xkeyboard-config: 2.45 -> 2.46

Update AppArmor policies to use modern conventions.
This includes
* Including abi version
* Adding conditional include of local/<name> policy file
* Use of the profile keyword
* Start file rules with a pathname

Author: ssoss <skyler.soss@gmail.com>

doc/languages-frameworks/haskell.section.md

@@ -260,6 +260,14 @@ the same package with the `previousIntermediates` argument to support
 incremental builds. See [“Incremental builds”](#haskell-incremental-builds) for
 more information. Defaults to `false`.
 
+`dontConvertCabalFileToUnix`
+: By default, `haskellPackages.mkDerivation` converts the `.cabal` file of a
+given package to Unix line endings.
+This is intended to work around
+[Hackage converting revised `.cabal` files to DOS line endings](https://github.com/haskell/hackage-server/issues/316)
+which frequently causes patches to stop applying.
+You can pass `true` to disable this behavior.
+
 `enableLibraryProfiling`
 : Whether to enable [profiling][profiling] for libraries contained in the
 package. Enabled by default if supported.
@@ -1249,8 +1257,8 @@ it does for the unstable branches.
 ### Why is topic X not covered in this section? Why is section Y missing? {#haskell-why-not-covered}
 
 We have been working on [moving the nixpkgs Haskell documentation back into the
-nixpkgs manual](https://github.com/NixOS/nixpkgs/issues/121403). Since this
-process has not been completed yet, you may find some topics missing here
+nixpkgs manual](https://github.com/NixOS/nixpkgs/issues/121403). <!-- krank:ignore-line -->
+Since this process has not been completed yet, you may find some topics missing here
 covered in the old [haskell4nix docs](https://haskell4nix.readthedocs.io/).
 
 If you feel any important topic is not documented at all, feel free to comment

doc/redirects.json

@@ -119,6 +119,12 @@
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
+  "libcxxhardeningextensive": [
+    "index.html#libcxxhardeningextensive"
+  ],
+  "libcxxhardeningfast": [
+    "index.html#libcxxhardeningfast"
+  ],
   "julec-hook": [
     "index.html#julec-hook"
   ],
@@ -247,6 +253,9 @@
   "sec-building-packages-with-llvm-using-clang-stdenv": [
     "index.html#sec-building-packages-with-llvm-using-clang-stdenv"
   ],
+  "sec-darwin-availability-checks": [
+    "index.html#sec-darwin-availability-checks"
+  ],
   "sec-darwin-libcxx-deployment-targets": [
     "index.html#sec-darwin-libcxx-deployment-targets"
   ],
@@ -1242,7 +1251,8 @@
     "index.html#sec-purity-in-nixpkgs"
   ],
   "sec-hardening-in-nixpkgs": [
-    "index.html#sec-hardening-in-nixpkgs"
+    "index.html#sec-hardening-in-nixpkgs",
+    "index.html#pie"
   ],
   "sec-hardening-flags-enabled-by-default": [
     "index.html#sec-hardening-flags-enabled-by-default"
@@ -1277,9 +1287,6 @@
   "sec-hardening-flags-disabled-by-default": [
     "index.html#sec-hardening-flags-disabled-by-default"
   ],
-  "pie": [
-    "index.html#pie"
-  ],
   "shadowstack": [
     "index.html#shadowstack"
   ],

doc/release-notes/rl-2511.section.md

@@ -12,6 +12,18 @@
 - The default GHC version has been updated from 9.8 to 9.10.
   `haskellPackages` correspondingly uses Stackage LTS 24 (instead of LTS 23) as a baseline.
 
+- **This release of Nixpkgs requires macOS Sonoma 14.0 or newer, as announced in the 25.05 release notes.**
+  The default SDK is now 14.4, but the minimum version is 14.0.
+  cc-wrapper will enforce that availability annotations are used or an appropriate deployment target is set.
+  See the Darwin platform notes for details.
+
+- **We expect to drop support for `x86_64-darwin` by Nixpkgs 26.11,** in light of Apple’s announcement that macOS 26 will be the final version to support Intel Macs.
+  When support is fully removed, we will no longer build packages for the platform or guarantee that it can build at all.
+  This may happen in stages, depending on our available build and maintenance resources and decisions made by projects we rely on.
+
+  By the time of 26.11’s release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
+  We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
+
 - Darwin has switched to using the system libc++. This was done for improved compatibility and to avoid ODR violations.
   If a newer C++ library feature is not available on the default deployment target, you will need to increase the deployment target.
   See the Darwin platform documentation for more details.
@@ -49,6 +61,8 @@
 
 - GHC 8.6, 8.10, 9.0, 9.2, and their package sets have been removed.
 
+- The `haskellPackages.mkDerivation` builder now converts packages' cabal files to Unix line endings before `patchPhase`. This behavior can be disabled using `dontConvertCabalFileToUnix`.
+
 - `webkitgtk_4_0` has been removed because it depends on an unmaintained version of security-critical libsoup library (`libsoup_2`) and the support will be [dropped upstream soon](https://webkitgtk.org/2025/10/07/webkitgtk-soup2-deprecation.html).
 
 - Support for bootstrapping native GHC compilers on 32‐bit ARM and little‐endian 64‐bit PowerPC has been dropped.
@@ -102,6 +116,8 @@
 
 - `forgejo` main program has been renamed to `bin/forgejo` from the previous `bin/gitea`.
 
+- the "pie" hardening flag has been removed. compilers are expected to enable PIE by default, as has been common practice since 2016 outside of nixpkgs. If a package needs "pie" disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalance of default PIE toolchains most packages incompatible with PIE already pass no-pie.
+
 - `wayclip` now uses the `ext-data-control-v1` Wayland protocol instead of `wlr-data-control-unstable-v1`.
 
 - `cudaPackages.cudatoolkit-legacy-runfile` has been removed.
@@ -152,6 +168,8 @@
 
 - `meilisearch_1_11` has been removed, as it is no longer supported.
 
+- `budgie-desktop` has been updated [10.9.3](https://github.com/BuddiesOfBudgie/budgie-desktop/releases/tag/v10.9.3), this changes `XDG_CURRENT_DESKTOP` from `Budgie:GNOME` to `Budgie`.
+
 - Greetd and its original greeters (`tuigreet`, `gtkgreet`, `qtgreet`, `regreet`, `wlgreet`) were moved from `greetd` namespace to top level (`greetd.tuigreet` -> `tuigreet`, `greetd.greetd` -> `greetd`, etc). The original attrs are available for compatibility as passthrus of `greetd`, but will emit a warning. They will be removed in future releases.
 
 - `carla` no longer support `gtk2` override.
@@ -215,9 +233,10 @@
 - `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatible due to major API changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`.
   Changelog: https://github.com/podofo/podofo/blob/1.0.0/CHANGELOG.md, API-Migration-Guide: https://github.com/podofo/podofo/blob/1.0.0/API-MIGRATION.md.
 
-- NetBox was updated to `>= 4.3.0`. Have a look at the breaking changes
-  of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
-  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_3;` in your configuration.
+- NetBox was updated to `>= 4.4.0`. Have a look at the breaking changes
+  of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.3.0)
+  and the [4.4 release](https://github.com/netbox-community/netbox/releases/tag/v4.4.0),
+  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_4;` in your configuration.
 
 - `privatebin` has been updated to `2.0.0`. This release changes configuration defaults including switching the template and removing legacy features. See the [v2.0.0 changelog entry](https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.0) for details on how to upgrade.
 
@@ -273,6 +292,8 @@
 
 - Added `gitConfig` and `gitConfigFile` option to the nixpkgs `config`, to allow for setting a default `gitConfigFile` for all `fetchgit` invocations.
 
+- Added `npmRegistryOverrides` and `npmRegistryOverridesString` option to the nixpkgs `config`, to allow for setting a default `npmRegistryOverridesString` for all `fetchNpmDeps` invocations.
+
 - The `dockerTools.streamLayeredImage` builder now uses a better algorithm for generating layered docker images, such that much more sharing is possible when the number of store paths exceeds the layer limit. It gives each of the largest store paths its own layer and adds dependencies to those layers when they aren't used elsewhere.
 
 - The systemd initrd will now respect `x-systemd.wants` and `x-systemd.requires` for reliably unlocking multi-disk bcachefs volumes.
@@ -293,7 +314,7 @@
 
 - `idris2` supports being instantiated with a package environment with `idris.withPackages (p: [ ])`
 
-- New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively.
+- New hardening flags `strictflexarrays1`, `strictflexarrays3`, `glibcxxassertions`, `libcxxhardeningfast` and `libcxxhardeningextensive` were made available.
 
 - `gramps` has been updated to 6.0.0
   Upstream recommends [backing up your Family Trees](https://gramps-project.org/wiki/index.php/Gramps_6.0_Wiki_Manual_-_Manage_Family_Trees#Backing_up_a_Family_Tree) before upgrading.
@@ -318,8 +339,6 @@
   and beware that the migration may take several hours depending on your library size and state.
   The process must not be interrupted.
 
-- A new hardening flag, `glibcxxassertions` was made available, corresponding to the glibc `_GLIBCXX_ASSERTIONS` option.
-
 - `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
 
 
@@ -336,6 +355,8 @@
 
 - `nix-prefetch-git`: Added a `--no-add-path` argument to disable adding the path to the store; this is useful when working with a [read-only store](https://nix.dev/manual/nix/2.28/command-ref/new-cli/nix3-help-stores#store-experimental-local-overlay-store-read-only).
 
+- `fetchNpmDeps`: Add `npmRegistryOverridesString` argument to pass NPM registry overrides to the fetcher.
+
 - `sftpman` has been updated to version 2, a rewrite in Rust which is mostly backward compatible but does include some changes to the CLI.
   For more information, [check the project's README](https://github.com/spantaleev/sftpman-rs#is-sftpman-v2-compatible-with-sftpman-v1).
 

doc/stdenv/platform-notes.chapter.md

@@ -47,6 +47,17 @@ See below for how to use a newer deployment target.
 For example, `std::print` depends on features that are only available on macOS 13.3 or newer.
 To make them available, set the deployment target to 13.3 using `darwinMinVersionHook`.
 
+#### Package fails to build due to missing API availability checks {#sec-darwin-availability-checks}
+
+This is normally a bug in the package or a misconfigured deployment target.
+* If it is using an API from a newer release (e.g., from macOS 26.0 while targeting macOS 14.0), it needs to use an availability check.
+  The code should be patched to use [`__builtin_available`](https://clang.llvm.org/docs/LanguageExtensions.html#objective-c-available).
+  Note that while the linked documentation is for Objective-C, it is applicable to C and C++ except that you use `__builtin_available` in place of `@available`.
+* If the package intends to require the newer platform (i.e., it does not support running on older versions with reduced functionality), use `darwinMinVersionHook` to set the deployment target to the required version.
+  See below for how to use a newer deployment target.
+* If the package actually handles this through some other mechanism (e.g., MoltenVK relies on the running platform’s MSL version), the error can be suppressed.
+  To suppress the error, add `-Wno-error=unguarded-availability` to `env.NIX_CFLAGS_COMPILE`.
+
 #### Package requires a non-default SDK or fails to build due to missing frameworks or symbols {#sec-darwin-troubleshooting-using-sdks}
 
 In some cases, you may have to use a non-default SDK.
@@ -106,13 +117,10 @@ The following is a list of Xcode versions, the SDK version in Nixpkgs, and the a
 Check your package’s documentation (platform support or installation instructions) to find which Xcode or SDK version to use.
 Generally, only the last SDK release for a major version is packaged.
 
-| Xcode version      | SDK version        | Nixpkgs attribute            |
-|--------------------|--------------------|------------------------------|
-| 12.0–12.5.1        | 11.3               | `apple-sdk_11` / `apple-sdk` |
-| 13.0–13.4.1        | 12.3               | `apple-sdk_12`               |
-| 14.0–14.3.1        | 13.3               | `apple-sdk_13`               |
-| 15.0–15.4          | 14.4               | `apple-sdk_14`               |
-| 16.0               | 15.0               | `apple-sdk_15`               |
+| Xcode version      | SDK version        | Nixpkgs attribute             |
+|--------------------|--------------------|-------------------------------|
+| 15.0–15.4          | 14.4               | `apple-sdk_14` / `apple-sdk`  |
+| 16.0               | 15.0               | `apple-sdk_15`                |
 
 
 #### Darwin Default SDK versions {#sec-darwin-troubleshooting-darwin-defaults}

doc/stdenv/stdenv.chapter.md

@@ -1631,19 +1631,6 @@ The following flags are disabled by default and should be enabled with `hardenin
 
 This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.
 
-#### `pie` {#pie}
-
-This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for
-
-  - `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues.
-
-  - Statically-linked for OpenBSD builds, where it appears to be required to get a working binary.
-
-Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.
-
-Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option.
-If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`.
-
 #### `strictflexarrays1` {#strictflexarrays1}
 
 This flag adds the `-fstrict-flex-arrays=1` compiler option, which reduces the cases the compiler treats as "flexible arrays" to those declared with length `[1]`, `[0]` or (the correct) `[]`. This increases the coverage of fortify checks, because such arrays declared as the trailing element of a structure can normally not have their intended length determined by the compiler.
@@ -1688,6 +1675,18 @@ Adds the `-D_GLIBCXX_ASSERTIONS` compiler flag. This flag only has an effect on
 
 These checks may have an impact on performance in some cases.
 
+#### `libcxxhardeningfast` {#libcxxhardeningfast}
+
+Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "fast" mode contains a set of security-critical checks that can be done with relatively little overhead in constant time.
+
+Disabling `libcxxhardeningfast` implies disablement of checks from `libcxxhardeningextensive`.
+
+#### `libcxxhardeningextensive` {#libcxxhardeningextensive}
+
+Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "extensive" mode adds checks for undefined behavior that incur relatively little overhead but aren’t security-critical. The additional rigour impacts performance more than fast mode: benchmarking is recommended to determine if it is acceptable for a particular application.
+
+Enabling this flag implies enablement of checks from `libcxxhardeningfast`. Disabling this flag does not imply disablement of checks from `libcxxhardeningfast`.
+
 #### `pacret` {#pacret}
 
 This flag adds the `-mbranch-protection=pac-ret` compiler option on aarch64-linux targets. This uses ARM v8.3's Pointer Authentication feature to sign function return pointers before adding them to the stack. The pointer's authenticity is then validated before returning to its destination. This dramatically increases the difficulty of ROP exploitation techniques.

lib/systems/default.nix

@@ -360,8 +360,8 @@ let
             null;
         # The canonical name for this attribute is darwinSdkVersion, but some
         # platforms define the old name "sdkVer".
-        darwinSdkVersion = final.sdkVer or "11.3";
-        darwinMinVersion = final.darwinSdkVersion;
+        darwinSdkVersion = final.sdkVer or "14.4";
+        darwinMinVersion = "14.0";
         darwinMinVersionVariable =
           if final.isMacOS then
             "MACOSX_DEPLOYMENT_TARGET"

maintainers/scripts/haskell/update-stackage.sh

@@ -99,6 +99,11 @@ sed -r \
     -e '/ Agda /d' \
     -e '/ stack /d' \
     -e '/ git-annex /d' \
+    -e '/ hledger /d' \
+    -e '/ hledger-iadd /d' \
+    -e '/ hledger-lib /d' \
+    -e '/ hledger-ui /d' \
+    -e '/ hledger-web /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.

maintainers/scripts/update.py

@@ -92,7 +92,15 @@ async def attr_instantiation_worker(
 ) -> tuple[Path, str]:
     async with semaphore:
         eprint(f"Instantiating {attr_path}…")
-        return (await nix_instantiate(attr_path), attr_path)
+        try:
+            return (await nix_instantiate(attr_path), attr_path)
+        except Exception as e:
+            # Failure should normally terminate the script but
+            # looks like Python is buggy so we need to do it ourselves.
+            eprint(f"Failed to instantiate {attr_path}")
+            if e.stderr:
+                eprint(e.stderr.decode("utf-8"))
+            sys.exit(1)
 
 
 async def requisites_worker(

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -22,6 +22,14 @@
 
 - COSMIC DE has been updated to the beta version, bringing it closer to its first stable release. This includes updates to its core components, applications, and overall stability.
 
