 

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -4,7 +4,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 26.11`) is v18.
 
 ## New Modules {#sec-release-26.11-new-modules}
 

nixos/lib/qemu-common.nix

@@ -46,15 +46,10 @@ rec {
         powerpc64-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
         riscv32-linux = "${qemuPkg}/bin/qemu-system-riscv32 -machine virt";
         riscv64-linux = "${qemuPkg}/bin/qemu-system-riscv64 -machine virt";
-        x86_64-darwin = "${qemuPkg}/bin/qemu-system-x86_64 -machine accel=${accel "kvm"} -cpu max";
       };
       otherHostGuestMatrix = {
         aarch64-darwin = {
           aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -machine virt,gic-version=2,accel=${accel "hvf"} -cpu max";
-          inherit (otherHostGuestMatrix.x86_64-darwin) x86_64-linux;
-        };
-        x86_64-darwin = {
-          x86_64-linux = "${qemuPkg}/bin/qemu-system-x86_64 -machine type=q35,accel=${accel "hvf"} -cpu max";
         };
       };
 

nixos/lib/systemd-lib.nix

@@ -78,16 +78,13 @@ rec {
         {
           preferLocalBuild = true;
           allowSubstitutes = false;
-          # unit.text can be null. But variables that are null listed in
-          # passAsFile are ignored by nix, resulting in no file being created,
-          # making the mv operation fail.
-          text = optionalString (unit.text != null) unit.text;
-          passAsFile = [ "text" ];
+          text = unit.text or "";
+          __structuredAttrs = true;
         }
         ''
           name=${shellEscape name}
           mkdir -p "$out/$(dirname -- "$name")"
-          mv "$textPath" "$out/$name"
+          printf "%s" "$text" > "$out/$name"
         ''
     else
       pkgs.runCommand "unit-${mkPathSafeName name}-disabled"

nixos/lib/test-driver/default.nix

@@ -11,6 +11,7 @@
   ptpython,
   pydantic,
   python,
+  ovmfvartool,
   remote-pdb,
   ruff,
   ty,
@@ -47,6 +48,7 @@ buildPythonApplication {
     junit-xml
     ptpython
     pydantic
+    ovmfvartool
     remote-pdb
   ]
   ++ extraPythonPackages python.pkgs;

nixos/lib/test-driver/src/test_driver/efi.py

@@ -0,0 +1,233 @@
+import binascii
+import io
+import os.path
+import uuid
+from collections.abc import Generator
+from contextlib import contextmanager
+from pathlib import Path
+from typing import IO, Any, TypeVar
+
+from ovmfvartool import (
+    AuthenticatedVariable,
+    FirmwareVolumeHeader,
+    UEFITime,
+    VariableStoreHeader,
+    resolveUUID,
+)
+
+import test_driver.machine
+from test_driver.errors import RequestedAssertionFailed
+
+EfiVariableT = TypeVar("EfiVariableT", bound="EfiVariable")
+
+# See edk2.git/OvmfPkg/Bhyve/VarStore.fdf.inc
+_NV_FTW_WORKING_OFFSET = 0x41000
+_NV_FTW_WORKING_VALUE = binascii.unhexlify(
+    b"2b29589e687c7d49a0ce6500fd9f1b952caf2c64feffffffe00f000000000000"
+)
+_NV_FTW_SIZE = 0x42000
+_NV_FTW_MAIN_PLUS_SPARE_SIZE = _NV_FTW_SIZE * 2
+
+
+class EfiVariable(AuthenticatedVariable):
+    class Flags:
+        NON_VOLATILE = 0x1
+        BOOTSERVICE_ACCESS = 0x2
+        RUNTIME_ACCESS = 0x4
+        TIME_BASED_AUTHENTICATED_WRITE_ACCESS = 0x20
+
+    class State:
+        VAR_HEADER_VALID_ONLY = 0x7F
+        VAR_ADDED = 0x3F
+
+    volatile = False
+    boot_access = False
+    runtime_access = False
+    hardware_error_record = False
+    authenticated_write_access = False
+    time_based_authenticated_write_access = False
+    append_write = False
+
+    def __init__(
+        self,
+        vendor_uuid: uuid.UUID | None = None,
+        name: str | None = None,
+        data: bytes | None = None,
+        state: int | None = None,
+        flags: int | None = None,
+    ) -> None:
+        self.magic = 0x55AA
+        self.reserved1 = 0
+        self.monotonicCount = 0
+        self.timestamp = UEFITime()
+        self.pubKeyIdx = 0
+        self.state = 0
+        self.flags = 0
+
+        if vendor_uuid is not None:
+            self.vendorUUID = uuid.UUID(bytes=vendor_uuid.bytes_le)
+
+        if state is not None:
+            self.state = state ^ 0xFF
+        else:
+            self.state = (0x40 | 0x80) ^ 0xFF
+
+        if flags is not None:
+            self.flags = flags
+
+        if name is not None:
+            self.name = name
+            self.nameLen = len(name) * 2 + 2
+
+        if data is not None:
+            self.data = data
+            self.dataLen = len(data)
+
+    def _read_flags(self) -> None:
+        if not (self.flags & 0x1):
+            self.volatile = True
+        if self.flags & 0x2:
+            self.boot_access = True
+        if self.flags & 0x4:
+            self.runtime_access = True
+        if self.flags & 0x8:
+            self.hardware_error_record = True
+        if self.flags & 0x10:
+            self.authenticated_write_access = True
+        if self.flags & 0x20:
+            self.time_based_authenticated_write_access = True
+        if self.flags & 0x40:
+            self.append_write = True
+
+        self.flags &= ~(0x1 | 0x2 | 0x4 | 0x8 | 0x10 | 0x20 | 0x40)
+
+    @classmethod
+    def deserialize(cls: type[EfiVariableT], f: Any) -> EfiVariableT | None:
+        # pylint: disable=no-member
+        # false positive https://github.com/PyCQA/pylint/issues/981
+        ret = super().deserialize(f)
+        if ret:
+            ret._read_flags()
+        return ret
+
+    @classmethod
+    def deserializeFromDocument(  # noqa: N802
+        cls: type[EfiVariableT],
+        vendorID: str,  # noqa: N803
+        name: str,
+        doc: dict[str, Any],
+    ) -> EfiVariableT:
+        # pylint: disable=no-member
+        # false positive https://github.com/PyCQA/pylint/issues/981
+        ret = super(cls, cls).deserializeFromDocument(vendorID, name, doc)
+        if ret:
+            ret._read_flags()
+        return ret
+
+
+class EfiVars:
+    """A container around the ovmf variables"""
+
+    state_path: Path
+    machine: "test_driver.machine.QemuMachine"
+
+    def __init__(self, state_path: Path, machine: Any):
+        self.state_path = state_path
+        self.machine = machine
+
+    def _assert_stopped(self) -> None:
+        if self.machine.booted:
+            raise RequestedAssertionFailed(
+                "System is currently running and concurrent reads / writes to the OVMF variables is unsupported"
+            )
+
+    def read_content(self) -> dict[str, dict[str, EfiVariable]] | None:
+        self._assert_stopped()
+        try:
+            with open(self.state_path, "rb") as f:
+                fvh = FirmwareVolumeHeader.deserialize(f)
+                vsh = VariableStoreHeader.deserialize(f)
+                _ = fvh
+                _ = vsh
+                variables: dict[str, dict[str, EfiVariable]] = {}
+
+                while True:
+                    v = EfiVariable.deserialize(f)
+                    if not v:
+                        break
+                    if v.isDeleted:
+                        continue
+
+                    k = resolveUUID(v.vendorUUID)
+                    variables.setdefault(k, {})
+                    variables[k][v.name] = v
+
+                return variables
+
+        except FileNotFoundError:
+            return None
+
+    @contextmanager
+    def _write_store(self, *args, **kwargs) -> Generator[IO[bytes]]:
+        with open(self.state_path, "wb") as fo:
+            fm = io.BytesIO(b"\xff" * _NV_FTW_MAIN_PLUS_SPARE_SIZE)
+            fm.write(FirmwareVolumeHeader.create().serialize())
+            fm.write(VariableStoreHeader.create().serialize())
+
+            try:
+                yield fm
+            finally:
+                fm.seek(_NV_FTW_WORKING_OFFSET)
+                fm.write(_NV_FTW_WORKING_VALUE)
+                fm.seek(0)
+                fo.write(fm.read())
+
+    def create_empty(self) -> None:
+        self._assert_stopped()
+
+        if os.path.exists(self.state_path):
+            raise RequestedAssertionFailed("OVMF variables store exists")
+
+        with self._write_store():
+            pass
+
+    def write(self, add: list[EfiVariable]) -> None:
+        self._assert_stopped()
+
+        variables = self.read_content()
+        if not variables:
+            variables = {}
+
+        for var in add:
+            k = resolveUUID(var.vendorUUID)
+            variables.setdefault(k, {})
+            variables[k][var.name] = var
+
+        with self._write_store() as fm:
+            for _, vendor in variables.items():
+                for _, v in vendor.items():
+                    fm.write(v.serialize())
+                    if fm.tell() % 4:
+                        fm.write(b"\xff" * (4 - (fm.tell() % 4)))
+                    assert (fm.tell() % 4) == 0
+
+
+class EfiGuid:
+    from ovmfvartool import (
+        gEdkiiVarErrorFlagGuid,
+        gEfiAuthenticatedVariableGuid,
+        gEfiCertDbGuid,
+        gEfiCustomModeEnableGuid,
+        gEfiGlobalVariableGuid,
+        gEfiImageSecurityDatabaseGuid,
+        gEfiIp4Config2ProtocolGuid,
+        gEfiIScsiInitiatorNameProtocolGuid,
+        gEfiMemoryTypeInformationGuid,
+        gEfiSecureBootEnableDisableGuid,
+        gEfiSystemNvDataFvGuid,
+        gEfiVendorKeysNvGuid,
+        gIScsiConfigGuid,
+        gMicrosoftVendorGuid,
+        gMtcVendorGuid,
+        mBmHardDriveBootVariableGuid,
+    )

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -22,6 +22,7 @@ from pathlib import Path
 from queue import Queue
 from typing import Any
 
+from test_driver.efi import EfiVariable, EfiVars
 from test_driver.errors import MachineError, RequestedAssertionFailed
 from test_driver.logger import AbstractLogger
 from test_driver.machine.ocr import (
@@ -192,6 +193,7 @@ class QemuStartCommand:
     def build_environment(
         state_dir: Path,
         shared_dir: Path,
+        efi_vars_path: Path | None = None,
     ) -> dict:
         # We make a copy to not update the current environment
         env = dict(os.environ)
@@ -202,6 +204,13 @@ class QemuStartCommand:
                 "USE_TMPDIR": "1",
             }
         )
+        if efi_vars_path is not None:
+            env.update(
+                {
+                    "NIX_EFI_VARS": str(efi_vars_path),
+                }
+            )
+
         return env
 
     def run(
@@ -212,6 +221,7 @@ class QemuStartCommand:
         qmp_socket_path: Path,
         shell_socket_path: Path,
         allow_reboot: bool,
+        efi_vars_path: Path | None = None,
         vsock_guest: Path | None = None,
     ) -> subprocess.Popen:
         return subprocess.Popen(
@@ -227,7 +237,9 @@ class QemuStartCommand:
             stderr=subprocess.STDOUT,
             shell=True,
             cwd=state_dir,
-            env=self.build_environment(state_dir, shared_dir),
+            env=self.build_environment(
+                state_dir, shared_dir, efi_vars_path=efi_vars_path
+            ),
         )
 
 
@@ -750,6 +762,9 @@ class QemuMachine(BaseMachine):
     # Store all console output for full log retrieval
     full_console_log: list[str]
 
+    efi_vars_path: Path
+    efi_vars: EfiVars
+
     def __init__(
         self,
         out_dir: Path,
@@ -791,6 +806,9 @@ class QemuMachine(BaseMachine):
         self.booted = False
         self.connected = False
 
+        self.efi_vars_path = self.state_dir / f"{self.name}-efi-vars.fd"
+        self.efi_vars = EfiVars(self.efi_vars_path, self)
+
     def ssh_backdoor_command(self) -> str:
         assert self.vsock_host is not None
         return f"ssh -o User=root vsock-mux/{self.vsock_host}"
@@ -1169,24 +1187,25 @@ class QemuMachine(BaseMachine):
         # to match multiline regexes.
         console = io.StringIO()
 
-        def console_matches(_last_try: bool) -> bool:
+        def console_matches(_last_try: bool, block: bool = False) -> bool:
             nonlocal console
             try:
-                # This will return as soon as possible and
-                # sleep 1 second.
-                console.write(self.last_lines.get(block=False))
+                while True:
+                    # This will return as soon as possible and
+                    # sleep 1 second.
+                    console.write(self.last_lines.get(block=block))
+                    console.seek(0)
+                    matches = re.search(regex, console.read())
+                    if matches is not None:
+                        return True
             except queue.Empty:
-                pass
-            console.seek(0)
-            matches = re.search(regex, console.read())
-            return matches is not None
+                return False
 
         with self.nested(f"waiting for {regex} to appear on console"):
             if timeout is not None:
                 retry(console_matches, timeout)
             else:
-                while not console_matches(False):
-                    pass
+                console_matches(False, block=True)
 
     def get_console_log(self) -> str:
         """
@@ -1253,6 +1272,7 @@ class QemuMachine(BaseMachine):
             self.qmp_path,
             self.shell_path,
             allow_reboot,
+            self.efi_vars_path,
             self.vsock_guest,
         )
 
@@ -1437,6 +1457,28 @@ class QemuMachine(BaseMachine):
         self.connected = False
         self.connect()
 
+    def dump_efi_vars(self) -> None:
+        for var in self.read_efi_vars():
+            var.print()
+
+    def read_efi_vars(self) -> list[EfiVariable]:
+        config = self.efi_vars.read_content()
+        if not config:
+            return []
+
+        out = []
+        for vendor, variables in config.items():
+            for name, v in variables.items():
+                out.append(v)
+
+        return out
+
+    def create_efi_vars(self) -> None:
+        self.efi_vars.create_empty()
+
+    def write_efi_vars(self, add: list[EfiVariable]) -> None:
+        self.efi_vars.write(add)
+
 
 class NspawnMachine(BaseMachine):
     """

nixos/lib/testing/nodes.nix

@@ -27,7 +27,6 @@ let
     else
       let
         hostToGuest = {
-          "x86_64-darwin" = "x86_64-linux";
           "aarch64-darwin" = "aarch64-linux";
         };
 

nixos/modules/installer/tools/nix-fallback-paths.nix

@@ -1,8 +1,8 @@
 {
-  x86_64-linux = "/nix/store/6qpfa1c19q4idpjij6s6yywkfvhp820s-nix-2.34.7";
-  i686-linux = "/nix/store/npdbf892fhicd1pw8flpywzbvhcdx469-nix-2.34.7";
-  aarch64-linux = "/nix/store/5i60qiqjx9bjkcy31fwvnx28ijljlbs3-nix-2.34.7";
-  riscv64-linux = "/nix/store/xvl2f539v978jwflp2d9r7znk35br00i-nix-riscv64-unknown-linux-gnu-2.34.7";
-  x86_64-darwin = "/nix/store/j9rh0z3zy9rq00lz9ckcsa1g1hn35cyw-nix-2.34.7";
-  aarch64-darwin = "/nix/store/yxgyagiaffxkbrff4d7mrg718wdj3llj-nix-2.34.7";
+  x86_64-linux = "/nix/store/09hmdfh1i61532nvhi1p1f37l9hjl6z7-nix-2.34.8";
+  i686-linux = "/nix/store/5f24f8nk8wnm6fimnx36cl1yhv0i3pli-nix-2.34.8";
+  aarch64-linux = "/nix/store/61m1ki4yy2b9gybx42p6czw8irmj7p5i-nix-2.34.8";
+  riscv64-linux = "/nix/store/gf1ja21cvli7zl978a8bm0ixl5k69kgg-nix-riscv64-unknown-linux-gnu-2.34.8";
+  x86_64-darwin = "/nix/store/kcnnz1r3sgp0bdpf3vjwqgqmk2m02rn8-nix-2.34.8";
+  aarch64-darwin = "/nix/store/bfh32jcac5an863033jknr92qg729wl0-nix-2.34.8";
 }

