From b1a34ed0ca58d37ce9c07724062b22a6664e6a45 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Mon, 21 Jul 2025 03:12:02 +0200
Subject: [PATCH 001/306] libheif: add lib output

This enables referencing the `bin` output from `out` without creating a
circular dependency.
---
 pkgs/by-name/li/libheif/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index 0d5e976c27ff9..9954e66d560af 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
     "out"
     "dev"
     "man"
+    "lib"
   ];
 
   src = fetchFromGitHub {
@@ -57,7 +58,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Fix installation path for gdk-pixbuf module
-  PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${placeholder "out"}/${gdk-pixbuf.moduleDir}";
+  PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${placeholder "lib"}/${gdk-pixbuf.moduleDir}";
 
   # Wrong include path in .cmake.  It's a bit difficult to patch because of special characters.
   postFixup = ''

From d4d8c251961582ce31dbeaaa130c6081571914e6 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sat, 26 Jul 2025 01:24:56 +0200
Subject: [PATCH 002/306] {eog,shotwell,xfce.ristretto,zathura}: libheif.out ->
 libheif.lib

libheif moved the gdk-pixbuf loader to its new `lib` output.
---
 pkgs/applications/misc/zathura/core/default.nix       | 2 +-
 pkgs/by-name/eo/eog/package.nix                       | 2 +-
 pkgs/by-name/sh/shotwell/package.nix                  | 2 +-
 pkgs/desktops/xfce/applications/ristretto/default.nix | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix
index b6de5c2eec01e..ab7f2a1ff65ba 100644
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
   # add support for more image formats
   env.GDK_PIXBUF_MODULE_FILE = gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
     extraLoaders = [
-      libheif.out
+      libheif.lib
       libjxl
       librsvg
       webp-pixbuf-loader
diff --git a/pkgs/by-name/eo/eog/package.nix b/pkgs/by-name/eo/eog/package.nix
index 09ce3ade221a8..4169f140d6030 100644
--- a/pkgs/by-name/eo/eog/package.nix
+++ b/pkgs/by-name/eo/eog/package.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
           libjxl
           librsvg
           webp-pixbuf-loader
-          libheif.out
+          libheif.lib
         ];
       }
     }"
diff --git a/pkgs/by-name/sh/shotwell/package.nix b/pkgs/by-name/sh/shotwell/package.nix
index cfa106cf00a98..2207a8ee8d5bb 100644
--- a/pkgs/by-name/sh/shotwell/package.nix
+++ b/pkgs/by-name/sh/shotwell/package.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     export GDK_PIXBUF_MODULE_FILE="${
       gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
         extraLoaders = [
-          libheif.out
+          libheif.lib
         ];
       }
     }"
diff --git a/pkgs/desktops/xfce/applications/ristretto/default.nix b/pkgs/desktops/xfce/applications/ristretto/default.nix
index 153c9051b8b5c..4c27e4d0056c0 100644
--- a/pkgs/desktops/xfce/applications/ristretto/default.nix
+++ b/pkgs/desktops/xfce/applications/ristretto/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     export GDK_PIXBUF_MODULE_FILE="${
       gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
         extraLoaders = [
-          libheif.out
+          libheif.lib
           libjxl
           librsvg
           webp-pixbuf-loader

From aab4ae5d70050971d02e2c45a961a29961c3eac8 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Mon, 21 Jul 2025 12:47:45 +0200
Subject: [PATCH 003/306] libheif: use absolute binary path in thumbnailer file

This fixes the thumbnailer for Nautilus when installed via home-manager.
---
 pkgs/by-name/li/libheif/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index 9954e66d560af..3f7521b26c3d1 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -60,6 +60,12 @@ stdenv.mkDerivation rec {
   # Fix installation path for gdk-pixbuf module
   PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${placeholder "lib"}/${gdk-pixbuf.moduleDir}";
 
+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/heif.thumbnailer \
+      --replace-fail "TryExec=heif-thumbnailer" "TryExec=$bin/bin/heif-thumbnailer" \
+      --replace-fail "Exec=heif-thumbnailer" "Exec=$bin/bin/heif-thumbnailer"
+  '';
+
   # Wrong include path in .cmake.  It's a bit difficult to patch because of special characters.
   postFixup = ''
     sed '/^  INTERFACE_INCLUDE_DIRECTORIES/s|"[^"]*/include"|"${placeholder "dev"}/include"|' \

From effa5e9bff9c055e299bfdfea488558f8e924d2a Mon Sep 17 00:00:00 2001
From: Ophestra <contrib@gensokyo.uk>
Date: Mon, 25 Aug 2025 17:34:47 +0900
Subject: [PATCH 004/306] sphinx: disable racy test

This disables another racy test that #435419 missed. It fails on the
same local networking mechanism.
---
 pkgs/development/python-modules/sphinx/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 5d4b4d581fa4f..7402fa2b3103b 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -135,6 +135,7 @@ buildPythonPackage rec {
     # Racy local networking
     "test_load_mappings_cache"
     "test_load_mappings_cache_update"
+    "test_load_mappings_cache_revert_update"
   ]
   ++ lib.optionals (pythonAtLeast "3.12") [
     # https://github.com/sphinx-doc/sphinx/issues/12430

From 779515eb7c13723f4ac373451bcb6e63a6ac3e3b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 Aug 2025 12:36:59 +0000
Subject: [PATCH 005/306] gumbo: 0.13.1 -> 0.13.2

---
 pkgs/by-name/gu/gumbo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gu/gumbo/package.nix b/pkgs/by-name/gu/gumbo/package.nix
index 7c64ef08745f3..ef1dbf8a7f476 100644
--- a/pkgs/by-name/gu/gumbo/package.nix
+++ b/pkgs/by-name/gu/gumbo/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gumbo";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "gumbo-parser";
     repo = "gumbo-parser";
     rev = version;
-    hash = "sha256-QNzllJI0ZHRl8o3ktJq+rI8v4SUUJ3MJ6uIubqf1heI=";
+    hash = "sha256-8mri7mLZkuIZgzE6p0yc41bNNyzGTV9V90OiA/9TkkU=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

From d3e3c7aaf473b3cc065ef19a2651fbfacf5776f0 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 07:01:15 +0200
Subject: [PATCH 006/306] libxcomposite: refactor, move to pkgs/by-name and
 rename from xorg.libXcomposite

---
 pkgs/by-name/li/libxcomposite/package.nix     | 65 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +-----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  5 +-
 pkgs/servers/x11/xorg/overrides.nix           |  8 ---
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 72 insertions(+), 49 deletions(-)
 create mode 100644 pkgs/by-name/li/libxcomposite/package.nix

diff --git a/pkgs/by-name/li/libxcomposite/package.nix b/pkgs/by-name/li/libxcomposite/package.nix
new file mode 100644
index 0000000000000..b141e7eece767
--- /dev/null
+++ b/pkgs/by-name/li/libxcomposite/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxfixes,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcomposite";
+  version = "0.4.6";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXcomposite-${finalAttrs.version}.tar.xz";
+    hash = "sha256-/kC88K4aCQcOuiQIil65gQ7+V0U3eeweIKVQgMbcLIc=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxfixes
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    # header file dependencies
+    libxfixes
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXcomposite \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Client library for the Composite extension to the X11 protocol";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcomposite";
+    license = with lib.licenses; [
+      hpndSellVariant
+      mit
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xcomposite" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 15acd52e9e485..a624e138cc0cd 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -29,8 +29,9 @@
   libxcb-render-util,
   libxcb-util,
   libxcb-wm,
-  libxcvt,
+  libxcomposite,
   libxcursor,
+  libxcvt,
   libxdmcp,
   libxext,
   libxfixes,
@@ -130,6 +131,7 @@ self: with self; {
   libX11 = libx11;
   libXau = libxau;
   libXaw = libxaw;
+  libXcomposite = libxcomposite;
   libXcursor = libxcursor;
   libXdmcp = libxdmcp;
   libXext = libxext;
@@ -1758,44 +1760,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXcomposite = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXfixes,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXcomposite";
-      version = "0.4.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz";
-        sha256 = "11rcvk380l5540gfqy9p8mbzw3l1p5g8l214p870f28smvqbqh7y";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXfixes
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xcomposite" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXdamage = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 0abd26780af1b..677d521fdd77c 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -61,6 +61,7 @@
 $pcMap{"xcb-proto"} = "xcbproto";
 $pcMap{"xcb-renderutil"} = "xcbutilrenderutil";
 $pcMap{"xcb-util"} = "xcbutil";
+$pcMap{"xcomposite"} = "libXcomposite";
 $pcMap{"xcursor"} = "libXcursor";
 $pcMap{"xdmcp"} = "libXdmcp";
 $pcMap{"xext"} = "libXext";
@@ -345,8 +346,9 @@
   libxcb-render-util,
   libxcb-util,
   libxcb-wm,
-  libxcvt,
+  libxcomposite,
   libxcursor,
+  libxcvt,
   libxdmcp,
   libxext,
   libxfixes,
@@ -446,6 +448,7 @@
   libX11 = libx11;
   libXau = libxau;
   libXaw = libxaw;
+  libXcomposite = libxcomposite;
   libXcursor = libxcursor;
   libXdmcp = libxdmcp;
   libXext = libxext;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index df416c019038d..870408a2f5f19 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -204,14 +204,6 @@ self: super:
     };
   });
 
-  libXcomposite = super.libXcomposite.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ xorg.libXfixes ];
-  });
-
   libXdamage = super.libXdamage.overrideAttrs (attrs: {
     outputs = [
       "out"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index c9e2c7583076d..e1f1a407ed11a 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -126,7 +126,6 @@ mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz
 mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz
 mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
 mirror://xorg/individual/lib/libXfont2-2.0.7.tar.xz

From 9e7b4cc4776000b8cd709277ec6f27212f422b74 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Mon, 18 Aug 2025 21:50:17 +0200
Subject: [PATCH 007/306] libxdamage: refactor, move to pkgs/by-name and rename
 from xorg.libXdamage