+- GNOME has been updated to version 49.
+
+  - Removes X11 session support. Though you can still run X11 apps using XWayland.
+  - gnome-session’s custom service manager was removed in favour of using systemd.
+  - GDM now allows multiple seats, which is useful for e.g. remote logins. Though we currently [limit this to five greeter instances](https://github.com/NixOS/nixpkgs/issues/458058).
+
+  Refer to the [GNOME release notes](https://release.gnome.org/49/) for more details.
+
 ## New Modules {#sec-release-25.11-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/config/vte.nix

@@ -9,7 +9,7 @@ let
   vteInitSnippet = ''
     # Show current working directory in VTE terminals window title.
     # Supports both bash and zsh, requires interactive shell.
-    . ${pkgs.vte.override { gtkVersion = null; }}/etc/profile.d/vte.sh
+    . ${pkgs.vte-gtk4}/etc/profile.d/vte.sh
   '';
 
 in

nixos/modules/module-list.nix

@@ -569,6 +569,7 @@
   ./services/desktops/gnome/gnome-online-miners.nix
   ./services/desktops/gnome/gnome-remote-desktop.nix
   ./services/desktops/gnome/gnome-settings-daemon.nix
+  ./services/desktops/gnome/gnome-software.nix
   ./services/desktops/gnome/gnome-user-share.nix
   ./services/desktops/gnome/localsearch.nix
   ./services/desktops/gnome/rygel.nix

nixos/modules/security/apparmor/includes.nix

@@ -19,7 +19,7 @@ let
           mode ? "r",
           trail ? "",
         }:
-        lib.optionalString (hasAttr path etc) "${mode} ${config.environment.etc.${path}.source}${trail},";
+        lib.optionalString (hasAttr path etc) "${config.environment.etc.${path}.source}${trail} ${mode},";
     in
     if isAttrs arg then go arg else go { path = arg; };
 in
@@ -93,19 +93,19 @@ in
     ];
     "abstractions/base" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"
-      r ${pkgs.stdenv.cc.libc}/share/locale/**,
-      r ${pkgs.stdenv.cc.libc}/share/locale.alias,
-      r ${config.i18n.glibcLocales}/lib/locale/locale-archive,
+      ${pkgs.stdenv.cc.libc}/share/locale/** r,
+      ${pkgs.stdenv.cc.libc}/share/locale.alias r,
+      ${config.i18n.glibcLocales}/lib/locale/locale-archive r,
       ${etcRule "localtime"}
-      r ${pkgs.tzdata}/share/zoneinfo/**,
-      r ${pkgs.stdenv.cc.libc}/share/i18n/**,
+      ${pkgs.tzdata}/share/zoneinfo/** r,
+      ${pkgs.stdenv.cc.libc}/share/i18n/** r,
     '';
     "abstractions/bash" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash"
 
       # bash inspects filesystems at startup
       # and /etc/mtab is linked to /proc/mounts
-      r @{PROC}/mounts,
+      @{PROC}/mounts r,
 
       # system-wide bash configuration
     ''
@@ -296,8 +296,8 @@ in
       # looking up users by name or id, groups by name or id, hosts by name
       # or IP, etc. These operations may be performed through files, dns,
       # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
-      mr ${getLib pkgs.nss}/lib/libnss_*.so*,
-      mr ${getLib pkgs.nss}/lib64/libnss_*.so*,
+      ${getLib pkgs.nss}/lib/libnss_*.so* mr,
+      ${getLib pkgs.nss}/lib64/libnss_*.so* mr,
     ''
     + lib.concatMapStringsSep "\n" etcRule [
       "group"
@@ -463,11 +463,11 @@ in
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs"
 
       # For the NixOS module: security.acme
-      r /var/lib/acme/*/cert.pem,
-      r /var/lib/acme/*/chain.pem,
-      r /var/lib/acme/*/fullchain.pem,
+      /var/lib/acme/*/cert.pem r,
+      /var/lib/acme/*/chain.pem r,
+      /var/lib/acme/*/fullchain.pem r,
 
-      r /etc/pki/tls/certs/,
+      /etc/pki/tls/certs/ r,
 
     ''
     + lib.concatMapStringsSep "\n" etcRule [
@@ -510,8 +510,8 @@ in
     ];
     "abstractions/ssl_keys" = ''
       # security.acme NixOS module
-      r /var/lib/acme/*/full.pem,
-      r /var/lib/acme/*/key.pem,
+      /var/lib/acme/*/full.pem r,
+      /var/lib/acme/*/key.pem r,
     '';
     "abstractions/vulkan" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/vulkan"

nixos/modules/services/accessibility/orca.nix

@@ -20,9 +20,7 @@ in
 
   config = mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
-    systemd.services.display-manager = lib.mkIf config.services.displayManager.enable {
-      path = [ cfg.package ];
-    };
+    systemd.packages = [ cfg.package ];
     services.speechd.enable = true;
   };
 }

nixos/modules/services/desktop-managers/gnome.nix

@@ -297,8 +297,12 @@ in
 
       systemd.packages = [
         pkgs.gnome-flashback
+        pkgs.metacity
+        (pkgs.gnome-panel-with-modules.override {
+          panelModulePackages = cfg.flashback.panelModulePackages;
+        })
       ]
-      ++ map pkgs.gnome-flashback.mkSystemdTargetForWm flashbackWms;
+      ++ map pkgs.gnome-flashback.mkSystemdTargetForWm cfg.flashback.customSessions;
 
       environment.systemPackages = [
         pkgs.gnome-flashback
@@ -311,9 +315,7 @@ in
         wm: pkgs.gnome-flashback.mkWmApplication { inherit (wm) wmName wmLabel wmCommand; }
       ) flashbackWms)
       # For /share/pkgs.gnome-session/sessions/gnome-flashback-${wmName}.session
-      ++ (map (
-        wm: pkgs.gnome-flashback.mkGnomeSession { inherit (wm) wmName wmLabel enableGnomePanel; }
-      ) flashbackWms);
+      ++ (map (wm: pkgs.gnome-flashback.mkGnomeSession { inherit (wm) wmName wmLabel; }) flashbackWms);
     })
 
     (lib.mkIf serviceCfg.core-os-services.enable {
@@ -444,38 +446,31 @@ in
 
     # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst
     (lib.mkIf serviceCfg.core-apps.enable {
-      environment.systemPackages = utils.removePackagesByName (
-        [
-          pkgs.baobab
-          pkgs.decibels
-          pkgs.epiphany
-          pkgs.gnome-text-editor
-          pkgs.gnome-calculator
-          pkgs.gnome-calendar
-          pkgs.gnome-characters
-          pkgs.gnome-clocks
-          pkgs.gnome-console
-          pkgs.gnome-contacts
-          pkgs.gnome-font-viewer
-          pkgs.gnome-logs
-          pkgs.gnome-maps
-          pkgs.gnome-music
-          pkgs.gnome-system-monitor
-          pkgs.gnome-weather
-          pkgs.loupe
-          pkgs.nautilus
-          pkgs.gnome-connections
-          pkgs.simple-scan
-          pkgs.snapshot
-          pkgs.totem
-          pkgs.yelp
-        ]
-        ++ lib.optionals config.services.flatpak.enable [
-          # Since PackageKit Nix support is not there yet,
-          # only install gnome-software if flatpak is enabled.
-          pkgs.gnome-software
-        ]
-      ) config.environment.gnome.excludePackages;
+      environment.systemPackages = utils.removePackagesByName [
+        pkgs.baobab
+        pkgs.decibels
+        pkgs.epiphany
+        pkgs.gnome-text-editor
+        pkgs.gnome-calculator
+        pkgs.gnome-calendar
+        pkgs.gnome-characters
+        pkgs.gnome-clocks
+        pkgs.gnome-console
+        pkgs.gnome-contacts
+        pkgs.gnome-font-viewer
+        pkgs.gnome-logs
+        pkgs.gnome-maps
+        pkgs.gnome-music
+        pkgs.gnome-system-monitor
+        pkgs.gnome-weather
+        pkgs.loupe
+        pkgs.nautilus
+        pkgs.gnome-connections
+        pkgs.simple-scan
+        pkgs.snapshot
+        pkgs.totem
+        pkgs.yelp
+      ] config.environment.gnome.excludePackages;
 
       # Enable default program modules
       # Since some of these have a corresponding package, we only
@@ -488,6 +483,12 @@ in
       programs.seahorse.enable = notExcluded pkgs.seahorse;
       services.gnome.sushi.enable = notExcluded pkgs.sushi;
 
+      # Since PackageKit Nix support is not there yet,
+      # only install gnome-software if flatpak is enabled.
+      services.gnome.gnome-software.enable = lib.mkIf config.services.flatpak.enable (
+        notExcluded pkgs.gnome-software
+      );
+
       # VTE shell integration for gnome-console
       programs.bash.vteIntegration = mkDefault true;
       programs.zsh.vteIntegration = mkDefault true;

nixos/modules/services/desktops/gnome/gnome-initial-setup.nix

@@ -77,9 +77,11 @@ in
     ];
 
     systemd.user.targets."gnome-session".wants = [
-      "gnome-initial-setup-copy-worker.service"
       "gnome-initial-setup-first-login.service"
-      "gnome-welcome-tour.service"
+    ];
+
+    systemd.user.targets."graphical-session-pre".wants = [
+      "gnome-initial-setup-copy-worker.service"
     ];
 
     systemd.user.targets."gnome-session@gnome-initial-setup".wants = [
@@ -89,6 +91,11 @@ in
     programs.dconf.profiles.gnome-initial-setup.databases = [
       "${pkgs.gnome-initial-setup}/share/gnome-initial-setup/initial-setup-dconf-defaults"
     ];
+
+    users = {
+      # TODO: switch to using provided gnome-initial-setup sysusers.d
+      groups.gnome-initial-setup = { };
+    };
   };
 
 }

nixos/modules/services/desktops/gnome/gnome-software.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+{
+  meta = {
+    maintainers = lib.teams.gnome.members;
+  };
+
+  options = {
+    services.gnome.gnome-software = {
+      enable = lib.mkEnableOption "GNOME Software, package manager for GNOME";
+    };
+  };
+
+  config = lib.mkIf config.services.gnome.gnome-software.enable {
+    environment.systemPackages = [
+      pkgs.gnome-software
+    ];
+
+    systemd.packages = [
+      pkgs.gnome-software
+    ];
+  };
+}

nixos/modules/services/display-managers/gdm.nix

@@ -183,10 +183,44 @@ in
       name = "gdm";
       uid = config.ids.uids.gdm;
       group = "gdm";
-      home = "/run/gdm";
       description = "GDM user";
     };
 
+    users.users.gdm-greeter = {
+      isSystemUser = true;
+      uid = 60578;
+      group = "gdm";
+      home = "/run/gdm";
+    };
+
+    users.users.gdm-greeter-1 = {
+      isSystemUser = true;
+      uid = 60579;
+      group = "gdm";
+      home = "/run/gdm-1";
+    };
+
+    users.users.gdm-greeter-2 = {
+      isSystemUser = true;
+      uid = 60580;
+      group = "gdm";
+      home = "/run/gdm-2";
+    };
+
+    users.users.gdm-greeter-3 = {
+      isSystemUser = true;
+      uid = 60581;
+      group = "gdm";
+      home = "/run/gdm-3";
+    };
+
+    users.users.gdm-greeter-4 = {
+      isSystemUser = true;
+      uid = 60582;
+      group = "gdm";
+      home = "/run/gdm-4";
+    };
+
     users.groups.gdm.gid = config.ids.gids.gdm;
 
     # GDM needs different xserverArgs, presumable because using wayland by default.
@@ -348,15 +382,15 @@ in
     # GDM LFS PAM modules, adapted somehow to NixOS
     security.pam.services = {
       gdm-launch-environment.text = ''
-        auth     required       pam_succeed_if.so audit quiet_success user = gdm
+        auth     required       pam_succeed_if.so audit quiet_success user ingroup gdm
         auth     optional       pam_permit.so
 
-        account  required       pam_succeed_if.so audit quiet_success user = gdm
+        account  required       pam_succeed_if.so audit quiet_success user ingroup gdm
         account  sufficient     pam_unix.so
 
         password required       pam_deny.so
 
-        session  required       pam_succeed_if.so audit quiet_success user = gdm
+        session  required       pam_succeed_if.so audit quiet_success user ingroup gdm
         session  required       pam_env.so conffile=/etc/pam/environment readenv=0
         session  optional       ${config.systemd.package}/lib/security/pam_systemd.so
         session  optional       pam_keyinit.so force revoke

nixos/modules/services/networking/murmur.nix

@@ -401,40 +401,40 @@ in
     ];
 
     security.apparmor.policies."bin.mumble-server".profile = ''
+      abi <abi/4.0>,
       include <tunables/global>
 
-      ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} {
+      profile ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
         include "${pkgs.apparmorRulesFromClosure { name = "mumble-server"; } cfg.package}"
-        pix ${cfg.package}/bin/.mumble-server-wrapped,
+        ${cfg.package}/bin/.mumble-server-wrapped pix,
 
-        r ${config.environment.etc."os-release".source},
-        r ${config.environment.etc."lsb-release".source},
-        owner rwk ${cfg.stateDir}/murmur.sqlite,
-        owner rw ${cfg.stateDir}/murmur.sqlite-journal,
-        owner r ${cfg.stateDir}/,
-        r /run/murmur/murmurd.pid,
-        r /run/murmur/murmurd.ini,
-        r ${configFile},
-    ''
-    + lib.optionalString cfg.logToFile ''
-      rw /var/log/murmur/murmurd.log,
-    ''
-    + lib.optionalString (cfg.sslCert != null) ''
-      r ${cfg.sslCert},
-    ''
-    + lib.optionalString (cfg.sslKey != null) ''
-      r ${cfg.sslKey},
-    ''
-    + lib.optionalString (cfg.sslCa != null) ''
-      r ${cfg.sslCa},
-    ''
-    + lib.optionalString (cfg.dbus != null) ''
-      dbus bus=${cfg.dbus}
-    ''
-    + ''
+        ${config.environment.etc."os-release".source} r,
+        ${config.environment.etc."lsb-release".source} r,
+        owner ${cfg.stateDir}/murmur.sqlite rwk,
+        owner ${cfg.stateDir}/murmur.sqlite-journal rw,
+        owner ${cfg.stateDir}/ r,
+        /run/murmur/murmurd.pid r,
+        /run/murmur/murmurd.ini r,
+        ${configFile} r,
+        ${lib.optionalString cfg.logToFile ''
+          /var/log/murmur/murmurd.log rw,
+        ''}
+        ${lib.optionalString (cfg.sslCert != null) ''
+          ${cfg.sslCert} r,
+        ''}
+        ${lib.optionalString (cfg.sslKey != null) ''
+          ${cfg.sslKey} r,
+        ''}
+        ${lib.optionalString (cfg.sslCa != null) ''
+          ${cfg.sslCa} r,
+        ''}
+        ${lib.optionalString (cfg.dbus != null) ''
+          dbus bus=${cfg.dbus},
+        ''}
+        include if exists <local/bin.mumble-server>
       }
     '';
   };

nixos/modules/services/torrent/transmission.nix

@@ -585,23 +585,23 @@ in
       include "${cfg.package.apparmor}/bin.transmission-daemon"
     '';
     security.apparmor.includes."local/bin.transmission-daemon" = ''
-      r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},
+      ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE} r,
 
-      owner rw ${cfg.home}/${settingsDir}/**,
-      rw ${cfg.settings.download-dir}/**,
+      owner ${cfg.home}/${settingsDir}/** rw,
+      ${cfg.settings.download-dir}/** rw,
       ${optionalString cfg.settings.incomplete-dir-enabled ''
-        rw ${cfg.settings.incomplete-dir}/**,
+        ${cfg.settings.incomplete-dir}/** rw,
       ''}
       ${optionalString cfg.settings.watch-dir-enabled ''
-        r${optionalString cfg.settings.trash-original-torrent-files "w"} ${cfg.settings.watch-dir}/**,
+        ${cfg.settings.watch-dir}/** r${optionalString cfg.settings.trash-original-torrent-files "w"},
       ''}
       profile dirs {
-        rw ${cfg.settings.download-dir}/**,
+        ${cfg.settings.download-dir}/** rw,
         ${optionalString cfg.settings.incomplete-dir-enabled ''
-          rw ${cfg.settings.incomplete-dir}/**,
+          ${cfg.settings.incomplete-dir}/** rw,
         ''}
         ${optionalString cfg.settings.watch-dir-enabled ''
-          r${optionalString cfg.settings.trash-original-torrent-files "w"} ${cfg.settings.watch-dir}/**,
+          ${cfg.settings.watch-dir}/** r${optionalString cfg.settings.trash-original-torrent-files "w"},
         ''}
       }
 
@@ -612,12 +612,12 @@ in
           # any existing profile for script-torrent-done-filename
           # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
           # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
-          px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
+          ${cfg.settings.script-torrent-done-filename} px -> &@{dirs},
         ''
       }
 