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -505,7 +505,7 @@ EOF
     # This should work for single and multi-device systems.
     # still needs subvolume support
     if ($fsType eq "bcachefs") {
-        my ($status, @info) = runCommand("bcachefs fs usage $rootDir$mountPoint");
+        my ($status, @info) = runCommand("@bcachefs@ fs usage $rootDir$mountPoint");
         my $UUID = $info[0];
 
         if ($status == 0 && $UUID =~ /^Filesystem:[ \t\n]*([0-9a-z-]+)/) {

nixos/modules/installer/tools/tools.nix

@@ -30,15 +30,20 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     replacements = {
-      perl = "${
+      perl = lib.getExe (
         pkgs.perl.withPackages (p: [
           p.FileSlurp
           p.ConfigIniFiles
         ])
-      }/bin/perl";
+      );
       hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
-      detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
-      btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
+      detectvirt = lib.getExe' config.systemd.package "systemd-detect-virt";
+      bcachefs =
+        if pkgs.bcachefs-tools.meta.broken then
+          lib.getExe' pkgs.coreutils "false"
+        else
+          lib.getExe pkgs.bcachefs-tools;
+      btrfs = lib.getExe pkgs.btrfs-progs;
       inherit (config.system.nixos-generate-config) configuration desktopConfiguration flake;
       xserverEnabled = config.services.xserver.enable;
     };

nixos/modules/misc/nixpkgs/test.nix

@@ -36,7 +36,7 @@ let
     nixpkgs.hostPlatform = "aarch64-linux";
     nixpkgs.buildPlatform = "aarch64-darwin";
     nixpkgs.system = "x86_64-linux";
-    nixpkgs.localSystem.system = "x86_64-darwin";
+    nixpkgs.localSystem.system = "x86_64-freebsd";
     nixpkgs.crossSystem.system = "i686-linux";
     imports = [
       {

nixos/modules/services/databases/postgresql.nix

@@ -204,7 +204,9 @@ in
         type = types.package;
         example = literalExpression "pkgs.postgresql_15";
         defaultText = literalExpression ''
-          if versionAtLeast config.system.stateVersion "25.11" then
+          if versionAtLeast config.system.stateVersion "26.11" then
+            pkgs.postgresql_18
+          else if versionAtLeast config.system.stateVersion "25.11" then
             pkgs.postgresql_17
           else if versionAtLeast config.system.stateVersion "24.11" then
             pkgs.postgresql_16
@@ -657,7 +659,9 @@ in
           '';
         base =
           # XXX Don't forget to keep `defaultText` of `services.postgresql.package` up to date!
-          if versionAtLeast config.system.stateVersion "25.11" then
+          if versionAtLeast config.system.stateVersion "26.11" then
+            pkgs.postgresql_18
+          else if versionAtLeast config.system.stateVersion "25.11" then
             pkgs.postgresql_17
           else if versionAtLeast config.system.stateVersion "24.11" then
             pkgs.postgresql_16

nixos/modules/services/hardware/pcscd.nix

@@ -10,8 +10,6 @@ let
     builtins.concatStringsSep "\n\n" config.services.pcscd.readerConfigs
   );
 
-  package = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
-
   pluginEnv = pkgs.buildEnv {
     name = "pcscd-plugins";
     paths = map (p: "${p}/pcsc/drivers") config.services.pcscd.plugins;
@@ -36,6 +34,11 @@ in
   options.services.pcscd = {
     enable = lib.mkEnableOption "PCSC-Lite daemon, to access smart cards using SCard API (PC/SC)";
 
+    package = (lib.mkPackageOption pkgs "pcsclite" { }) // {
+      default = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
+      defaultText = lib.literalExpression "if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite";
+    };
+
     plugins = lib.mkOption {
       type = lib.types.listOf lib.types.package;
       defaultText = lib.literalExpression "[ pkgs.ccid ]";
@@ -101,8 +104,8 @@ in
   config = lib.mkIf config.services.pcscd.enable {
     environment.etc."reader.conf".source = cfgFile;
 
-    environment.systemPackages = [ package ];
-    systemd.packages = [ package ];
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
 
     services.pcscd.plugins = [ pkgs.ccid ];
 
@@ -133,7 +136,7 @@ in
       # https://github.com/NixOS/nixpkgs/issues/121088
       serviceConfig.ExecStart = [
         ""
-        "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
+        "${lib.getExe cfg.package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
       ];
     };
 

nixos/modules/testing/test-instrumentation.nix

@@ -78,6 +78,8 @@ let
     # Allow very slow start
     DefaultTimeoutStartSec = 300;
     DefaultDeviceTimeoutSec = 300;
+    # Don't enforce a minimum uptime before shutting down.
+    MinimumUptimeSec = 0;
   };
 
 in

nixos/modules/virtualisation/qemu-vm.nix

@@ -741,7 +741,7 @@ in
       default = pkgs;
       defaultText = literalExpression "pkgs";
       example = literalExpression ''
-        import pkgs.path { system = "x86_64-darwin"; }
+        import pkgs.path { system = "aarch64-darwin"; }
       '';
       description = ''
         Package set to use for the host-specific packages of the VM runner.

nixos/tests/all-tests.nix

@@ -154,6 +154,7 @@ in
     containers = runTest ./nixos-test-driver/containers.nix;
     nspawn-daemon-reexec-dbus = runTest ./nspawn-daemon-reexec-dbus.nix;
     skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
+    console-timeout = runTest ./nixos-test-driver/console-timeout.nix;
     options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
     driver-timeout =
       pkgs.runCommand "ensure-timeout-induced-failure"
@@ -168,6 +169,7 @@ in
           [[ 143 = $(cat $failed/testBuildFailure.exit) ]]
           touch $out
         '';
+    efivars = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/efivars.nix;
   };
 
   # NixOS vm tests and non-vm unit tests

nixos/tests/installer.nix

@@ -41,7 +41,7 @@ let
         documentation.enable = false;
 
         # To ensure that we can rebuild the grub configuration on the nixos-rebuild
-        system.extraDependencies = with pkgs; [ stdenvNoCC ];
+        system.extraDependencies = with pkgs; [ stdenvNoCC hello ];
 
         boot.initrd.systemd.enable = ${boolToString systemdStage1};
 
@@ -278,14 +278,14 @@ let
           target.succeed("nix-store --verify --check-contents >&2")
 
       with subtest("Check whether the channel works"):
-          target.succeed("nix-env -iA nixos.procps >&2")
-          assert ".nix-profile" in target.succeed("type -tP ps | tee /dev/stderr")
+          target.succeed("nix-env -iA nixos.hello >&2")
+          assert ".nix-profile" in target.succeed("type -tP hello | tee /dev/stderr")
 
       with subtest(
           "Check that the daemon works, and that non-root users can run builds "
           "(this will build a new profile generation through the daemon)"
       ):
-          target.succeed("su alice -l -c 'nix-env -iA nixos.procps' >&2")
+          target.succeed("su alice -l -c 'nix-env -iA nixos.hello' >&2")
 
       with subtest("Configure system with writable Nix store on next boot"):
           # we're not using copy_from_host here because the installer image
@@ -677,7 +677,6 @@ let
         # non-EFI tests can only run on x86
         platforms = mkIf (!isEfi) [
           "x86_64-linux"
-          "x86_64-darwin"
           "i686-linux"
         ];
         inherit broken;
@@ -745,6 +744,7 @@ let
                   desktop-file-utils
                   docbook5
                   docbook_xsl_ns
+                  hello
                   kbd.dev
                   kmod.dev
                   libarchive.dev

nixos/tests/nixos-test-driver/console-timeout.nix

@@ -0,0 +1,26 @@
+{ pkgs, lib, ... }:
+{
+  name = "console-timeout";
+
+  nodes.machine = {
+    systemd.services.generate-output.script = ''
+      echo "match that"
+      sleep 1
+
+      for i in $(seq 15); do
+        echo "line $i"
+      done
+
+      echo "match this"
+    '';
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    machine.systemctl("start generate-output")
+    machine.wait_for_console_text("match that")
+    machine.wait_for_console_text("match this", timeout=10)
+  '';
+}

nixos/tests/nixos-test-driver/efivars.nix

@@ -0,0 +1,110 @@
+{ pkgs, lib, ... }:
+let
+  vendorUuid = "a19f72f8-b554-4bd7-a0c2-2762bd854691";
+  varName = "Demo";
+  readWriteVar = pkgs.writers.writePython3 "read-increment-efi-var" { } ''
+    import os
+    import sys
+    import fcntl
+    import array
+
+    if len(sys.argv) != 3:
+        print(f"Usage: {sys.argv[0]} NAME UUID", file=sys.stderr)
+        sys.exit(1)
+
+    name = sys.argv[1]
+    uuid = sys.argv[2]
+    path = f"/sys/firmware/efi/efivars/{name}-{uuid}"
+
+    FS_IMMUTABLE_FL = 0x00000010
+    FS_IOC_GETFLAGS = 0x80086601
+    FS_IOC_SETFLAGS = 0x40086602
+
+    if not os.path.exists(path):
+        print(f"{path}: does not exist", file=sys.stderr)
+        sys.exit(1)
+
+    with open(path, "rb") as f:
+        data = f.read()
+
+    # The first 4 bytes are attributes, the rest is the data
+    if data[4:] != b"\x2a":
+        print(f"0x2a value expected, got {data[4:]!r}", file=sys.stderr)
+        sys.exit(1)
+
+    fd = os.open(path, os.O_RDONLY)
+    arg = array.array("L", [0])
+    fcntl.ioctl(fd, FS_IOC_GETFLAGS, arg)
+    if arg[0] & FS_IMMUTABLE_FL:
+        arg[0] &= ~FS_IMMUTABLE_FL
+        fcntl.ioctl(fd, FS_IOC_SETFLAGS, arg)
+    os.close(fd)
+
+    with open(path, "wb") as f:
+        # Write 0x2b
+        data = bytes(list(data[:4]) + [0x2b])
+        f.write(data)
+  '';
+in
+{
+  name = "efivars";
+
+  nodes.machine = {
+    boot.loader.efi.canTouchEfiVariables = true;
+    virtualisation.useEFIBoot = true;
+  };
+
+  testScript = ''
+    import uuid
+    import unittest
+
+    from test_driver.efi import EfiVariable
+    from test_driver.errors import RequestedAssertionFailed
+
+
+    class TestConcurrentRead(unittest.TestCase):
+        def __init__(self, machine):
+            super().__init__()
+            self.machine = machine
+
+        def test_concurrent_read(self):
+            with self.assertRaises(RequestedAssertionFailed):
+                self.machine.read_efi_vars()
+
+
+    vendor_uuid = uuid.UUID('${vendorUuid}')
+    machine.create_efi_vars()
+    machine.write_efi_vars([
+        EfiVariable(
+            vendor_uuid=vendor_uuid,
+            name="${varName}",
+            data=bytes([0x2a]),
+            flags=EfiVariable.Flags.NON_VOLATILE | EfiVariable.Flags.BOOTSERVICE_ACCESS | EfiVariable.Flags.RUNTIME_ACCESS,
+        )
+    ])
+
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    print(machine.succeed('${readWriteVar} "${varName}" "${vendorUuid}"'))
+
+    TestConcurrentRead(machine).test_concurrent_read()
+    machine.crash()
+
+    machine.dump_efi_vars()
+    vars = machine.read_efi_vars()
+
+    guid = uuid.UUID(bytes=vendor_uuid.bytes_le)
+    predicate = lambda v: v.name == "${varName}" and v.vendorUUID == guid
+    var = next((v for v in vars if predicate(v)), None)
+
+    if var:
+        var.print()
+        if var.data == bytes([0x2b]):
+            print("Congrats!")
+        else:
+            raise ValueError("Value 0x2b expected")
+    else:
+        raise ValueError("Could not find ${varName} variable")
+  '';
+}

nixos/tests/web-apps/immich-vectorchord-reindex.nix

@@ -37,6 +37,10 @@
                     hash = "sha256-+BOuiinbKPZZaDl9aYsIoZPgvLZ4FA6Rb4/W+lAz4so=";
                   };
 
+                  # Remove the patches currently used for vectorchord 1.1.1,
+                  # as vectorchord 1.0.0 does not need them.
+                  patches = [ ];
+
                   cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
                     inherit (finalAttrs) src;
                     hash = "sha256-kwe2x7OTjpdPonZsvnR1C/89D5W/R5JswYF79YcSFEA=";

pkgs/applications/audio/mpg123/default.nix

@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.4";
+  version = "1.33.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-OujJ/4Cpe/wOIuifvNdGh+yk/B2zFbEmB/J/ActaR9k=";
+    hash = "sha256-DX68jaCv88o4PIxrWmrb5ALuW7JWaFuMVJnzpzn51t0=";
   };
 
   outputs = [

pkgs/applications/editors/emacs/make-emacs.nix

@@ -116,6 +116,8 @@
 
   # test
   callPackage,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 assert (withGTK3 && !withNS && variant != "macport") -> withX || withPgtk;
@@ -252,7 +254,11 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
   ]
   ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    sigtool
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
+  ];
 
   buildInputs = [
     gnutls
@@ -418,10 +424,15 @@ stdenv.mkDerivation (finalAttrs: {
       NATIVE_FULL_AOT = "1";
       LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
     }
-    // lib.optionalAttrs (variant == "macport") {
-      # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
-      # See https://github.com/NixOS/nixpkgs/issues/127902
-      NIX_CFLAGS_COMPILE = "-isystem ${./macport-noescape-noop}";
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      # workaround for ld64 hardening issue
+      #
+      # TODO: Clean up on `staging`
+      NIX_CFLAGS_COMPILE =
+        "-fuse-ld=lld"
+        # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
+        # See https://github.com/NixOS/nixpkgs/issues/127902
+        + lib.optionalString (variant == "macport") " -isystem ${./macport-noescape-noop}";
     };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0389";
+  version = "9.2.0541";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-shhdJn1bPJ/68a54UZMn1fla7P4tjVUN4DGLbx3ohOg=";
+    hash = "sha256-M2vdIAM3P2MZdcMvFX/3/fixliTosR06nvPIX7NXFNo=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/default.nix

@@ -14,6 +14,8 @@
     url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   },
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -37,6 +39,10 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     gettext
     pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
   buildInputs = [
     ncurses
@@ -44,6 +50,13 @@ stdenv.mkDerivation {
     gawk
   ];
 
+  # workaround for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_COMPILE = "-fuse-ld=lld";
+  };
+
   strictDeps = true;
 
   configureFlags = [

pkgs/applications/editors/vim/full.nix

@@ -48,6 +48,9 @@
   darwinSupport ? config.vim.darwin or false, # Enable Darwin support
   ftNixSupport ? config.vim.ftNix or true, # Add nix indentation support from vim-nix (not needed for basic syntax highlighting)
   sodiumSupport ? config.vim.sodium or true, # Enable sodium based encryption
+
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -169,7 +172,9 @@ stdenv.mkDerivation {
   ++ lib.optional nlsSupport gettext
   ++ lib.optional perlSupport perl
   ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook3
-  ++ lib.optional waylandSupport wayland-scanner;
+  ++ lib.optional waylandSupport wayland-scanner
+  # TODO: Clean up on `staging`
+  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
 
   buildInputs = [
     ncurses
@@ -196,7 +201,10 @@ stdenv.mkDerivation {
   ++ lib.optional sodiumSupport libsodium;
 