---
 pkgs/by-name/li/libxdamage/package.nix        | 58 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 40 +------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           |  7 ---
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 63 insertions(+), 46 deletions(-)
 create mode 100644 pkgs/by-name/li/libxdamage/package.nix

diff --git a/pkgs/by-name/li/libxdamage/package.nix b/pkgs/by-name/li/libxdamage/package.nix
new file mode 100644
index 0000000000000..39c34e3530fa4
--- /dev/null
+++ b/pkgs/by-name/li/libxdamage/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxfixes,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxdamage";
+  version = "1.1.6";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXdamage-${finalAttrs.version}.tar.xz";
+    hash = "sha256-UnM8H1Ji/KNfZOfVBgxvzYGogLqOHmXJYhzwcnr7XRE=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxfixes
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXdamage \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Damage Extension library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxdamage";
+    license = lib.licenses.hpndSellVariant;
+    maintainers = [ ];
+    pkgConfigModules = [ "xdamage" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index a624e138cc0cd..0024c39765cc0 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -32,6 +32,7 @@
   libxcomposite,
   libxcursor,
   libxcvt,
+  libxdamage,
   libxdmcp,
   libxext,
   libxfixes,
@@ -133,6 +134,7 @@ self: with self; {
   libXaw = libxaw;
   libXcomposite = libxcomposite;
   libXcursor = libxcursor;
+  libXdamage = libxdamage;
   libXdmcp = libxdmcp;
   libXext = libxext;
   libXfixes = libxfixes;
@@ -1760,44 +1762,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXdamage = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXfixes,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXdamage";
-      version = "1.1.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz";
-        sha256 = "04axzdx75w0wcb4na7lfpa0ai0fddw60dmg7cigs7z32a8gkqwsj";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXfixes
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xdamage" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXfont = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 677d521fdd77c..5ca2415e875d6 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -63,6 +63,7 @@
 $pcMap{"xcb-util"} = "xcbutil";
 $pcMap{"xcomposite"} = "libXcomposite";
 $pcMap{"xcursor"} = "libXcursor";
+$pcMap{"xdamage"} = "libXdamage";
 $pcMap{"xdmcp"} = "libXdmcp";
 $pcMap{"xext"} = "libXext";
 $pcMap{"xfixes"} = "libXfixes";
@@ -349,6 +350,7 @@
   libxcomposite,
   libxcursor,
   libxcvt,
+  libxdamage,
   libxdmcp,
   libxext,
   libxfixes,
@@ -450,6 +452,7 @@
   libXaw = libxaw;
   libXcomposite = libxcomposite;
   libXcursor = libxcursor;
+  libXdamage = libxdamage;
   libXdmcp = libxdmcp;
   libXext = libxext;
   libXfixes = libxfixes;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 870408a2f5f19..4d464fc6f02d7 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -204,13 +204,6 @@ self: super:
     };
   });
 
-  libXdamage = super.libXdamage.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-  });
-
   libXft = super.libXft.overrideAttrs (attrs: {
     outputs = [
       "out"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index e1f1a407ed11a..78ce8d011fa99 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -126,7 +126,6 @@ mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz
 mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
 mirror://xorg/individual/lib/libXfont2-2.0.7.tar.xz
 mirror://xorg/individual/lib/libXft-2.3.9.tar.xz

From 5e02ae89216ed8f187188e06ec397527a62496bf Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 14:53:09 +0200
Subject: [PATCH 008/306] libxfont_{1,2}: refactor, move to pkgs/by-name and
 rename from xorg.libXfont{,2}

relevant changes:
- this removes freetype from propagatedBuildInputs of libxfont_1 since
  it is not in 'Requires:' of xfont.pc nor imported in the header files
  The comment on the line said "propagate link reqs", however, if i
  understand this correctly, link requirements don't need to be propagated
---
 pkgs/by-name/li/libxfont_1/package.nix        | 73 +++++++++++++++
 pkgs/by-name/li/libxfont_2/package.nix        | 60 +++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 88 +------------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  6 ++
 pkgs/servers/x11/xorg/overrides.nix           | 10 ---
 pkgs/servers/x11/xorg/tarballs.list           |  2 -
 6 files changed, 143 insertions(+), 96 deletions(-)
 create mode 100644 pkgs/by-name/li/libxfont_1/package.nix
 create mode 100644 pkgs/by-name/li/libxfont_2/package.nix

diff --git a/pkgs/by-name/li/libxfont_1/package.nix b/pkgs/by-name/li/libxfont_1/package.nix
new file mode 100644
index 0000000000000..421f34dd9afec
--- /dev/null
+++ b/pkgs/by-name/li/libxfont_1/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libfontenc,
+  xorgproto,
+  freetype,
+  xtrans,
+  zlib,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxfont_1";
+  version = "1.5.4";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXfont-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-Gn90kHdMh/IFLRRtHg5kUY0y5oSBhKGGVOjQu1eIMkI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libfontenc
+    xorgproto
+    freetype
+    xtrans
+    zlib
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  # prevents "misaligned_stack_error_entering_dyld_stub_binder"
+  configureFlags = lib.optional stdenv.hostPlatform.isDarwin "CFLAGS=-O0";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXfont \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X font handling library for server & utilities";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxfont";
+    license = with lib.licenses; [
+      mit
+      mitOpenGroup
+      hpnd
+      hpndSellVariant
+      # this was originally BSD-3-Clause-UC, however the University of California rescinded
+      # clause 3, the advertising clause, in 1999 effectively reverting it to a BSD-3-Clause
+      bsd3
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xfont" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxfont_2/package.nix b/pkgs/by-name/li/libxfont_2/package.nix
new file mode 100644
index 0000000000000..2902d682931ff
--- /dev/null
+++ b/pkgs/by-name/li/libxfont_2/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libfontenc,
+  xorgproto,
+  freetype,
+  xtrans,
+  zlib,
+  writeScript,
+  testers,
+  # for inheriting the meta attributes
+  libxfont_1,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxfont_2";
+  version = "2.0.7";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXfont2-${finalAttrs.version}.tar.xz";
+    hash = "sha256-i3uC/eukh2m2lDPo4/u5hKX2vzaLDV9Hq+7EnePljvs=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libfontenc
+    xorgproto
+    freetype
+    xtrans
+    zlib
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXfont2 \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    inherit (libxfont_1.meta) description homepage license;
+    maintainers = [ ];
+    pkgConfigModules = [ "xfont2" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 0024c39765cc0..b41b8d631691b 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -36,6 +36,8 @@
   libxdmcp,
   libxext,
   libxfixes,
+  libxfont_1,
+  libxfont_2,
   libxmu,
   libxpm,
   libxrandr,
@@ -138,6 +140,8 @@ self: with self; {
   libXdmcp = libxdmcp;
   libXext = libxext;
   libXfixes = libxfixes;
+  libXfont2 = libxfont_2;
+  libXfont = libxfont_1;
   libXmu = libxmu;
   libXpm = libxpm;
   libXrandr = libxrandr;
@@ -1762,90 +1766,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXfont = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libfontenc,
-      xorgproto,
-      freetype,
-      xtrans,
-      zlib,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXfont";
-      version = "1.5.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2";
-        sha256 = "0hiji1bvpl78aj3a3141hkk353aich71wv8l5l2z51scfy878zqs";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libfontenc
-        xorgproto
-        freetype
-        xtrans
-        zlib
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xfont" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXfont2 = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libfontenc,
-      xorgproto,
-      freetype,
-      xtrans,
-      zlib,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXfont2";
-      version = "2.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXfont2-2.0.7.tar.xz";
-        sha256 = "1ywfwpirvi7fmd3my3cb6szzd9c4p7xy7s1kjjv6k1x4xgyq4ywb";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libfontenc
-        xorgproto
-        freetype
-        xtrans
-        zlib
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xfont2" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXft = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 5ca2415e875d6..a163122e191f3 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -67,6 +67,8 @@
 $pcMap{"xdmcp"} = "libXdmcp";
 $pcMap{"xext"} = "libXext";
 $pcMap{"xfixes"} = "libXfixes";
+$pcMap{"xfont"} = "libXfont";
+$pcMap{"xfont2"} = "libXfont2";
 $pcMap{"xmu"} = "libXmu";
 $pcMap{"xmuu"} = "libXmu";
 $pcMap{"xpm"} = "libXpm";
@@ -354,6 +356,8 @@
   libxdmcp,
   libxext,
   libxfixes,
+  libxfont_1,
+  libxfont_2,
   libxmu,
   libxpm,
   libxrandr,
@@ -456,6 +460,8 @@
   libXdmcp = libxdmcp;
   libXext = libxext;
   libXfixes = libxfixes;
+  libXfont2 = libxfont_2;
+  libXfont = libxfont_1;
   libXmu = libxmu;
   libXpm = libxpm;
   libXrandr = libxrandr;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 4d464fc6f02d7..7cadc9ef56243 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -156,16 +156,6 @@ self: super:
     };
   });
 
-  libXfont = super.libXfont.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ freetype ]; # propagate link reqs. like bzip2
-    # prevents "misaligned_stack_error_entering_dyld_stub_binder"
-    configureFlags = lib.optional isDarwin "CFLAGS=-O0";
-  });
-
   libWindowsWM = super.libWindowsWM.overrideAttrs (attrs: {
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
   });
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 78ce8d011fa99..3d7f0c9781934 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -126,8 +126,6 @@ mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
-mirror://xorg/individual/lib/libXfont2-2.0.7.tar.xz
 mirror://xorg/individual/lib/libXft-2.3.9.tar.xz
 mirror://xorg/individual/lib/libXi-1.8.2.tar.xz
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz

From 0b402f072535c1ecd9e96ac279bf2d2c466cb33d Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 13:16:31 +0200
Subject: [PATCH 009/306] libxft: refactor, move to pkgs/by-name and rename
 from xorg.libXft

relevant changes:
- remove the patched in 'Requires: freetype2' as it does not matter
  since the dependency is propagated anyway
- remove 'inherit freetype fontconfig' from passthru because that was
  probably there through an error anyways. It was added here
  https://github.com/NixOS/nixpkgs/commit/9454f71fefcbe413fdfcb61b510256f1301c5f5c
---
 pkgs/by-name/li/libxft/package.nix            | 76 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 44 +----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           | 21 -----
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 81 insertions(+), 64 deletions(-)
 create mode 100644 pkgs/by-name/li/libxft/package.nix