       ${optionalString (cfg.webHome != null) ''
-        r ${cfg.webHome}/**,
+        ${cfg.webHome}/** r,
       ''}
     '';
   };

nixos/modules/services/web-apps/miniflux.nix

@@ -207,15 +207,18 @@ in
     environment.systemPackages = [ cfg.package ];
 
     security.apparmor.policies."bin.miniflux".profile = ''
+      abi <abi/4.0>,
       include <tunables/global>
-      ${cfg.package}/bin/miniflux {
+
+      profile ${cfg.package}/bin/miniflux {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
         include <abstractions/golang>
         include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
-        r ${cfg.package}/bin/miniflux,
-        rw /run/miniflux/**,
+        ${cfg.package}/bin/miniflux r,
+        /run/miniflux/** rw,
+        include if exists <local/bin.miniflux>
       }
     '';
   };

nixos/modules/services/web-apps/netbox.nix

@@ -109,10 +109,10 @@ in
     package = lib.mkOption {
       type = lib.types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "25.11" then pkgs.netbox_4_3 else pkgs.netbox_4_2;
+        if lib.versionAtLeast config.system.stateVersion "25.11" then pkgs.netbox_4_4 else pkgs.netbox_4_2;
       defaultText = lib.literalExpression ''
         if lib.versionAtLeast config.system.stateVersion "25.11"
-        then pkgs.netbox_4_3
+        then pkgs.netbox_4_4
         else pkgs.netbox_4_2;
       '';
       description = ''

nixos/tests/all-tests.nix

@@ -1011,6 +1011,7 @@ in
   netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
   netbox_4_2 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_2; };
   netbox_4_3 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_3; };
+  netbox_4_4 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_4; };
   netdata = runTest ./netdata.nix;
   networking.networkd = handleTest ./networking/networkd-and-scripted.nix { networkd = true; };
   networking.networkmanager = handleTest ./networking/networkmanager.nix { };

nixos/tests/budgie.nix

@@ -42,13 +42,7 @@
     in
     ''
       with subtest("Wait for login"):
-          # wait_for_x() checks graphical-session.target, which is expected to be
-          # inactive on Budgie before Budgie manages user session with systemd.
-          # https://github.com/BuddiesOfBudgie/budgie-desktop/blob/39e9f0895c978f76/src/session/budgie-desktop.in#L16
-          #
-          # Previously this was unconditionally touched by xsessionWrapper but was
-          # changed in #233981 (we have Budgie:GNOME in XDG_CURRENT_DESKTOP).
-          # machine.wait_for_x()
+          machine.wait_for_x()
           machine.wait_until_succeeds('journalctl -t budgie-session-binary --grep "Entering running state"')
           machine.wait_for_file("${user.home}/.Xauthority")
           machine.succeed("xauth merge ${user.home}/.Xauthority")
@@ -58,8 +52,9 @@
           machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Check if Budgie session components actually start"):
-          for i in ["budgie-daemon", "budgie-panel", "budgie-wm", "budgie-desktop-view", "gsd-media-keys"]:
-              machine.wait_until_succeeds(f"pgrep -f {i}")
+          for i in ["budgie-daemon", "budgie-panel", "budgie-wm", "bsd-media-keys", "gsd-xsettings"]:
+              machine.wait_until_succeeds(f"pgrep {i}")
+          machine.wait_until_succeeds("pgrep -xf /run/current-system/sw/bin/org.buddiesofbudgie.budgie-desktop-view")
           # We don't check xwininfo for budgie-wm.
           # See https://github.com/NixOS/nixpkgs/pull/216737#discussion_r1155312754
           machine.wait_for_window("budgie-daemon")
@@ -67,7 +62,7 @@
 
       with subtest("Check if various environment variables are set"):
           cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/budgie-wm)/environ"
-          machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Budgie:GNOME'")
+          machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Budgie'")
           machine.succeed(f"{cmd} | grep 'BUDGIE_PLUGIN_DATADIR' | grep '${pkgs.budgie-desktop-with-plugins.pname}'")
           # From the nixos/budgie module
           machine.succeed(f"{cmd} | grep 'SSH_AUTH_SOCK' | grep 'gcr'")

nixos/tests/gnome-flashback.nix

@@ -26,8 +26,17 @@
 
       services.desktopManager.gnome.enable = true;
       services.desktopManager.gnome.debug = true;
-      services.desktopManager.gnome.flashback.enableMetacity = true;
-      services.displayManager.defaultSession = "gnome-flashback-metacity";
+
+      services.desktopManager.gnome.flashback.customSessions = [
+        {
+          # Intentionally a different name to test mkSystemdTargetForWm.
+          wmName = "metacitytest";
+          wmLabel = "Metacity";
+          wmCommand = "${pkgs.metacity}/bin/metacity";
+          enableGnomePanel = true;
+        }
+      ];
+      services.displayManager.defaultSession = "gnome-flashback-metacitytest";
     };
 
   testScript =
@@ -40,7 +49,7 @@
     ''
       with subtest("Login to GNOME Flashback with GDM"):
           machine.wait_for_x()
-          machine.wait_until_succeeds('journalctl -t gnome-session-binary --grep "Entering running state"')
+          machine.wait_until_succeeds('journalctl -t gnome-session-service --grep "Entering running state"')
           # Wait for alice to be logged in"
           machine.wait_for_unit("default.target", "${user.name}")
           machine.wait_for_file("${xauthority}")

nixos/tests/login.nix

@@ -48,13 +48,12 @@
         machine.wait_for_file("/home/alice/done")
 
     with subtest("Systemd gives and removes device ownership as needed"):
-        # Change back to /dev/snd/timer after systemd-258.1
-        machine.succeed("getfacl /dev/dri/card0 | grep -q alice")
+        machine.succeed("getfacl /dev/snd/timer | grep -q alice")
         machine.send_key("alt-f1")
         machine.wait_until_succeeds("[ $(fgconsole) = 1 ]")
-        machine.fail("getfacl /dev/dri/card0 | grep -q alice")
+        machine.fail("getfacl /dev/snd/timer | grep -q alice")
         machine.succeed("chvt 2")
-        machine.wait_until_succeeds("getfacl /dev/dri/card0 | grep -q alice")
+        machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice")
 
     with subtest("Virtual console logout"):
         machine.send_chars("exit\n")

nixos/tests/pantheon.nix

@@ -66,7 +66,7 @@
 
       with subtest("Login with elementary-greeter"):
           machine.send_chars("${user.password}\n")
-          machine.wait_until_succeeds('journalctl -t gnome-session-binary --grep "Entering running state"')
+          machine.wait_until_succeeds('journalctl -t gnome-session-service --grep "Entering running state"')
 
       with subtest("Wait for wayland server"):
           machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")

nixos/tests/web-apps/netbox-upgrade.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, ... }:
 let
-  oldNetbox = "netbox_4_2";
-  newNetbox = "netbox_4_3";
+  oldNetbox = "netbox_4_3";
+  newNetbox = "netbox_4_4";
 
   apiVersion =
     version:

nixos/tests/web-apps/netbox/testScript.py

@@ -61,7 +61,7 @@ def compare(a: str, b: str):
     return 0
 
 with subtest("Home screen loads"):
-    machine.succeed(
+    machine.wait_until_succeeds(
         "curl -sSfL http://[::1]:8001 | grep '<title>Home | NetBox</title>'"
     )
 

pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix

@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
     faust2lv2
   ];
 
-  # ld: crtbegin.o: relocation R_X86_64_32 against hidden symbol `__TMC_END__' can not be used when making a PIE object
-  # ld: failed to set dynamic section sizes: bad value
-  hardeningDisable = [ "pie" ];
-
   enableParallelBuilding = true;
 
   dontWrapQtApps = true;

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1833";
+  version = "9.1.1869";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-bcHTwrJt7ERsIYydCj+Um4AY7sREtkdkqlEA0OdgnuM=";
+    hash = "sha256-AHx4AHsJAsEE5LRzKgBeV3LoCaoHUB+0/gq7kOHObMk=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/emulators/wine/base.nix

@@ -40,12 +40,6 @@ let
     };
   } ./setup-hook-darwin.sh;
 
-  # Using the 14.4 SDK allows Wine to use `os_sync_wait_on_address` for its futex implementation on Darwin.
-  # It does an availability check, so older systems will still work.
-  darwinFrameworks = lib.optionals stdenv.hostPlatform.isDarwin (
-    toBuildInputs pkgArches (pkgs: [ pkgs.apple-sdk_14 ])
-  );
-
   # Building Wine with these flags isn’t supported on Darwin. Using any of them will result in an evaluation failures
   # because they will put Darwin in `meta.badPlatforms`.
   darwinUnsupportedFlags = [
@@ -168,7 +162,6 @@ stdenv.mkDerivation (
           pkgs.libGL
           pkgs.libdrm
         ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin darwinFrameworks
         ++ lib.optionals x11Support (
           with pkgs.xorg;
           [
@@ -213,11 +206,7 @@ stdenv.mkDerivation (
     # LD_LIBRARY_PATH.
     NIX_LDFLAGS = toString (
       map (path: "-rpath " + path) (
-        map (x: "${lib.getLib x}/lib") (
-          [ stdenv.cc.cc ]
-          # Avoid adding rpath references to non-existent framework `lib` paths.
-          ++ lib.subtractLists darwinFrameworks finalAttrs.buildInputs
-        )
+        map (x: "${lib.getLib x}/lib") [ stdenv.cc.cc ]
         # libpulsecommon.so is linked but not found otherwise
         ++ lib.optionals supportFlags.pulseaudioSupport (
           map (x: "${lib.getLib x}/lib/pulseaudio") (toBuildInputs pkgArches (pkgs: [ pkgs.libpulseaudio ]))

pkgs/applications/networking/cluster/linkerd/generic.nix

@@ -31,11 +31,6 @@ buildGoModule rec {
     env GOFLAGS="" go generate ./jaeger/static
     env GOFLAGS="" go generate ./multicluster/static
     env GOFLAGS="" go generate ./viz/static
-
-    # Necessary for building Musl
-    if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
-        export GOFLAGS="-buildmode=pie $GOFLAGS"
-    fi
   '';
 
   tags = [

pkgs/applications/networking/irc/weechat/default.nix

@@ -158,8 +158,6 @@ stdenv.mkDerivation rec {
   ++ lib.concatMap (p: p.buildInputs) enabledPlugins
   ++ extraBuildInputs;
 
-  hardeningEnable = [ "pie" ];
-
   env.NIX_CFLAGS_COMPILE =
     "-I${python}/include/${python.libPrefix}"
     # Fix '_res_9_init: undefined symbol' error

pkgs/applications/networking/mailreaders/astroid/default.nix

@@ -41,6 +41,11 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     sed -i "s~gvim ~${vim}/bin/vim -g ~g" src/config.cc
     sed -i "s~ -geom 10x10~~g" src/config.cc
+
+    # Switch to girepository-2.0
+    substituteInPlace src/plugin/gir_main.c \
+      --replace-fail "<girepository.h>" "<girepository/girepository.h>" \
+      --replace-fail "g_irepository_get_option_group" "gi_repository_get_option_group"
   '';
 
   nativeBuildInputs = [

pkgs/applications/networking/mailreaders/evolution/evolution/default.nix

@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  fetchpatch,
   cmake,
   ninja,
   intltool,
@@ -47,23 +46,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.56.2";
+  version = "3.58.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-ff3JrrLasybav9wfhXfE7MEjoS2gAS+MZKcmBlo8Cys=";
+    hash = "sha256-Nz/hdFow9x8RN1XvKvwwp6F2imA2GVpk2wUplacaGr8=";
   };
 
-  patches = [
-    # fix crash when opening attachment with recent webkitgtk versions
-    # https://gitlab.gnome.org/GNOME/evolution/-/issues/3124
-    # remove when updating to 3.58.0
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/evolution/-/commit/811a6df1f990855e49ecc0ba7b1a7f7a5ec251e6.patch";
-      hash = "sha256-Aj8H7PnAblInX2zRPQH7n0HOdLNuhITNHunWRYCPBsI=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     intltool

pkgs/applications/networking/p2p/transmission/4.nix

@@ -175,21 +175,22 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     mkdir $apparmor
     cat >$apparmor/bin.transmission-daemon <<EOF
+    abi <abi/4.0>,
     include <tunables/global>
-    $out/bin/transmission-daemon {
+    profile $out/bin/transmission-daemon {
       include <abstractions/base>
       include <abstractions/nameservice>
       include <abstractions/ssl_certs>
       include "${apparmorRules}"
-      r @{PROC}/sys/kernel/random/uuid,
-      r @{PROC}/sys/vm/overcommit_memory,
-      r @{PROC}/@{pid}/environ,
-      r @{PROC}/@{pid}/mounts,
-      rwk /tmp/tr_session_id_*,
+      @{PROC}/sys/kernel/random/uuid r,
+      @{PROC}/sys/vm/overcommit_memory r,
+      @{PROC}/@{pid}/environ r,
+      @{PROC}/@{pid}/mounts r,
+      /tmp/tr_session_id_* rwk,
 
-      r $out/share/transmission/public_html/**,
+      $out/share/transmission/public_html/** r,
 
-      include <local/bin.transmission-daemon>
+      include if exists <local/bin.transmission-daemon>
     }
     EOF
     install -Dm0444 -t $out/share/icons ../qt/icons/transmission.svg

pkgs/applications/networking/sync/rsync/default.nix

@@ -19,7 +19,6 @@
   enableZstd ? true,
   zstd,
   nixosTests,
-  fakeroot,
 }:
 
 stdenv.mkDerivation rec {
@@ -58,9 +57,6 @@ stdenv.mkDerivation rec {
   ++ lib.optional enableOpenSSL openssl
   ++ lib.optional enableXXHash xxHash;
 
-  # fakeroot doesn't work well on darwin anymore, apparently
-  checkInputs = lib.optionals (!stdenv.isDarwin) [ fakeroot ];
-
   configureFlags = [
     (lib.enableFeature enableLZ4 "lz4")
     (lib.enableFeature enableOpenSSL "openssl")

pkgs/applications/office/pdfmixtool/default.nix

@@ -1,60 +0,0 @@
-{
-  lib,
-  mkDerivation,
-  fetchFromGitLab,
-  fetchpatch,
-  fetchpatch2,
-  cmake,
-  pkg-config,
-  qtbase,
-  qttools,
-  qpdf,
-  podofo,
-  imagemagick,
-}:
-
-mkDerivation rec {
-  pname = "pdfmixtool";
-  version = "1.1.1";
-
-  src = fetchFromGitLab {
-    owner = "scarpetta";
-    repo = "pdfmixtool";
-    rev = "v${version}";
-    hash = "sha256-fgtRKUG6J/CM6cXUTHWAPemqL8loWZT3wZmGdRHldq8=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-
-  buildInputs = [
-    imagemagick
-    qtbase
-    qttools
-    qpdf
-    podofo
-  ];
-
-  patches = [
-    # fix incompatibility with qpdf11.3.0 usage of c++17 - delete this patch when we reach pdfmixtool version > v1.1.1
-    (fetchpatch {
-      url = "https://gitlab.com/scarpetta/pdfmixtool/-/commit/bd5f78c3a4d977d9b0c74302ce2521c737189b43.diff";
-      hash = "sha256-h2g5toFqgEEnObd2TYQms1a1WFTgN7VsIHyy0Uyq4/I=";
-    })
-    # https://gitlab.com/scarpetta/pdfmixtool/-/merge_requests/14
-    (fetchpatch2 {
-      url = "https://gitlab.com/scarpetta/pdfmixtool/-/commit/268291317ccd1805dc1c801ff88641ba06c6a7f0.patch";
-      hash = "sha256-56bDoFtE+IOQHcV9xPfyrgYYFvTfB0QiLIfRl91irb0=";
-    })
-  ];
-
-  meta = with lib; {
-    description = "Application to split, merge, rotate and mix PDF files";
-    mainProgram = "pdfmixtool";
-    homepage = "https://gitlab.com/scarpetta/pdfmixtool";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ onny ];
-  };
-}

pkgs/applications/version-management/git/default.nix

@@ -60,7 +60,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.51.0";
+  version = "2.51.2";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [
     CGI
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
         }.tar.xz"
       else
         "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-YKfCJRzC5YjVzYe65WcmBhfG3gwi3KnNv8TH0riZC2I=";
+    hash = "sha256-Iz1xQ6LVjmB1Xu6bdvVZ7HPqKzwpf1tQMWKs6VlmtOM=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -489,6 +489,12 @@ stdenv.mkDerivation (finalAttrs: {
     disable_test t5319-multi-pack-index
     disable_test t6421-merge-partial-clone
     disable_test t7504-commit-msg-hook
+    disable_test t5515-fetch-merge-logic
+    disable_test t4104-apply-boundary
+    disable_test t7002-mv-sparse-checkout
+    disable_test t4122-apply-symlink-inside
+    disable_test t7513-interpret-trailers
+    disable_test t2200-add-update
 