   # error: '__declspec' attributes are not enabled; use '-fdeclspec' or '-fms-extensions' to enable support for __declspec attributes
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec";
+  # workaround for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec -fuse-ld=lld";
 
   preConfigure = lib.optionalString ftNixSupport ''
     cp ${vimPlugins.vim-nix.src}/ftplugin/nix.vim runtime/ftplugin/nix.vim

pkgs/applications/editors/vim/macvim.nix

@@ -17,6 +17,8 @@
   # This can be set to one of the `darwin.xcode_*` packages as well.
   # If set, this should be a path to Xcode.app, e.g. `"/Applications/Xcode.app"`.
   withXcodePath ? null,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 # Try to match MacVim's documented script interface compatibility
@@ -48,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
   ];
   buildInputs = [
     # MacVim references up to MAC_OS_VERSION_14_0 in its source
@@ -188,7 +192,8 @@ stdenv.mkDerivation (finalAttrs: {
   # macvim obj-c log macro triggers -Wformat-security (seems like a bug? it's a string literal!)
   hardeningDisable = common.hardeningDisable ++ [ "format" ];
   # os_log also enables -Werror,-Wformat by default
-  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS";
+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS -fuse-ld=lld";
 
   # We rely on the user's Xcode install to build. It may be located in an arbitrary place, and
   # it's not clear what system-level components it may require, so for now we'll just allow full

pkgs/applications/graphics/inkscape/default.nix

@@ -103,6 +103,14 @@ stdenv.mkDerivation (finalAttrs: {
       # Fix path to ps2pdf binary
       inherit ghostscript;
     })
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/7919
+    (fetchpatch {
+      name = "fix-build-poppler-26.05.0";
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/98828255aa0c1212329236b3ff4ac7f41efb4a67.patch";
+      hash = "sha256-ujUl0SxZyb/TyJRmq1ETNn5W8lDDNn3JqHQQQPU5klA=";
+    })
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/7968
+    ./fix-build-poppler-26.06.0.patch
   ];
 
   postPatch = ''

pkgs/applications/graphics/inkscape/fix-build-poppler-26.06.0.patch

@@ -0,0 +1,487 @@
+From 35a470d9cbff50467cc700bc17ab2c4e8f5cf0bc Mon Sep 17 00:00:00 2001
+From: KrIr17 <elendil.krir17@gmail.com>
+Date: Mon, 8 Jun 2026 20:16:32 +0200
+Subject: [PATCH] Fix Building with Poppler 26.06.0
+
+- pdfparser: Some `const PDFRectangle *` to `const PDFRectangle &` [1]
+- pdfparser: Some `const GfxColor *` to `const GfxColor &` [2]
+- pdf-utils: Add a `getRect(const PDFRectangle &)` alongside `getRect(const
+  PDFRectangle *)`
+- poppler-cairo-font-engine: `getKey()` now returns std::string and not
+  char[], so change `strcmp` to `std::string(...).compare(...)` [3]
+- poppler-utils: `obj->dictGetKey()` etc. were removed; use
+  `obj->dict()->getKey()` instead (these have also existed in poppler
+  since the beginning, so shouldn't break any old poppler) [4,5]
+- svg-builder: `convertGfxColor` now takes `const GfxColor &` as input.
+  A convenience function taking `const GfxColor *` (for older poppler)
+  now calls the new one after confirming `color` is a valid pointer
+- svg-builder: `_addStopToGradient` now  takes `const GfxColor &` as
+  input. This was used only in `convertGfxColor` and therefore doesn't
+  need a helper function for compatibility
+- testfiles pdf-utils-test: `<poppler/*.h>` to `<*.h>` (see e3eb1210)
+- testfiles pdf-utils-test: Some `const PDFRectangle *`
+  to `const PDFRectangle &` [1]
+
+Fixes https://gitlab.com/inkscape/inkscape/-/work_items/6210
+
+Upstream Commits:
+
+[1] https://gitlab.freedesktop.org/poppler/poppler/-/commit/d50a4510
+[2] https://gitlab.freedesktop.org/poppler/poppler/-/commit/0f94f530
+[3] https://gitlab.freedesktop.org/poppler/poppler/-/commit/a3de7f8a
+[4] https://gitlab.freedesktop.org/poppler/poppler/-/commit/bb13b0f5
+[5] https://gitlab.freedesktop.org/poppler/poppler/-/commit/8ae0f8e7
+---
+ src/extension/internal/pdfinput/pdf-input.cpp | 14 +++++-
+ .../internal/pdfinput/pdf-parser.cpp          | 45 ++++++++++---------
+ src/extension/internal/pdfinput/pdf-parser.h  |  4 +-
+ src/extension/internal/pdfinput/pdf-utils.cpp |  5 +++
+ src/extension/internal/pdfinput/pdf-utils.h   |  1 +
+ .../pdfinput/poppler-cairo-font-engine.cpp    |  2 +-
+ .../pdfinput/poppler-transition-api.h         | 16 +++++++
+ .../internal/pdfinput/poppler-utils.cpp       | 20 +++++----
+ .../internal/pdfinput/svg-builder.cpp         | 36 +++++++++------
+ src/extension/internal/pdfinput/svg-builder.h |  3 +-
+ testfiles/src/pdf-utils-test.cpp              |  7 +--
+ 11 files changed, 100 insertions(+), 53 deletions(-)
+
+diff --git a/src/extension/internal/pdfinput/pdf-input.cpp b/src/extension/internal/pdfinput/pdf-input.cpp
+index aa4285b01d..dc5394c3d8 100644
+--- a/src/extension/internal/pdfinput/pdf-input.cpp
++++ b/src/extension/internal/pdfinput/pdf-input.cpp
+@@ -820,7 +820,11 @@ PdfInput::add_builder_page(std::shared_ptr<PDFDoc>pdf_doc, SvgBuilder *builder,
+     }
+ 
+     // Apply crop settings
++#if POPPLER_CHECK_VERSION(26, 2, 0)
++    std::optional<PDFRectangle> clipToBox;
++#else
+     _POPPLER_CONST PDFRectangle *clipToBox = nullptr;
++#endif
+ 
+     if (crop_to == "media-box") {
+         clipToBox = page->getMediaBox();
+@@ -834,8 +838,16 @@ PdfInput::add_builder_page(std::shared_ptr<PDFDoc>pdf_doc, SvgBuilder *builder,
+         clipToBox = page->getArtBox();
+     }
+ 
++    std::optional<PDFRectangle> cropBox;
++#if POPPLER_CHECK_VERSION(26, 2, 0)
++    cropBox = clipToBox;
++#else
++    if (clipToBox) {
++        cropBox = *clipToBox;
++    }
++#endif
+     // Create parser  (extension/internal/pdfinput/pdf-parser.h)
+-    auto pdf_parser = PdfParser(pdf_doc, builder, page, clipToBox);
++    auto pdf_parser = PdfParser(pdf_doc, builder, page, cropBox);
+ 
+     // Set up approximation precision for parser. Used for converting Mesh Gradients into tiles.
+     if ( color_delta <= 0.0 ) {
+diff --git a/src/extension/internal/pdfinput/pdf-parser.cpp b/src/extension/internal/pdfinput/pdf-parser.cpp
+index b336c48ce3..86fc51b1f2 100644
+--- a/src/extension/internal/pdfinput/pdf-parser.cpp
++++ b/src/extension/internal/pdfinput/pdf-parser.cpp
+@@ -43,6 +43,7 @@
+ #include <poppler/GlobalParams.h>
+ #include <poppler/Lexer.h>
+ #include <poppler/Object.h>
++#include <poppler/OptionalContent.h>
+ #include <poppler/OutputDev.h>
+ #include <poppler/PDFDoc.h>
+ #include <poppler/Page.h>
+@@ -264,7 +265,7 @@ GfxPatch blankPatch()
+ //------------------------------------------------------------------------
+ 
+ PdfParser::PdfParser(std::shared_ptr<PDFDoc> pdf_doc, Inkscape::Extension::Internal::SvgBuilder *builderA, Page *page,
+-                     _POPPLER_CONST PDFRectangle *cropBox)
++                     const std::optional<PDFRectangle> &cropBox)
+     : _pdf_doc(pdf_doc)
+     , xref(pdf_doc->getXRef())
+     , builder(builderA)
+@@ -307,8 +308,8 @@ PdfParser::PdfParser(std::shared_ptr<PDFDoc> pdf_doc, Inkscape::Extension::Inter
+     builder->setMargins(getRect(page->getTrimBox()) * scale,
+                         getRect(page->getArtBox()) * scale,
+                         getRect(page->getBleedBox()) * scale);
+-    if (cropBox && getRect(cropBox) != page_box) {
+-        builder->cropPage(getRect(cropBox) * scale);
++     if (cropBox && getRect(*cropBox) != page_box) {
++         builder->cropPage(getRect(*cropBox) * scale);
+     }
+ 
+     saveState();
+@@ -331,7 +332,7 @@ PdfParser::PdfParser(XRef *xrefA, Inkscape::Extension::Internal::SvgBuilder *bui
+     , printCommands(false)
+     , res(new GfxResources(xref, resDict, nullptr))
+     , // start the resource stack
+-    state(new GfxState(72, 72, box, 0, false))
++    state(new _POPPLER_GFX_STATE(72, 72, *box, 0, false))
+     , fontChanged(gFalse)
+     , clip(clipNone)
+     , ignoreUndef(0)
+@@ -964,7 +965,7 @@ void PdfParser::opSetFillGray(Object args[], int /*numArgs*/)
+   state->setFillPattern(nullptr);
+   state->setFillColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(std::make_unique<GfxDeviceGrayColorSpace>()));
+   color.c[0] = dblToCol(args[0].getNum());
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -976,7 +977,7 @@ void PdfParser::opSetStrokeGray(Object args[], int /*numArgs*/)
+   state->setStrokePattern(nullptr);
+   state->setStrokeColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(std::make_unique<GfxDeviceGrayColorSpace>()));
+   color.c[0] = dblToCol(args[0].getNum());
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -991,7 +992,7 @@ void PdfParser::opSetFillCMYKColor(Object args[], int /*numArgs*/)
+   for (i = 0; i < 4; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1005,7 +1006,7 @@ void PdfParser::opSetStrokeCMYKColor(Object args[], int /*numArgs*/)
+   for (int i = 0; i < 4; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1019,7 +1020,7 @@ void PdfParser::opSetFillRGBColor(Object args[], int /*numArgs*/)
+   for (int i = 0; i < 3; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1032,7 +1033,7 @@ void PdfParser::opSetStrokeRGBColor(Object args[], int /*numArgs*/) {
+   for (int i = 0; i < 3; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1048,7 +1049,7 @@ void PdfParser::opSetFillColorSpace(Object args[], int numArgs)
+     GfxColor color;
+     colorSpace->getDefaultColor(&color);
+     state->setFillColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(colorSpace));
+-    state->setFillColor(&color);
++    state->_POPPLER_SET_FILL_COLOR(color);
+     builder->updateStyle(state);
+   } else {
+     error(errSyntaxError, getPos(), "Bad color space (fill)");
+@@ -1069,7 +1070,7 @@ void PdfParser::opSetStrokeColorSpace(Object args[], int numArgs)
+     GfxColor color;
+     colorSpace->getDefaultColor(&color);
+     state->setStrokeColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(colorSpace));
+-    state->setStrokeColor(&color);
++    state->_POPPLER_SET_STROKE_COLOR(color);
+     builder->updateStyle(state);
+   } else {
+     error(errSyntaxError, getPos(), "Bad color space (stroke)");
+@@ -1089,7 +1090,7 @@ void PdfParser::opSetFillColor(Object args[], int numArgs) {
+   for (i = 0; i < numArgs; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1106,7 +1107,7 @@ void PdfParser::opSetStrokeColor(Object args[], int numArgs) {
+   for (i = 0; i < numArgs; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1127,7 +1128,7 @@ void PdfParser::opSetFillColorN(Object args[], int numArgs) {
+ 	  color.c[i] = dblToCol(args[i].getNum());
+ 	}
+       }
+-      state->setFillColor(&color);
++      state->_POPPLER_SET_FILL_COLOR(color);
+       builder->updateStyle(state);
+     }
+     if (auto pattern = lookupPattern(&(args[numArgs - 1]), state)) {
+@@ -1146,7 +1147,7 @@ void PdfParser::opSetFillColorN(Object args[], int numArgs) {
+ 	color.c[i] = dblToCol(args[i].getNum());
+       }
+     }
+-    state->setFillColor(&color);
++    state->_POPPLER_SET_FILL_COLOR(color);
+     builder->updateStyle(state);
+   }
+ }
+@@ -1170,7 +1171,7 @@ void PdfParser::opSetStrokeColorN(Object args[], int numArgs) {
+ 	  color.c[i] = dblToCol(args[i].getNum());
+ 	}
+       }
+-      state->setStrokeColor(&color);
++      state->_POPPLER_SET_STROKE_COLOR(color);
+       builder->updateStyle(state);
+     }
+     if (auto pattern = lookupPattern(&(args[numArgs - 1]), state)) {
+@@ -1189,7 +1190,7 @@ void PdfParser::opSetStrokeColorN(Object args[], int numArgs) {
+ 	color.c[i] = dblToCol(args[i].getNum());
+       }
+     }
+-    state->setStrokeColor(&color);
++    state->_POPPLER_SET_STROKE_COLOR(color);
+     builder->updateStyle(state);
+   }
+ }
+@@ -1673,7 +1674,7 @@ void PdfParser::doFunctionShFill1(GfxFunctionShading *shading,
+ 
+     // use the center color
+     shading->getColor(xM, yM, &fillColor);
+-    state->setFillColor(&fillColor);
++    state->_POPPLER_SET_FILL_COLOR(fillColor);
+ 
+     // fill the rectangle
+     state->moveTo(x0 * matrix[0] + y0 * matrix[2] + matrix[4],
+@@ -1799,7 +1800,7 @@ void PdfParser::gouraudFillTriangle(double x0, double y0, GfxColor *color0,
+     }
+   }
+   if (i == nComps || depth == maxDepths[pdfGouraudTriangleShading-1]) {
+-    state->setFillColor(color0);
++    state->_POPPLER_SET_FILL_COLOR(*color0);
+     state->moveTo(x0, y0);
+     state->lineTo(x1, y1);
+     state->lineTo(x2, y2);
+@@ -1877,7 +1878,7 @@ void PdfParser::fillPatch(_POPPLER_CONST GfxPatch *patch, int nComps, int depth)
+     color.c[i] = GfxColorComp(patch->color[0][0].c[i]);
+   }
+   if (i == nComps || depth == maxDepths[pdfPatchMeshShading-1]) {
+-    state->setFillColor(&color);
++    state->_POPPLER_SET_FILL_COLOR(color);
+     state->moveTo(patch->x[0][0], patch->y[0][0]);
+     state->curveTo(patch->x[0][1], patch->y[0][1],
+                   patch->x[0][2], patch->y[0][2],
+diff --git a/src/extension/internal/pdfinput/pdf-parser.h b/src/extension/internal/pdfinput/pdf-parser.h
+index 098ff26e26..29dd259167 100644
+--- a/src/extension/internal/pdfinput/pdf-parser.h
++++ b/src/extension/internal/pdfinput/pdf-parser.h
+@@ -113,8 +113,8 @@ struct OpHistoryEntry {
+ class PdfParser {
+ public:
+ 
+-  // Constructor for regular output.
+-    PdfParser(std::shared_ptr<PDFDoc> pdf_doc, SvgBuilder *builderA, Page *page, _POPPLER_CONST PDFRectangle *cropBox);
++    // Constructor for regular output.
++    PdfParser(std::shared_ptr<PDFDoc> pdf_doc, SvgBuilder *builderA, Page *page, const std::optional<PDFRectangle> &cropBox);
+     // Constructor for a sub-page object.
+     PdfParser(XRef *xrefA, SvgBuilder *builderA, Dict *resDict, _POPPLER_CONST PDFRectangle *box);
+ 
+diff --git a/src/extension/internal/pdfinput/pdf-utils.cpp b/src/extension/internal/pdfinput/pdf-utils.cpp
+index 22e5df62c8..3aa6c02d3c 100644
+--- a/src/extension/internal/pdfinput/pdf-utils.cpp
++++ b/src/extension/internal/pdfinput/pdf-utils.cpp
+@@ -133,6 +133,11 @@ Geom::Rect getRect(_POPPLER_CONST PDFRectangle *box)
+     return Geom::Rect(box->x1, box->y1, box->x2, box->y2);
+ }
+ 
++Geom::Rect getRect(const PDFRectangle &box)
++{
++    return Geom::Rect(box.x1, box.y1, box.x2, box.y2);
++}
++
+ Geom::PathVector getPathV(GfxPath *path) 
+ {
+     if (!path) {
+diff --git a/src/extension/internal/pdfinput/pdf-utils.h b/src/extension/internal/pdfinput/pdf-utils.h
+index d259a8c2f7..30e9b5bf86 100644
+--- a/src/extension/internal/pdfinput/pdf-utils.h
++++ b/src/extension/internal/pdfinput/pdf-utils.h
+@@ -59,6 +59,7 @@ private:
+ };
+ 
+ Geom::Rect getRect(_POPPLER_CONST PDFRectangle *box);
++Geom::Rect getRect(_POPPLER_CONST PDFRectangle &box);
+ Geom::PathVector getPathV(GfxPath *gPath);
+ 
+ #endif /* PDF_UTILS_H */
+diff --git a/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp b/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp
+index 19ebd26693..39ce22af38 100644
+--- a/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp
++++ b/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp
+@@ -713,7 +713,7 @@ CairoType3Font *CairoType3Font::create(GfxFont *gfxFont, PDFDoc *doc, CairoFontE
+         codeToGID[i] = 0;
+         if (charProcs && (name = enc[i])) {
+             for (int j = 0; j < charProcs->getLength(); j++) {
+-                if (strcmp(name, charProcs->getKey(j)) == 0) {
++                if (std::string(charProcs->getKey(j)).compare(name) == 0) {
+                     codeToGID[i] = j;
+                 }
+             }
+diff --git a/src/extension/internal/pdfinput/poppler-transition-api.h b/src/extension/internal/pdfinput/poppler-transition-api.h
+index d69829d512..23550a3068 100644
+--- a/src/extension/internal/pdfinput/poppler-transition-api.h
++++ b/src/extension/internal/pdfinput/poppler-transition-api.h
+@@ -15,6 +15,22 @@
+ #include <glib/poppler-features.h>
+ #include <UTF.h>
+ 
++#if POPPLER_CHECK_VERSION(26, 6, 0)
++#define _POPPLER_GET_GRAY(color, gray) getGray(color, gray)
++#define _POPPLER_GET_RGB(color, rgb) getRGB(color, rgb)
++#define _POPPLER_GET_CMYK(color, cmyk) getCMYK(color, cmyk)
++#define _POPPLER_SET_FILL_COLOR(color) setFillColor(color)
++#define _POPPLER_SET_STROKE_COLOR(color) setStrokeColor(color)
++#define _POPPLER_GFX_STATE(h, v, Rect, rotateA, upsideDown) GfxState(h, v, Rect, rotateA, upsideDown)
++#else
++#define _POPPLER_GET_GRAY(color, gray) getGray(&color, gray)
++#define _POPPLER_GET_RGB(color, rgb) getRGB(&color, rgb)
++#define _POPPLER_GET_CMYK(color, cmyk) getCMYK(&color, cmyk)
++#define _POPPLER_SET_FILL_COLOR(color) setFillColor(&color)
++#define _POPPLER_SET_STROKE_COLOR(color) setStrokeColor(&color)
++#define _POPPLER_GFX_STATE(h, v, Rect, rotateA, upsideDown) GfxState(h, v, &Rect, rotateA, upsideDown)
++#endif
++
+ #if POPPLER_CHECK_VERSION(26, 2, 0)
+ #define _POPPLER_WMODE GfxFont::WritingMode
+ #define _POPPLER_WMODE_HORIZONTAL GfxFont::WritingMode::Horizontal
+diff --git a/src/extension/internal/pdfinput/poppler-utils.cpp b/src/extension/internal/pdfinput/poppler-utils.cpp
+index 2338dbe2d9..66dcf85e1d 100644
+--- a/src/extension/internal/pdfinput/poppler-utils.cpp
++++ b/src/extension/internal/pdfinput/poppler-utils.cpp
+@@ -196,15 +196,17 @@ void InkFontDict::hashFontObject1(const Object *obj, FNVHash *h)
+                 hashFontObject1(&obj2, h);
+             }
+             break;
+-        case objDict:
+-            h->hash('d');
+-            n = obj->dictGetLength();
+-            h->hash((char *)&n, sizeof(int));
+-            for (i = 0; i < n; ++i) {
+-                p = obj->dictGetKey(i);
+-                h->hash(p, (int)strlen(p));
+-                const Object &obj2 = obj->dictGetValNF(i);
+-                hashFontObject1(&obj2, h);
++        case objDict: {
++                h->hash('d');
++                auto objdict = obj->getDict();
++                n = objdict->getLength();
++                h->hash((char *)&n, sizeof(int));
++                for (i = 0; i < n; ++i) {
++                    auto p = std::string(objdict->getKey(i));
++                    h->hash(p.c_str(), p.length());
++                    const Object &obj2 = objdict->getValNF(i);
++                    hashFontObject1(&obj2, h);
++                }
+             }
+             break;
+         case objStream:
+diff --git a/src/extension/internal/pdfinput/svg-builder.cpp b/src/extension/internal/pdfinput/svg-builder.cpp
+index 3dfdfbbed4..bf7ccf1a8b 100644
+--- a/src/extension/internal/pdfinput/svg-builder.cpp
++++ b/src/extension/internal/pdfinput/svg-builder.cpp
+@@ -392,7 +392,15 @@ static std::string svgConvertGfxRGB(GfxRGB *color)
+     return svgConvertRGBToText(r, g, b);
+ }
+ 
+-std::string SvgBuilder::convertGfxColor(const GfxColor *color, GfxColorSpace *space)
++// for poppler < 26.06.0
++std::string SvgBuilder::convertGfxColor(const GfxColor *color, GfxColorSpace *space) {
++    if (!color) {
++        return "";
++    }
++    return convertGfxColor(*color, space);
++}
++
++std::string SvgBuilder::convertGfxColor(const GfxColor &color, GfxColorSpace *space)
+ {
+     std::string icc = "";
+     switch (space->getMode()) {
+@@ -419,7 +427,7 @@ std::string SvgBuilder::convertGfxColor(const GfxColor *color, GfxColorSpace *sp
+         Inkscape::CSSOStringStream icc_color;
+         icc_color << rgb_color << " icc-color(" << icc;
+         for (int i = 0; i < space->getNComps(); ++i) {
+-            icc_color << ", " << colToDbl((*color).c[i]);
++            icc_color << ", " << colToDbl((color).c[i]);
+         }
+         icc_color << ");";
+         return icc_color.str();
+@@ -1204,7 +1212,7 @@ gchar *SvgBuilder::_createGradient(GfxShading *shading, const Geom::Affine pat_m
+ /**
+  * \brief Adds a stop with the given properties to the gradient's representation
+  */
+-void SvgBuilder::_addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor *color, GfxColorSpace *space,
++void SvgBuilder::_addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor &color, GfxColorSpace *space,
+                                     double opacity)
+ {
+     Inkscape::XML::Node *stop = _xml_doc->createElement("svg:stop");
+@@ -1255,8 +1263,8 @@ bool SvgBuilder::_addGradientStops(Inkscape::XML::Node *gradient, GfxShading *sh
+         if (!svgGetShadingColor(shading, 0.0, &stop1) || !svgGetShadingColor(shading, 1.0, &stop2)) {
+             return false;
+         } else {
+-            _addStopToGradient(gradient, 0.0, &stop1, space, 1.0);
+-            _addStopToGradient(gradient, 1.0, &stop2, space, 1.0);
++            _addStopToGradient(gradient, 0.0, stop1, space, 1.0);
++            _addStopToGradient(gradient, 1.0, stop2, space, 1.0);
+         }
+     } else if (type == _POPPLER_FUNCTION_TYPE_STITCHING) {
+         auto stitchingFunc = static_cast<_POPPLER_CONST StitchingFunction*>(func);
+@@ -1269,7 +1277,7 @@ bool SvgBuilder::_addGradientStops(Inkscape::XML::Node *gradient, GfxShading *sh
+         // Add stops from all the stitched functions
+         GfxColor prev_color, color;
+         svgGetShadingColor(shading, bounds[0], &prev_color);
+-        _addStopToGradient(gradient, bounds[0], &prev_color, space, 1.0);
++        _addStopToGradient(gradient, bounds[0], prev_color, space, 1.0);
+         for ( int i = 0 ; i < num_funcs ; i++ ) {
+             svgGetShadingColor(shading, bounds[i + 1], &color);
+             // Add stops
+@@ -1279,14 +1287,14 @@ bool SvgBuilder::_addGradientStops(Inkscape::XML::Node *gradient, GfxShading *sh
+                     expE = (bounds[i + 1] - bounds[i])/expE;    // approximate exponential as a single straight line at x=1
+                     if (encode[2*i] == 0) {    // normal sequence
+                         auto offset = (bounds[i + 1] - expE) / max_bound;
+-                        _addStopToGradient(gradient, offset, &prev_color, space, 1.0);
++                        _addStopToGradient(gradient, offset, prev_color, space, 1.0);
+                     } else {                   // reflected sequence
+                         auto offset = (bounds[i] + expE) / max_bound;
+-                        _addStopToGradient(gradient, offset, &color, space, 1.0);
++                        _addStopToGradient(gradient, offset, color, space, 1.0);
+                     }
+                 }
+             }
+-            _addStopToGradient(gradient, bounds[i + 1] / max_bound, &color, space, 1.0);
++            _addStopToGradient(gradient, bounds[i + 1] / max_bound, color, space, 1.0);
+             prev_color = color;
+         }
+     } else { // Unsupported function type
+diff --git a/src/extension/internal/pdfinput/svg-builder.h b/src/extension/internal/pdfinput/svg-builder.h
+index c4b217f58e..348f3a2ce3 100644
+--- a/src/extension/internal/pdfinput/svg-builder.h
++++ b/src/extension/internal/pdfinput/svg-builder.h
+@@ -186,7 +186,7 @@ private:
+     // Pattern creation
+     gchar *_createPattern(GfxPattern *pattern, GfxState *state, bool is_stroke=false);
+     gchar *_createGradient(GfxShading *shading, const Geom::Affine pat_matrix, bool for_shading = false);
+-    void _addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor *color, GfxColorSpace *space,
++    void _addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor &color, GfxColorSpace *space,
+                             double opacity);
+     bool _addGradientStops(Inkscape::XML::Node *gradient, GfxShading *shading,
+                            _POPPLER_CONST Function *func);
+@@ -239,6 +239,7 @@ private:
+     static bool _attrEqual(Inkscape::XML::Node *a, Inkscape::XML::Node *b, char const *attr);
+ 
+     // Colors
++    std::string convertGfxColor(const GfxColor &color, GfxColorSpace *space);
+     std::string convertGfxColor(const GfxColor *color, GfxColorSpace *space);
+     std::string _getColorProfile(cmsHPROFILE hp);
+ 