diff --git a/pkgs/by-name/li/libxft/package.nix b/pkgs/by-name/li/libxft/package.nix
new file mode 100644
index 0000000000000..3f5955be00ace
--- /dev/null
+++ b/pkgs/by-name/li/libxft/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  fontconfig,
+  freetype,
+  libx11,
+  libxrender,
+  xorgproto,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxft";
+  version = "2.3.9";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXft-${finalAttrs.version}.tar.xz";
+    hash = "sha256-YKJbeJRe1pMmNbO7GJmlF9Md90VuaYZ/+6J/if85dvU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libx11
+    libxrender
+    xorgproto
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    # header file dependencies
+    freetype
+    fontconfig
+    libxrender
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXft \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X FreeType library";
+    longDescription = ''
+      libXft is the client side font rendering library, using libfreetype, libX11, and the
+      X Render extension to display anti-aliased text.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxft";
+    license = lib.licenses.hpndSellVariant;
+    maintainers = [ ];
+    pkgConfigModules = [ "xft" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index b41b8d631691b..470a7319989b1 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -38,6 +38,7 @@
   libxfixes,
   libxfont_1,
   libxfont_2,
+  libxft,
   libxmu,
   libxpm,
   libxrandr,
@@ -142,6 +143,7 @@ self: with self; {
   libXfixes = libxfixes;
   libXfont2 = libxfont_2;
   libXfont = libxfont_1;
+  libXft = libxft;
   libXmu = libxmu;
   libXpm = libxpm;
   libXrandr = libxrandr;
@@ -1766,48 +1768,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXft = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontconfig,
-      freetype,
-      libX11,
-      xorgproto,
-      libXrender,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXft";
-      version = "2.3.9";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXft-2.3.9.tar.xz";
-        sha256 = "1xbn77zqjzx2zdzqcsbf8pvivlqplnciifxk6lk97mjyjiw5p8k0";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        fontconfig
-        freetype
-        libX11
-        xorgproto
-        libXrender
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xft" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXi = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index a163122e191f3..974d338324b70 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -69,6 +69,7 @@
 $pcMap{"xfixes"} = "libXfixes";
 $pcMap{"xfont"} = "libXfont";
 $pcMap{"xfont2"} = "libXfont2";
+$pcMap{"xft"} = "libXft";
 $pcMap{"xmu"} = "libXmu";
 $pcMap{"xmuu"} = "libXmu";
 $pcMap{"xpm"} = "libXpm";
@@ -358,6 +359,7 @@
   libxfixes,
   libxfont_1,
   libxfont_2,
+  libxft,
   libxmu,
   libxpm,
   libxrandr,
@@ -462,6 +464,7 @@
   libXfixes = libxfixes;
   libXfont2 = libxfont_2;
   libXfont = libxfont_1;
+  libXft = libxft;
   libXmu = libxmu;
   libXpm = libxpm;
   libXrandr = libxrandr;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 7cadc9ef56243..ace5bb4d7b29e 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -194,27 +194,6 @@ self: super:
     };
   });
 
-  libXft = super.libXft.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [
-      xorg.libXrender
-      freetype
-      fontconfig
-    ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-
-    # the include files need ft2build.h, and Requires.private isn't enough for us
-    postInstall = ''
-      sed "/^Requires:/s/$/, freetype2/" -i "$dev/lib/pkgconfig/xft.pc"
-    '';
-    passthru = attrs.passthru // {
-      inherit freetype fontconfig;
-    };
-  });
-
   libXi = super.libXi.overrideAttrs (attrs: {
     outputs = [
       "out"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 3d7f0c9781934..cae367655a1c5 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -126,7 +126,6 @@ mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXft-2.3.9.tar.xz
 mirror://xorg/individual/lib/libXi-1.8.2.tar.xz
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz

From 203364c3a78622c67f9caca6aa98e80da92d3109 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 13:52:48 +0200
Subject: [PATCH 010/306] libxi: refactor, move to pkgs/by-name and rename from
 xorg.libXi

---
 pkgs/by-name/li/libxi/package.nix             | 76 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +---------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           | 18 -----
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 81 insertions(+), 59 deletions(-)
 create mode 100644 pkgs/by-name/li/libxi/package.nix

diff --git a/pkgs/by-name/li/libxi/package.nix b/pkgs/by-name/li/libxi/package.nix
new file mode 100644
index 0000000000000..3cbac22c36f38
--- /dev/null
+++ b/pkgs/by-name/li/libxi/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxfixes,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxi";
+  version = "1.8.2";
+
+  outputs = [
+    "out"
+    "dev"
+    "man"
+    "doc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-0OBVXlPW4hFOq/pEImuhYtJwhQGiXhjZnPs1wJTGwQQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxfixes
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    # header file dependencies
+    libx11
+    libxext
+    libxfixes
+  ];
+
+  configureFlags =
+    lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "xorg_cv_malloc0_returns_null=no"
+    ++ lib.optional stdenv.hostPlatform.isStatic "--disable-shared";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXi \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "library for the X Input Extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxi";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpnd
+      mit
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xi" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 470a7319989b1..f9014e1b707b5 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -39,6 +39,7 @@
   libxfont_1,
   libxfont_2,
   libxft,
+  libxi,
   libxmu,
   libxpm,
   libxrandr,
@@ -144,6 +145,7 @@ self: with self; {
   libXfont2 = libxfont_2;
   libXfont = libxfont_1;
   libXft = libxft;
+  libXi = libxi;
   libXmu = libxmu;
   libXpm = libxpm;
   libXrandr = libxrandr;
@@ -1768,46 +1770,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      libXfixes,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXi";
-      version = "1.8.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXi-1.8.2.tar.xz";
-        sha256 = "0161qsac0dgvkkcihpm2062p1lk2l5mj4i7smd713qnnadg5bq6h";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-        libXfixes
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xi" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXinerama = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 974d338324b70..7707038ca6484 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -70,6 +70,7 @@
 $pcMap{"xfont"} = "libXfont";
 $pcMap{"xfont2"} = "libXfont2";
 $pcMap{"xft"} = "libXft";
+$pcMap{"xi"} = "libXi";
 $pcMap{"xmu"} = "libXmu";
 $pcMap{"xmuu"} = "libXmu";
 $pcMap{"xpm"} = "libXpm";
@@ -360,6 +361,7 @@
   libxfont_1,
   libxfont_2,
   libxft,
+  libxi,
   libxmu,
   libxpm,
   libxrandr,
@@ -465,6 +467,7 @@
   libXfont2 = libxfont_2;
   libXfont = libxfont_1;
   libXft = libxft;
+  libXi = libxi;
   libXmu = libxmu;
   libXpm = libxpm;
   libXrandr = libxrandr;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index ace5bb4d7b29e..7b280c7be4b95 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -194,24 +194,6 @@ self: super:
     };
   });
 
-  libXi = super.libXi.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "man"
-      "doc"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [
-      xorg.libXfixes
-      xorg.libXext
-    ];
-    configureFlags =
-      lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-        "xorg_cv_malloc0_returns_null=no"
-      ]
-      ++ lib.optional stdenv.hostPlatform.isStatic "--disable-shared";
-  });
-
   libXinerama = super.libXinerama.overrideAttrs (attrs: {
     outputs = [
       "out"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index cae367655a1c5..03b23d238da8f 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -126,7 +126,6 @@ mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXi-1.8.2.tar.xz
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
 mirror://xorg/individual/lib/libXp-1.0.4.tar.xz

From 7e96b523d10942786a3b8371ef0eafabd1231a87 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 21:40:15 +0200
Subject: [PATCH 011/306] appres: refactor and move to pkgs/by-name from xorg
 namespace

---
 pkgs/by-name/ap/appres/package.nix            | 60 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 40 +------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           | 10 ----
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 64 insertions(+), 49 deletions(-)
 create mode 100644 pkgs/by-name/ap/appres/package.nix

diff --git a/pkgs/by-name/ap/appres/package.nix b/pkgs/by-name/ap/appres/package.nix
new file mode 100644
index 0000000000000..21d45efb2ea3a
--- /dev/null
+++ b/pkgs/by-name/ap/appres/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  meson,
+  ninja,
+  xorgproto,
+  libx11,
+  libxt,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "appres";
+  version = "1.0.7";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/appres-${finalAttrs.version}.tar.xz";
+    hash = "sha256-ERSxiSOf2HqNHbQz7ctEhjRtKZEhMrkeru5WZ/E7gZ8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxt
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to list X application resource database";
+    longDescription = ''
+      The appres program prints the resources seen by an application (or subhierarchy of an
+      application) with the specified class and instance names.
+      It can be used to determine which resources a particular program will load.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/appres";
+    license = lib.licenses.mitOpenGroup;
+    mainProgram = "appres";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 15acd52e9e485..9b4c8979b4819 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1,6 +1,7 @@
 # THIS IS A GENERATED FILE.  DO NOT EDIT!
 {
   lib,
+  appres,
   bdftopcf,
   font-alias,
   font-bh-ttf,
@@ -81,6 +82,7 @@
 self: with self; {
 
   inherit
+    appres
     bdftopcf
     gccmakedep
     ico
@@ -158,44 +160,6 @@ self: with self; {
   xorgdocs = xorg-docs;
   xorgsgmldoctools = xorg-sgml-doctools;
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  appres = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      libXt,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "appres";
-      version = "1.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/appres-1.0.7.tar.xz";
-        sha256 = "17w17gqnfmpfmqgbjci1j4lnsd468k5yscxl3n6pmn4z4f4v250i";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   bitmap = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 0abd26780af1b..2d9f4ecb1b07b 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -317,6 +317,7 @@
 # THIS IS A GENERATED FILE.  DO NOT EDIT!
 {
   lib,
+  appres,
   bdftopcf,
   font-alias,
   font-bh-ttf,
@@ -397,6 +398,7 @@
 self: with self; {
 
   inherit
+    appres
     bdftopcf
     gccmakedep
     ico
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index df416c019038d..1eccdbb5c8bfa 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -112,16 +112,6 @@ self: super:
       )
   ) { };
 
-  appres = super.appres.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [
-      meson
-      ninja
-    ];
-    meta = attrs.meta // {
-      mainProgram = "appres";
-    };
-  });
-
   bitmap = addMainProgram super.bitmap { };
 
   editres = super.editres.overrideAttrs (attrs: {
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index c9e2c7583076d..53ce1c31383c1 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -1,4 +1,3 @@
-mirror://xorg/individual/app/appres-1.0.7.tar.xz
 mirror://xorg/individual/app/bitmap-1.1.1.tar.xz
 mirror://xorg/individual/app/editres-1.0.9.tar.xz
 mirror://xorg/individual/app/fonttosfnt-1.2.4.tar.xz

From 417a0b348ab9249d47eee1945918bd2aa6eb13b9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 19:06:46 +0000
Subject: [PATCH 012/306] rust-bindgen-unwrapped: 0.72.0 -> 0.72.1

---
 pkgs/development/tools/rust/bindgen/unwrapped.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/bindgen/unwrapped.nix b/pkgs/development/tools/rust/bindgen/unwrapped.nix
index 39b4de40b83bf..c78eeb55be784 100644
--- a/pkgs/development/tools/rust/bindgen/unwrapped.nix
+++ b/pkgs/development/tools/rust/bindgen/unwrapped.nix
@@ -11,15 +11,15 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.72.0";
+  version = "0.72.1";
 
   src = fetchCrate {
     pname = "bindgen-cli";
     inherit version;
-    hash = "sha256-0hIxXKq7zu/gq0QAs2Ffuq584a9w1RWctPs9SBfc0/I=";
+    hash = "sha256-rhdQZcnlqVSUqvFDg0Scs1+DHGcKyazeS5H9HH7u8Fk=";
   };
 
-  cargoHash = "sha256-K/iM79RfNU+3f2ae6wy/FMFAD68vfqzSUebqALPJpJY=";
+  cargoHash = "sha256-YNpqVB+zdZ76Av2L+yQuBrxKvNML9+3H7ES4+7mED0E=";
 
   preConfigure = ''
     export LIBCLANG_PATH="${lib.getLib clang.cc}/lib"