     # Fails reproducibly on ZFS on Linux with formD normalization
     disable_test t0021-conversion

pkgs/applications/virtualization/qemu/default.nix

@@ -32,8 +32,6 @@
   socat,
   libslirp,
   libcbor,
-  apple-sdk_13,
-  darwinMinVersionHook,
   guestAgentSupport ?
     (with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows) && !minimal,
   numaSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32 && !minimal,
@@ -128,14 +126,6 @@ assert lib.assertMsg (
 
 let
   hexagonSupport = hostCpuTargets == null || lib.elem "hexagon" hostCpuTargets;
-
-  # needed in buildInputs and depsBuildBuild
-  # check log for warnings eg: `warning: 'hv_vm_config_get_max_ipa_size' is only available on macOS 13.0`
-  # to indicate if min version needs to get bumped.
-  darwinSDK = [
-    apple-sdk_13
-    (darwinMinVersionHook "13")
-  ];
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -156,7 +146,6 @@ stdenv.mkDerivation (finalAttrs: {
   depsBuildBuild = [
     buildPackages.stdenv.cc
   ]
-  ++ lib.optionals stdenv.buildPlatform.isDarwin darwinSDK
   ++ lib.optionals hexagonSupport [ pkg-config ];
 
   nativeBuildInputs = [
@@ -205,7 +194,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!userOnly) [ curl ]
   ++ lib.optionals ncursesSupport [ ncurses ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin darwinSDK
   ++ lib.optionals seccompSupport [ libseccomp ]
   ++ lib.optionals numaSupport [ numactl ]
   ++ lib.optionals alsaSupport [ alsa-lib ]

pkgs/build-support/bintools-wrapper/add-hardening.sh

@@ -15,7 +15,7 @@ for flag in @hardening_unsupported_flags@; do
 done
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(pie relro bindnow)
+  declare -a allHardeningFlags=(relro bindnow)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -36,16 +36,6 @@ fi
 
 for flag in "${!hardeningEnableMap[@]}"; do
   case $flag in
-    pie)
-      if [[ ! (" ${params[*]} " =~ " -shared " \
-            || " ${params[*]} " =~ " -static " \
-            || " ${params[*]} " =~ " -r " \
-            || " ${params[*]} " =~ " -Ur " \
-            || " ${params[*]} " =~ " -i ") ]]; then
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
-        hardeningLDFlags+=('-pie')
-      fi
-      ;;
     relro)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
       hardeningLDFlags+=('-z' 'relro')

pkgs/build-support/bintools-wrapper/default.nix

@@ -49,30 +49,15 @@
     "format"
     "fortify"
     "fortify3"
+    "libcxxhardeningextensive"
+    "libcxxhardeningfast"
     "pic"
     "relro"
     "stackclashprotection"
     "stackprotector"
     "strictoverflow"
     "zerocallusedregs"
-  ]
-  ++ lib.optional (
-    with stdenvNoCC;
-    lib.any (x: x) [
-      # OpenBSD static linking requires PIE
-      (with targetPlatform; isOpenBSD && isStatic)
-      (lib.all (x: x) [
-        # Musl-based platforms will keep "pie", other platforms will not.
-        # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
-        # in the nixpkgs manual to inform users about the defaults.
-        (targetPlatform.libc == "musl")
-        # Except when:
-        #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
-        #    - static armv7l, where compilation fails.
-        (!(targetPlatform.isAarch && targetPlatform.isStatic))
-      ])
-    ]
-  ) "pie",
+  ],
 }:
 
 assert propagateDoc -> bintools ? man;

pkgs/build-support/build-mozilla-mach/142-relax-apple-sdk.patch

@@ -1,13 +0,0 @@
-diff --git a/build/moz.configure/toolchain.configure b/build/moz.configure/toolchain.configure
-index 37c00230c853..dd89bea24392 100644
---- a/build/moz.configure/toolchain.configure
-+++ b/build/moz.configure/toolchain.configure
-@@ -233,7 +233,7 @@ with only_when(host_is_osx | target_is_osx):
-     )
- 
-     def mac_sdk_min_version():
--        return "15.5"
-+        return "15.2"
- 
-     @depends(
-         "--with-macos-sdk",

pkgs/build-support/build-mozilla-mach/default.nix

@@ -328,15 +328,6 @@ buildStdenv.mkDerivation {
       # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
       ./139-wayland-drag-animation.patch
     ]
-    ++
-      lib.optionals
-        (
-          (lib.versionAtLeast version "141.0.2" && lib.versionOlder version "145.0")
-          || (lib.versionAtLeast version "140.2.0" && lib.versionOlder version "141.0")
-        )
-        [
-          ./142-relax-apple-sdk.patch
-        ]
     ++ extraPatches;
 
   postPatch = ''

pkgs/build-support/buildenv/builder.pl

@@ -15,7 +15,7 @@ $SIG{__DIE__}  = sub { die "pkgs.buildEnv error: ", @_ };
 my $out = $ENV{"out"};
 my $extraPrefix = $ENV{"extraPrefix"};
 
-my @pathsToLink = split ' ', $ENV{"pathsToLink"};
+my @pathsToLink = @{decode_json $ENV{"pathsToLinkJSON"}};
 
 sub isInPathsToLink($path) {
     $path = "/" if $path eq "";

pkgs/build-support/buildenv/default.nix

@@ -105,6 +105,7 @@ lib.makeOverridable (
           nativeBuildInputs
           buildInputs
           ;
+        pathsToLinkJSON = builtins.toJSON pathsToLink;
         pkgs = builtins.toJSON chosenOutputs;
         extraPathsFrom = lib.optional includeClosures (writeClosure pathsForClosure);
         preferLocalBuild = true;

pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh

@@ -35,3 +35,7 @@ elif [[ $0 != *cpp ]]; then
         extraBefore+=(-mabi=@explicitAbiValue@)
     fi
 fi
+
+if [[ "@darwinMinVersion@" ]]; then
+    extraBefore+=(-Werror=unguarded-availability)
+fi

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -25,6 +25,13 @@ if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
   hardeningEnableMap["strictflexarrays1"]=1
 fi
 
+# libcxxhardeningextensive implies libcxxhardeningfast enablement - make explicit before
+# we filter unsupported flags because unsupporting libcxxhardeningextensive
+# doesn't mean we should unsupport libcxxhardeningfast too
+if [[ -n "${hardeningEnableMap[libcxxhardeningextensive]-}" ]]; then
+  hardeningEnableMap["libcxxhardeningfast"]=1
+fi
+
 
 # Remove unsupported flags.
 for flag in @hardening_unsupported_flags@; do
@@ -37,6 +44,10 @@ for flag in @hardening_unsupported_flags@; do
   if [[ "$flag" = 'strictflexarrays1' ]] ; then
     unset -v "hardeningEnableMap['strictflexarrays3']"
   fi
+  # libcxxhardeningfast being unsupported implies libcxxhardeningextensive is unsupported
+  if [[ "$flag" = 'libcxxhardeningfast' ]] ; then
+    unset -v "hardeningEnableMap['libcxxhardeningextensive']"
+  fi
 done
 
 
@@ -50,9 +61,14 @@ if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
   unset -v "hardeningEnableMap['strictflexarrays1']"
 fi
 
+# now make libcxxhardeningfast and libcxxhardeningextensive mutually exclusive
+if [[ -n "${hardeningEnableMap[libcxxhardeningextensive]-}" ]]; then
+  unset -v "hardeningEnableMap['libcxxhardeningfast']"
+fi
+
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pie pic strictoverflow glibcxxassertions format trivialautovarinit zerocallusedregs)
+  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pic strictoverflow libcxxhardeningfast libcxxhardeningextensive glibcxxassertions format trivialautovarinit zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -115,27 +131,26 @@ for flag in "${!hardeningEnableMap[@]}"; do
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling glibcxxassertions >&2; fi
       hardeningCFlagsBefore+=('-D_GLIBCXX_ASSERTIONS')
       ;;
+    libcxxhardeningfast)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling libcxxhardeningfast >&2; fi
+      hardeningCFlagsBefore+=('-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST')
+      ;;
+    libcxxhardeningextensive)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling libcxxhardeningextensive >&2; fi
+      hardeningCFlagsBefore+=('-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE')
+      ;;
     stackprotector)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
       hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
       ;;
     stackclashprotection)
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stack-clash-protection >&2; fi
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackclashprotection >&2; fi
       hardeningCFlagsBefore+=('-fstack-clash-protection')
       ;;
     nostrictaliasing)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling nostrictaliasing >&2; fi
       hardeningCFlagsBefore+=('-fno-strict-aliasing')
       ;;
-    pie)
-      # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
-      hardeningCFlagsBefore=('-fPIE' "${hardeningCFlagsBefore[@]}")
-      if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
-        hardeningCFlagsBefore=('-pie' "${hardeningCFlagsBefore[@]}")
-      fi
-      ;;
     pic)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
       hardeningCFlagsBefore+=('-fPIC')

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -140,6 +140,15 @@ if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then
     params=(${kept+"${kept[@]}"})
 fi
 
+# Some build systems such as Bazel and SwiftPM use `clang` instead of `clang++`,
+# which will find the libc++ headers in the sysroot for C++ files.
+if [[ "$isCxx" = 0 && "@isClang@" ]]; then
+# This duplicates the behavior of a native toolchain, which can find the
+# libc++ headers but requires `-lc++` to be specified explicitly when linking.
+    isCxx=1
+    cxxLibrary=0
+fi
+
 if [[ "$isCxx" = 1 ]]; then
     if [[ "$cxxInclude" = 1 ]]; then
         #

pkgs/build-support/cc-wrapper/default.nix

@@ -753,14 +753,14 @@ stdenvNoCC.mkDerivation {
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
     + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
       for dir in ${gccForLibs}/include/c++/*; do
-        include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
+        include -cxx-isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
       for dir in ${gccForLibs}/include/c++/*/${targetPlatform.config}; do
-        include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
+        include -cxx-isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
     ''
     + optionalString (libcxx.isLLVM or false) ''
-      include -isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
+      include -cxx-isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
     ''
     # GCC NG friendly libc++

pkgs/build-support/go/module.nix

@@ -250,6 +250,12 @@ lib.extendMkDerivation {
             export GOPATH="$TMPDIR/go"
             export GOPROXY=off
             export GOSUMDB=off
+            if [ -f "$NIX_CC_FOR_TARGET/nix-support/dynamic-linker" ]; then
+              export GO_LDSO=$(cat $NIX_CC_FOR_TARGET/nix-support/dynamic-linker)
+            fi
+            if [ "$CGO_ENABLED" = "0" ]; then
+              export GOFLAGS="-buildmode=exe $GOFLAGS"
+            fi
             cd "$modRoot"
           ''
           + lib.optionalString (finalAttrs.vendorHash != null) ''
@@ -266,13 +272,6 @@ lib.extendMkDerivation {
             }
           ''
           + ''
-
-            # currently pie is only enabled by default in pkgsMusl
-            # this will respect the `hardening{Disable,Enable}` flags if set
-            if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
-              export GOFLAGS="-buildmode=pie $GOFLAGS"
-            fi
-
             runHook postConfigure
           ''
         );

pkgs/build-support/node/fetch-npm-deps/default.nix

@@ -12,6 +12,7 @@
   cacert,
   prefetch-npm-deps,
   fetchNpmDeps,
+  config,
 }:
 
 {
@@ -68,6 +69,7 @@
             hash,
             forceGitDeps ? false,
             forceEmptyCache ? false,
+            npmRegistryOverridesString ? "{}",
           }:
           testers.invalidateFetcherByDrvHash fetchNpmDeps {
             inherit
@@ -75,6 +77,7 @@
               hash
               forceGitDeps
               forceEmptyCache
+              npmRegistryOverridesString
               ;
 
             src = makeTestSrc { inherit name src; };
@@ -175,6 +178,23 @@
 
           hash = "sha256-FhxlJ0HdJMPiWe7+n1HaGLWOr/2HJEPwiS65uqXZM8Y=";
         };
+
+        # Test that npmRegistryOverrides work
+        npmRegistryOverrides = makeTest {
+          name = "npm-registry-overrides";
+
+          src = fetchurl {
+            url = "https://cyberchaos.dev/yuka/trainsearch/-/raw/e3cba6427e8ecfd843d0f697251ddaf5e53c2327/package-lock.json";
+            postFetch = "sed -i 's/registry.npmjs.org/broken.link/' $out";
+            hash = "sha256-Qo24ei1d9Ql4zCLjQJ04zVgS4qhBUpew9NZrhrsBds4=";
+          };
+
+          npmRegistryOverridesString = builtins.toJSON {
+            "broken.link" = "https://registry.npmjs.org";
+          };
+
+          hash = "sha256-QGObVDd9qVtf/U78+ayP6RHVWsU+HXhg70BFblQ1PZs=";
+        };
       };
 
     meta = with lib; {
@@ -192,6 +212,9 @@
       forceGitDeps ? false,
       forceEmptyCache ? false,
       nativeBuildInputs ? [ ],
+      # A string with a JSON attrset specifying registry mirrors, for example
+      #   {"registry.example.org": "my-mirror.local/registry.example.org"}
+      npmRegistryOverridesString ? config.npmRegistryOverridesString,
       ...
     }@args:
     let
@@ -243,6 +266,8 @@
         # `{ "registry.example.com": "example-registry-bearer-token", ... }`
         impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_TOKENS" ];
 
+        NIX_NPM_REGISTRY_OVERRIDES = npmRegistryOverridesString;
+
         SSL_CERT_FILE =
           if
             (

pkgs/build-support/node/fetch-npm-deps/src/util.rs

@@ -18,6 +18,22 @@ use std::{
 use url::Url;
 
 pub fn get_url(url: &Url) -> Result<Body, anyhow::Error> {
+    let url_ = url.clone();
+    let mut url = url.clone();
+    // Respect NIX_NPM_REGISTRY_OVERRIDES environment variable, which should be a JSON mapping in the shape of:
+    // `{ "registry.example.com": "my-registry.local", ... }`
+    if let Some(host) = url.host_str() {
+        if let Ok(npm_mirrors) = env::var("NIX_NPM_REGISTRY_OVERRIDES") {
+            if let Ok(mirrors) = serde_json::from_str::<Map<String, Value>>(&npm_mirrors) {
+                if let Some(mirror) = mirrors.get(host).and_then(serde_json::Value::as_str) {
+                    let mirror_url = Url::parse(mirror)?;
+                    url.set_path(&(mirror_url.path().to_owned() + url.path()));
+                    url.set_host(Some(mirror_url.host_str().expect(format!("Mirror URL without host part: {mirror_url}").as_str())))?;
+                    eprintln!("Replaced URL {url_} with {url}");
+                }
+            }
+        }
+    }
     let mut request = Request::get(url.as_str()).redirect_policy(RedirectPolicy::Limit(10));
 
     // Respect SSL_CERT_FILE if environment variable exists

pkgs/build-support/ocaml/oasis.nix

@@ -20,48 +20,47 @@
   ...
 }@args:
 
-if args ? minimumOCamlVersion && lib.versionOlder ocaml.version args.minimumOCamlVersion then
-  throw "${pname}-${version} is not available for OCaml ${ocaml.version}"
-else
+stdenv.mkDerivation (
+  args
+  // {
+    name = "ocaml${ocaml.version}-${pname}-${version}";
 
-  stdenv.mkDerivation (
-    args
-    // {
-      name = "ocaml${ocaml.version}-${pname}-${version}";
+    nativeBuildInputs = [
+      ocaml
+      findlib
+      ocamlbuild
+      ocaml_oasis
+    ]
+    ++ nativeBuildInputs;
 
-      nativeBuildInputs = [
-        ocaml
-        findlib
-        ocamlbuild
-        ocaml_oasis
-      ]
-      ++ nativeBuildInputs;
+    inherit createFindlibDestdir;
+    inherit dontStrip;
 
-      inherit createFindlibDestdir;
-      inherit dontStrip;
+    strictDeps = true;
 
-      strictDeps = true;
+    buildPhase = ''
+      runHook preBuild
+      oasis setup
+      ocaml setup.ml -configure --prefix $OCAMLFIND_DESTDIR --exec-prefix $out
+      ocaml setup.ml -build
+      runHook postBuild
+    '';
 
-      buildPhase = ''
-        runHook preBuild
-        oasis setup
-        ocaml setup.ml -configure --prefix $OCAMLFIND_DESTDIR --exec-prefix $out
-        ocaml setup.ml -build
-        runHook postBuild
-      '';
+    checkPhase = ''
+      runHook preCheck
+      ocaml setup.ml -test
+      runHook postCheck
+    '';
 
-      checkPhase = ''
-        runHook preCheck
-        ocaml setup.ml -test
-        runHook postCheck
-      '';
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      ocaml setup.ml -install
+      runHook postInstall
+    '';
 
-      installPhase = ''
-        runHook preInstall
-        mkdir -p $out
-        ocaml setup.ml -install
-        runHook postInstall
-      '';
-
-    }
-  )
+    meta = args.meta // {
+      broken = args ? minimumOCamlVersion && lib.versionOlder ocaml.version args.minimumOCamlVersion;
+    };
+  }
+)

pkgs/build-support/rust/build-rust-crate/test/default.nix

@@ -774,6 +774,7 @@ rec {
           # On Darwin, the debug symbols are in a separate directory.
           "./bin/test_binary1.dSYM/Contents/Info.plist"
           "./bin/test_binary1.dSYM/Contents/Resources/DWARF/test_binary1"
+          "./bin/test_binary1.dSYM/Contents/Resources/Relocations/${stdenv.hostPlatform.rust.platform.arch}/test_binary1.yml"
         ];
       };
 

pkgs/build-support/rust/build-rust-package/default.nix

@@ -15,6 +15,16 @@
   windows,
 }:
 
+let
+  interpolateString =
+    s:
+    if lib.isList s then
+      lib.concatMapStringsSep " " (s: "${s}") (lib.filter (s: s != null) s)
+    else if s == null then
+      ""
+    else
+      "${s}";
+in
 lib.extendMkDerivation {
   constructDrv = stdenv.mkDerivation;
 
@@ -23,6 +33,7 @@ lib.extendMkDerivation {
     "cargoUpdateHook"
     "cargoLock"
     "useFetchCargoVendor"
+    "RUSTFLAGS"
   ];
 
   extendDrvArgs =
@@ -77,11 +88,19 @@ lib.extendMkDerivation {
     assert lib.warnIf (args ? useFetchCargoVendor)
       "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it"
       true;
+    {
+      env = {
+        PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
+        RUST_LOG = logLevel;
+        RUSTFLAGS =
+          lib.optionalString (
+            stdenv.hostPlatform.isDarwin && buildType == "debug"
+          ) "-C split-debuginfo=packed "
+          # Workaround the existing RUSTFLAGS specified as a list.
+          + interpolateString (args.RUSTFLAGS or "");
+      }
+      // args.env or { };
 
-    lib.optionalAttrs (stdenv.hostPlatform.isDarwin && buildType == "debug") {
-      RUSTFLAGS = "-C split-debuginfo=packed " + (args.RUSTFLAGS or "");
-    }
-    // {
       cargoDeps =
         if cargoVendorDir != null then
           null
@@ -143,15 +162,6 @@ lib.extendMkDerivation {
 
       patches = cargoPatches ++ patches;
 