pkgs/applications/office/libreoffice/default.nix

@@ -398,6 +398,34 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Don't detect Qt paths from qmake, so our patched-in onese are used
     ./dont-detect-qt-paths-from-qmake.patch
+
+    # Fix build with Poppler 26.02
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.02.0.patch";
+      hash = "sha256-IInhSoqTemDITB+AtkvVa9eGbodTbUGSpMMpC9N/mmg=";
+    })
+    # Fix build with Poppler 26.04
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.04.0.patch";
+      hash = "sha256-I9owj/NTCTi6ISszuasH410NLlhunPn/Ig22tenu8tw=";
+    })
+    # Fix build with Poppler 26.05
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.05.0.patch";
+      hash = "sha256-7wdiciTf/LrTk0MibBBYGliWRCvK1rtTGESgH7db1I4=";
+    })
+    # Fix build with Poppler 26.06
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-3/fix_build_with_poppler_26.06.0.patch";
+      hash = "sha256-j66IsrzaqQ55MRVzhlw25guuoDtxx1D4XeJsBhgWP2c=";
+    })
+  ]
+  ++ lib.optionals (variant != "fresh") [
+    # Fix build with Poppler 26.01
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.01.0.patch";
+      hash = "sha256-5JTTvJFIV5MG0Gz7y46wAr3q9tWdSVoZ9TJQlMJVqBc=";
+    })
   ]
   ++ lib.optionals (variant != "collabora" && variant != "collabora-coda") [
     # Revert part of https://github.com/LibreOffice/core/commit/6f60670877208612b5ea320b3677480ef6508abb that broke zlib linking

pkgs/applications/science/logic/coq/default.nix

@@ -105,11 +105,25 @@ let
     substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
     substituteInPlace plugins/micromega/coq_micromega.ml --replace "System.is_in_system_path \"csdp\"" "true"
   '';
+  dune =
+    if lib.versions.isEq coq-version "8.20" then
+      args.dune.override { version = "3.21.1"; }
+    else
+      args.dune;
   ocamlPackages =
     if customOCamlPackages != null then
       customOCamlPackages
     else
       lib.switch coq-version [
+        {
+          case = lib.versions.isEq "8.20";
+          out = ocamlPackages_4_14.overrideScope (
+            self: super: {
+              inherit dune;
+              dune_3 = dune;
+            }
+          );
+        }
         {
           case = lib.versions.range "8.16" "9.1";
           out = ocamlPackages_4_14;

pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix

@@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
   # - We need "getLib" instead of default derivation, otherwise it brings gstreamer-bin;
   # - without gst-plugins-base it won't even show proper errors in logs;
   # - Without gst-plugins-bad it won't find element "vapostproc";
-  # - gst-vaapi adds "VA-API" to "Encoder type";
   # Tip: "could not link appsrc to videoconvert1" can mean a lot of things, enable GST_DEBUG=2 for help.
   passthru.obsWrapperArguments =
     let
@@ -48,7 +47,6 @@ stdenv.mkDerivation rec {
       gstreamer
       gst-plugins-base
       gst-plugins-bad
-      gst-vaapi
     ];
 