From ffbb3f889b449db9ebbae41b68cb11d1f6c77104 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 00:55:33 +0000
Subject: [PATCH 013/306] libxfixes: 6.0.1 -> 6.0.2

---
 pkgs/by-name/li/libxfixes/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libxfixes/package.nix b/pkgs/by-name/li/libxfixes/package.nix
index cf51e21d9d1e7..026a2d4259ec9 100644
--- a/pkgs/by-name/li/libxfixes/package.nix
+++ b/pkgs/by-name/li/libxfixes/package.nix
@@ -10,7 +10,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxfixes";
-  version = "6.0.1";
+  version = "6.0.2";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libXfixes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tpX5PNJJlCGrAtInREWOZQzMiMHUyBMNYCACE6vALVg=";
+    hash = "sha256-OfEV1y2cX4ER5GhBZNPWjMH9Ifmyf/JAGwj938D0Cbo=";
   };
 
   strictDeps = true;

From 02eeaee65f59d8719d17d07ec0d326bf87880c3d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 11 Sep 2025 07:03:42 +0100
Subject: [PATCH 014/306] btrfs-progs: 6.16 -> 6.16.1

Changes: https://github.com/kdave/btrfs-progs/releases/tag/v6.16.1
---
 pkgs/by-name/bt/btrfs-progs/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bt/btrfs-progs/package.nix b/pkgs/by-name/bt/btrfs-progs/package.nix
index fd8e3bce91c40..5527d82577c8a 100644
--- a/pkgs/by-name/bt/btrfs-progs/package.nix
+++ b/pkgs/by-name/bt/btrfs-progs/package.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.16";
+  version = "6.16.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-Makw+HN8JhioJK1L0f3YP1QQPg6qFaqtxIT/rjNGb8U=";
+    hash = "sha256-cKo/lUAXynQ1KYKN6yoQ3Oqy1BMhWDrRV+lnhH3bJPw=";
   };
 
   nativeBuildInputs = [

From 0307f20d57587a2564d27be438a8ef80959f6863 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Sep 2025 21:51:07 +0000
Subject: [PATCH 015/306] cpuinfo: 0-unstable-2025-07-24 ->
 0-unstable-2025-09-05

---
 pkgs/by-name/cp/cpuinfo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cp/cpuinfo/package.nix b/pkgs/by-name/cp/cpuinfo/package.nix
index fdde7e38af041..01f453bf1152e 100644
--- a/pkgs/by-name/cp/cpuinfo/package.nix
+++ b/pkgs/by-name/cp/cpuinfo/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpuinfo";
-  version = "0-unstable-2025-07-24";
+  version = "0-unstable-2025-09-05";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "cpuinfo";
-    rev = "33ed0be77d7767d0e2010e2c3cf972ef36c7c307";
-    hash = "sha256-0rZzbZkOo6DAt1YnH4rtx0FvmCuYH8M6X3DNJ0gURpU=";
+    rev = "877328f188a3c7d1fa855871a278eb48d530c4c0";
+    hash = "sha256-JW83AgI1cWv4TSpXNe9sv/hNYAA7MOdUeTHY8+0lHgc=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

From 0922a4b685bc61cd7ad8e31e7d6dd2c79a06418a Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 13 Sep 2025 20:57:51 +0200
Subject: [PATCH 016/306] font-bh-100dpi: refactor, migrate to pkgs/by-name &
 rename from xorg.fontbh100dpi

the package output doesn't change
---
 pkgs/by-name/fo/font-bh-100dpi/package.nix    | 51 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 43 +---------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           |  1 -
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 55 insertions(+), 43 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-bh-100dpi/package.nix

diff --git a/pkgs/by-name/fo/font-bh-100dpi/package.nix b/pkgs/by-name/fo/font-bh-100dpi/package.nix
new file mode 100644
index 0000000000000..d7e65f131f08d
--- /dev/null
+++ b/pkgs/by-name/fo/font-bh-100dpi/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-100dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-/Y9e/oSR+qvdJ0SAjT1Or9rlyD5hcBfH/d0nFtBJqx4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Luxi 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-100dpi";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 15acd52e9e485..8e2759acc1cbb 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -3,6 +3,7 @@
   lib,
   bdftopcf,
   font-alias,
+  font-bh-100dpi,
   font-bh-ttf,
   font-bh-type1,
   font-encodings,
@@ -118,6 +119,7 @@ self: with self; {
     ;
   encodings = font-encodings;
   fontalias = font-alias;
+  fontbh100dpi = font-bh-100dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
@@ -534,47 +536,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbh100dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-100dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-100dpi-1.0.4.tar.xz";
-        sha256 = "07mb9781c9yxzp3ifw317v4fbnmg9qyqv0244zfspylihkz5x3zx";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbh75dpi = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 0abd26780af1b..08c557c609746 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -319,6 +319,7 @@
   lib,
   bdftopcf,
   font-alias,
+  font-bh-100dpi,
   font-bh-ttf,
   font-bh-type1,
   font-encodings,
@@ -434,6 +435,7 @@
     ;
   encodings = font-encodings;
   fontalias = font-alias;
+  fontbh100dpi = font-bh-100dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index df416c019038d..afeb0a04ac44d 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1023,7 +1023,6 @@ self: super:
       "fontadobeutopia100dpi"
       "fontadobeutopia75dpi"
       "fontibmtype1"
-      "fontbh100dpi"
       "fontbh75dpi"
 
       # Bigelow & Holmes fonts
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index c9e2c7583076d..e1800e31eeedb 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -100,7 +100,6 @@ mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.5.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.5.tar.xz
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-75dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz

From 14cf636039e48082bc98432798cc4ad9444f47dc Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 13 Sep 2025 21:01:59 +0200
Subject: [PATCH 017/306] font-bh-75dpi: refactor, move to pkgs/by-name &
 rename from xorg.fontbh75dpi

the package output doesn't change
---
 pkgs/by-name/fo/font-bh-75dpi/package.nix     | 51 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 43 +---------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           |  1 -
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 55 insertions(+), 43 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-bh-75dpi/package.nix

diff --git a/pkgs/by-name/fo/font-bh-75dpi/package.nix b/pkgs/by-name/fo/font-bh-75dpi/package.nix
new file mode 100644
index 0000000000000..f639da44cfbe0
--- /dev/null
+++ b/pkgs/by-name/fo/font-bh-75dpi/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-75dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-YCbYwHNWPdPLtIeNAHbu2XDeur0hQjs7Yd2QRBuefNo=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Luxi 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-75dpi";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 8e2759acc1cbb..568ff545aafd9 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -4,6 +4,7 @@
   bdftopcf,
   font-alias,
   font-bh-100dpi,
+  font-bh-75dpi,
   font-bh-ttf,
   font-bh-type1,
   font-encodings,
@@ -120,6 +121,7 @@ self: with self; {
   encodings = font-encodings;
   fontalias = font-alias;
   fontbh100dpi = font-bh-100dpi;
+  fontbh75dpi = font-bh-75dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
@@ -536,47 +538,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbh75dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-75dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-75dpi-1.0.4.tar.xz";
-        sha256 = "1nkwkqdl946xc4xknhi1pnxdww6rxrv013c7nk5x6ganfg0dh9k0";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbhlucidatypewriter100dpi = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 08c557c609746..f025450bddc9c 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -320,6 +320,7 @@
   bdftopcf,
   font-alias,
   font-bh-100dpi,
+  font-bh-75dpi,
   font-bh-ttf,
   font-bh-type1,
   font-encodings,
@@ -436,6 +437,7 @@
   encodings = font-encodings;
   fontalias = font-alias;
   fontbh100dpi = font-bh-100dpi;
+  fontbh75dpi = font-bh-75dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index afeb0a04ac44d..5c4ec3731aa5d 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1023,7 +1023,6 @@ self: super:
       "fontadobeutopia100dpi"
       "fontadobeutopia75dpi"
       "fontibmtype1"
-      "fontbh75dpi"
 
       # Bigelow & Holmes fonts
       # https://www.x.org/releases/current/doc/xorg-docs/License.html#Bigelow_Holmes_Inc_and_URW_GmbH_Luxi_font_license
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index e1800e31eeedb..8ca724bf04ce1 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -99,7 +99,6 @@ mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.5.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.5.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.5.tar.xz
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz

From 7abbe6b31ef74a20b96405abaf09c4a0773d3f44 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 13 Sep 2025 21:43:46 +0200
Subject: [PATCH 018/306] font-bh-lucidatypewriter-100dpi: refactor, move to
 pkgs/by-name & rename from xorg.fontbhlucidatypewriter100dpi

this doesn't change the package output'
---
 .../package.nix                               | 52 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 43 +--------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           |  1 -
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 56 insertions(+), 43 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix

diff --git a/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix b/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix
new file mode 100644
index 0000000000000..d25eabfe905ad
--- /dev/null
+++ b/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-lucidatypewriter-100dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-duwJ7aQJSinUe5HPWcProinI99HKa64qu7P5JeM96PI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Lucida Sans Typewriter 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-lucidatypewriter-100dpi";
+    # no license just a copyright notice
+    license = lib.licenses.unfree;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 568ff545aafd9..685603d467a3b 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -5,6 +5,7 @@
   font-alias,
   font-bh-100dpi,
   font-bh-75dpi,
+  font-bh-lucidatypewriter-100dpi,
   font-bh-ttf,
   font-bh-type1,
   font-encodings,
@@ -122,6 +123,7 @@ self: with self; {
   fontalias = font-alias;
   fontbh100dpi = font-bh-100dpi;
   fontbh75dpi = font-bh-75dpi;
+  fontbhlucidatypewriter100dpi = font-bh-lucidatypewriter-100dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
@@ -538,47 +540,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhlucidatypewriter100dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-lucidatypewriter-100dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-1.0.4.tar.xz";
-        sha256 = "1wp87pijbydkpcmawsyas7vwhad2xg1mkkwigga2jjh9lknhkv3n";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbhlucidatypewriter75dpi = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index f025450bddc9c..40b2c2ec1e4e5 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -321,6 +321,7 @@
   font-alias,
   font-bh-100dpi,
   font-bh-75dpi,
+  font-bh-lucidatypewriter-100dpi,
   font-bh-ttf,
   font-bh-type1,
   font-encodings,
@@ -438,6 +439,7 @@
   fontalias = font-alias;
   fontbh100dpi = font-bh-100dpi;
   fontbh75dpi = font-bh-75dpi;
+  fontbhlucidatypewriter100dpi = font-bh-lucidatypewriter-100dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 5c4ec3731aa5d..15c46a6434f89 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1026,7 +1026,6 @@ self: super:
 
       # Bigelow & Holmes fonts
       # https://www.x.org/releases/current/doc/xorg-docs/License.html#Bigelow_Holmes_Inc_and_URW_GmbH_Luxi_font_license
-      "fontbhlucidatypewriter100dpi"
       "fontbhlucidatypewriter75dpi"
     ];
 