-      PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
-
-      postUnpack = ''
-        eval "$cargoDepsHook"
-
-        export RUST_LOG=${logLevel}
-      ''
-      + (args.postUnpack or "");
-
       configurePhase =
         args.configurePhase or ''
           runHook preConfigure

pkgs/build-support/rust/hooks/cargo-setup-hook.sh

@@ -1,6 +1,8 @@
 cargoSetupPostUnpackHook() {
     echo "Executing cargoSetupPostUnpackHook"
 
+    eval "${cargoDepsHook-}"
+
     # Some cargo builds include build hooks that modify their own vendor
     # dependencies. This copies the vendor directory into the build tree and makes
     # it writable. If we're using a tarball, the unpackFile hook already handles

pkgs/build-support/setup-hooks/copy-desktop-items.sh

@@ -28,8 +28,10 @@ copyDesktopItems() {
         return
     fi
 
+    concatTo desktopItemsArray desktopItems
+
     applications="${!outputBin}/share/applications"
-    for desktopItem in $desktopItems; do
+    for desktopItem in "${desktopItemsArray[@]}"; do
         if [[ -f "$desktopItem" ]]; then
             echo "Copying '$desktopItem' into '${applications}'"
             install -D -m 444 -t "${applications}" "$desktopItem"

pkgs/by-name/_1/_1fps/package.nix

@@ -4,7 +4,6 @@
   buildGoModule,
   xorg,
   stdenv,
-  apple-sdk_14,
 }:
 buildGoModule rec {
   pname = "1fps";
@@ -25,8 +24,7 @@ buildGoModule rec {
     xorg.libX11
     xorg.libXtst
     xorg.libXi
-  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin apple-sdk_14;
+  ];
 
   meta = {
     description = "Encrypted Screen Sharing";

pkgs/by-name/_2/_2ship2harkinian/package.nix

@@ -150,9 +150,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Linking fails without this
   hardeningDisable = [ "format" ];
 
-  # Pie needs to be enabled or else it segfaults
-  hardeningEnable = [ "pie" ];
-
   preConfigure = ''
     # mirror 2ship's stb
     mkdir stb

pkgs/by-name/ad/adwaita-fonts/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adwaita-fonts";
-  version = "48.2";
+  version = "49.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-fonts/${lib.versions.major finalAttrs.version}/adwaita-fonts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FW9+kvL4LlJ/xzwwnbsjfApKXDqVvF7pSl77aUfFU+A=";
+    hash = "sha256-MVfGIOtbcrJasVbRlKpOsiP5hw1Uf+g/298G0+e+yzc=";
   };
 
   nativeBuildInputs = [
@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   meta = {
     description = "Adwaita Sans, a variation of Inter, and Adwaita Mono, Iosevka customized to match Inter";
     homepage = "https://gitlab.gnome.org/GNOME/adwaita-fonts";
-    license = lib.licenses.gpl3Plus;
+    license = lib.licenses.ofl;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.qxrein ];
     teams = [ lib.teams.gnome ];

pkgs/by-name/ad/adwaita-icon-theme/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "adwaita-icon-theme";
-  version = "48.0";
+  version = "49.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major version}/adwaita-icon-theme-${version}.tar.xz";
-    hash = "sha256-hHBoiIZQ2WcxFb5tvyv9wxpGrrxSimqdtEIOYOZWuNQ=";
+    hash = "sha256-ZRZkYdGyeKqUL1mqjQ/M8RCNccZfNyxiZuFyRJeRdVw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ap/apple-sdk/metadata/apple-oss-lockfile.json

@@ -1,538 +1,4 @@
 {
-  "11.3": {
-    "CarbonHeaders": {
-      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
-      "version": "18.1"
-    },
-    "CommonCrypto": {
-      "hash": "sha256-92v9tuNLqvalwYV4AqQllA8yN9fqGjSpc4MNAmFPrbk=",
-      "version": "60178.100.1"
-    },
-    "IOAudioFamily": {
-      "hash": "sha256-dSSbt9ZoL/Tq2xXwvvXsDmD3Xru7igzdK1MxGL1K+Aw=",
-      "version": "300.6.1"
-    },
-    "IOBDStorageFamily": {
-      "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
-      "version": "20.100.1"
-    },
-    "IOCDStorageFamily": {
-      "hash": "sha256-w0YhZ38RBfnxSc74Q8r5UdK+WiWOSAX46r5hahHLnSg=",
-      "version": "59"
-    },
-    "IODVDStorageFamily": {
-      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
-      "version": "43"
-    },
-    "IOFWDVComponents": {
-      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
-      "version": "208"
-    },
-    "IOFireWireAVC": {
-      "hash": "sha256-7H3WcZC/HuS9xsTNDWRqt+1JzUNK4ndvd4u2ru0GGRE=",
-      "version": "428"
-    },
-    "IOFireWireFamily": {
-      "hash": "sha256-2xppN8RJ9cxrHWjPQ4bUIjtupPbzfmrm3rXnT/9QVfc=",
-      "version": "483"
-    },
-    "IOFireWireSBP2": {
-      "hash": "sha256-kfhmZy8veqI3/XHDtOTKmKj6P7s+j0B+BiAbcjhGq0M=",
-      "version": "442"
-    },
-    "IOFireWireSerialBusProtocolTransport": {
-      "hash": "sha256-WDq2Ak72Jw6gYNIKgZkiexA6LzccrPn1kpSbW5U50ek=",
-      "version": "257.40.1"
-    },
-    "IOGraphics": {
-      "hash": "sha256-kEP4RWIZwu3ZPIq9IAPUKM0gIXHr8xD50SnGNFCQRcI=",
-      "version": "585.1"
-    },
-    "IOHIDFamily": {
-      "hash": "sha256-QASfvttke+AUx55In4DD4vsQGzC3nbe+MugQQ4ddXGU=",
-      "version": "1633.100.36"
-    },
-    "IOKitUser": {
-      "hash": "sha256-NQCRrufElx00B7CqqslBi5BTxf5Zs4lcMcJig4Eab0k=",
-      "version": "1845.100.19"
-    },
-    "IONetworkingFamily": {
-      "hash": "sha256-HqTKzrX75mMFYYbxNKwPdXmI7h7t/QWuO3W1Qo//zIo=",
-      "version": "151.40.1"
-    },
-    "IOSerialFamily": {
-      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
-      "version": "93"
-    },
-    "IOStorageFamily": {
-      "hash": "sha256-dy6CYz/z6SwPw0YfC6GLZO2u62Xy8otMDUNrZ5JhTDY=",
-      "version": "260.100.1"
-    },
-    "IOUSBFamily": {
-      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
-      "version": "630.4.5"
-    },
-    "Libc": {
-      "hash": "sha256-v01g/EtMW/STZQ1neKDMyUGL7sgaCzlwXN0VDaj/Mf0=",
-      "version": "1439.100.3"
-    },
-    "Libinfo": {
-      "hash": "sha256-T7KO6zfswjyTIKSdZJCbvfsdqQfPMLj5nheX9iSIl9o=",
-      "version": "542.40.3"
-    },
-    "Libm": {
-      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
-      "version": "2026"
-    },
-    "Libnotify": {
-      "hash": "sha256-vcDjdwB5OiTEUdl8ISezzpoHeFttkdvkulY/YbUOZjk=",
-      "version": "279.40.4"
-    },
-    "Librpcsvc": {
-      "hash": "sha256-8e8E9TkRTAep3/miyqhF/mSkNdlym12W+AVhXF94+Bg=",
-      "version": "26"
-    },
-    "Libsystem": {
-      "hash": "sha256-24T9aD4W71prcpr3MnnaU3pfxIzIwkOz39OyhCwPO/E=",
-      "version": "1292.100.5"
-    },
-    "OpenDirectory": {
-      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
-      "version": "146"
-    },
-    "Security": {
-      "hash": "sha256-o5MyyqDpERvNPvbEfXNgqMIq0YpQV0+ju72C9g/9OdI=",
-      "version": "59754.100.106"
-    },
-    "architecture": {
-      "hash": "sha256-pIX9pEXE1Xjll9qwiWrMRwqw6G4g0isto/ALHsmkUSc=",
-      "version": "279"
-    },
-    "configd": {
-      "hash": "sha256-WEorIW5Vl8E9/aB0RBTY2bhkfVOF3tckjNztGDOOueA=",
-      "version": "1109.101.1"
-    },
-    "copyfile": {
-      "hash": "sha256-3BHFM67dvwUpinzF0pSX3QiUbIsqtLo77WzB3tMbTW4=",
-      "version": "173.40.2"
-    },
-    "dtrace": {
-      "hash": "sha256-FfyaYjEMDeL9wGdUyZ4eJdkbkp/WpdTGyBvaorwKSi8=",
-      "version": "370.40.1"
-    },
-    "dyld": {
-      "hash": "sha256-dtDTh6YqubBI4Z+QeytwGgUmU6tutvonIWHqzw6zuxo=",
-      "version": "851.27"
-    },
-    "eap8021x": {
-      "hash": "sha256-Ap7qumn/oKYe424n2NW6QkuivgDyLoJgDfl30Q5O7Jo=",
-      "version": "304.100.1"
-    },
-    "hfs": {
-      "hash": "sha256-MSnc1pB8DcB+mn308snTD1uRQ7Ro4aWyFuLdWjHtAG4=",
-      "version": "556.100.11"
-    },
-    "launchd": {
-      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
-      "version": "842.1.4"
-    },
-    "libclosure": {
-      "hash": "sha256-UgmMnDUosaC2yI7IyQ7mkNwZ6/oft77ay+SmGSoycIw=",
-      "version": "79"
-    },
-    "libdispatch": {
-      "hash": "sha256-K8QL9NfjGsj8c0jbocKegmKBqydimpKu8yRXnQQqdH8=",
-      "version": "1271.100.5"
-    },
-    "libmalloc": {
-      "hash": "sha256-k3dJk7S0Lom3B28vRI9QxIuo0AOkd9OHzWO7MandfUw=",
-      "version": "317.100.9"
-    },
-    "libplatform": {
-      "hash": "sha256-BSIGgKj5B6Dr0KQiIl2LSA3+ZEhzk/snQeCauErcq6k=",
-      "version": "254.80.2"
-    },
-    "libpthread": {
-      "hash": "sha256-cGaDXLTztUYppbMvv41qj5RqONXfhfdHpt9dqY6+5Lc=",
-      "version": "454.100.8"
-    },
-    "mDNSResponder": {
-      "hash": "sha256-eqcv174vIwWYXrIhzph+KO1zG8TdK5jRFVgsaAlV9es=",
-      "version": "1310.100.10"
-    },
-    "objc4": {
-      "hash": "sha256-rqOPyN9S4KbMhCCVvtyEmGxTWzy+tsh0kfu3k47szXo=",
-      "version": "818.2"
-    },
-    "ppp": {
-      "hash": "sha256-pSOlu/yXQhopCHDLnmhUnQeU89MkXhkQB0ZrN9r3qyk=",
-      "version": "877.40.2"
-    },
-    "removefile": {
-      "hash": "sha256-B79A9AQ1/cB+zlmVKWcEXVOJHW6rOrX40S/hrMuWqXU=",
-      "version": "49.101.1"
-    },
-    "xnu": {
-      "hash": "sha256-M1XWippH55VUJu4aosRFX8j9aOm/PONYVjPZOPufD80=",
-      "version": "7195.101.1"
-    }
-  },
-  "12.3": {
-    "CarbonHeaders": {
-      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
-      "version": "18.1"
-    },
-    "CommonCrypto": {
-      "hash": "sha256-HTGBUE6vHjS80CFTiIQ8F17m8Yd2ZRHccvFu2CA2P9U=",
-      "version": "60191.100.1"
-    },
-    "IOAudioFamily": {
-      "hash": "sha256-CuBFZeX2JTKIab2xpp+Yvn66bCl4+aKOv9TvzJef20c=",
-      "version": "340.2"
-    },
-    "IOBDStorageFamily": {
-      "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
-      "version": "22"
-    },
-    "IOCDStorageFamily": {
-      "hash": "sha256-p/2qM5zjXFDRb/DISpEHxQEdvmuLlRGt/Ygc71Yu2rI=",
-      "version": "61"
-    },
-    "IODVDStorageFamily": {
-      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
-      "version": "43"
-    },
-    "IOFWDVComponents": {
-      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
-      "version": "208"
-    },
-    "IOFireWireAVC": {
-      "hash": "sha256-ruAomp5Lv7zuPu9vHsNKoPtDvD1AIrRARsPMpcx/fh0=",
-      "version": "430"
-    },
-    "IOFireWireFamily": {
-      "hash": "sha256-W0KOF4hkA7kFOnL1ThAeFU/YlhFVqoqk9uzGjcBppX8=",
-      "version": "487"
-    },
-    "IOFireWireSBP2": {
-      "hash": "sha256-bItnRQIaGUxMyiU0q+4N8e5+jYiDEOUPmsrKhBFXvok=",
-      "version": "445"
-    },
-    "IOFireWireSerialBusProtocolTransport": {
-      "hash": "sha256-P7egeaD9SSa+YyrIRzM44gILKbIL7vezXK3M6q3MBOI=",
-      "version": "260"
-    },
-    "IOGraphics": {
-      "hash": "sha256-lzxBrPLlF01+2jFKRJtSnwpf0r05C0H3tM7Q0N1RUPA=",
-      "version": "594"
-    },
-    "IOHIDFamily": {
-      "hash": "sha256-EQQHAS8WKUoTxZscixylc2ZMoD4UYBlHRUj2O7Ikgac=",
-      "version": "1787.100.13"
-    },
-    "IOKitUser": {
-      "hash": "sha256-Cdfa/YXM0W4O15femcU0G1Xcpbm+iADWIBWIdzoeuTE=",
-      "version": "1955.100.5"
-    },
-    "IONetworkingFamily": {
-      "hash": "sha256-odUZJQq8lb3UYk7F8dBi1Hds00M+kwdlyGwZkVkSwTg=",
-      "version": "160.100.2"
-    },
-    "IOSerialFamily": {
-      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
-      "version": "93"
-    },
-    "IOStorageFamily": {
-      "hash": "sha256-2b32qe1z7Z+Od1dVlAGdM142DdF8cBaRC+ElysSuAQ4=",
-      "version": "290.100.6"
-    },
-    "IOUSBFamily": {
-      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
-      "version": "630.4.5"
-    },
-    "Libc": {
-      "hash": "sha256-obalDxsbE+7gm7YwznUbfxL7MCriamQFP3DrXleNwU4=",
-      "version": "1507.100.9"
-    },
-    "Libinfo": {
-      "hash": "sha256-OjnnSHEcifcWarVyXiHvYg/9jbCQy5/lzaq6fJRriy0=",
-      "version": "554"
-    },
-    "Libm": {
-      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
-      "version": "2026"
-    },
-    "Libnotify": {
-      "hash": "sha256-JXG0kHEdoIs6krVZ4+KsRVES4AuNjnQi8qF+XKSp5jE=",
-      "version": "301"
-    },
-    "Librpcsvc": {
-      "hash": "sha256-8e8E9TkRTAep3/miyqhF/mSkNdlym12W+AVhXF94+Bg=",
-      "version": "26"
-    },
-    "Libsystem": {
-      "hash": "sha256-mPPAxo67wWLtemO+PuKg1Ui0zKEfjnYVj/qX1/0kNBs=",
-      "version": "1311.100.3"
-    },
-    "OpenDirectory": {
-      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
-      "version": "146"
-    },
-    "Security": {
-      "hash": "sha256-cIqfXcfQOZonxaKndH80xC5YmmveHw+TxHOxqvc9u8I=",
-      "version": "60158.100.133"
-    },
-    "architecture": {
-      "hash": "sha256-PRNUrhzSOrwmxSPkKmV0LV7yEIik65sdkfKdBqcwFhU=",
-      "version": "280.100.2"
-    },
-    "configd": {
-      "hash": "sha256-X34mjXdil4HeBLyqY4tyBWdmpjsOFTJDdDE81UQf708=",
-      "version": "1163.100.19.0.2"
-    },
-    "copyfile": {
-      "hash": "sha256-3/zI3j/m9b13hebjCsOLry3Mf8ADdWJgrtQOdD0huG0=",
-      "version": "180.100.3"
-    },
-    "dtrace": {
-      "hash": "sha256-q8H6slCN4RwJ5TxC5s3og6cIbjALySP5ODfVw6a/a+M=",
-      "version": "375"
-    },
-    "dyld": {
-      "hash": "sha256-v1kk/Z3eI2sufNm2rx3FRbA/f9BeKJ3t9i9W7tTksXg=",
-      "version": "955"
-    },
-    "eap8021x": {
-      "hash": "sha256-SayP1d2KWoRShykBA/NrQCuRnPoxlTiaLwifoqm0Gkg=",
-      "version": "315.100.2"
-    },
-    "hfs": {
-      "hash": "sha256-q1yOIei98oudGAoBMNPRTV5EOYpXFL7iYmlCYsKsG0o=",
-      "version": "583.100.10"
-    },
-    "launchd": {
-      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
-      "version": "842.1.4"
-    },
-    "libclosure": {
-      "hash": "sha256-Ez75a0m+fJas7mGqFeDjjpc7sFDnyirRbtLMTYQDVxw=",
-      "version": "79.1"
-    },
-    "libdispatch": {
-      "hash": "sha256-/VbSUtnWyToWOUyAAg/3wImbJ2w5k1tbJkt827x2lIE=",
-      "version": "1325.100.36"
-    },
-    "libmalloc": {
-      "hash": "sha256-tyYce5nk0N923MbzoGzkGqunoKwArbTiZl8PCppYpso=",
-      "version": "374.100.5"
-    },
-    "libplatform": {
-      "hash": "sha256-JUD2NdS310OhZ0F8gnOvoD8AgEtWRtPahKDw5iE2QJU=",
-      "version": "273.100.5"
-    },
-    "libpthread": {
-      "hash": "sha256-al8QumtH7/D04oJ4LUSYW+6OdX0Ko3S3rwYU53n9/54=",
-      "version": "486.100.11"
-    },
-    "mDNSResponder": {
-      "hash": "sha256-hsV0VYTPoO5YpaxrUXpXFy97LxlERzrQT0FRfCMOwic=",
-      "version": "1557.101.2"
-    },
-    "objc4": {
-      "hash": "sha256-MKXnfZL46VtmAQMolqd7ATF9fYjCNstapGQfcH4uVwo=",
-      "version": "841.13"
-    },
-    "ppp": {
-      "hash": "sha256-YyCE19T3rcM1G5jdXuYXuBXblJgR/nelvjpq+9maMhw=",
-      "version": "884"
-    },
-    "removefile": {
-      "hash": "sha256-xF1VtTUhoiGsFQsvuFnFYemwiCdsKeriFJv51vRLqmw=",
-      "version": "60"
-    },
-    "xnu": {
-      "hash": "sha256-bfFmDfRBSvoWMdQYVstsJRbcq+15lDjVFqk+0XYWpy8=",
-      "version": "8020.101.4"
-    }
-  },
-  "13.3": {
-    "CarbonHeaders": {
-      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
-      "version": "18.1"
-    },
-    "CommonCrypto": {
-      "hash": "sha256-tftAQbs5xIOc5VZLVAKXAUvle9WO/i33/pQ3D64l/yI=",
-      "version": "600016.100.4"
-    },
-    "IOAudioFamily": {
-      "hash": "sha256-CuBFZeX2JTKIab2xpp+Yvn66bCl4+aKOv9TvzJef20c=",
-      "version": "440.2"
-    },
-    "IOBDStorageFamily": {
-      "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
-      "version": "22"
-    },
-    "IOCDStorageFamily": {
-      "hash": "sha256-p/2qM5zjXFDRb/DISpEHxQEdvmuLlRGt/Ygc71Yu2rI=",
-      "version": "61"
-    },
-    "IODVDStorageFamily": {
-      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
-      "version": "43"
-    },
-    "IOFWDVComponents": {
-      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
-      "version": "208"
-    },
-    "IOFireWireAVC": {
-      "hash": "sha256-IUytBKhhCgg0vtI+7q8d5kxpOUgO3tQD7TMy++jrorc=",
-      "version": "431"
-    },
-    "IOFireWireFamily": {
-      "hash": "sha256-W0KOF4hkA7kFOnL1ThAeFU/YlhFVqoqk9uzGjcBppX8=",
-      "version": "487"
-    },
-    "IOFireWireSBP2": {
-      "hash": "sha256-bItnRQIaGUxMyiU0q+4N8e5+jYiDEOUPmsrKhBFXvok=",
-      "version": "445"
-    },
-    "IOFireWireSerialBusProtocolTransport": {
-      "hash": "sha256-P7egeaD9SSa+YyrIRzM44gILKbIL7vezXK3M6q3MBOI=",
-      "version": "260"
-    },
-    "IOGraphics": {
-      "hash": "sha256-KubCz8DNwf1WuF7LrtARM2VJugFDP0wfHoUhnIz/faQ=",
-      "version": "596.1"
-    },
-    "IOHIDFamily": {
-      "hash": "sha256-7UFMBdF5k9aVFVuoL2riozzKmn8uOt87Aitt8j6XkN8=",
-      "version": "1915.100.21"
-    },
-    "IOKitUser": {
-      "hash": "sha256-hgFRHPAuoqSf6aRUBUyfU2y2+dBUA34DKwLHLwhPNms=",
-      "version": "2022.100.19"
-    },
-    "IONetworkingFamily": {
-      "hash": "sha256-SwZvXLSB9cMHssZU4dCogGVoV64qYdGN1CGYV3FZ6tk=",
-      "version": "170"
-    },
-    "IOSerialFamily": {
-      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
-      "version": "93"
-    },
-    "IOStorageFamily": {
-      "hash": "sha256-g4oCrxM5VtHm8h1M+zM81Ar1LsaaiJZLej5fT8EHPG4=",
-      "version": "302.100.1"
-    },
-    "IOUSBFamily": {
-      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
-      "version": "630.4.5"
-    },
-    "Libc": {
-      "hash": "sha256-dqbdWtBuaRq3IHnSUPH2aj8h/X4zCwUNSOeSdwfKvN8=",
-      "version": "1534.100.14"
-    },
-    "Libinfo": {
-      "hash": "sha256-iUyndeUXx7FFZ/jgJ6jRwda3IChOaMs4dZW/ISuAJ1E=",
-      "version": "564.101.1"
-    },
-    "Libm": {
-      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
-      "version": "2026"
-    },
-    "Libnotify": {
-      "hash": "sha256-7AwTfogvCUMdoabxf413ENWXtFTOM6AUldccoPQ89sU=",
-      "version": "312"
-    },
-    "Librpcsvc": {
-      "hash": "sha256-UWYdCQ9QsBqwM01bWr+igINAHSdSluB/FrOclC5AjTI=",
-      "version": "31"
-    },
-    "Libsystem": {
-      "hash": "sha256-IIksf0yCg3GdME3HofYzD1MRC+ofsPhHcxddmNd7V2M=",
-      "version": "1319.100.3"
-    },
-    "OpenDirectory": {
-      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
-      "version": "146"
-    },
-    "Security": {
-      "hash": "sha256-lPq58QIx+H9DouTXAUJSMf1X7dj9V6xu3c8VWr2R1IY=",
-      "version": "60420.101.4"
-    },
-    "architecture": {
-      "hash": "sha256-PRNUrhzSOrwmxSPkKmV0LV7yEIik65sdkfKdBqcwFhU=",
-      "version": "282"
-    },
-    "configd": {
-      "hash": "sha256-M/fRAnUw2wObhCQp9a6zQbCGhACCQHpju4/1+KGlkjg=",
-      "version": "1241.100.11"
-    },
-    "copyfile": {
-      "hash": "sha256-te3WcQudrXPqnTM1s/AtsTdu7VIXf5dIASy+IGnIxv0=",
-      "version": "191.100.3"
-    },
-    "dtrace": {
-      "hash": "sha256-7jAG66hG9qmqpRbECazMD1Pyi53CWTOGNnZca1NpcxE=",
-      "version": "397"
-    },
-    "dyld": {
-      "hash": "sha256-OkDOTV86EB44LxsqwTD4ZncMcr7iqSHXxw+6U+AP7oU=",
-      "version": "1066.8"
-    },
-    "eap8021x": {
-      "hash": "sha256-FMG+IGVPpcwrRe2/OKpFycrY/EFPZkge2vX61NgorGg=",
-      "version": "336.100.6"
-    },
-    "hfs": {
-      "hash": "sha256-Au5VDrYRBerI1I6rjC0lVDwB5IBwGARrAdcTI4M+Fx0=",
-      "version": "627.100.6"
-    },
-    "launchd": {
-      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
-      "version": "842.1.4"
-    },
-    "libclosure": {
-      "hash": "sha256-V1tpp/XG6baETunJt029rI6wp6moYSnFprt+bNGaQ40=",
-      "version": "87"
-    },
-    "libdispatch": {
-      "hash": "sha256-d1VObN11bNdtNJlZQqp2y8yP4lit5Wbj+4/aN3StsPc=",
-      "version": "1415.100.11"
-    },
-    "libmalloc": {
-      "hash": "sha256-jcR1AO/chcZzfAvELkC+U3q9tzxqPdwgLcHrnkQmN4M=",
-      "version": "425.100.7"
-    },
-    "libplatform": {
-      "hash": "sha256-+BB23YGGT0hA326Dh+3k2UvAqBdEJ84A6yGA/ccrihg=",
-      "version": "292.100.1"
-    },
-    "libpthread": {
-      "hash": "sha256-/l17vMWhfAs0YhIHi+l84vGVxpGFOzocvxxii7B+WUk=",
-      "version": "514.100.2"
-    },
-    "mDNSResponder": {
-      "hash": "sha256-M4yfQsdlKwes5M2QOEEfjv7ldSVZw7oGXLISaDcObjs=",
-      "version": "1807.101.2"
-    },
-    "objc4": {
-      "hash": "sha256-qOV9YfP59WP8Izp+IvM/aiYTW8fCoq21uxU64OcIHk8=",
-      "version": "876"
-    },
-    "ppp": {
-      "hash": "sha256-Sg5c5qOSk5TaS4pgXZ+eAy/iuGBa1oFML0dkj463DcE=",
-      "version": "1010"
-    },
-    "removefile": {
-      "hash": "sha256-oQorWHlJ0ctekCTUsLXHko8k1aCKBJ00A2FHkRd4B3E=",
-      "version": "68"
-    },
-    "xnu": {
-      "hash": "sha256-w9/lDZ/E54YzYQkOWptNpX5GomgI/fvZLAy7NY3O+IQ=",
-      "version": "8796.101.5"
-    }
-  },
   "14.4": {
     "CarbonHeaders": {
       "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",