   # Fix output directory

pkgs/build-support/bintools-wrapper/setup-hook.sh

@@ -60,7 +60,8 @@ do
     if
         PATH=$_PATH type -p "@targetPrefix@${cmd}" > /dev/null
     then
-        export "${cmd^^}${role_post}=@targetPrefix@${cmd}";
+        upper_case="$(echo "$cmd" | tr "a-z" "A-Z")"
+        export "${upper_case}${role_post}=@targetPrefix@${cmd}";
     fi
 done
 

pkgs/build-support/build-mozilla-mach/153-cbindgen-0.29.4-compat.patch

@@ -0,0 +1,36 @@
+commit c4aab1ba6aadd6985fcd271679d2118f094ec876
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Tue Jun 9 22:04:44 2026 +0000
+
+    Bug 2046162 - Remove some redundant pub qualifiers. r=gfx-reviewers,aosmond
+    
+    The enum is not public so this doesn't change behavior but a patch I'm
+    working on in cbindgen gets a bit confused with this.
+    
+    Differential Revision: https://phabricator.services.mozilla.com/D305678
+
+diff --git a/gfx/wr/webrender/src/texture_cache.rs b/gfx/wr/webrender/src/texture_cache.rs
+index e14c26bd3190..77e1f3a312ac 100644
+--- a/gfx/wr/webrender/src/texture_cache.rs
++++ b/gfx/wr/webrender/src/texture_cache.rs
+@@ -273,9 +273,9 @@ enum BudgetType {
+ }
+ 
+ impl BudgetType {
+-    pub const COUNT: usize = 7;
++    const COUNT: usize = 7;
+ 
+-    pub const VALUES: [BudgetType; BudgetType::COUNT] = [
++    const VALUES: [BudgetType; BudgetType::COUNT] = [
+         BudgetType::SharedColor8Linear,
+         BudgetType::SharedColor8Nearest,
+         BudgetType::SharedColor8Glyphs,
+@@ -285,7 +285,7 @@ impl BudgetType {
+         BudgetType::Standalone,
+     ];
+ 
+-    pub const PRESSURE_COUNTERS: [usize; BudgetType::COUNT] = [
++    const PRESSURE_COUNTERS: [usize; BudgetType::COUNT] = [
+         profiler::ATLAS_COLOR8_LINEAR_PRESSURE,
+         profiler::ATLAS_COLOR8_NEAREST_PRESSURE,
+         profiler::ATLAS_COLOR8_GLYPHS_PRESSURE,

pkgs/build-support/build-mozilla-mach/default.nix

@@ -58,6 +58,7 @@ in
   pkg-config,
   pkgsCross, # wasm32 rlbox
   python3,
+  python313,
   runCommand,
   rustc,
   rust-cbindgen,
@@ -340,6 +341,11 @@ buildStdenv.mkDerivation {
       # https://bugzilla.mozilla.org/show_bug.cgi?id=1985509
       ./140-bindgen-string-view.patch
     ]
+    ++ lib.optionals (lib.versionAtLeast version "140" && lib.versionOlder version "140.13") [
+      # https://github.com/mozilla/cbindgen/issues/1165
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=2046162
+      ./153-cbindgen-0.29.4-compat.patch
+    ]
     ++ extraPatches;
 
   postPatch = ''
@@ -364,7 +370,7 @@ buildStdenv.mkDerivation {
     makeBinaryWrapper
     nodejs
     perl
-    python3
+    (if lib.versionAtLeast version "143.0" then python3 else python313)
     rust-cbindgen
     rustPlatform.bindgenHook
     rustc

pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh

@@ -36,6 +36,6 @@ elif [[ $0 != *cpp ]]; then
     fi
 fi
 
-if [[ "@darwinMinVersion@" ]]; then
+if [[ "@darwinMinVersion@" ]] && [ "@isFlang@" != 1 ]; then
     extraBefore+=(-Werror=unguarded-availability)
 fi

pkgs/build-support/cc-wrapper/add-flags.sh

@@ -11,6 +11,8 @@ var_templates_list=(
     NIX_CXXSTDLIB_COMPILE
     NIX_CXXSTDLIB_LINK
     NIX_GNATFLAGS_COMPILE
+    NIX_FFLAGS_COMPILE
+    NIX_FFLAGS_COMPILE_BEFORE
 )
 var_templates_bool=(
     NIX_ENFORCE_NO_NATIVE

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -44,7 +44,7 @@ while (( "$n" < "$nParams" )); do
 
     case "$p" in
         -[cSEM] | -MM) dontLink=1 ;;
-        -cc1) cc1=1 ;;
+        -cc1 | -fc1 ) cc1=1 ;;
         -nostdinc) cInclude=0 cxxInclude=0 ;;
         -nostdinc++) cxxInclude=0 ;;
         -nostdlib) cxxLibrary=0 ;;
@@ -185,9 +185,19 @@ fi
 
 source @out@/nix-support/add-hardening.sh
 
-# Add the flags for the C compiler proper.
-extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_CFLAGS_COMPILE_@suffixSalt@)
-extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
+# Add the flags for the compiler proper. Flang reads its user-supplied
+# flags from the Fortran-specific NIX_FFLAGS_COMPILE channel so that
+# C-only flags injected by setup hooks (e.g. -frandom-seed= from
+# reproducible-builds.sh, which Flang does not accept) never reach the
+# Fortran driver. This mirrors the NIX_GNATFLAGS_COMPILE channel that
+# the Ada/GNAT wrapper uses for the same reason.
+if [ "@isFlang@" = 1 ]; then
+    extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_FFLAGS_COMPILE_@suffixSalt@)
+    extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_FFLAGS_COMPILE_BEFORE_@suffixSalt@)
+else
+    extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_CFLAGS_COMPILE_@suffixSalt@)
+    extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
+fi
 
 if [ "$dontLink" != 1 ]; then
     linkType=$(checkLinkType $NIX_LDFLAGS_BEFORE_@suffixSalt@ "${params[@]}" ${NIX_CFLAGS_LINK_@suffixSalt@:-} $NIX_LDFLAGS_@suffixSalt@)

pkgs/build-support/cc-wrapper/default.nix

@@ -26,6 +26,8 @@
   nixSupport ? { },
   isGNU ? false,
   isClang ? cc.isClang or false,
+  isFlang ? cc.isFlang or false,
+  isAlireGNAT ? false,
   isZig ? cc.isZig or false,
   isArocc ? cc.isArocc or false,
   isCcache ? cc.isCcache or false,
@@ -314,6 +316,17 @@ let
   tune =
     if targetPlatform ? gcc.tune then findBestTuneApproximation targetPlatform.gcc.tune else null;
 
+  tlsDialect =
+    if
+      # Support status on non-Linux systems is a bit unclear.
+      targetPlatform.isLinux
+      # Support added in https://github.com/llvm/llvm-project/commit/36b4a9ccd9f7e04010476e6b2a311f2052a4ac20 (19.1.0)
+      && (isClang -> versionAtLeast ccVersion "19.1")
+    then
+      (if targetPlatform.isx86 then "gnu2" else null)
+    else
+      null;
+
   # Machine flags. These are necessary to support
 
   # TODO: We should make a way to support miscellaneous machine
@@ -351,7 +364,13 @@ let
         # TODO: clang on powerpcspe also needs a condition: https://github.com/llvm/llvm-project/issues/71356
         # https://releases.llvm.org/18.1.6/tools/clang/docs/ReleaseNotes.html#loongarch-support
         ((targetPlatform.isLoongArch64 && isClang) -> versionAtLeast ccVersion "18.1")
-    ) "-mcmodel=${targetPlatform.gcc.cmodel}";
+    ) "-mcmodel=${targetPlatform.gcc.cmodel}"
+    # Enable TLSDESC. This needs to be supported by the libc and bintools.
+    # See: https://maskray.me/blog/2021-02-14-all-about-thread-local-storage
+    # Aarch64 uses TLSDESC by default and the option is completely ignored (at least on LLVM).
+    # TODO: Enable by default in GCC via --with-tls since https://gcc.gnu.org/cgit/gcc/commit/?id=96a291c4bb0b8a00b0a125e6a60f60072ffe53a7 (GCC 16).
+    # No equivalent build-time option for LLVM yet.
+    ++ optional (tlsDialect != null) "-mtls-dialect=${tlsDialect}";
 
   defaultHardeningFlags = bintools.defaultHardeningFlags or [ ];
 
@@ -387,7 +406,9 @@ let
   #
   # TODO: Drop `mangle-NIX_STORE-in-__FILE__.patch` from GCC and make
   # this unconditional once the upstream bug is fixed.
-  useMacroPrefixMap = !isGNU;
+  useMacroPrefixMap = !isGNU && !isFlang;
+  systemIncludeFlag = if isFlang || isArocc then "-I" else "-idirafter";
+  fortifyIncludeFlag = if isFlang then "-I" else "-isystem";
 in
 
 assert includeFortifyHeaders' -> fortify-headers != null;
@@ -574,10 +595,18 @@ stdenvNoCC.mkDerivation {
   ''
 
   + optionalString cc.langFortran or false ''
-    wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
-    ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
-    ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
-    export named_fc=${targetPrefix}gfortran
+    if [ -e $ccPath/${targetPrefix}gfortran ]; then
+      wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
+      ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
+      ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
+      export named_fc=${targetPrefix}gfortran
+    elif [ -e $ccPath/${targetPrefix}flang ]; then
+      wrap ${targetPrefix}flang $wrapper $ccPath/${targetPrefix}flang
+      export named_fc=${targetPrefix}flang
+    elif [ -e $ccPath/flang ]; then
+      wrap ${targetPrefix}flang $wrapper $ccPath/flang
+      export named_fc=${targetPrefix}flang
+    fi
   ''
 
   + optionalString cc.langGo or false ''
@@ -709,13 +738,11 @@ stdenvNoCC.mkDerivation {
         touch "$out/nix-support/libc-cflags"
         touch "$out/nix-support/libc-ldflags"
       ''
-      + optionalString (!isArocc) ''
+      + optionalString (!isArocc && !(isAlireGNAT && targetPlatform.isDarwin)) ''
         echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
       ''
       + ''
-        include "-${
-          if isArocc then "I" else "idirafter"
-        }" "${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
+        include "${systemIncludeFlag}" "${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
       ''
       + optionalString isGNU ''
         for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
@@ -723,9 +750,9 @@ stdenvNoCC.mkDerivation {
         done
       ''
       + optionalString (libc.w32api or null != null) ''
-        echo '-idirafter ${lib.getDev libc.w32api}${
+        include "${systemIncludeFlag}" "${lib.getDev libc.w32api}${
           libc.incdir or "/include/w32api"
-        }' >> $out/nix-support/libc-cflags
+        }" >> $out/nix-support/libc-cflags
       ''
       + ''
 
@@ -740,7 +767,7 @@ stdenvNoCC.mkDerivation {
       # like option that forces the libc headers before all -idirafter,
       # hence -isystem here.
       + optionalString includeFortifyHeaders' ''
-        include -isystem "${fortify-headers}/include" >> $out/nix-support/libc-cflags
+        include "${fortifyIncludeFlag}" "${fortify-headers}/include" >> $out/nix-support/libc-cflags
       ''
     )
 
@@ -761,7 +788,7 @@ stdenvNoCC.mkDerivation {
     # already knows how to find its own libstdc++, and adding
     # additional -isystem flags will confuse gfortran (see
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
-    + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
+    + optionalString (libcxx == null && isClang && useGccForLibs && (cc.langCC or false)) ''
       for dir in ${gccForLibs}/include/c++/*; do
         include -cxx-isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
@@ -786,7 +813,9 @@ stdenvNoCC.mkDerivation {
     # ${cc_solib}/lib64 (even though it does actually search there...)..
     # This confuses libtool.  So add it to the compiler tool search
     # path explicitly.
-    + optionalString (!nativeTools && !isArocc) ''
+    # Injecting CFlags and LDFlags causes duplicate rpath at linking
+    # stage for Alire GNAT. Skip adding flags here.
+    + optionalString (!nativeTools && !isArocc && !isAlireGNAT) ''
       ccLDFlags=()
       ccCFlags=()
       if [ -e "${cc_solib}/lib64" -a ! -L "${cc_solib}/lib64" ]; then
@@ -801,7 +830,6 @@ stdenvNoCC.mkDerivation {
       touch "$out/nix-support/gnat-cflags"
       touch "$out/nix-support/gnat-ldflags"
       basePath=$(echo $cc/lib/*/*/*)
-      ccCFlags+=("-B$basePath" "-I$basePath/adainclude")
       gnatCFlags="-I$basePath/adainclude -I$basePath/adalib"
 
       echo "$gnatCFlags" >> $out/nix-support/gnat-cflags
@@ -828,6 +856,7 @@ stdenvNoCC.mkDerivation {
       optionalString
         (
           (cc.isClang or false)
+          && !isFlang
           && !(cc.isROCm or false)
           && !targetPlatform.isDarwin
           && !targetPlatform.isAndroid
@@ -862,7 +891,8 @@ stdenvNoCC.mkDerivation {
       let
         enable_fp = !targetPlatform.isx86_32 && !targetPlatform.isS390;
         enable_leaf_fp =
-          enable_fp
+          !isFlang
+          && enable_fp
           && (
             targetPlatform.isx86_64
             || targetPlatform.isAarch64
@@ -928,7 +958,7 @@ stdenvNoCC.mkDerivation {
     # well with multi line flags, so make the flags single line again
     + ''
       for flags in "$out/nix-support"/*flags*; do
-        substituteInPlace "$flags" --replace $'\n' ' '
+        substituteInPlace "$flags" --replace-quiet $'\n' ' '
       done
 
       substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
@@ -974,6 +1004,7 @@ stdenvNoCC.mkDerivation {
 
   env = {
     inherit isClang;
+    inherit isFlang;
 
     # for substitution in utils.bash
     # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence

pkgs/build-support/node/prefetch-npm-deps/default.nix

@@ -195,6 +195,28 @@
 
           hash = "sha256-QGObVDd9qVtf/U78+ayP6RHVWsU+HXhg70BFblQ1PZs=";
         };
+
+        # Test lockfiles with file: dependencies
+        fileDependenciesV1 = makeTest {
+          name = "file-dependencies-lockfile-v1";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/elbywan/wretch/970b19e0fcc3dd219b9f3fc247d8f34cc01979c6/package-lock.json";
+            hash = "sha256-3vTMxc9M2TeiclUFYbG5eTzavSAXjAzz6N5v/1VM4Bc=";
+          };
+
+          hash = "sha256-4wTohTVWF49iQvdaUxNhwplfTVb53yFnAaUVA2xIXrc=";
+        };
+        fileDependenciesV3 = makeTest {
+          name = "file-dependencies-lockfile-v3";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/alam00000/bentopdf/146e3f07d4111e309d0b29bb949e78e44454be3b/package-lock.json";
+            hash = "sha256-9Ea5ctJYbClxStYNhSfSpsO/P99/4CQK58PLK5e6PoQ=";
+          };
+
+          hash = "sha256-1xWkzAzZXd9f4sY9xFHLfj482ZCs2oKFJ79C+Iy7RFY=";
+        };
       };
 
     meta = {

pkgs/build-support/node/prefetch-npm-deps/src/main.rs

@@ -238,6 +238,7 @@ fn fixup_lockfile(
                 .values_mut()
             {
                 if let Some(Value::String(resolved)) = package.get("resolved")
+                    && !resolved.starts_with("file:")
                     && let Some(Value::String(integrity)) = package.get("integrity")
                 {
                     if resolved.starts_with("git+") {
@@ -286,6 +287,7 @@ fn fixup_v1_deps(
             .as_object()
             .expect("v1 dep must be object")
             .get("resolved")
+            && !resolved.starts_with("file:")
             && let Some(Value::String(integrity)) = dep
                 .as_object()
                 .expect("v1 dep must be object")
@@ -509,6 +511,10 @@ mod tests {
                     "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
                     "integrity": "sha512-aaa"
                 },
+                "baz": {
+                    "resolved": "file:baz.tar.gz",
+                    "integrity": "sha512-bbb"
+                },
                 "foo-bad": {
                     "resolved": "foo",
                     "integrity": "sha1-foo"
@@ -534,6 +540,10 @@ mod tests {
                 "bar": {
                     "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
                 },
+                "baz": {
+                    "resolved": "file:baz.tar.gz",
+                    "integrity": "sha512-bbb"
+                },
                 "foo-bad": {
                     "resolved": "foo",
                     "integrity": "sha512-foo"

pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs

@@ -25,10 +25,10 @@ pub fn lockfile(
     let mut packages = lock::packages(content)
         .context("failed to extract packages from lockfile")?
         .into_par_iter()
-        .map(|p| {
+        .filter_map(|p| {
             let n = p.name.clone().unwrap();
 
-            Package::from_lock(p).with_context(|| format!("failed to parse data for {n}"))
+            Package::from_lock(p).with_context(|| format!("failed to parse data for {n}")).transpose()
         })
         .collect::<anyhow::Result<Vec<_>>>()?;
 
@@ -124,7 +124,7 @@ enum Specifics {
 }
 
 impl Package {
-    fn from_lock(pkg: lock::Package) -> anyhow::Result<Package> {
+    fn from_lock(pkg: lock::Package) -> anyhow::Result<Option<Package>> {
         let mut resolved = match pkg
             .resolved
             .expect("at this point, packages should have URLs")
@@ -133,6 +133,10 @@ impl Package {
             UrlOrString::String(_) => panic!("at this point, all packages should have URLs"),
         };
 
+        if resolved.scheme() == "file" {
+            return Ok(None);
+        }
+
         let specifics = match get_hosted_git_url(&resolved)? {
             Some(hosted) => {
                 let body = util::get_url_body_with_retry(&hosted)?;
@@ -174,12 +178,12 @@ impl Package {
             },
         };
 
-        Ok(Package {
+        Ok(Some(Package {
             name: pkg.name.unwrap(),
             version: pkg.version,
             url: resolved,
             specifics,
-        })
+        }))
     }
 
     pub fn tarball(&self) -> anyhow::Result<Vec<u8>> {

pkgs/build-support/rust/fetch-cargo-vendor.nix

@@ -3,7 +3,7 @@
   stdenvNoCC,
   runCommand,
   writers,
-  python3Packages,
+  python3,
   cargo,
   gitMinimal,
   nix-prefetch-git,
@@ -11,6 +11,16 @@
 }:
 
 let
+  python = python3.override {
+    self = python;
+    packageOverrides = final: prev: {
+      # The ast-serialize package, a dependency for mypy, depends on
+      # fetchCargoVendor and is part of the bootstrap chain for requests.
+      charset-normalizer = prev.charset-normalizer.override { withMypyc = false; };
+    };
+  };
+  python3Packages = python.pkgs;
+
   replaceWorkspaceValues = writers.writePython3Bin "replace-workspace-values" {
     libraries = with python3Packages; [
       tomli

pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix

@@ -76,7 +76,136 @@ makeSetupHook {
           ];
         };
 
-        # The wrapper for executable files should add path to dconf GIO module.
+        # Simple derivation containing a program and a daemon, but split over multiple outputs.
+        basic-multiple-outputs = stdenv.mkDerivation {
+          name = "basic-multiple-outputs";
+
+          src = sample-project;
+
+          outputs = [
+            "out"
+            "lib"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            # Wrapper will want to append this to XDG_DATA_DIRS, but should not cause a cyclic dependency;
+            # i.e. only "out" will be wrapped.
+            mkdir -p $out/share
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using a non-default output
+        # Executables in "bin" should be handled correctly automatically
+        basic-bin-output = stdenv.mkDerivation {
+          name = "basic-bin-output";
+
+          src = sample-project;
+
+          outputs = [
+            "bin"
+            "dev"
+            "lib"
+            "out"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            mkdir -p $bin
+            mv $out/bin $bin
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using a non-default output
+        basic-other-outputs = stdenv.mkDerivation {
+          name = "basic-other-outputs";
+
+          src = sample-project;
+
+          outputs = [
+            "dev"
+            "lib"
+            "out"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          wrapGAppsInOutputs = [
+            "dev"
+            "lib"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            mkdir -p $dev
+            mv $out/bin $dev
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using non-default outputs
+        # that are explicitly referenced via wrapGAppsInOutputs
+        basic-other-outputs-structuredattrs = stdenv.mkDerivation {
+          name = "basic-other-outputs-structuredAttrs";
+
+          __structuredAttrs = true;
+
+          src = sample-project;
+
+          outputs = [
+            "dev"
+            "lib"
+            "out"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          wrapGAppsInOutputs = [
+            "dev"
+            "lib"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            mkdir -p $dev
+            mv $out/bin $dev
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using non-default outputs
+        # that are explicitly referenced via wrapGAppsInOutputs, while structuredAttrs are enabled
+        # so that it is a proper array.
         basic-contains-dconf =
           let
             tested = basic;
@@ -92,6 +221,64 @@ makeSetupHook {
             ''
           );
 
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-multiple-outputs-contains-dconf =
+          let
+            tested = basic-multiple-outputs;
+          in
+          testLib.runTest "basic-multiple-outputs-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-bin-output-contains-dconf =
+          let
+            tested = basic-bin-output;
+          in
+          testLib.runTest "basic-bin-output-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-other-outputs-contains-dconf =
+          let
+            tested = basic-other-outputs;
+          in
+          testLib.runTest "basic-other-outputs-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.dev}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.lib}/libexec/bar" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-other-outputs-contains-dconf-structuredattrs =
+          let
+            tested = basic-other-outputs-structuredattrs;
+          in
+          testLib.runTest "basic-other-outputs-structuredattrs-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.dev}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.lib}/libexec/bar" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
         basic-contains-gdk-pixbuf =
           let
             tested = basic;

pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh

@@ -42,13 +42,36 @@ wrapGApp() {
     wrapProgram "$program" "${gappsWrapperArgs[@]}" "$@"
 }
 
+_wrapGAppsHookMayRunForOutput() {
+    local -r output="$1"
+    if [[ -v wrapGAppsInOutputs ]]; then
+        local allowedOutput
+        # Support both structuredAttrs on and off
+        local -a allowedOutputs
+        concatTo allowedOutputs wrapGAppsInOutputs
+        for allowedOutput in "${allowedOutputs[@]}"; do
+            [ "$allowedOutput" = "$output" ] && return 0
+        done
+    else
+        [ "$outputBin" = "$output" ] && return 0
+    fi
+    return 1
+ }
+
+declare -gA wrapGAppsHookHasRunForOutput
+
 # Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set.
+# $output is brought into scope via fixupPhase() in pkgs/stdenv/generic/setup.sh
 wrapGAppsHook() {
-    # guard against running multiple times (e.g. due to propagation)
-    [ -z "$wrapGAppsHookHasRun" ] || return 0
-    wrapGAppsHookHasRun=1
+    # guard against running multiple times for the same output (e.g. due to propagation)
+    [ "${wrapGAppsHookHasRunForOutput["$output"]:-}" = 1 ] && return 0
+    wrapGAppsHookHasRunForOutput["$output"]=1
+    # guard against running for outputs we don't want to run it for
+    _wrapGAppsHookMayRunForOutput "$output" || return 0
 
     if [[ -z "${dontWrapGApps:-}" ]]; then
+        local targetDirsThatExist targetDirsRealPath targetDirs targetDir
+
         targetDirsThatExist=()
         targetDirsRealPath=()
 
@@ -69,6 +92,7 @@ wrapGAppsHook() {
         # wrap links to binaries that point outside targetDirs
         # Note: links to binaries within targetDirs do not need
         #       to be wrapped as the binaries have already been wrapped
+        local linkPathReal targetPath
         if [[ ${#targetDirsThatExist[@]} -ne 0 ]]; then
             find "${targetDirsThatExist[@]}" -type l -xtype f -executable -print0 |
                 while IFS= read -r -d '' linkPath; do

pkgs/by-name/ab/abseil-cpp_202505/package.nix

@@ -6,6 +6,8 @@
   gtest,
   static ? stdenv.hostPlatform.isStatic,
   cxxStandard ? null,
+  testers,
+  validatePkgConfig,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -30,10 +32,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    validatePkgConfig
+  ];
 
   buildInputs = [ gtest ];
 
+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
@@ -41,5 +52,208 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.GaetanLepage ];
+    pkgConfigModules = [
+      "absl_log_internal_check_op"
+      "absl_absl_check"
+      "absl_strerror"
+      "absl_common_policy_traits"
+      "absl_graphcycles_internal"
+      "absl_raw_hash_set"
+      "absl_random_internal_entropy_pool"
+      "absl_time_zone"
+      "absl_prefetch"
+      "absl_compressed_tuple"
+      "absl_nullability"
+      "absl_vlog_is_on"
+      "absl_utf8_for_code_point"
+      "absl_base_internal"
+      "absl_bad_variant_access"
+      "absl_flags_parse"
+      "absl_exponential_biased"
+      "absl_log_internal_nullstream"
+      "absl_log_internal_structured_proto"
+      "absl_log_internal_check_impl"
+      "absl_tracing_internal"
+      "absl_random_bit_gen_ref"
+      "absl_meta"
+      "absl_random_distributions"
+      "absl_numeric"
+      "absl_flat_hash_set"
+      "absl_random_internal_randen_hwaes_impl"
+      "absl_malloc_internal"
+      "absl_layout"
+      "absl_type_traits"
+      "absl_random_internal_mock_helpers"
+      "absl_log_streamer"
+      "absl_function_ref"
+      "absl_log"
+      "absl_dynamic_annotations"
+      "absl_non_temporal_memcpy"
+      "absl_random_internal_randen"
+      "absl_stacktrace"
+      "absl_log_internal_globals"
+      "absl_log_internal_strip"
+      "absl_atomic_hook"
+      "absl_flags_usage_internal"
+      "absl_log_internal_voidify"
+      "absl_synchronization"
+      "absl_debugging_internal"
+      "absl_bind_front"
+      "absl_crc_internal"
+      "absl_random_internal_platform"
+      "absl_flags_path_util"
+      "absl_hash_testing"
+      "absl_flags_commandlineflag_internal"
+      "absl_hashtable_debug"
+      "absl_hashtablez_sampler"
+      "absl_random_internal_randen_engine"
+      "absl_log_globals"
+      "absl_optional"
+      "absl_crc_cpu_detect"
+      "absl_demangle_internal"
+      "absl_node_hash_map"
+      "absl_core_headers"
+      "absl_statusor"
+      "absl_str_format_internal"
+      "absl_crc32c"
+      "absl_cordz_update_scope"
+      "absl_cordz_handle"
+      "absl_log_internal_nullguard"
+      "absl_numeric_representation"
+      "absl_log_internal_log_impl"
+      "absl_raw_hash_set_resize_impl"
+      "absl_random_internal_distribution_test_util"
+      "absl_kernel_timeout_internal"
+      "absl_random_internal_uniform_helper"
+      "absl_random_seed_sequences"
+      "absl_cordz_info"
+      "absl_spy_hash_state"
+      "absl_vlog_config_internal"
+      "absl_flags_program_name"
+      "absl_hashtable_debug_hooks"
+      "absl_crc_cord_state"
+      "absl_decode_rust_punycode"
+      "absl_debugging"
+      "absl_overload"
+      "absl_config"
+      "absl_random_internal_fast_uniform_bits"
+      "absl_raw_hash_map"
+      "absl_random_internal_randen_hwaes"
+      "absl_bad_any_cast"
+      "absl_variant"
+      "absl_has_ostream_operator"
+      "absl_span"
+      "absl_btree"
+      "absl_random_internal_distribution_caller"
+      "absl_failure_signal_handler"
+      "absl_any"
+      "absl_poison"
+      "absl_str_format"
+      "absl_cord"
+      "absl_random_internal_wide_multiply"
+      "absl_random_internal_pcg_engine"
+      "absl_flags_internal"
+      "absl_check"
+      "absl_random_internal_seed_material"
+      "absl_log_flags"
+      "absl_no_destructor"
+      "absl_low_level_hash"
+      "absl_hashtable_control_bytes"
+      "absl_periodic_sampler"
+      "absl_log_internal_format"
+      "absl_log_initialize"
+      "absl_random_internal_generate_real"
+      "absl_raw_logging_internal"
+      "absl_inlined_vector"
+      "absl_log_internal_log_sink_set"
+      "absl_log_internal_flags"
+      "absl_flat_hash_map"
+      "absl_scoped_mock_log"
+      "absl_cordz_functions"
+      "absl_random_mocking_bit_gen"
+      "absl_fast_type_id"
+      "absl_sample_recorder"
+      "absl_log_internal_message"
+      "absl_bits"
+      "absl_random_seed_gen_exception"
+      "absl_log_sink_registry"
+      "absl_flags_marshalling"
+      "absl_leak_check"
+      "absl_examine_stack"
+      "absl_status_matchers"
+      "absl_flags_commandlineflag"
+      "absl_absl_vlog_is_on"
+      "absl_any_invocable"
+      "absl_cleanup_internal"
+      "absl_log_severity"
+      "absl_random_internal_salted_seed_seq"
+      "absl_flags_config"
+      "absl_log_structured"
+      "absl_die_if_null"
+      "absl_fixed_array"
+      "absl_cord_internal"
+      "absl_endian"
+      "absl_strings_internal"
+      "absl_symbolize"
+      "absl_log_internal_config"
+      "absl_absl_log"
+      "absl_memory"
+      "absl_container_common"
+      "absl_compare"
+      "absl_civil_time"
+      "absl_int128"
+      "absl_log_internal_append_truncated"
+      "absl_cordz_statistics"
+      "absl_log_internal_fnmatch"
+      "absl_flags"
+      "absl_non_temporal_arm_intrinsics"
+      "absl_random_internal_traits"
+      "absl_base"
+      "absl_algorithm_container"
+      "absl_hash"
+      "absl_log_internal_conditions"
+      "absl_time"
+      "absl_node_slot_policy"
+      "absl_errno_saver"
+      "absl_random_internal_randen_slow"
+      "absl_charset"
+      "absl_bounded_utf8_length_sequence"
+      "absl_city"
+      "absl_bad_optional_access"
+      "absl_random_internal_nonsecure_base"
+      "absl_flags_usage"
+      "absl_utility"
+      "absl_iterator_traits_internal"
+      "absl_spinlock_wait"
+      "absl_pretty_function"
+      "absl_algorithm"
+      "absl_log_sink"
+      "absl_status"
+      "absl_demangle_rust"
+      "absl_node_hash_set"
+      "absl_hash_policy_traits"
+      "absl_flags_private_handle_accessor"
+      "absl_cord_test_helpers"
+      "absl_strings"
+      "absl_log_internal_proto"
+      "absl_inlined_vector_internal"
+      "absl_iterator_traits_test_helper_internal"
+      "absl_random_random"
+      "absl_flags_reflection"
+      "absl_scoped_set_env"
+      "absl_throw_delegate"
+      "absl_hash_function_defaults"
+      "absl_weakly_mixed_integer"
+      "absl_cleanup"
+      "absl_random_internal_iostream_state_saver"
+      "absl_cordz_sample_token"
+      "absl_cordz_update_tracker"
+      "absl_string_view"
+      "absl_hash_container_defaults"
+      "absl_random_internal_fastmath"
+      "absl_log_internal_structured"
+      "absl_container_memory"
+      "absl_log_entry"
+    ];
   };
 })

pkgs/by-name/ab/abseil-cpp_202508/package.nix

@@ -6,6 +6,8 @@
   gtest,
   static ? stdenv.hostPlatform.isStatic,
   cxxStandard ? null,
+  testers,
+  validatePkgConfig,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,10 +37,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    validatePkgConfig
+  ];
 
   buildInputs = [ gtest ];
 