pkgs/by-name/ap/apple-sdk/metadata/versions.json

@@ -1,28 +1,4 @@
 {
-  "11": {
-    "urls": [
-      "https://swcdn.apple.com/content/downloads/02/62/071-54303-A_EU2CL1YVT7/943i95dpeyi2ghlnj2mgyq3t202t5gf18b/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20250210235110/https://swcdn.apple.com/content/downloads/02/62/071-54303-A_EU2CL1YVT7/943i95dpeyi2ghlnj2mgyq3t202t5gf18b/CLTools_macOSNMOS_SDK.pkg"
-    ],
-    "version": "11.3",
-    "hash": "sha256-/go8utcx3jprf6c8V/DUbXwsmNYSFchOAai1OaJs3Bg="
-  },
-  "12": {
-    "urls": [
-      "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20250210235341/https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOSNMOS_SDK.pkg"
-    ],
-    "version": "12.3",
-    "hash": "sha256-qG21ssNUmkqxPLTXALGP2N/RBHu8NMlI1dWvGlV+Wm8="
-  },
-  "13": {
-    "urls": [
-      "https://swcdn.apple.com/content/downloads/15/62/032-84673-A_7A1TG1RF8Z/xpc8q44ggn2pkn82iwr0fi1zeb9cxi8ath/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20250210235949/https://swcdn.apple.com/content/downloads/15/62/032-84673-A_7A1TG1RF8Z/xpc8q44ggn2pkn82iwr0fi1zeb9cxi8ath/CLTools_macOSNMOS_SDK.pkg"
-    ],
-    "version": "13.3",
-    "hash": "sha256-zZ4pbgoXunLGwdYDemxOfyH4CE5WGfMy2s5jN+0q4B4="
-  },
   "14": {
     "urls": [
       "https://swcdn.apple.com/content/downloads/14/48/052-59890-A_I0F5YGAY0Y/p9n40hio7892gou31o1v031ng6fnm9sb3c/CLTools_macOSNMOS_SDK.pkg",

pkgs/by-name/ar/ares/package.nix

@@ -1,7 +1,7 @@
 {
   lib,
   alsa-lib,
-  apple-sdk_14,
+  apple-sdk,
   cmake,
   fetchFromGitHub,
   gtk3,
@@ -55,7 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_14
     moltenvk
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
@@ -73,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     (replaceVars ./darwin-build-fixes.patch {
-      sdkVersion = apple-sdk_14.version;
+      sdkVersion = apple-sdk.version;
     })
   ];
 

pkgs/by-name/at/at-spi2-core/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -12,6 +13,7 @@
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
   gsettings-desktop-schemas,
   makeWrapper,
+  python3,
   dbus,
   glib,
   dconf,
@@ -27,7 +29,7 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.56.2";
+  version = "2.58.0";
 
   outputs = [
     "out"
@@ -37,15 +39,25 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor version}/at-spi2-core-${version}.tar.xz";
-    hash = "sha256-4bHJg2qJR4UvdEDDLiMXkjTHa9mM2cxAAfN2QF+LeDs=";
+    hash = "sha256-390zANong6IZaf+t4oiYF/t8GQak75JJfrpllps9q1o=";
   };
 
+  # TODO apply unconditionally on rebuild
+  patches = lib.optionals stdenv.isDarwin [
+    (fetchpatch {
+      name = "timersub.patch";
+      url = "https://github.com/GNOME/at-spi2-core/commit/02108ea1b96db0189b2d4a9eceb843e1f13b7bdf.diff";
+      hash = "sha256-pVBhawfRnJoXmovl9CAmzh+YWJkbvlOVrCs8XanjP00=";
+    })
+  ];
+
   nativeBuildInputs = [
     glib
     meson
     ninja
     pkg-config
     makeWrapper
+    python3
   ]
   ++ lib.optionals withIntrospection [
     gobject-introspection

pkgs/by-name/at/atuin/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin";
-  version = "18.8.0";
+  version = "18.10.0";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FJEXIxdeg6ExXvrQ3dtugMK5xw+NwWyB+ld9rj7okoU=";
+    hash = "sha256-bfSa3RtVXxHt3usDqqpE/oXKKDUZOrf+tD9uL59fr6M=";
   };
 
-  cargoHash = "sha256-xJPSMu22Bq9Panrafsd5vUSnEQYuJB19OEZaAq8z0mw=";
+  cargoHash = "sha256-67ffivZVCly1GWA3fJ9mT8nGv2EGd6eCthbaIu/IW3M=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.
@@ -41,13 +41,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --zsh <($out/bin/atuin gen-completions -s zsh)
   '';
 
-  passthru = {
-    tests = {
-      inherit (nixosTests) atuin;
-    };
-    updateScript = nix-update-script { };
-  };
-
   checkFlags = [
     # tries to make a network access
     "--skip=registration"
@@ -56,11 +49,19 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # PermissionDenied (Operation not permitted)
     "--skip=change_password"
     "--skip=multi_user_test"
-    "--skip=store::var::tests::build_vars"
-    # Tries to touch files
-    "--skip=build_aliases"
   ];
 
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) atuin;
+    };
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Replacement for a shell history which records additional commands context with optional encrypted synchronization between machines";
     homepage = "https://github.com/atuinsh/atuin";

pkgs/by-name/au/audit/package.nix

@@ -117,8 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pythonImportsCheck = [ "audit" ];
 
-  enableParallelChecking = false;
-  doCheck = true;
+  doCheck = false;
 
   postInstall = ''
     installShellCompletion --bash init.d/audit.bash_completion
@@ -156,6 +155,11 @@ stdenv.mkDerivation (finalAttrs: {
       static = pkgsStatic.audit or null;
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       audit = nixosTests.audit;
+      # Broken on a hardened kernel
+      package = finalAttrs.finalPackage.overrideAttrs (previousAttrs: {
+        pname = previousAttrs.pname + "-test";
+        doCheck = true;
+      });
     };
   };
 

pkgs/by-name/az/azahar/package.nix

@@ -42,8 +42,6 @@
   gamemode,
   enableGamemode ? lib.meta.availableOn stdenv.hostPlatform gamemode,
   nix-update-script,
-  darwinMinVersionHook,
-  apple-sdk_12,
   fetchpatch2,
 }:
 let
@@ -129,10 +127,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ optionals stdenv.hostPlatform.isDarwin [
     moltenvk
-
-    # error: 'lowPowerModeEnabled' is unavailable: not available on macOS
-    apple-sdk_12
-    (darwinMinVersionHook "12.0")
   ];
 
   postPatch = ''

pkgs/by-name/ba/bakelite/package.nix

@@ -16,7 +16,6 @@ stdenv.mkDerivation {
     hash = "sha256-rRJrtCcgfbqC/4qQiTVeUUcPqoJlNfitYRqIO58AmpA=";
   };
 
-  hardeningEnable = [ "pie" ];
   preBuild = ''
     # pipe2() is only exposed with _GNU_SOURCE
     # Upstream makefile explicitly uses -O3 to improve SHA-3 performance

pkgs/by-name/ba/balena-cli/package.nix

@@ -9,7 +9,6 @@
   python3,
   udev,
   cctools,
-  apple-sdk_12,
 }:
 
 let
@@ -44,13 +43,9 @@ buildNpmPackage' rec {
     cctools
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      udev
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      apple-sdk_12
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    udev
+  ];
 
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/balena";

pkgs/by-name/ba/baobab/package.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "baobab";
-  version = "48.0";
+  version = "49.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/baobab/${lib.versions.major version}/baobab-${version}.tar.xz";
-    hash = "sha256-VFklBNSdgH8jWRvn5+7xDGyd/LesUnuBw6zVh4eyb9o=";
+    hash = "sha256-GVwBgtxNf2lN0LTuNucuD0q3V4JfwjgjNAnuwt9IP64=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/bash-completion/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bash-completion";
-  version = "2.16.0";
+  version = "2.17.0";
 