+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage.dev;
+    };
+  };
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
@@ -46,5 +57,99 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.GaetanLepage ];
+    pkgConfigModules = [
+      "absl_base"
+      "absl_city"
+      "absl_civil_time"
+      "absl_cord_internal"
+      "absl_cord"
+      "absl_cordz_functions"
+      "absl_cordz_handle"
+      "absl_cordz_info"
+      "absl_cordz_sample_token"
+      "absl_crc_cord_state"
+      "absl_crc_cpu_detect"
+      "absl_crc_internal"
+      "absl_crc32c"
+      "absl_debugging_internal"
+      "absl_decode_rust_punycode"
+      "absl_demangle_internal"
+      "absl_demangle_rust"
+      "absl_die_if_null"
+      "absl_examine_stack"
+      "absl_exponential_biased"
+      "absl_failure_signal_handler"
+      "absl_flags_commandlineflag_internal"
+      "absl_flags_commandlineflag"
+      "absl_flags_config"
+      "absl_flags_internal"
+      "absl_flags_marshalling"
+      "absl_flags_parse"
+      "absl_flags_private_handle_accessor"
+      "absl_flags_program_name"
+      "absl_flags_reflection"
+      "absl_flags_usage_internal"
+      "absl_flags_usage"
+      "absl_graphcycles_internal"
+      "absl_hash"
+      "absl_hashtable_profiler"
+      "absl_hashtablez_sampler"
+      "absl_int128"
+      "absl_kernel_timeout_internal"
+      "absl_leak_check"
+      "absl_log_entry"
+      "absl_log_flags"
+      "absl_log_globals"
+      "absl_log_initialize"
+      "absl_log_internal_check_op"
+      "absl_log_internal_conditions"
+      "absl_log_internal_fnmatch"
+      "absl_log_internal_format"
+      "absl_log_internal_globals"
+      "absl_log_internal_log_sink_set"
+      "absl_log_internal_message"
+      "absl_log_internal_nullguard"
+      "absl_log_internal_proto"
+      "absl_log_internal_structured_proto"
+      "absl_log_severity"
+      "absl_log_sink"
+      "absl_malloc_internal"
+      "absl_periodic_sampler"
+      "absl_poison"
+      "absl_profile_builder"
+      "absl_random_distributions"
+      "absl_random_internal_distribution_test_util"
+      "absl_random_internal_entropy_pool"
+      "absl_random_internal_platform"
+      "absl_random_internal_randen_hwaes_impl"
+      "absl_random_internal_randen_hwaes"
+      "absl_random_internal_randen_slow"
+      "absl_random_internal_randen"
+      "absl_random_internal_seed_material"
+      "absl_random_seed_gen_exception"
+      "absl_random_seed_sequences"
+      "absl_raw_hash_set"
+      "absl_raw_logging_internal"
+      "absl_scoped_mock_log"
+      "absl_scoped_set_env"
+      "absl_spinlock_wait"
+      "absl_stacktrace"
+      "absl_status_matchers"
+      "absl_status"
+      "absl_statusor"
+      "absl_str_format_internal"
+      "absl_strerror"
+      "absl_string_view"
+      "absl_strings_internal"
+      "absl_strings"
+      "absl_symbolize"
+      "absl_synchronization"
+      "absl_throw_delegate"
+      "absl_time_zone"
+      "absl_time"
+      "absl_tracing_internal"
+      "absl_utf8_for_code_point"
+      "absl_vlog_config_internal"
+    ];
   };
 })

pkgs/by-name/af/afew/package.nix

@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   nativeBuildInputs = with python3Packages; [
     sphinxHook
-    setuptools
+    setuptools_80
     setuptools-scm
   ];
 

pkgs/by-name/al/alerta-server/package.nix

@@ -7,14 +7,16 @@
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "alerta-server";
   version = "9.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
     hash = "sha256-v4+0l5Sx9RTxmNFnKCoKrWFl1xu1JIRZ/kiI6zi/y0I=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = [ python3.pkgs.setuptools_80 ];
+
+  dependencies = with python3.pkgs; [
     bcrypt
     blinker
     cryptography

pkgs/by-name/al/alsa-lib/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   alsa-topology-conf,
   alsa-ucm-conf,
   testers,
@@ -11,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.15.3";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ewedYU1YLK3nq42yNk5lJx0Id6N9+HV6xKwMiXC+hh4=";
+    hash = "sha256-EiseMWbVX+GbzeZWU116NvKrEOZscsatL0PyD/3tCpY=";
   };
 
   patches = [
@@ -24,11 +23,6 @@ stdenv.mkDerivation (finalAttrs: {
     # "libs" field to declare locations for both native and 32bit plugins, in
     # order to support apps with 32bit sound running on x86_64 architecture.
     ./alsa-plugin-conf-multilib.patch
-    (fetchpatch {
-      name = "CVE-2026-25068.patch";
-      url = "https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40.patch";
-      hash = "sha256-4memtcg+FDOctX6wgiCdmnlG+IUS+5rL1f3LcsWS5lw=";
-    })
   ];
 
   enableParallelBuilding = true;
@@ -66,6 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
       "alsa-topology"
     ];
     platforms = with lib.platforms; linux ++ freebsd;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
   };
 })

pkgs/by-name/al/alsa-ucm-conf/package.nix

@@ -1,7 +1,6 @@
 {
   directoryListingUpdater,
   fetchurl,
-  fetchpatch,
   lib,
   stdenvNoCC,
   coreutils,
@@ -10,19 +9,15 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
-  version = "1.2.15.3";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-n3noE8CPyGz6Rt11xPzaGkpRtILbJgfh/PqvuS9YijE=";
+    hash = "sha256-rLyXLW5x7fo0Xnav3xDDmf0PHzz5DYSv20z1G/xKZUg=";
   };
 
   patches = [
-    # fix for typo in 1.2.15.3 – remove with subsequent release
-    (fetchpatch {
-      url = "https://github.com/alsa-project/alsa-ucm-conf/commit/95377000e849259764f37295e0ddd58fd8a55a76.patch";
-      hash = "sha256-o2qR69jiGXFWM0mxeIhXd+tCvGikYqnoalce1UOVppw=";
-    })
+
   ];
 
   dontBuild = true;
@@ -63,6 +58,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       roastiek
       mvs
+      nick-linux
     ];
 
     platforms = lib.platforms.linux ++ lib.platforms.freebsd;

pkgs/by-name/al/alsa-utils/package.nix

@@ -32,11 +32,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-utils";
-  version = "1.2.15.2";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/utils/alsa-utils-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-eqqvv7AZQhE+wMMeUfcFkQ6BB5IFCIyi+PE3o4aeGjo=";
+    hash = "sha256-CSOZ1eh0mh1eGI45MVdSHOxLdWk7YOu3m7znKM/yIyw=";
   };
 
   nativeBuildInputs = [
@@ -98,6 +98,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
   };
 })

pkgs/by-name/am/amf-headers/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "amf-headers";
-  version = "1.5.0";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "GPUOpen-LibrariesAndSDKs";
     repo = "AMF";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-ZVC1e4S5CNpfl3ewHR9aVfYwxDBE7/BJ6OyH2kF00fQ=";
+    sha256 = "sha256-+jVYm/Zmt+1bzKnKTiClgoMRsyhqpuKZj79DvGHpPTM=";
   };
 
   installPhase = ''

pkgs/by-name/ap/apparmor-parser/package.nix

@@ -6,6 +6,8 @@
   bison,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   buildPackages,
+  zstd,
+  fetchpatch,
 
   # apparmor deps
   libapparmor,
@@ -23,17 +25,27 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     patchShebangs .
+
+    substituteInPlace init/rc.apparmor.functions \
+      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" \
+      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
+    sed -i init/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+
     cd parser
 
     substituteInPlace Makefile \
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" # FIXME
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
-    sed -i rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
   '';
 
+  patches = [
+    (fetchpatch {
+      # https://gitlab.com/apparmor/apparmor/-/merge_requests/2133
+      # Patches generated yacc parser code to compile with format-security
+      url = "https://gitlab.com/apparmor/apparmor/-/commit/6bdec74d5e74660b97e00b4b8fafc014b05907b7.diff";
+      hash = "sha256-7c5EFByrGIDj2lc31bRttyeybwndDm4iS4qdPMVaG/I=";
+    })
+  ];
+
   nativeBuildInputs = [
     bison
     flex
@@ -42,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libapparmor
+    zstd
     runtimeShellPackage
   ];
 

pkgs/by-name/ap/apparmor-profiles/package.nix

@@ -1,7 +1,9 @@
 {
+  lib,
   stdenv,
   which,
   callPackage,
+  python3,
 
   # apparmor deps
   libapparmor,
@@ -28,9 +30,16 @@ stdenv.mkDerivation {
     apparmor-utils
   ];
 
+  checkInputs = [
+    python3
+  ];
+
   preCheck = ''
     export USE_SYSTEM=1
     export LOGPROF="aa-logprof --configdir ${callPackage ./test_config.nix { }} --no-check-mountpoint"
+    patchShebangs ../parser/tst
+    substituteInPlace ../parser/tst/test_profile.py \
+      --replace-fail '../parser/apparmor_parser' '${lib.getExe apparmor-parser}'
   '';
 
   doCheck = true;

pkgs/by-name/ap/apple-sdk/common/plists.nix

@@ -28,26 +28,24 @@ let
   # These files are all based off of Xcode spec files found in
   # /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/Library/Xcode/PrivatePlugIns/IDEOSXSupportCore.ideplugin/Contents/Resources.
 
-  # Based off of the "MacOSX Architectures.xcspec" file. All i386 stuff
-  # is removed because NixPkgs only supports darwin-x86_64 and darwin-arm64.
+  # Based off of the "MacOSX Architectures.xcspec" file. All x86 stuff
+  # is removed because Nixpkgs only supports aarch64-darwin.
   Architectures = [
     {
       Identifier = "Standard";
       Type = "Architecture";
-      Name = "Standard Architectures (Apple Silicon, 64-bit Intel)";
+      Name = "Standard Architectures (Apple Silicon)";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD";
     }
     {
       Identifier = "Universal";
       Type = "Architecture";
-      Name = "Universal (Apple Silicon, 64-bit Intel)";
+      Name = "Universal (Apple Silicon)";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD_32_64_BIT";
     }
@@ -60,17 +58,16 @@ let
     {
       Identifier = "Standard64bit";
       Type = "Architecture";
-      Name = "Apple Silicon, 64-bit Intel";
+      Name = "Apple Silicon";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD_64_BIT";
     }
     {
       Identifier = stdenvNoCC.hostPlatform.darwinArch;
       Type = "Architecture";
-      Name = "Apple Silicon or Intel 64-bit";
+      Name = "Apple Silicon";
     }
     {
       Identifier = "Standard_Including_64_bit";
@@ -78,7 +75,6 @@ let
       Name = "Standard Architectures (including 64-bit)";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD_INCLUDING_64_BIT";
     }

pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix

@@ -48,17 +48,13 @@ in
 self: super: {
   # These packages are propagated only because other platforms include them in their libc (or otherwise by default).
   # Reducing the number of special cases required to support Darwin makes supporting it easier for package authors.
-  propagatedBuildInputs =
-    super.propagatedBuildInputs or [ ]
-    ++ [
-      libiconv
-      darwin.libresolv
-      darwin.libsbuf
-      # Shipped with the SDK only as a library with no headers
-      (lib.getLib darwin.libutil)
-    ]
-    # x86_64-darwin links the object files from Csu when targeting very old releases
-    ++ lib.optionals stdenvNoCC.hostPlatform.isx86_64 [ darwin.Csu ];
+  propagatedBuildInputs = super.propagatedBuildInputs or [ ] ++ [
+    libiconv
+    darwin.libresolv
+    darwin.libsbuf
+    # Shipped with the SDK only as a library with no headers
+    (lib.getLib darwin.libutil)
+  ];
 
   # The Darwin module for Swift requires certain headers to be included in the SDK (and not just be propagated).
   buildPhase = super.buildPhase or "" + ''

pkgs/by-name/ap/apple-sdk/metadata/versions.json

@@ -17,10 +17,10 @@
   },
   "26": {
     "urls": [
-      "https://swcdn.apple.com/content/downloads/32/53/047-96692-A_OAHIHT53YB/ybtshxmrcju8m2qvw3w5elr4rajtg1x3y3/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20260406133131/https://swcdn.apple.com/content/downloads/32/53/047-96692-A_OAHIHT53YB/ybtshxmrcju8m2qvw3w5elr4rajtg1x3y3/CLTools_macOSNMOS_SDK.pkg"
+      "https://swcdn.apple.com/content/downloads/09/08/047-91568-A_Y1CFZWQCD4/4xekpyz43i26dbp4enxfro8eb1q7wiujh5/CLTools_macOSNMOS_SDK.pkg",
+      "https://web.archive.org/web/20260512015547/https://swcdn.apple.com/content/downloads/09/08/047-91568-A_Y1CFZWQCD4/4xekpyz43i26dbp4enxfro8eb1q7wiujh5/CLTools_macOSNMOS_SDK.pkg"
     ],
-    "version": "26.4",
-    "hash": "sha256-7nrbCv1pNlpzEqwZWVfUPCvDfXEJJNOl7ApkeFpIOC0="
+    "version": "26.5",
+    "hash": "sha256-IkDNtiO7PP4GI6OszCNWE1Xb4iepCUKwQHYUyc9NgNA="
   }
 }

pkgs/by-name/ar/arrow-cpp/package.nix

@@ -80,7 +80,7 @@ let
     hash = "sha256-Xd6o3RT6Q0tPutV77J0P1x3F6U3RHdCBOKGUKtkQCKk=";
   };
 
-  version = "23.0.0";
+  version = "24.0.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "arrow-cpp";
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "apache";
     repo = "arrow";
     rev = "apache-arrow-${version}";
-    hash = "sha256-BluUlbtGJwvlrpN/c/KziOfFh5dvzZyuCy4JZkkFea4=";
+    hash = "sha256-qTdkzZegANNvtO7nbqXVC8hc7BexvmeFF/0l5VzRb8g=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/cpp";
@@ -305,6 +305,8 @@ stdenv.mkDerivation (finalAttrs: {
         "arrow-flight-integration-test"
         # File already exists in database: orc_proto.proto
         "arrow-orc-adapter-test"
+        # missing test fixture
+        "parquet-encryption-test"
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         # https://github.com/NixOS/nixpkgs/issues/460687

pkgs/by-name/av/avahi/package.nix

@@ -11,6 +11,7 @@
   expat,
   gettext,
   glib,
+  autoconf-archive,
   autoreconfHook,
   libiconv,
   libevent,
@@ -180,6 +181,12 @@ stdenv.mkDerivation rec {
 
   ];
 
+  postPatch = ''
+    # Remove the vendored ACX_PTHREAD macro in favor of the more up-to-date
+    # implementation from autoconf-archive, especially to support static builds.
+    rm common/acx_pthread.m4
+  '';
+
   depsBuildBuild = [
     pkg-config
   ];
@@ -188,6 +195,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     glib
+    autoconf-archive
     autoreconfHook
   ];
 

pkgs/by-name/aw/aws-c-http/package.nix

@@ -14,13 +14,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-http";
   # nixpkgs-update: no auto update
-  version = "0.10.4";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t9PoxOjgV9qLris+C18SaEwXodBGcgK591LZl0dajxU=";
+    hash = "sha256-SCdZfGIIHU6f0OArygZm0yY0wE6Hdx/JWvHZcK1DQOw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-io/package.nix

@@ -12,13 +12,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-io";
   # nixpkgs-update: no auto update
-  version = "0.22.0";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-io";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NOEjXk4s/FV4CdmyXOr4Oh2y+pFNrUMP/Sy+X+fVQc4=";
+    hash = "sha256-0vzuSvJ/4you0YYnizjctKP5AcLm5sJieDOSCHwm1HM=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/awscli2/package.nix

@@ -12,6 +12,7 @@
   awscli2,
   addBinToPathHook,
   writableTmpDirAsHomeHook,
+  cacert,
 }:
 
 let
@@ -74,6 +75,7 @@ py.pkgs.buildPythonApplication rec {
       --replace-fail 'prompt-toolkit>=3.0.24,<3.0.52' 'prompt-toolkit>=3.0.24' \
       --replace-fail 'ruamel_yaml>=0.15.0,<=0.19.1' 'ruamel_yaml>=0.15.0' \
       --replace-fail 'ruamel_yaml_clib>=0.2.0,<=0.2.15' 'ruamel_yaml_clib>=0.2.0' \
+      --replace-fail 'urllib3>=1.25.4,<=2.6.3' 'urllib3>=1.25.4' \
       --replace-fail 'wcwidth<0.3.0' 'wcwidth>=0.3.0'
 
     substituteInPlace requirements-base.txt \
@@ -83,6 +85,8 @@ py.pkgs.buildPythonApplication rec {
     # with a configure script, but we don't as we provide all of the packages
     # through PYTHONPATH
     sed -i '/pip>=/d' requirements/bootstrap.txt
+
+    ln -sf ${cacert}/etc/ssl/certs/ca-no-trust-rules-bundle.crt awscli/botocore/cacert.pem
   '';
 
   nativeBuildInputs = [

pkgs/by-name/bl/blas/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   lapack-reference,
   openblas,
+  openmpCheckPhaseHook,
   isILP64 ? false,
   blasProvider ? openblas,
 }:
@@ -186,6 +187,10 @@ stdenv.mkDerivation {
     "dev"
   ];
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   meta = (blasProvider'.meta or { }) // {
     description = "${lib.getName blasProvider} with just the BLAS C and FORTRAN ABI";
   };

pkgs/by-name/bl/bluez/package.nix

@@ -44,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=21e13976f2e375d701b8b7032ba5c1b2e56c305f";
       hash = "sha256-JrdmYiC+U0KeMP8oVg12Z8CvkMEKWBVgiiUACx0E7dY=";
     })
+    (fetchpatch2 {
+      name = "support-libical-4.0.patch";
+      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=e60d07255327db3fc4e3a28d7fcc792cd42c34d0";
+      hash = "sha256-1uw+5nTjh+t1/L++fRNIlQWblwDwTJifH0EvAn3dym8=";
+    })
     ./lreadline.patch
   ];
 

pkgs/by-name/bm/bmake/package.nix

@@ -67,6 +67,8 @@ stdenv.mkDerivation (finalAttrs: {
     ) "export"
   );
 
+  __structuredAttrs = true;
+
   strictDeps = true;
 
   doCheck = true;
@@ -93,7 +95,11 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    ./boot-strap --prefix=$out -o . op=install
+    # `boot-strap op=install` runs the built bmake, which breaks cross builds.
+    install -Dm755 bmake $out/bin/bmake
+    install -Dm644 bmake.1 $man/share/man/man1/bmake.1
+    install -Dm755 -d $out/share/mk
+    sh mk/install-mk -v -m 444 $out/share/mk
 
     runHook postInstall
   '';

pkgs/by-name/bo/boost-build/package.nix

@@ -35,7 +35,9 @@ stdenv.mkDerivation {
   patches =
     useBoost.boostBuildPatches or [ ]
     ++ lib.optional (
-      useBoost ? version && lib.versionAtLeast useBoost.version "1.81"
+      useBoost ? version
+      && lib.versionAtLeast useBoost.version "1.81"
+      && lib.versionOlder useBoost.version "1.88"
     ) ./fix-clang-target.patch;
 
   postPatch =

pkgs/by-name/by/byacc/package.nix

@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "byacc";
-  version = "20241231";
+  version = "20260126";
 
   src = fetchurl {
     urls = [
       "https://invisible-mirror.net/archives/byacc/byacc-${finalAttrs.version}.tgz"
       "https://invisible-island.net/archives/byacc/byacc-${finalAttrs.version}.tgz"
     ];
-    hash = "sha256-GSwvrgSNTn9RS6RRYn+cTmEnZQmfgZwZGR+f3j5glnM=";
+    hash = "sha256-thjF+0TC9fBIhD25D30bJPePR7B5E8jHuoyULT6ySwA=";
   };
 
   configureFlags = [

pkgs/by-name/c-/c-ares/package.nix

@@ -20,6 +20,9 @@ stdenv.mkDerivation rec {
   pname = "c-ares";
   version = "1.34.6";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchurl {
     # Note: tag name varies in some versions, e.g. v1.30.0, c-ares-1_17_0.
     url = "https://github.com/c-ares/c-ares/releases/download/v${version}/c-ares-${version}.tar.gz";

pkgs/by-name/ca/cacert/package.nix

@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.123";
+  version = "3.125";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-dxMO+RITdyhEVh+9OqMdQTslwqx/V2/qO8O7/375NIk=";
+    hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0=";
   };
 
   unpackPhase = ''

pkgs/by-name/ca/cargo-auditable/builder.nix

@@ -16,11 +16,14 @@ lib.extendMkDerivation {
       auditable ? true,
       hash ? "",
       cargoHash ? "",
+      passthru ? { },
       ...
     }:
     {
       inherit auditable pname;
 
+      __structuredAttrs = true;
+
       src = fetchFromGitHub {
         owner = "rust-secure-code";
         repo = "cargo-auditable";
@@ -39,13 +42,28 @@ lib.extendMkDerivation {
         # https://github.com/rust-secure-code/cargo-auditable/issues/235
         "--skip=test_proc_macro"
         "--skip=test_self_hosting"
-      ];
+      ]
+      # TODO: Clean up on `staging`.
+      ++
+        lib.optionals
+          (
+            stdenv.hostPlatform.isMusl
+            || stdenv.hostPlatform.isAarch32
+            || stdenv.hostPlatform.isDarwin
+            || stdenv.hostPlatform.isMsvc
+          )
+          [
+            # Expects `linker = "rust-lld"` to work.
+            "--skip=test_bare_linker"
+          ];
 
       postInstall = ''
         installManPage cargo-auditable/cargo-auditable.1
       '';
 
-      passthru.bootstrap = auditable-bootstrap;
+      passthru = passthru // {
+        bootstrap = auditable-bootstrap;
+      };
 
       meta = {
         description = "Tool to make production Rust binaries auditable";

pkgs/by-name/ca/cargo-auditable/package.nix

@@ -2,6 +2,7 @@
   buildPackages,
   callPackage,
   makeRustPlatform,
+  nix-update-script,
 }:
 let
   # Need to use the build platform rustc and Cargo so that
@@ -18,9 +19,9 @@ let
     auditable-bootstrap = bootstrap;
   };
 
-  version = "0.7.2";
-  hash = "sha256-hR6PjTOps8JSM7UbfGlCoZmmwtWExVqYwh4lxDiFWdc=";
-  cargoHash = "sha256-JEfnUJ9J6Xak3AOCwQCnu+v+3Wl3QbXX20qVFWB6040=";
+  version = "0.7.5";
+  hash = "sha256-0VONJCv/msLcGenItWMLJ7DH79RTD6vsU9gX/nphh1g=";
+  cargoHash = "sha256-/iAYib+xDQSJ8B559/V7b994ErSUGsPSDx64jFF5B6I=";
 
   # cargo-auditable cannot be built with cargo-auditable until cargo-auditable is built
   bootstrap = auditableBuilder {
@@ -32,4 +33,5 @@ in
 auditableBuilder {
   inherit version hash cargoHash;
   auditable = true;
+  passthru.updateScript = nix-update-script { };
 }

pkgs/by-name/ca/cargo-c/package.nix

@@ -12,19 +12,19 @@
 
 let
   # this version may need to be updated along with package version
-  cargoVersion = "0.93.0";
+  cargoVersion = "0.96.0";
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-c";
-  version = "0.10.19";
+  version = "0.10.22";
 
   src = fetchCrate {
     inherit (finalAttrs) pname;
     version = "${finalAttrs.version}+cargo-${cargoVersion}";
-    hash = "sha256-PrBmB+0tmU2MAUnRr+wx4g9hu0Y9i6WfR8U89bwiLVY=";
+    hash = "sha256-yqSrpBZUa0NmsPawYKKgywmbbG4zgguwfDF667s7zdo=";
   };
 
-  cargoHash = "sha256-EM/vAfW/ucOfK/XmAQn9Zk75eFb7pp8uZoByKbALCyo=";
+  cargoHash = "sha256-yeJWZtkgCRB0ipyTslsGcJi9Fi/XoWziuv74exRhAIk=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ca/catch2_3/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     tag = "v${version}";
-    hash = "sha256-tegAa+cNF7pJcW33B+VZ86ZlDG7dwS3o6QnN/XvTI2A=";
+    hash = "sha256-1GBzS8jgJXb82BMMRuHWqszB1Xwg6wohmCuINWE7QoU=";
   };
 
   patches = lib.optionals stdenv.cc.isClang [

pkgs/by-name/cd/cdparanoia-iii/freebsd.patch

@@ -0,0 +1,45 @@
+From 368ea1fcdf4e8f9a5de4e7ade590242292ccb8fa Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Mon, 15 Jun 2026 18:40:07 +0200
+Subject: [PATCH] Fix designated initializers in memcpy arguments
+
+On FreeBSD, memcpy is a macro, and the lack of parentheses causes a
+compilation failure.
+---
+ interface/scsi_interface.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/interface/scsi_interface.c b/interface/scsi_interface.c
+index adbb9bf..7805559 100644
+--- a/interface/scsi_interface.c
++++ b/interface/scsi_interface.c
+@@ -674,7 +674,7 @@ static int scsi_read_toc (cdrom_drive *d){
+   }
+ 
+   for (i = first; i <= last; i++){
+-    memcpy(cmd, (char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}, 10);
++    memcpy(cmd, ((char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}), 10);
+     cmd[1]=d->lun<<5;
+     cmd[6]=i;
+     
+@@ -695,7 +695,7 @@ static int scsi_read_toc (cdrom_drive *d){
+     }
+   }
+ 
+-  memcpy(cmd, (char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}, 10);
++  memcpy(cmd, ((char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}), 10);
+   cmd[1]=d->lun<<5;
+   cmd[6]=0xAA;
+     
+@@ -745,7 +745,7 @@ static int scsi_read_toc2 (cdrom_drive *d){
+   }
+ 
+   for (i = 0; i < tracks; i++){
+-    memcpy(cmd, (char[]){ 0xe5, 0, 0, 0, 0, 0, 0, 0, 0, 0}, 10);
++    memcpy(cmd, ((char[]){ 0xe5, 0, 0, 0, 0, 0, 0, 0, 0, 0}), 10);
+     cmd[5]=i+1;
+     cmd[8]=255;
+     
+-- 
+2.54.0
+

pkgs/by-name/cd/cdparanoia-iii/package.nix

@@ -62,9 +62,10 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://salsa.debian.org/optical-media-team/cdparanoia/-/raw/f7bab3024c5576da1fdb7497abbd6abc8959a98c/debian/patches/04-endian.patch";
         hash = "sha256-krfprwls0L3hsNfoj2j69J5k1RTKEQtzE0fLYG9EJKo=";
       })
+      ./freebsd.patch
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch
-    ++ [
+    ++ lib.optional (!stdenv.hostPlatform.isDarwin) [
       (fetchpatch {
         url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_low__interface.h";
         hash = "sha256-bXrcRFCbU7/7/N+J8VGKGSxIB1m8XwoAlc/KTnt9wN0=";
@@ -171,6 +172,9 @@ stdenv.mkDerivation (finalAttrs: {
       gpl2Plus
       lgpl21Plus
     ];
+    maintainers = with lib.maintainers; [
+      olduser101
+    ];
     platforms = lib.platforms.unix;
     mainProgram = "cdparanoia";
   };

pkgs/by-name/ci/citrix-workspace/package.nix

@@ -91,7 +91,6 @@ let
     gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-ugly
-    gst_all_1.gst-vaapi
   ];
 
   gstPluginPath = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gstPackages;

pkgs/by-name/cm/cmocka/package.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cmocka";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchurl {
     url = "https://cmocka.org/files/${lib.versions.majorMinor finalAttrs.version}/cmocka-${finalAttrs.version}.tar.xz";
-    hash = "sha256-PzUzOCuimrOr9cT0snt50WXw31HqWH3nSbEbaLQBkYA=";
+    hash = "sha256-OfkvNmvfPxoCr02nW0pcUt9sn35zbH1l3hMoP58O9BY=";
   };
 
   patches = [

pkgs/by-name/cp/cpcm-x/package.nix

@@ -89,10 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch

@@ -1,32 +0,0 @@
-From 2a2104f3cff44bb28bb570a093be52bbeeed8f23 Mon Sep 17 00:00:00 2001
-From: Stefan Eissing <stefan@eissing.org>
-Date: Mon, 11 May 2026 14:56:04 +0200
-Subject: [PATCH] event: fix wakeup consumption
-
-The events on a multi wakeup socketpair were only consumed via
-curl_multi_poll()/curl_multi_wait() but not in event based processing on
-a curl_multi_socket() call. That led to busy loops as reported in
-
-Fixes #21547
-Reported-by: Earnestly on github
-Closes #21549
----
- lib/multi.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/lib/multi.c b/lib/multi.c
-index be32740a7097..5e84133f13fd 100644
---- a/lib/multi.c
-+++ b/lib/multi.c
-@@ -2703,6 +2703,11 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
-   Curl_uint32_bset_remove(&multi->dirty, data->mid);
- 
-   if(data == multi->admin) {
-+#ifdef ENABLE_WAKEUP
-+    /* Consume any pending wakeup signals before processing.
-+     * This is necessary for event based processing. See #21547 */
-+    (void)Curl_wakeup_consume(multi->wakeup_pair, TRUE);
-+#endif
- #ifdef USE_RESOLV_THREADED
-     Curl_async_thrdd_multi_process(multi);
- #endif

pkgs/by-name/cu/curlMinimal/package.nix

@@ -84,7 +84,7 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.20.0";
+  version = "8.21.0";
 
   src = fetchurl {
     urls = [
@@ -93,16 +93,9 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-Y/4twUi6DOromSLvg49+XJRicsLni3xZ+rS3nTziuJY=";
+    hash = "sha256-qhtmpw6s6D3GJFCHRWRsCK5WHeUSq0A63/uTrIf8cuY=";
   };
 
-  patches = [
-    # https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
-    # According to <https://curl.se/mail/distros-2026-05/0000.html>, this fixes
-    # a performance regression, causing high CPU usage
-    ./fix-wakeup-consumption.patch
-  ];
-
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''

pkgs/by-name/da/dash/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dash";
-  version = "0.5.13.3";
+  version = "0.5.13.4";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/dash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-qDcnwSmaxMPZ1Dl5OTs6TrACddVjauAlJueXnVHW+9E=";
+    hash = "sha256-0Q39Qc2lkWVWDbOcqRXCxKdjb/8EKB2NLfd62Sx1Pis=";
   };
 
   strictDeps = true;

pkgs/by-name/db/dbus/package.nix

@@ -129,6 +129,9 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dselinux=disabled"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # D-Bus defaults to launchd-activation on Darwin, but that requires the launch agent be installed. It also breaks
+    # anything that uses `dbus-run-session` in tests. Changing the default aligns Darwin with other UNIX platforms.
+    "-Ddbus_session_bus_listen_address=unix:tmpdir=/tmp"
     # `launchctl` is only needed at runtime. Lie to `find_program` because it will always be present on a Darwin host.
     "--cross-file=${writeText "darwin.ini" ''
       [binaries]
@@ -156,6 +159,14 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'DBUS_DAEMONDIR"/dbus-daemon"' '"/run/current-system/sw/bin/dbus-daemon"'
   '';
 
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # For some reason, only these binaries reference the dylib by rpath instead of by an absolute install name.
+    for exe in bin/dbus-daemon bin/dbus-run-session libexec/dbus-daemon-launch-helper; do
+      install_name_tool "$out/$exe" \
+        -change "@rpath/libdbus-1.3.dylib" "$lib/lib/libdbus-1.3.dylib"
+    done
+  '';
+
   postFixup = ''
     # It's executed from $lib by absolute path
     moveToOutput bin/dbus-launch "$lib"

pkgs/by-name/de/deltachat-tauri/package.nix

@@ -64,7 +64,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       gst_all_1.gst-plugins-base
       gst_all_1.gst-plugins-good
       gst_all_1.gst-plugins-bad
-      gst_all_1.gst-vaapi
       gst_all_1.gstreamer
       libayatana-appindicator
       openssl

pkgs/by-name/de/deterministic-uname/package.nix

@@ -46,6 +46,9 @@ replaceVarsWith {
     modDirVersion = if modDirVersion != "" then modDirVersion else "unknown";
   };
 
+  # coreutils uname is in initialPath, so ordinarily appears in PATH before packages in nativeBuildInputs.
+  setupHook = ./setup-hook.sh;
+
   meta = {
     description = "Print certain system information (hardcoded with lib/system values)";
     mainProgram = "uname";

pkgs/by-name/de/deterministic-uname/setup-hook.sh

@@ -0,0 +1,8 @@
+# PATH is overwritten after package setup hooks are run,
+# so the variable change needs to be delayed until a phase.
+# An entry in prePhases is the earliest possible, useful
+# in case an unpack or patch hook attempts to run uname.
+unamePreHook() {
+  export PATH="@out@/bin:$PATH"
+}
+appendToVar prePhases unamePreHook