   # Using fetchurl because fetchGithub or fetchzip will have trouble on
   # e.g. APFS filesystems (macOS) because of non UTF-8 characters in some of the
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   # See discussion in https://github.com/NixOS/nixpkgs/issues/107768
   src = fetchurl {
     url = "https://github.com/scop/bash-completion/releases/download/${version}/bash-completion-${version}.tar.xz";
-    hash = "sha256-M2m9XkGKdfuZCGOSWu1bQgOYrOuzIOxMAwaz6uI/EHo=";
+    hash = "sha256-3Z2CXklkNfs766Oue+qfd+gh6JRmfQdDHR1MjFcLnlg=";
   };
 
   postPatch = ''

pkgs/by-name/be/bespokesynth/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   gitUpdater,
-  apple-sdk_11,
   cmake,
   pkg-config,
   ninja,
@@ -120,9 +119,6 @@ stdenv.mkDerivation (finalAttrs: {
     xcb-util-cursor
     pcre
     mount
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_11
   ];
 
   postInstall =

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  apple-sdk_14,
   buildNpmPackage,
   cargo,
   copyDesktopItems,
@@ -130,10 +129,6 @@ buildNpmPackage' rec {
     darwin.autoSignDarwinBinariesHook
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_14
-  ];
-
   preBuild = ''
     if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '^[0-9]+') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
       echo 'ERROR: electron version mismatch'

pkgs/by-name/bl/blender/package.nix

@@ -16,7 +16,7 @@
   embree,
   fetchzip,
   fetchFromGitHub,
-  ffmpeg,
+  ffmpeg_7,
   fftw,
   fftwFloat,
   freetype,
@@ -239,7 +239,7 @@ stdenv'.mkDerivation (finalAttrs: {
   buildInputs = [
     alembic
     boost
-    ffmpeg
+    ffmpeg_7
     fftw
     fftwFloat
     freetype

pkgs/by-name/bm/bmake/package.nix

@@ -3,7 +3,6 @@
   bc,
   fetchurl,
   getopt,
-  ksh,
   pkgsMusl ? { },
   stdenv,
   tzdata,
@@ -39,9 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeCheckInputs = [
     bc
     tzdata
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.libc != "musl") [
-    ksh
   ];
 
   # The generated makefile is a small wrapper for calling ./boot-strap with a

pkgs/by-name/bu/budgie-analogue-clock-applet/package.nix

@@ -8,7 +8,7 @@
   vala,
   budgie-desktop,
   gtk3,
-  libpeas,
+  libpeas2,
   nix-update-script,
 }:
 
@@ -33,9 +33,15 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     budgie-desktop
     gtk3
-    libpeas
+    libpeas2
   ];
 
+  postPatch = ''
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/749
+    substituteInPlace meson.build \
+      --replace-fail "dependency('libpeas-1.0')" "dependency('libpeas-2')"
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };

pkgs/by-name/bu/budgie-control-center/package.nix

@@ -70,14 +70,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-control-center";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-control-center";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-W5PF7BPdQdg/7xJ4J+fEnuDdpoG/lyhX56RDnX2DXoY=";
+    hash = "sha256-Je3X1V4U2t0LMxWwtoYZKEI56IS4zK/w6OL615tqKkk=";
   };
 
   patches = [

pkgs/by-name/bu/budgie-desktop/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   accountsservice,
   alsa-lib,
   budgie-screensaver,
@@ -10,6 +9,7 @@
   glib,
   gnome-desktop,
   gnome-settings-daemon,
+  gobject-introspection,
   graphene,
   gst_all_1,
   gtk-doc,
@@ -19,10 +19,12 @@
   libcanberra-gtk3,
   libgee,
   libGL,
+  libgudev,
   libnotify,
-  libpeas,
+  libpeas2,
   libpulseaudio,
   libuuid,
+  libwacom,
   libwnck,
   magpie,
   libgbm,
@@ -35,6 +37,7 @@
   polkit,
   sassc,
   testers,
+  udev,
   upower,
   vala,
   validatePkgConfig,
@@ -45,14 +48,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-desktop";
-  version = "10.9.2";
+  version = "10.9.3-unstable-2025-09-13";
 
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-desktop";
-    tag = "v${finalAttrs.version}";
+    rev = "68d5136613fa1b15d39cc67ada3085590ec162ae";
     fetchSubmodules = true;
-    hash = "sha256-lDsQlUAa79gnM8wC5pwyquvFyEiayH4W4gD/uyC5Koo=";
+    hash = "sha256-xqN06CGS4xyUwnJCsLplYzKtO/V8hDmb6UNJu/nhQHs=";
   };
 
   outputs = [
@@ -63,31 +66,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./plugins.patch
-
-    # Adapt to libxfce4windowing v4.19.8
-    # https://github.com/BuddiesOfBudgie/budgie-desktop/pull/627
-    (fetchpatch {
-      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/ba8170b4f3108f9de28331b6a98a9d92bb0ed4de.patch";
-      hash = "sha256-T//1/NmaV81j0jiIYK7vEp8sgKCgF2i10D+Rk9qAAeE=";
-    })
-
-    # Resolve vala 0.56.18 compact class inheritance removal
-    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/679
-    (fetchpatch {
-      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/46c83b1265b4230668da472d9ef6926941678418.patch";
-      hash = "sha256-qnA8iBEctZbE86qIPudI1vMbgFy4xDWrxxej517ORws=";
-    })
-
-    # Add override for overlay-key to prevent crash with mutter-common v48-rc
-    # https://github.com/BuddiesOfBudgie/budgie-desktop/pull/683
-    (fetchpatch {
-      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/c24091bb424abe99ebcdd33eedd37068f735ad2a.patch";
-      hash = "sha256-4WEkscftOGZmzH7imMTmcTDPH6eHMeEhgto+R5NNlh0=";
-    })
   ];
 
   nativeBuildInputs = [
     docbook-xsl-nons
+    gobject-introspection
     gtk-doc
     intltool
     meson
@@ -115,21 +98,30 @@ stdenv.mkDerivation (finalAttrs: {
     libcanberra-gtk3
     libgee
     libGL
+    libgudev
     libnotify
     libpulseaudio
     libuuid
+    libwacom
     libwnck
     magpie
     libgbm
     polkit
     sassc
+    udev
     upower
     xfce.libxfce4windowing
   ];
 
   propagatedBuildInputs = [
     # budgie-1.0.pc, budgie-raven-plugin-1.0.pc
-    libpeas
+    libpeas2
+  ];
+
+  mesonFlags = [
+    # FIXME: The meson option name is confusing
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/pull/739#discussion_r2359421711
+    "-Dbsd-libexecdir=${gnome-settings-daemon}/libexec"
   ];
 
   passthru = {

pkgs/by-name/bu/budgie-desktop/plugins.patch

@@ -1,175 +1,45 @@
-diff --git a/meson.build b/meson.build
-index 6c6e473e..9b8fb73a 100644
---- a/meson.build
-+++ b/meson.build
-@@ -88,11 +88,6 @@ datadir = join_paths(prefix, get_option('datadir'))
- localedir = join_paths(prefix, get_option('localedir'))
- podir = join_paths(meson.source_root(), 'po')
+diff --git a/src/panel/plugin/plugin-manager.c b/src/panel/plugin/plugin-manager.c
+index 1f0d32d60..2f46cee6e 100644
+--- a/src/panel/plugin/plugin-manager.c
++++ b/src/panel/plugin/plugin-manager.c
+@@ -115,12 +115,26 @@ static void budgie_panel_plugin_manager_init(BudgiePanelPluginManager *self) {
+ 	}
  
--cdata.set_quoted('DATADIR', datadir)
--cdata.set_quoted('SYSCONFDIR', confdir)
--cdata.set_quoted('LOCALEDIR', localedir)
--cdata.set_quoted('PACKAGE_URL', 'https://buddiesofbudgie.org')
--
- # Handle i18n on the .desktop file
- # Originally stolem from TingPing:
- # https://github.com/vinszent/gnome-twitch/blob/master/data/meson.build
-@@ -111,23 +106,10 @@ cdata.set_quoted('MODULEDIR', plugin_libdir)
- cdata.set_quoted('MODULE_DATA_DIR', plugin_datadir)
- cdata.set_quoted('RAVEN_PLUGIN_LIBDIR', raven_plugin_libdir)
- cdata.set_quoted('RAVEN_PLUGIN_DATADIR', raven_plugin_datadir)
--
--if prefix == '/usr' or prefix == '/usr/local'
--    cdata.set('HAS_SECONDARY_PLUGIN_DIRS', true)
--
--    if prefix == '/usr'
--        secondary_libdir_root = join_paths(prefix, 'local', get_option('libdir'), meson.project_name())
--        secondary_datadir_root = join_paths(prefix, 'local', get_option('datadir'), meson.project_name())
--    else
--        secondary_libdir_root = join_paths('/usr', get_option('libdir'), meson.project_name())
--        secondary_datadir_root = join_paths('/usr', get_option('datadir'), meson.project_name())
--    endif
--
--    cdata.set_quoted('MODULEDIR_SECONDARY', join_paths(secondary_libdir_root, 'plugins'))
--    cdata.set_quoted('MODULE_DATA_DIR_SECONDARY', join_paths(secondary_datadir_root, 'plugins'))
--    cdata.set_quoted('RAVEN_PLUGIN_LIBDIR_SECONDARY', join_paths(secondary_libdir_root, 'raven-plugins'))
--    cdata.set_quoted('RAVEN_PLUGIN_DATADIR_SECONDARY', join_paths(secondary_datadir_root, 'raven-plugins'))
--endif
-+cdata.set_quoted('DATADIR', datadir)
-+cdata.set_quoted('SYSCONFDIR', confdir)
-+cdata.set_quoted('LOCALEDIR', localedir)
-+cdata.set_quoted('PACKAGE_URL', 'https://buddiesofbudgie.org')
+ 	/* System path */
+-	peas_engine_add_search_path(self->engine, BUDGIE_MODULE_DIRECTORY, BUDGIE_MODULE_DATA_DIRECTORY);
++	const gchar* libdir = NULL;
++	const gchar* datadir = NULL;
++	libdir = g_getenv("BUDGIE_PLUGIN_LIBDIR");
++	if (libdir != NULL) {
++		g_debug("BUDGIE_PLUGIN_LIBDIR is set to %s", libdir);
++	} else {
++		g_debug("BUDGIE_PLUGIN_LIBDIR is unset, defaulting to %s", BUDGIE_MODULE_DIRECTORY);
++		libdir = BUDGIE_MODULE_DIRECTORY;
++	}
  
- with_bluetooth = get_option('with-bluetooth')
- if with_bluetooth == true
-diff --git a/src/config/budgie-config.c b/src/config/budgie-config.c
-index 3ffe3632..da53e054 100644
---- a/src/config/budgie-config.c
-+++ b/src/config/budgie-config.c
-@@ -11,7 +11,6 @@
+-	if (BUDGIE_HAS_SECONDARY_PLUGIN_DIRS) {
+-		peas_engine_add_search_path(self->engine, BUDGIE_MODULE_DIRECTORY_SECONDARY, BUDGIE_MODULE_DATA_DIRECTORY_SECONDARY);
++	datadir = g_getenv("BUDGIE_PLUGIN_DATADIR");
++	if (datadir != NULL) {
++		g_debug("BUDGIE_PLUGIN_DATADIR is set to %s", datadir);
++	} else {
++		g_debug("BUDGIE_PLUGIN_DATADIR is unset, defaulting to %s", BUDGIE_MODULE_DATA_DIRECTORY);
++		datadir = BUDGIE_MODULE_DATA_DIRECTORY;
+ 	}
  
- #ifndef CONFIG_H_INCLUDED
- #include "config.h"
--#include <stdbool.h>
- #include <stddef.h>
- 
- /**
-@@ -22,20 +21,6 @@ const char* BUDGIE_MODULE_DATA_DIRECTORY = MODULE_DATA_DIR;
- const char* BUDGIE_RAVEN_PLUGIN_LIBDIR = RAVEN_PLUGIN_LIBDIR;
- const char* BUDGIE_RAVEN_PLUGIN_DATADIR = RAVEN_PLUGIN_DATADIR;
- 
--#ifdef HAS_SECONDARY_PLUGIN_DIRS
--const bool BUDGIE_HAS_SECONDARY_PLUGIN_DIRS = true;
--const char* BUDGIE_MODULE_DIRECTORY_SECONDARY = MODULEDIR_SECONDARY;
--const char* BUDGIE_MODULE_DATA_DIRECTORY_SECONDARY = MODULE_DATA_DIR_SECONDARY;
--const char* BUDGIE_RAVEN_PLUGIN_LIBDIR_SECONDARY = RAVEN_PLUGIN_LIBDIR_SECONDARY;
--const char* BUDGIE_RAVEN_PLUGIN_DATADIR_SECONDARY = RAVEN_PLUGIN_DATADIR_SECONDARY;
--#else
--const bool BUDGIE_HAS_SECONDARY_PLUGIN_DIRS = false;
--const char* BUDGIE_MODULE_DIRECTORY_SECONDARY = NULL;
--const char* BUDGIE_MODULE_DATA_DIRECTORY_SECONDARY = NULL;
--const char* BUDGIE_RAVEN_PLUGIN_LIBDIR_SECONDARY = NULL;
--const char* BUDGIE_RAVEN_PLUGIN_DATADIR_SECONDARY = NULL;
--#endif
--
- const char* BUDGIE_DATADIR = DATADIR;
- const char* BUDGIE_VERSION = PACKAGE_VERSION;
- const char* BUDGIE_WEBSITE = PACKAGE_URL;
-diff --git a/src/config/budgie-config.h b/src/config/budgie-config.h
-index b7581203..11df4347 100644
---- a/src/config/budgie-config.h
-+++ b/src/config/budgie-config.h
-@@ -12,7 +12,6 @@
- #ifndef _BUDGIE_CONFIG_H_
- #define _BUDGIE_CONFIG_H_
- 
--#include <stdbool.h>
- #include <stddef.h>
- 
- /* i.e. /usr/lib/budgie-desktop */
-@@ -27,12 +26,6 @@ extern const char* BUDGIE_RAVEN_PLUGIN_LIBDIR;
- /* i.e. /usr/share/budgie-desktop/raven-plugins */
- extern const char* BUDGIE_RAVEN_PLUGIN_DATADIR;
- 
--extern const bool BUDGIE_HAS_SECONDARY_PLUGIN_DIRS;
--extern const char* BUDGIE_MODULE_DIRECTORY_SECONDARY;
--extern const char* BUDGIE_MODULE_DATA_DIRECTORY_SECONDARY;
--extern const char* BUDGIE_RAVEN_PLUGIN_LIBDIR_SECONDARY;
--extern const char* BUDGIE_RAVEN_PLUGIN_DATADIR_SECONDARY;
--
- /* i.e. /usr/share/ */
- extern const char* BUDGIE_DATADIR;
- 
-diff --git a/src/config/budgie-config.vapi b/src/config/budgie-config.vapi
-index 5eb445d1..7d27e348 100644
---- a/src/config/budgie-config.vapi
-+++ b/src/config/budgie-config.vapi
-@@ -22,21 +22,6 @@ namespace Budgie {
- 	[CCode (cheader_filename="budgie-config.h")]
- 	public extern const string RAVEN_PLUGIN_DATADIR;
- 
--	[CCode (cheader_filename="budgie-config.h")]
--	public extern const bool HAS_SECONDARY_PLUGIN_DIRS;
--
--	[CCode (cheader_filename="budgie-config.h")]
--	public extern const string? MODULE_DIRECTORY_SECONDARY;
--
--	[CCode (cheader_filename="budgie-config.h")]
--    public extern const string? MODULE_DATA_DIRECTORY_SECONDARY;
--
--	[CCode (cheader_filename="budgie-config.h")]
--	public extern const string? RAVEN_PLUGIN_LIBDIR_SECONDARY;
--
--	[CCode (cheader_filename="budgie-config.h")]
--	public extern const string? RAVEN_PLUGIN_DATADIR_SECONDARY;
--
-     [CCode (cheader_filename="budgie-config.h")]
-     public extern const string DATADIR;
- 
-diff --git a/src/panel/plugin_manager.vala b/src/panel/plugin_manager.vala
-index f4f2e4da..3dfee49a 100644
---- a/src/panel/plugin_manager.vala
-+++ b/src/panel/plugin_manager.vala
-@@ -40,13 +40,26 @@ namespace Budgie {
- 			}
- 
- 			/* System path */
--			var dir = Environment.get_user_data_dir();
--			engine.add_search_path(Budgie.MODULE_DIRECTORY, Budgie.MODULE_DATA_DIRECTORY);
--			if (Budgie.HAS_SECONDARY_PLUGIN_DIRS) {
--				engine.add_search_path(Budgie.MODULE_DIRECTORY_SECONDARY, Budgie.MODULE_DATA_DIRECTORY_SECONDARY);
-+			var libdir = Environment.get_variable("BUDGIE_PLUGIN_LIBDIR");
-+			if (libdir != null) {
-+				debug("BUDGIE_PLUGIN_LIBDIR is set to %s", libdir);
-+			} else {
-+				debug("BUDGIE_PLUGIN_LIBDIR is unset, defaulting to %s", Budgie.MODULE_DIRECTORY);
-+				libdir = Budgie.MODULE_DIRECTORY;
-+ 			}
++	peas_engine_add_search_path(self->engine, libdir, datadir);
 +
-+			var datadir = Environment.get_variable("BUDGIE_PLUGIN_DATADIR");
-+			if (datadir != null) {
-+				debug("BUDGIE_PLUGIN_DATADIR is set to %s", datadir);
-+			} else {
-+				debug("BUDGIE_PLUGIN_DATADIR is unset, defaulting to %s", Budgie.MODULE_DATA_DIRECTORY);
-+				datadir = Budgie.MODULE_DATA_DIRECTORY;
- 			}
- 
-+			engine.add_search_path(libdir, datadir);
-+
- 			/* User path */
-+			var dir = Environment.get_user_data_dir();
- 			var user_mod = Path.build_path(Path.DIR_SEPARATOR_S, dir, "budgie-desktop", "plugins");
- 			var hdata = Path.build_path(Path.DIR_SEPARATOR_S, dir, "budgie-desktop", "data");
- 			engine.add_search_path(user_mod, hdata);
+ 	/* User path */
+ 	user_data_dir = g_get_user_data_dir();
+ 	user_mod_dir = g_build_path(G_DIR_SEPARATOR_S, user_data_dir, "budgie-desktop", "plugins", NULL);
 diff --git a/src/raven/plugin_manager.vala b/src/raven/plugin_manager.vala
-index 01f32553..2826b7e5 100644
+index 1ff139c9a..809b9b82a 100644
 --- a/src/raven/plugin_manager.vala
 +++ b/src/raven/plugin_manager.vala
-@@ -51,13 +51,26 @@ namespace Budgie {
- 			}
+@@ -51,11 +51,24 @@ namespace Budgie {
  
  			/* System path */
--			var dir = Environment.get_user_data_dir();
+ 			var dir = Environment.get_user_data_dir();
 -			engine.add_search_path(Budgie.RAVEN_PLUGIN_LIBDIR, Budgie.RAVEN_PLUGIN_DATADIR);
 -			if (Budgie.HAS_SECONDARY_PLUGIN_DIRS) {
 -				engine.add_search_path(Budgie.RAVEN_PLUGIN_LIBDIR_SECONDARY, Budgie.RAVEN_PLUGIN_DATADIR_SECONDARY);
@@ -192,7 +62,5 @@ index 01f32553..2826b7e5 100644
 +			engine.add_search_path(libdir, datadir);
 +
  			/* User path */
-+			var dir = Environment.get_user_data_dir();
  			var user_mod = Path.build_path(Path.DIR_SEPARATOR_S, dir, "budgie-desktop", "raven-plugins");
  			var hdata = Path.build_path(Path.DIR_SEPARATOR_S, dir, "budgie-desktop", "raven-data");
- 			engine.add_search_path(user_mod, hdata);

pkgs/by-name/bu/budgie-media-player-applet/package.nix

@@ -45,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     substituteInPlace meson.build --replace-fail "/usr" "$out"
+
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/749
+    substituteInPlace budgie-media-player-applet.plugin.in \
+      --replace-fail "Loader=@PYTHON@" "Loader=python"
   '';
 
   postFixup = ''

pkgs/by-name/bu/budgie-systemmonitor-applet/package.nix

@@ -7,7 +7,7 @@
   gtk3,
   libgee,
   libgtop,
-  libpeas,
+  libpeas2,
   meson,
   ninja,
   nix-update-script,
@@ -45,9 +45,15 @@ stdenv.mkDerivation (finalAttrs: {
     gtk3
     libgee
     libgtop
-    libpeas
+    libpeas2
   ];
 
+  postPatch = ''
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/749
+    substituteInPlace meson.build \
+      --replace-fail "dependency('libpeas-1.0', version: '>= 1.8.0')" "dependency('libpeas-2')"
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };

pkgs/by-name/bu/budgie-user-indicator-redux/package.nix

@@ -7,7 +7,7 @@
   gtk3,
   intltool,
   libgee,
-  libpeas,
+  libpeas2,
   meson,
   ninja,
   nix-update-script,
@@ -40,10 +40,16 @@ stdenv.mkDerivation (finalAttrs: {
     budgie-desktop
     gtk3
     libgee
-    libpeas
+    libpeas2
     sassc
   ];
 
+  postPatch = ''
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/749
+    substituteInPlace meson.build \
+      --replace-fail "dependency('libpeas-1.0', version: '>= 1.26.0')" "dependency('libpeas-2')"
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };

pkgs/by-name/ca/catch2_3/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     tag = "v${version}";
-    hash = "sha256-eeqqzHMeXLRiXzbY+ay8gJ/YDuxDj3f6+d6eXA1uZHE=";
+    hash = "sha256-7Dx7PhtRwkbo8vHF57sAns2fQZ442D3cMyCt25RvzJc=";
   };
 
   patches = lib.optionals stdenv.cc.isClang [
@@ -40,9 +40,9 @@ stdenv.mkDerivation rec {
     "-DCATCH_BUILD_TESTING=${if doCheck then "ON" else "OFF"}"
     "-DCATCH_ENABLE_WERROR=OFF"
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && doCheck) [
+  ++ lib.optionals (stdenv.cc.isClang && doCheck) [
     # test has a faulty path normalization technique that won't work in
-    # our darwin build environment https://github.com/catchorg/Catch2/issues/1691
+    # our darwin/LLVM build environment https://github.com/catchorg/Catch2/issues/1691
     "-DCMAKE_CTEST_ARGUMENTS=-E;ApprovalTests"
   ];
 

pkgs/by-name/cc/cctools/meson.build

@@ -12,7 +12,7 @@ project(
             '-DCCTB_PROJECT=cctools',
             '-DCCTB_PROJVERS=cctools-@version@',
             '-DCCTB_VERSION=@version@',
-            '-DCURRENT_PROJECT_VERSION="@version@"',
+            '-DCURRENT_PROJECT_VERSION="cctools-@version@"',
             '-DCODEDIRECTORY_SUPPORT',
             '-DLTO_SUPPORT',
         ],

pkgs/by-name/ch/choose-gui/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   xcbuild,
-  apple-sdk_11,
 }:
 
 stdenv.mkDerivation rec {
@@ -19,8 +18,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ xcbuild ];
 
-  buildInputs = [ apple-sdk_11 ];
-
   buildPhase = ''
     runHook preBuild
     xcodebuild -configuration Release SYMROOT="./output" HOME="$(mktemp -d)" build

pkgs/by-name/ch/chromaprint/package.nix

@@ -75,12 +75,12 @@ stdenv.mkDerivation (finalAttrs: {
       };
 
       # sha256 because actual output of fpcalc is quite long
-      expectedHash = "c47ae40e02caf798ff5ab4d91ff00cfdca8f6786c581662436941d3e000c9aac";
+      expectedHash = "e2895130bcbe7190184379021daa60c5f5d476da4a2fecb06df7160819662e20";
     in
     ''
       runHook preCheck
       tests/all_tests
-      ${lib.optionalString withTools "diff -u <(src/cmd/fpcalc ${exampleAudio} | sha256sum | cut -c-64) <(echo '${expectedHash}')"}
+      ${lib.optionalString withTools "diff -u <(src/cmd/fpcalc -plain ${exampleAudio} | sha256sum | cut -c-64) <(echo '${expectedHash}')"}
       runHook postCheck
     '';
 

pkgs/by-name/ch/chrony/package.nix

@@ -62,8 +62,6 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   doCheck = true;
 
-  hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
-
   passthru.tests = {
     inherit (nixosTests) chrony chrony-ptp;
   };

pkgs/by-name/cm/cmake/setup-hook.sh

@@ -39,13 +39,6 @@ cmakeConfigurePhase() {
     prependToVar cmakeFlags "-DCMAKE_RANLIB=$(command -v $RANLIB)"
     prependToVar cmakeFlags "-DCMAKE_STRIP=$(command -v $STRIP)"
 
-    # on macOS we want to prefer Unix-style headers to Frameworks
-    # because we usually do not package the framework
-    prependToVar cmakeFlags "-DCMAKE_FIND_FRAMEWORK=LAST"
-
-    # correctly detect our clang compiler
-    prependToVar cmakeFlags "-DCMAKE_POLICY_DEFAULT_CMP0025=NEW"
-
     # This installs shared libraries with a fully-specified install
     # name. By default, cmake installs shared libraries with just the
     # basename as the install name, which means that, on Darwin, they

pkgs/by-name/cu/curlMinimal/fix-h2-paused-transfers.patch

@@ -0,0 +1,27 @@
+From 7e91f24c73256af59ac9061c41b73a184c4690aa Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 3 Nov 2025 15:07:57 +0100
+Subject: [PATCH] cw-out: fix EAGAIN handling on pause
+
+The interim CURLE_AGAIN result was not always converted to a
+CURLE_OK and then caused write callers to report a failure.
+
+Fixes #19334
+Reported-by: pennae on github
+Closes #19338
+---
+ lib/cw-out.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/cw-out.c b/lib/cw-out.c
+index 1f4031649267..9c0a36e7e5e2 100644
+--- a/lib/cw-out.c
++++ b/lib/cw-out.c
+@@ -302,6 +302,7 @@ static CURLcode cw_out_buf_flush(struct cw_out_ctx *ctx,
+                               &consumed);
+     if(result && (result != CURLE_AGAIN))
+       return result;
++    result = CURLE_OK;
+ 
+     if(consumed) {
+       if(consumed == curlx_dyn_len(&cwbuf->b)) {

pkgs/by-name/cu/curlMinimal/package.nix

@@ -98,6 +98,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-QMjN28tsxiUcA96kI6Ryps6kA3vmVLpc9d7G6y0i/x0=";
   };
 
+  patches = [
+    # Bug introduced in curl@fa915b (8.16.0) https://github.com/curl/curl/issues/19334 Paused
+    # HTTP/2 transfers will return the wrong errors and trash the whole
+    # transfer. Remove this patch once curl is updated to 8.17.0 which will be
+    # released on the 5th November 2025.
+    ./fix-h2-paused-transfers.patch
+  ];
+
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''

pkgs/by-name/d-/d-spy/package.nix

@@ -7,6 +7,7 @@
   gettext,
   gtk4,
   libadwaita,
+  libdex,
   meson,
   ninja,
   pkg-config,
@@ -16,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "d-spy";
-  version = "48.0";
+  version = "49.1";
 
   outputs = [
     "out"
@@ -25,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/d-spy/${lib.versions.major finalAttrs.version}/d-spy-${finalAttrs.version}.tar.xz";
-    hash = "sha256-D3oJAZBGGU2X/Dw0KzhOocOA4Qqc/IAlv83lfVlcODA=";
+    hash = "sha256-4m4YEg5k1FG2HyAs+qORNienAxwqlUrs85HIPYPQnYo=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     glib
     gtk4
     libadwaita
+    libdex
   ];
 
   passthru = {

pkgs/by-name/da/dash/package.nix

@@ -7,15 +7,19 @@
   libedit,
   runCommand,
   dash,
+
+  # Reverse dependency smoke tests
+  tests,
+  patchRcPathPosix,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dash";
-  version = "0.5.12";
+  version = "0.5.13.1";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/dash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-akdKxG6LCzKRbExg32lMggWNMpfYs4W3RQgDDKSo8oo=";
+    hash = "sha256-2ScbzgnBJ9mGbiXAEVgt3HWrmIlYoEvE2FU6O48w43A=";
   };
 
   strictDeps = true;
@@ -43,6 +47,19 @@ stdenv.mkDerivation (finalAttrs: {
         [ -s $out/success ]
         grep -q "Hello World" $out/success
       '';
+
+      /**
+        Reverse dependency smoke tests. Build success of `dash.tests` informs
+        whether an update makes it into staging.
+      */
+      reverseDependencies = lib.recurseIntoAttrs {
+        writers = lib.recurseIntoAttrs {
+          simple = tests.writers.simple.dash;
+          bin = tests.writers.bin.dash;
+        };
+        # Not sure if effective smoke test, but cheap
+        patch-rc-path-posix = patchRcPathPosix.tests.test-posix;
+      };
     };
   };
 

pkgs/by-name/da/dav1d/package.nix

@@ -27,13 +27,13 @@ assert useVulkan -> withExamples;
 
 stdenv.mkDerivation rec {
   pname = "dav1d";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "videolan";
     repo = "dav1d";
     rev = version;
-    hash = "sha256-qcs9QoZ/uWEQ8l1ChZ8nYctZnnWJ0VvCw1q2rEktC9g=";
+    hash = "sha256-rxRO5EWjrOUsCYXd2rDDhfcEZbfSuMfjujRAHTqUYhI=";
   };
 
   outputs = [

pkgs/by-name/dc/dconf-editor/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   desktop-file-utils,
   meson,
   ninja,
@@ -23,20 +22,14 @@
 
 stdenv.mkDerivation rec {
   pname = "dconf-editor";
-  version = "45.0.1";
+  version = "49.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/dconf-editor/${lib.versions.major version}/dconf-editor-${version}.tar.xz";
-    hash = "sha256-EYApdnju2uYhfMUUomOMGH0vHR7ycgy5B5t0DEKZQd0=";
+    hash = "sha256-kKjM+t9R3/MeACgyT7mjWLLSbFroYaccfb+fTdm905k=";
   };
 
   patches = [
-    # Fix crash with GSETTINGS_SCHEMA_DIR env var.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/dconf-editor/-/commit/baf183737d459dcde065c9f8f6fe5be7ed874de6.patch";
-      hash = "sha256-Vp0qjJChDr6IarUD+tZPLJhdI8v8r6EzWNfqFSnGvqQ=";
-    })
-
     # Look for compiled schemas in NIX_GSETTINGS_OVERRIDES_DIR
     # environment variable, to match what we patched GLib to do.
     ./schema-override-variable.patch

pkgs/by-name/de/decibels/package.nix

@@ -17,11 +17,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "decibels";
-  version = "48.0";
+  version = "49.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/decibels/${lib.versions.major finalAttrs.version}/decibels-${finalAttrs.version}.tar.xz";
-    hash = "sha256-IpsRqSYxR7y4w+If8NSvZZ+yYmL4rs5Uetz4xl4DH3Q=";
+    hash = "sha256-KbebouKWfmkUHjnwrSxnfjj+P/ufug+lx1MflNP2c8o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/di/diebahn/package.nix

@@ -24,18 +24,18 @@
 
 stdenv.mkDerivation rec {
   pname = "diebahn";
-  version = "2.8.2";
+  version = "2.9.0";
 
   src = fetchFromGitLab {
     owner = "schmiddi-on-mobile";
     repo = "railway";
     tag = version;
-    hash = "sha256-pPjOl46R8hBpyKdwq/gwHv/qCtFkI0LVDsqxcQOgtkU=";
+    hash = "sha256-9ADJX2NFYv+l7umAmDLa1cO6wEnaNKu9SLzwJjfGrRM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-kxt6z2RaSnlso/Jz36B9VNwti2o3b8+Ggd4zDIjFf2c=";
+    hash = "sha256-OijGiVBGe4wmGN7e9xOnZRoF9HpiryGi+stqgBIrlzc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/dn/dnsmasq/package.nix

@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     "PKG_CONFIG=${buildPackages.pkg-config}/bin/${buildPackages.pkg-config.targetPrefix}pkg-config"
   ];
 
-  hardeningEnable = [ "pie" ];
+  enableParallelBuilding = true;
 
   postBuild = lib.optionalString stdenv.hostPlatform.isLinux ''
     make -C contrib/lease-tools

pkgs/by-name/do/double-conversion/package.nix

@@ -4,17 +4,19 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
-  enableStatic ? stdenv.hostPlatform.isStatic,
+  ninja,
+  ctestCheckHook,
+  testers,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "double-conversion";
   version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "double-conversion";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-M80H+azCzQYa4/gBLWv5GNNhEuHsH7LbJ/ajwmACnrM=";
   };
 
@@ -30,22 +32,46 @@ stdenv.mkDerivation rec {
       url = "https://github.com/google/double-conversion/commit/0604b4c18815aadcf7f4b78dfa6bfcb91a634ed7.patch";
       hash = "sha256-cJBp1ou1O/bMQ/7kvcX52dWbUdhmPfQ9aWmEhQdyhis=";
     })
+    (fetchpatch {
+      name = "double-conversion-add-pkg-config.patch";
+      url = "https://github.com/google/double-conversion/commit/ddfd18c58ecc32fc74afc1083bb8774240b54efb.patch";
+      hash = "sha256-/pKCL19vS8fNwCm27yTNP+32ApHTH5dEGpnsMI11Lf4=";
+    })
   ];
 
-  nativeBuildInputs = [ cmake ];
+  outputs = [
+    "out"
+    "dev"
+  ];
 
-  cmakeFlags = lib.optional (!enableStatic) "-DBUILD_SHARED_LIBS=ON";
+  nativeBuildInputs = [
+    cmake
+    ninja
+    ctestCheckHook
+  ];
+
+  doCheck = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_TESTING" true)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" stdenv.hostPlatform.hasSharedLibraries)
+  ];
 
   # Case sensitivity issue
   preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
     rm BUILD
   '';
 
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
   meta = with lib; {
+    pkgConfigModules = [ "double-conversion" ];
     description = "Binary-decimal and decimal-binary routines for IEEE doubles";
     homepage = "https://github.com/google/double-conversion";
     license = licenses.bsd3;
     platforms = platforms.unix ++ platforms.windows;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ fzakaria ];
   };
-}
+})