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 8ca724bf04ce1..09669e27ea1bd 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -100,7 +100,6 @@ mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.5.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.5.tar.xz
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz

From 837e11d2c395a452d2a488142345a3229838338f Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Tue, 26 Aug 2025 16:17:39 +0200
Subject: [PATCH 019/306] font-bh-lucidatypewriter-75dpi: refactor, move to
 pkgs/by-name and rename from xorg.fontbhlucidatypewriter75dpi

relevant changes:
- license is now unfree instead of unfreeRedistributable because the
  COPYING file in the repo only has a copyright notice
  The link in overrides goes to the license of the Bigelow & Holmes Luxi
  fonts which are the font-bh-<...> packages

this doesn't change the package output
---
 .../package.nix                               | 52 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 43 +--------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           |  4 --
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 56 insertions(+), 46 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix

diff --git a/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix b/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix
new file mode 100644
index 0000000000000..455fe1a6f326f
--- /dev/null
+++ b/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-lucidatypewriter-75dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-hk4sOaxh8E9pP8LIqq7SSymMLNQCg87BLu5FnFY16PU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Lucida Sans Typewriter 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-lucidatypewriter-75dpi";
+    # no license just a copyright notice
+    license = lib.licenses.unfree;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 685603d467a3b..d0c01ca208ea0 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -6,6 +6,7 @@
   font-bh-100dpi,
   font-bh-75dpi,
   font-bh-lucidatypewriter-100dpi,
+  font-bh-lucidatypewriter-75dpi,
   font-bh-ttf,
   font-bh-type1,
   font-encodings,
@@ -124,6 +125,7 @@ self: with self; {
   fontbh100dpi = font-bh-100dpi;
   fontbh75dpi = font-bh-75dpi;
   fontbhlucidatypewriter100dpi = font-bh-lucidatypewriter-100dpi;
+  fontbhlucidatypewriter75dpi = font-bh-lucidatypewriter-75dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
@@ -540,47 +542,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhlucidatypewriter75dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-lucidatypewriter-75dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-1.0.4.tar.xz";
-        sha256 = "1xg86mb9qigf5v0wx0q2shn8qaabsapamj627xllzw31mhwjqkl6";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbitstream100dpi = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 40b2c2ec1e4e5..fb4aee3cddfab 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -322,6 +322,7 @@
   font-bh-100dpi,
   font-bh-75dpi,
   font-bh-lucidatypewriter-100dpi,
+  font-bh-lucidatypewriter-75dpi,
   font-bh-ttf,
   font-bh-type1,
   font-encodings,
@@ -440,6 +441,7 @@
   fontbh100dpi = font-bh-100dpi;
   fontbh75dpi = font-bh-75dpi;
   fontbhlucidatypewriter100dpi = font-bh-lucidatypewriter-100dpi;
+  fontbhlucidatypewriter75dpi = font-bh-lucidatypewriter-75dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 15c46a6434f89..cf4e4d35c5a85 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1023,10 +1023,6 @@ self: super:
       "fontadobeutopia100dpi"
       "fontadobeutopia75dpi"
       "fontibmtype1"
-
-      # Bigelow & Holmes fonts
-      # https://www.x.org/releases/current/doc/xorg-docs/License.html#Bigelow_Holmes_Inc_and_URW_GmbH_Luxi_font_license
-      "fontbhlucidatypewriter75dpi"
     ];
 
     # unfree, possibly not redistributable
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 09669e27ea1bd..852ccbe5e19ff 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -99,7 +99,6 @@ mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.5.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.5.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.5.tar.xz
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz

From ab33dd85d43a295dfc5777cbd778afff4d6cf0f3 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 13 Sep 2025 22:24:06 +0200
Subject: [PATCH 020/306] font-bh{,-lucidatypewriter}-{100,75}dpi: move font
 from $out/lib to $out/share

also fixes the paths in xdummy to point to the new font locations
---
 pkgs/by-name/fo/font-bh-100dpi/package.nix                  | 2 +-
 pkgs/by-name/fo/font-bh-75dpi/package.nix                   | 2 +-
 pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix | 2 +-
 pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix  | 2 +-
 pkgs/by-name/xd/xdummy/package.nix                          | 6 +++---
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/fo/font-bh-100dpi/package.nix b/pkgs/by-name/fo/font-bh-100dpi/package.nix
index d7e65f131f08d..7932de16aa134 100644
--- a/pkgs/by-name/fo/font-bh-100dpi/package.nix
+++ b/pkgs/by-name/fo/font-bh-100dpi/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ font-util ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
 
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
diff --git a/pkgs/by-name/fo/font-bh-75dpi/package.nix b/pkgs/by-name/fo/font-bh-75dpi/package.nix
index f639da44cfbe0..c970a3826f541 100644
--- a/pkgs/by-name/fo/font-bh-75dpi/package.nix
+++ b/pkgs/by-name/fo/font-bh-75dpi/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ font-util ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
 
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
diff --git a/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix b/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix
index d25eabfe905ad..7f80b188a61d8 100644
--- a/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix
+++ b/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ font-util ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
 
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
diff --git a/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix b/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix
index 455fe1a6f326f..696a05e0e0e12 100644
--- a/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix
+++ b/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ font-util ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
 
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
diff --git a/pkgs/by-name/xd/xdummy/package.nix b/pkgs/by-name/xd/xdummy/package.nix
index 399226c7fc85f..eca25be27d56a 100644
--- a/pkgs/by-name/xd/xdummy/package.nix
+++ b/pkgs/by-name/xd/xdummy/package.nix
@@ -34,9 +34,9 @@ let
       FontPath "${xorg.fontmiscmisc}/lib/X11/fonts/misc"
       FontPath "${xorg.fontcursormisc}/lib/X11/fonts/misc"
     ${lib.optionalString unfreeFonts ''
-      FontPath "${xorg.fontbhlucidatypewriter75dpi}/lib/X11/fonts/75dpi"
-      FontPath "${xorg.fontbhlucidatypewriter100dpi}/lib/X11/fonts/100dpi"
-      FontPath "${xorg.fontbh100dpi}/lib/X11/fonts/100dpi"
+      FontPath "${xorg.fontbhlucidatypewriter75dpi}/share/fonts/X11/75dpi"
+      FontPath "${xorg.fontbhlucidatypewriter100dpi}/share/fonts/X11/100dpi"
+      FontPath "${xorg.fontbh100dpi}/share/fonts/X11/100dpi"
     ''}
     EndSection
 

From 5e23f445e5d81021389cdae7449e143cd3811a5b Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 27 Aug 2025 05:07:03 +0200
Subject: [PATCH 021/306] font-cronyx-cyrillic: refactor, move to pkgs/by-name
 and rename from xorg.fontcronyxcyrillic

this doesn't change the output of the package
---
 .../fo/font-cronyx-cyrillic/package.nix       | 45 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +----------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 49 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-cronyx-cyrillic/package.nix

diff --git a/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix b/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix
new file mode 100644
index 0000000000000..449f10bc3ae1f
--- /dev/null
+++ b/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-cronyx-cyrillic";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-cronyx-cyrillic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-3AeBzg3L/9v2quGgAXOhNAP5Kw3pJbylqeEX5OLWt4k=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Cronyx pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/cronyx-cyrillic";
+    license = lib.licenses.cronyx;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index c03863a205d9a..cc42b60448d2d 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -10,6 +10,7 @@
   font-alias,
   font-bh-ttf,
   font-bh-type1,
+  font-cronyx-cyrillic,
   font-encodings,
   font-mutt-misc,
   font-util,
@@ -140,6 +141,7 @@ self: with self; {
   fontalias = font-alias;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
+  fontcronyxcyrillic = font-cronyx-cyrillic;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
@@ -672,46 +674,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontcronyxcyrillic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-cronyx-cyrillic";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-cronyx-cyrillic-1.0.4.tar.xz";
-        sha256 = "12dpsvif85z1m6jvq9g91lmzj0rll5rh3871mbvdpzyb1p7821yw";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontcursormisc = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 9975b4053e152..d44ac181bb5d7 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -326,6 +326,7 @@
   font-alias,
   font-bh-ttf,
   font-bh-type1,
+  font-cronyx-cyrillic,
   font-encodings,
   font-mutt-misc,
   font-util,
@@ -456,6 +457,7 @@
   fontalias = font-alias;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
+  fontcronyxcyrillic = font-cronyx-cyrillic;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index b9f495cf71f5f..242e07503291e 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -97,7 +97,6 @@ mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz
 mirror://xorg/individual/font/font-bitstream-type1-1.0.4.tar.xz
-mirror://xorg/individual/font/font-cronyx-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-cursor-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-daewoo-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-dec-misc-1.0.4.tar.xz

From 191109e0d90ec68854a894499607ba1bd6945e9d Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Thu, 28 Aug 2025 01:18:57 +0200
Subject: [PATCH 022/306] font-isas-misc: refactor, move to pkgs/by-name and
 rename from xorg.fontisasmisc

relevant changes:
- remove some unneeded deps and configureFlags

the package output doesn't change
---
 pkgs/by-name/fo/font-isas-misc/package.nix    | 45 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +----------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 49 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-isas-misc/package.nix

diff --git a/pkgs/by-name/fo/font-isas-misc/package.nix b/pkgs/by-name/fo/font-isas-misc/package.nix
new file mode 100644
index 0000000000000..e098e7d3857d2
--- /dev/null
+++ b/pkgs/by-name/fo/font-isas-misc/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-isas-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-isas-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-R+WVu+baREufb8qiZTmrx7oZieI6+mzcSeIuSEzEOPw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Isas Fangsong ti & Song ti pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/isas-misc";
+    license = lib.licenses.hpnd;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index cc42b60448d2d..4154351c639fc 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -12,6 +12,7 @@
   font-bh-type1,
   font-cronyx-cyrillic,
   font-encodings,
+  font-isas-misc,
   font-mutt-misc,
   font-util,
   gccmakedep,
@@ -142,6 +143,7 @@ self: with self; {
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontcronyxcyrillic = font-cronyx-cyrillic;
+  fontisasmisc = font-isas-misc;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
@@ -832,46 +834,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontisasmisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-isas-misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-isas-misc-1.0.4.tar.xz";
-        sha256 = "1z1qqi64hbp297f6ryiswa4ikfn7mcwnb8nadyglni6swsxrbra7";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontjismisc = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index d44ac181bb5d7..8981b126406fa 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -328,6 +328,7 @@
   font-bh-type1,
   font-cronyx-cyrillic,
   font-encodings,
+  font-isas-misc,
   font-mutt-misc,
   font-util,
   gccmakedep,
@@ -458,6 +459,7 @@
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontcronyxcyrillic = font-cronyx-cyrillic;
+  fontisasmisc = font-isas-misc;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 242e07503291e..709cc1c5d8a48 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -101,7 +101,6 @@ mirror://xorg/individual/font/font-cursor-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-daewoo-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-dec-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-ibm-type1-1.0.4.tar.xz
-mirror://xorg/individual/font/font-isas-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-micro-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz

From ce9e0b565a3a4db63f015bf605134efddba2d4b1 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Thu, 28 Aug 2025 02:01:54 +0200
Subject: [PATCH 023/306] font-micro-misc: refactor, move to pkgs/by-name and
 rename from xorg.fontmicromisc

relevant changes:
- remove some unneeded deps and configureFlags

the package output doesn't change
---
 pkgs/by-name/fo/font-micro-misc/package.nix   | 45 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +----------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 49 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-micro-misc/package.nix

diff --git a/pkgs/by-name/fo/font-micro-misc/package.nix b/pkgs/by-name/fo/font-micro-misc/package.nix
new file mode 100644
index 0000000000000..4112508113220
--- /dev/null
+++ b/pkgs/by-name/fo/font-micro-misc/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-micro-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-micro-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-LuC51r166Emv8b2C76tEobazaPu14R0S/38BWj32+UM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Micro pcf font";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/micro-misc";
+    license = lib.licenses.publicDomain;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 4154351c639fc..e1b3a438d7332 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -13,6 +13,7 @@
   font-cronyx-cyrillic,
   font-encodings,
   font-isas-misc,
+  font-micro-misc,
   font-mutt-misc,
   font-util,
   gccmakedep,
@@ -144,6 +145,7 @@ self: with self; {
   fontbhtype1 = font-bh-type1;
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
+  fontmicromisc = font-micro-misc;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
@@ -874,46 +876,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmicromisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-micro-misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-micro-misc-1.0.4.tar.xz";
-        sha256 = "0hzryqyml0bzzw91vqdmzdlb7dm18jmyz0mxy6plks3sppbbkq1f";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmisccyrillic = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 8981b126406fa..a9e5e1faaeafe 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -329,6 +329,7 @@
   font-cronyx-cyrillic,
   font-encodings,
   font-isas-misc,
+  font-micro-misc,
   font-mutt-misc,
   font-util,
   gccmakedep,
@@ -460,6 +461,7 @@
   fontbhtype1 = font-bh-type1;
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
+  fontmicromisc = font-micro-misc;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 709cc1c5d8a48..8b7d81e134f1d 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -102,7 +102,6 @@ mirror://xorg/individual/font/font-daewoo-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-dec-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-ibm-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-micro-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz

From 62e6b67dd0d7165ba3a9abaeee06c1182db4b75c Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Thu, 28 Aug 2025 21:38:21 +0200
Subject: [PATCH 024/306] font-misc-cyrillic: refactor, move to pkgs/by-name
 and rename from xorg.fontmisccyrillic

relevant changes:
- remove some unneeded deps and configureFlags

the package output doesn't change
---
 .../by-name/fo/font-misc-cyrillic/package.nix | 51 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +--------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 55 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-misc-cyrillic/package.nix

diff --git a/pkgs/by-name/fo/font-misc-cyrillic/package.nix b/pkgs/by-name/fo/font-misc-cyrillic/package.nix
new file mode 100644
index 0000000000000..2fa83f37b94f2
--- /dev/null
+++ b/pkgs/by-name/fo/font-misc-cyrillic/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-misc-cyrillic";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-misc-cyrillic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-dgIaf1MGQAGRSlf9CO+uV/draPCiTcqKsbJFR07o6ZM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Misc Cyrillic pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/misc-cyrillic";
+    license = with lib.licenses; [
+      publicDomain
+      cronyx
+      # misc free
+      # "May be distributed and modified without restrictions."
+      free
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index e1b3a438d7332..adb118f47a1d4 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -14,6 +14,7 @@
   font-encodings,
   font-isas-misc,
   font-micro-misc,
+  font-misc-cyrillic,
   font-mutt-misc,
   font-util,
   gccmakedep,
@@ -146,6 +147,7 @@ self: with self; {
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
+  fontmisccyrillic = font-misc-cyrillic;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
@@ -876,46 +878,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmisccyrillic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-misc-cyrillic";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz";
-        sha256 = "14z9x174fidjn65clkd2y1l6pxspmvphizap9a8h2h06adzil0kn";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmiscethiopic = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index a9e5e1faaeafe..bd0b91424f51b 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -330,6 +330,7 @@
   font-encodings,
   font-isas-misc,
   font-micro-misc,
+  font-misc-cyrillic,
   font-mutt-misc,
   font-util,
   gccmakedep,
@@ -462,6 +463,7 @@
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
+  fontmisccyrillic = font-misc-cyrillic;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 8b7d81e134f1d..ade9956c0439f 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -102,7 +102,6 @@ mirror://xorg/individual/font/font-daewoo-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-dec-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-ibm-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz

From e013f09554c54ac19c32d2ec2252c025c5a3dee0 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Thu, 28 Aug 2025 21:44:16 +0200
Subject: [PATCH 025/306] font-misc-ethiopic: refactor, move to pkgs/by-name
 and rename from xorg.fontmiscethiopic

relevant changes:
- remove some unneeded deps and configureFlags

the package output doesn't change
---
 .../by-name/fo/font-misc-ethiopic/package.nix | 41 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 40 +-----------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 45 insertions(+), 39 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-misc-ethiopic/package.nix

diff --git a/pkgs/by-name/fo/font-misc-ethiopic/package.nix b/pkgs/by-name/fo/font-misc-ethiopic/package.nix
new file mode 100644
index 0000000000000..90c7b4afb63d9
--- /dev/null
+++ b/pkgs/by-name/fo/font-misc-ethiopic/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-misc-ethiopic";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-misc-ethiopic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-R0mn5uGh7vbJH8yaBOixwO0CfUDBWZ5abJMnDYRpthI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ mkfontscale ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Ge'ez Frontiers Foundation's Zemen OpenType and TrueType fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/misc-ethiopic";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index adb118f47a1d4..fda98b12383d1 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -15,6 +15,7 @@
   font-isas-misc,
   font-micro-misc,
   font-misc-cyrillic,
+  font-misc-ethiopic,
   font-mutt-misc,
   font-util,
   gccmakedep,
@@ -148,6 +149,7 @@ self: with self; {
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
   fontmisccyrillic = font-misc-cyrillic;
+  fontmiscethiopic = font-misc-ethiopic;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
@@ -878,44 +880,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmiscethiopic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-misc-ethiopic";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz";
-        sha256 = "04mnd620s9wkdid9wnf181yh5vf0n7l096nc3z4zdvm1w7kafja7";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmiscmeltho = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index bd0b91424f51b..e45070709dfab 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -331,6 +331,7 @@
   font-isas-misc,
   font-micro-misc,
   font-misc-cyrillic,
+  font-misc-ethiopic,
   font-mutt-misc,
   font-util,
   gccmakedep,
@@ -464,6 +465,7 @@
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
   fontmisccyrillic = font-misc-cyrillic;
+  fontmiscethiopic = font-misc-ethiopic;
   fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index ade9956c0439f..fbc39d3176b97 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -102,7 +102,6 @@ mirror://xorg/individual/font/font-daewoo-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-dec-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-ibm-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
 mirror://xorg/individual/font/font-schumacher-misc-1.1.3.tar.xz

From 1f3e600d3c53582d446b93c72533462b343aec63 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 13 Sep 2025 22:29:01 +0200
Subject: [PATCH 026/306] 
 font-{cronyx-cyrillic,{isas,micro}-misc,misc-{cyrillic,ethiopic}}: move font
 from $out/lib to $out/share

---
 pkgs/by-name/fo/font-cronyx-cyrillic/package.nix | 2 --
 pkgs/by-name/fo/font-isas-misc/package.nix       | 2 --
 pkgs/by-name/fo/font-micro-misc/package.nix      | 2 --
 pkgs/by-name/fo/font-misc-cyrillic/package.nix   | 2 --
 pkgs/by-name/fo/font-misc-ethiopic/package.nix   | 2 --
 5 files changed, 10 deletions(-)

diff --git a/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix b/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix
index 449f10bc3ae1f..ebc6e229669d5 100644
--- a/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix
+++ b/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     mkfontscale
   ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/fo/font-isas-misc/package.nix b/pkgs/by-name/fo/font-isas-misc/package.nix
index e098e7d3857d2..d58c4fed6b003 100644
--- a/pkgs/by-name/fo/font-isas-misc/package.nix
+++ b/pkgs/by-name/fo/font-isas-misc/package.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     mkfontscale
   ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/fo/font-micro-misc/package.nix b/pkgs/by-name/fo/font-micro-misc/package.nix
index 4112508113220..4a11aa3d5bdf7 100644
--- a/pkgs/by-name/fo/font-micro-misc/package.nix
+++ b/pkgs/by-name/fo/font-micro-misc/package.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     mkfontscale
   ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/fo/font-misc-cyrillic/package.nix b/pkgs/by-name/fo/font-misc-cyrillic/package.nix
index 2fa83f37b94f2..491326daf9c7e 100644
--- a/pkgs/by-name/fo/font-misc-cyrillic/package.nix
+++ b/pkgs/by-name/fo/font-misc-cyrillic/package.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     mkfontscale
   ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/fo/font-misc-ethiopic/package.nix b/pkgs/by-name/fo/font-misc-ethiopic/package.nix
index 90c7b4afb63d9..863e1cc390455 100644
--- a/pkgs/by-name/fo/font-misc-ethiopic/package.nix
+++ b/pkgs/by-name/fo/font-misc-ethiopic/package.nix
@@ -18,8 +18,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ mkfontscale ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell

From 2dc1d4e9370144e4ef8ec84c33f05bea98feb452 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 30 Aug 2025 19:17:47 +0200
Subject: [PATCH 027/306] font-schumacher-misc: refactor, move to pkgs/by-name
 and rename from xorg.fontschumachermisc

the package output doesn't change
---
 .../fo/font-schumacher-misc/package.nix       | 51 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 43 +---------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 55 insertions(+), 42 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-schumacher-misc/package.nix

diff --git a/pkgs/by-name/fo/font-schumacher-misc/package.nix b/pkgs/by-name/fo/font-schumacher-misc/package.nix
new file mode 100644
index 0000000000000..3b1534196914e
--- /dev/null
+++ b/pkgs/by-name/fo/font-schumacher-misc/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-schumacher-misc";
+  version = "1.1.3";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-schumacher-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-i4SfDNseVaNMw92LD7N0Q/q7wiTVukQIVWlYEkSmgHA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Schumacher pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/schumacher-misc";
+    license = lib.licenses.hpnd;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index c03863a205d9a..6869bec8e6437 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -12,6 +12,7 @@
   font-bh-type1,
   font-encodings,
   font-mutt-misc,
+  font-schumacher-misc,
   font-util,
   gccmakedep,
   ico,
@@ -141,6 +142,7 @@ self: with self; {
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
+  fontschumachermisc = font-schumacher-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
   libFS = libfs;
@@ -1147,47 +1149,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontschumachermisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-schumacher-misc";
-      version = "1.1.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-schumacher-misc-1.1.3.tar.xz";
-        sha256 = "0w40lr214n39al449fnm4k1bpyj3fjrhz2yxqd6a6m8yvc69z14b";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontscreencyrillic = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 9975b4053e152..c088655e40b89 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -328,6 +328,7 @@
   font-bh-type1,
   font-encodings,
   font-mutt-misc,
+  font-schumacher-misc,
   font-util,
   gccmakedep,
   ico,
@@ -457,6 +458,7 @@
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
+  fontschumachermisc = font-schumacher-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
   libFS = libfs;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index b9f495cf71f5f..344491857d207 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -109,7 +109,6 @@ mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/font/font-schumacher-misc-1.1.3.tar.xz
 mirror://xorg/individual/font/font-screen-cyrillic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-sony-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz

From d3a2b393f37c31683a25b2247297849166916c49 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 30 Aug 2025 21:39:40 +0200
Subject: [PATCH 028/306] font-screen-cyrillic: refactor, move to pkgs/by-name
 and rename from xorg.fontscreencyrillic

relevant changes:
- remove some unneeded deps and configureFlags

the package output doesn't change
---
 .../fo/font-screen-cyrillic/package.nix       | 45 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +----------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 49 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-screen-cyrillic/package.nix

diff --git a/pkgs/by-name/fo/font-screen-cyrillic/package.nix b/pkgs/by-name/fo/font-screen-cyrillic/package.nix
new file mode 100644
index 0000000000000..217fab306ea72
--- /dev/null
+++ b/pkgs/by-name/fo/font-screen-cyrillic/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-screen-cyrillic";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-screen-cyrillic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-j3WLuM1YDH5lVIfR0Ntp0xmsrlTZMrKV2W2dm4P95cA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Screen Cyrillic pcf font";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/screen-cyrillic";
+    license = lib.licenses.cronyx;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 6869bec8e6437..30afa97e5cbf2 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -13,6 +13,7 @@
   font-encodings,
   font-mutt-misc,
   font-schumacher-misc,
+  font-screen-cyrillic,
   font-util,
   gccmakedep,
   ico,
@@ -143,6 +144,7 @@ self: with self; {
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
   fontschumachermisc = font-schumacher-misc;
+  fontscreencyrillic = font-screen-cyrillic;
   fontutil = font-util;
   libAppleWM = libapplewm;
   libFS = libfs;
@@ -1149,46 +1151,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontscreencyrillic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-screen-cyrillic";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-screen-cyrillic-1.0.5.tar.xz";
-        sha256 = "1h75zn1rp7bdv6av4cnrajpaq6fkd7dx1lc7aijpw32qrnw8nxcg";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontsonymisc = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index c088655e40b89..a74215ae9d096 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -329,6 +329,7 @@
   font-encodings,
   font-mutt-misc,
   font-schumacher-misc,
+  font-screen-cyrillic,
   font-util,
   gccmakedep,
   ico,
@@ -459,6 +460,7 @@
   fontbhtype1 = font-bh-type1;
   fontmuttmisc = font-mutt-misc;
   fontschumachermisc = font-schumacher-misc;
+  fontscreencyrillic = font-screen-cyrillic;
   fontutil = font-util;
   libAppleWM = libapplewm;
   libFS = libfs;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 344491857d207..f70d1fcea1935 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -109,7 +109,6 @@ mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/font/font-screen-cyrillic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-sony-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz

From 667074fff0bff5275b9c707ce965142a186d05f5 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 30 Aug 2025 21:46:47 +0200
Subject: [PATCH 029/306] font-sony-misc: refactor, move to pkgs/by-name and
 rename from xorg.fontsonymisc

relevant changes:
- remove some unneeded deps and configureFlags

the package output doesn't change
---
 pkgs/by-name/fo/font-sony-misc/package.nix    | 45 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +----------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 49 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-sony-misc/package.nix

diff --git a/pkgs/by-name/fo/font-sony-misc/package.nix b/pkgs/by-name/fo/font-sony-misc/package.nix
new file mode 100644
index 0000000000000..6c9341b855bf9
--- /dev/null
+++ b/pkgs/by-name/fo/font-sony-misc/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-sony-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-sony-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-5rCfgj/MsG4L0LIGIoO2UUFTMjvYp0hunC4/VauElGs=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Sony pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/sony-misc";
+    license = lib.licenses.hpnd;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 30afa97e5cbf2..1a72d2cf32ad0 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -14,6 +14,7 @@
   font-mutt-misc,
   font-schumacher-misc,
   font-screen-cyrillic,
+  font-sony-misc,
   font-util,
   gccmakedep,
   ico,
@@ -145,6 +146,7 @@ self: with self; {
   fontmuttmisc = font-mutt-misc;
   fontschumachermisc = font-schumacher-misc;
   fontscreencyrillic = font-screen-cyrillic;
+  fontsonymisc = font-sony-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
   libFS = libfs;
@@ -1151,46 +1153,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontsonymisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-sony-misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-sony-misc-1.0.4.tar.xz";
-        sha256 = "0swlhjmmagrfkip4i9yq7cr56hains1j41mjs05nxc6c7y19zc76";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontsunmisc = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index a74215ae9d096..c7db8fda7f052 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -330,6 +330,7 @@
   font-mutt-misc,
   font-schumacher-misc,
   font-screen-cyrillic,
+  font-sony-misc,
   font-util,
   gccmakedep,
   ico,
@@ -461,6 +462,7 @@
   fontmuttmisc = font-mutt-misc;
   fontschumachermisc = font-schumacher-misc;
   fontscreencyrillic = font-screen-cyrillic;
+  fontsonymisc = font-sony-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
   libFS = libfs;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index f70d1fcea1935..3bde7ed573832 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -109,7 +109,6 @@ mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/font/font-sony-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz

From 154002f5a64ce55c07e2ced6cbfe65c80fac43f4 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 30 Aug 2025 21:52:08 +0200
Subject: [PATCH 030/306] font-sun-misc: refactor, move to pkgs/by-name and
 rename from xorg.fontsunmisc

relevant changes:
- remove some unneeded deps and configureFlags

the package output doesn't change
---
 pkgs/by-name/fo/font-sun-misc/package.nix     | 45 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +----------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 49 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-sun-misc/package.nix

diff --git a/pkgs/by-name/fo/font-sun-misc/package.nix b/pkgs/by-name/fo/font-sun-misc/package.nix
new file mode 100644
index 0000000000000..25d701a489b03
--- /dev/null
+++ b/pkgs/by-name/fo/font-sun-misc/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-sun-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-sun-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-3YTdEW2Sev+k+g+ilyez7PwPBkI4gXwKHlUqCsOE258=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Open Look Glyph and Cursor pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/sun-misc/";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 1a72d2cf32ad0..1166089e31a03 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -15,6 +15,7 @@
   font-schumacher-misc,
   font-screen-cyrillic,
   font-sony-misc,
+  font-sun-misc,
   font-util,
   gccmakedep,
   ico,
@@ -147,6 +148,7 @@ self: with self; {
   fontschumachermisc = font-schumacher-misc;
   fontscreencyrillic = font-screen-cyrillic;
   fontsonymisc = font-sony-misc;
+  fontsunmisc = font-sun-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
   libFS = libfs;
@@ -1153,46 +1155,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontsunmisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-sun-misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz";
-        sha256 = "17yvhk1hlajm3q57r09q8830zz7cnckrg8hgzajgyyljdl8xv16x";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fonttosfnt = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index c7db8fda7f052..20a0aecdc9ab5 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -331,6 +331,7 @@
   font-schumacher-misc,
   font-screen-cyrillic,
   font-sony-misc,
+  font-sun-misc,
   font-util,
   gccmakedep,
   ico,
@@ -463,6 +464,7 @@
   fontschumachermisc = font-schumacher-misc;
   fontscreencyrillic = font-screen-cyrillic;
   fontsonymisc = font-sony-misc;
+  fontsunmisc = font-sun-misc;
   fontutil = font-util;
   libAppleWM = libapplewm;
   libFS = libfs;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 3bde7ed573832..776349d76dfb2 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -109,7 +109,6 @@ mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2

From a8c9ed2a405a0b5081108b6ff5c336090a9ca593 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 30 Aug 2025 21:59:00 +0200
Subject: [PATCH 031/306] font-winitzki-cyrillic: refactor, move to
 pkgs/by-name and rename from xorg.fontwinitzkicyrillic

relevant changes:
- remove some unneeded deps and configureFlags

the package output doesn't change
---
 .../fo/font-winitzki-cyrillic/package.nix     | 45 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +----------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 49 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-winitzki-cyrillic/package.nix

diff --git a/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix b/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix
new file mode 100644
index 0000000000000..65a6b6e97d5fc
--- /dev/null
+++ b/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-winitzki-cyrillic";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-winitzki-cyrillic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-O22CEi3BR3bjr82HeDOng04fkAxT/Bx7stZ8eBz6l6g=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Winitzki Proof Cyrillic pcf font";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/winitzki-cyrillic";
+    license = lib.licenses.publicDomain;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 1166089e31a03..3e2ec060080f3 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -17,6 +17,7 @@
   font-sony-misc,
   font-sun-misc,
   font-util,
+  font-winitzki-cyrillic,
   gccmakedep,
   ico,
   imake,
@@ -150,6 +151,7 @@ self: with self; {
   fontsonymisc = font-sony-misc;
   fontsunmisc = font-sun-misc;
   fontutil = font-util;
+  fontwinitzkicyrillic = font-winitzki-cyrillic;
   libAppleWM = libapplewm;
   libFS = libfs;
   libICE = libice;
@@ -1193,46 +1195,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontwinitzkicyrillic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-winitzki-cyrillic";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz";
-        sha256 = "1a4pz8f7hz6nn9xirz2k1j81ykl3lwrpi1ydmzipciy15l984v9v";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontxfree86type1 = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 20a0aecdc9ab5..e3f4a71971699 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -333,6 +333,7 @@
   font-sony-misc,
   font-sun-misc,
   font-util,
+  font-winitzki-cyrillic,
   gccmakedep,
   ico,
   imake,
@@ -466,6 +467,7 @@
   fontsonymisc = font-sony-misc;
   fontsunmisc = font-sun-misc;
   fontutil = font-util;
+  fontwinitzkicyrillic = font-winitzki-cyrillic;
   libAppleWM = libapplewm;
   libFS = libfs;
   libICE = libice;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 776349d76dfb2..2383dd1df7e6e 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -109,7 +109,6 @@ mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz

From 157a4e3863a766c9d7977002e911a976fcb92940 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 30 Aug 2025 23:16:02 +0200
Subject: [PATCH 032/306] font-xfree86-type1: refactor, move to pkgs/by-name
 and rename from xorg.fontxfree86type1

relevant changes:
- remove some unneeded deps and configureFlags

package output doesn't change
---
 .../by-name/fo/font-xfree86-type1/package.nix | 41 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 40 +-----------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 45 insertions(+), 39 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-xfree86-type1/package.nix

diff --git a/pkgs/by-name/fo/font-xfree86-type1/package.nix b/pkgs/by-name/fo/font-xfree86-type1/package.nix
new file mode 100644
index 0000000000000..acb1a3167b057
--- /dev/null
+++ b/pkgs/by-name/fo/font-xfree86-type1/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-xfree86-type1";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-xfree86-type1-${finalAttrs.version}.tar.xz";
+    hash = "sha256-qTwseIpeocACr3yGYs+dmCH7HfUbjSssXgAm39/qSDc=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ mkfontscale ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "XFree86 Cusrsor Postscript Type 1 Font";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/xfree86-type1";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 3e2ec060080f3..3b669b3156412 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -18,6 +18,7 @@
   font-sun-misc,
   font-util,
   font-winitzki-cyrillic,
+  font-xfree86-type1,
   gccmakedep,
   ico,
   imake,
@@ -152,6 +153,7 @@ self: with self; {
   fontsunmisc = font-sun-misc;
   fontutil = font-util;
   fontwinitzkicyrillic = font-winitzki-cyrillic;
+  fontxfree86type1 = font-xfree86-type1;
   libAppleWM = libapplewm;
   libFS = libfs;
   libICE = libice;
@@ -1195,44 +1197,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontxfree86type1 = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-xfree86-type1";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz";
-        sha256 = "0ds8xbgxy9h0bqn2p38vylfzn8cqkp7n51kwmw1c18ayi9w2qg59";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   iceauth = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index e3f4a71971699..6631d892a848c 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -334,6 +334,7 @@
   font-sun-misc,
   font-util,
   font-winitzki-cyrillic,
+  font-xfree86-type1,
   gccmakedep,
   ico,
   imake,
@@ -468,6 +469,7 @@
   fontsunmisc = font-sun-misc;
   fontutil = font-util;
   fontwinitzkicyrillic = font-winitzki-cyrillic;
+  fontxfree86type1 = font-xfree86-type1;
   libAppleWM = libapplewm;
   libFS = libfs;
   libICE = libice;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 2383dd1df7e6e..486a353c3bfb5 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -109,7 +109,6 @@ mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz
 mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz

From 45169f4be17f933977fe9ca9d9f3828af9ac4deb Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 13 Sep 2025 22:34:23 +0200
Subject: [PATCH 033/306] 
 font-{{screen,winitzki}-cyrillic,{schumacher,sony,sun}-misc,xfree86-type1}:
 move font from $out/lib to $out/share

for font-xfree86-type1 this fixes xorg nixos module accordingly
---
 nixos/modules/services/x11/xserver.nix             | 2 +-
 pkgs/by-name/fo/font-schumacher-misc/package.nix   | 2 +-
 pkgs/by-name/fo/font-screen-cyrillic/package.nix   | 2 --
 pkgs/by-name/fo/font-sony-misc/package.nix         | 2 --
 pkgs/by-name/fo/font-sun-misc/package.nix          | 2 --
 pkgs/by-name/fo/font-winitzki-cyrillic/package.nix | 2 --
 pkgs/by-name/fo/font-xfree86-type1/package.nix     | 2 --
 7 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index e90d51b19ffea..6be128f69f285 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -177,7 +177,7 @@ let
     {
       postInstall = ''
         alias='cursor -xfree86-cursor-medium-r-normal--0-${sizeString}-0-0-p-0-adobe-fontspecific'
-        echo "$alias" > $out/lib/X11/fonts/Type1/fonts.alias
+        echo "$alias" > $out/share/fonts/X11/Type1/fonts.alias
       '';
     }
   );
diff --git a/pkgs/by-name/fo/font-schumacher-misc/package.nix b/pkgs/by-name/fo/font-schumacher-misc/package.nix
index 3b1534196914e..c83b593c16aac 100644
--- a/pkgs/by-name/fo/font-schumacher-misc/package.nix
+++ b/pkgs/by-name/fo/font-schumacher-misc/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ font-util ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
 
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
diff --git a/pkgs/by-name/fo/font-screen-cyrillic/package.nix b/pkgs/by-name/fo/font-screen-cyrillic/package.nix
index 217fab306ea72..bea6992d9b240 100644
--- a/pkgs/by-name/fo/font-screen-cyrillic/package.nix
+++ b/pkgs/by-name/fo/font-screen-cyrillic/package.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     mkfontscale
   ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/fo/font-sony-misc/package.nix b/pkgs/by-name/fo/font-sony-misc/package.nix
index 6c9341b855bf9..8562279b8678b 100644
--- a/pkgs/by-name/fo/font-sony-misc/package.nix
+++ b/pkgs/by-name/fo/font-sony-misc/package.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     mkfontscale
   ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/fo/font-sun-misc/package.nix b/pkgs/by-name/fo/font-sun-misc/package.nix
index 25d701a489b03..bc8eb50a71c5d 100644
--- a/pkgs/by-name/fo/font-sun-misc/package.nix
+++ b/pkgs/by-name/fo/font-sun-misc/package.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     mkfontscale
   ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix b/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix
index 65a6b6e97d5fc..efbee8e3633e8 100644
--- a/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix
+++ b/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     mkfontscale
   ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/fo/font-xfree86-type1/package.nix b/pkgs/by-name/fo/font-xfree86-type1/package.nix
index acb1a3167b057..6d8e451f85941 100644
--- a/pkgs/by-name/fo/font-xfree86-type1/package.nix
+++ b/pkgs/by-name/fo/font-xfree86-type1/package.nix
@@ -18,8 +18,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ mkfontscale ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell

From a426acee1e48bbbcec5a623446f2df9654b5b937 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 14 Sep 2025 01:26:47 +0300
Subject: [PATCH 034/306] python313Packages.numpy: 2.3.2 -> 2.3.3

Changelog: https://github.com/numpy/numpy/releases/tag/v2.3.3
---
 pkgs/development/python-modules/numpy/2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 397b071909e8b..b6fd45abd9617 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -59,7 +59,7 @@ let
 in
 buildPythonPackage rec {
   pname = "numpy";
-  version = "2.3.2";
+  version = "2.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -67,7 +67,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
-    hash = "sha256-4EhqEewwzey1PxhNSW0caiB4bIHlXkFkAnATAFb47kg=";
+    hash = "sha256-3cfDlye6YrgN/b7fQA0cEN36ju+9fsjcsRi+i1bTECk=";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [

From f59036bf7543980c12ed56704f7943a444092778 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 14 Sep 2025 01:27:43 +0300
Subject: [PATCH 035/306] python313Packages.scipy: 1.16.1 -> 1.16.2

Diff: https://github.com/scipy/scipy/compare/v1.16.1...v1.16.2

Changelog: https://github.com/scipy/scipy/releases/tag/v1.16.2
---
 pkgs/development/python-modules/scipy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 92151e4682599..663389069579d 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -50,8 +50,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.16.1";
-  srcHash = "sha256-/LgYQUMGoQjSWMCWBgnekNGzEc0LVg2qiN2tV399rQU=";
+  version = "1.16.2";
+  srcHash = "sha256-vWXJyLvOqCC5jwDawWHF6K2GVU2gnvW4a85lF/6tVYg=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";

From 963a04e217144b9addfaef99622ea343e54ba0bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 14 Sep 2025 20:03:29 +0200
Subject: [PATCH 036/306] python2: 2.7.18.8 -> 2.7.18.12

---
 pkgs/development/interpreters/python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 980ebdf2d582c..4d0672faa816d 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -36,9 +36,9 @@
         major = "2";
         minor = "7";
         patch = "18";
-        suffix = ".8"; # ActiveState's Python 2 extended support
+        suffix = ".12"; # ActiveState's Python 2 extended support
       };
-      hash = "sha256-HUOzu3uJbtd+3GbmGD35KOk/CDlwL4S7hi9jJGRFiqI=";
+      hash = "sha256-RuEgfpags9wJm9Xe0daotqUx4knABEUc7DvtgnQXEfE=";
       inherit passthruFun;
     };
 

From 6747987a9f6c9312a3297e17fc31707443c11857 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Thu, 11 Sep 2025 21:00:31 +0200
Subject: [PATCH 037/306] python313Packages.tkinter: revert to building with
 tcl 8.6

Tcl 9.0 support in Tkinter is not quite there yet [1]. There is ongoing
work on improving support, though.

This fixes the build of `python310Packages.tkinter` and
`python311Packages.tkinter`.

[1] https://github.com/python/cpython/issues/124111
---
 pkgs/development/python-modules/tkinter/pyproject.toml | 3 +--
 pkgs/top-level/python-packages.nix                     | 7 +++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/tkinter/pyproject.toml b/pkgs/development/python-modules/tkinter/pyproject.toml
index 770331a7ef4f5..a53ccd8c72a28 100644
--- a/pkgs/development/python-modules/tkinter/pyproject.toml
+++ b/pkgs/development/python-modules/tkinter/pyproject.toml
@@ -11,6 +11,5 @@ requires-python = ">=@python_version@"
 [tool.setuptools]
 packages = ["tkinter"]
 ext-modules = [
-  { name = "_tkinter", sources = ["_tkinter.c"], libraries = ["tcl9.0", "tcl9tk9.0"], include-dirs = ["@python_internal_dir@/"] }
+  { name = "_tkinter", sources = ["_tkinter.c"], libraries = ["tcl", "tk"], include-dirs = ["@python_internal_dir@/"] }
 ]
-
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9e7bfc8df7f13..e7e417363f0c8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -18388,8 +18388,11 @@ self: super: with self; {
       null
     else
       callPackage ../development/python-modules/tkinter {
-        tcl = pkgs.tcl-9_0;
-        tk = pkgs.tk-9_0;
+        # Tcl/Tk 9.0 support in Tkinter is not quite ready yet:
+        # - https://github.com/python/cpython/issues/124111
+        # - https://github.com/python/cpython/issues/104568
+        tcl = pkgs.tcl-8_6;
+        tk = pkgs.tk-8_6;
       };
 
   tkinter-gl = callPackage ../development/python-modules/tkinter-gl { };

From 0ff96eca9b5e0a70e4c7b2ea3d8788605ddd3285 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Thu, 11 Sep 2025 21:04:05 +0200
Subject: [PATCH 038/306] python313Packages.tkinter: enable tests by default

---
 pkgs/development/python-modules/tkinter/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/python-modules/tkinter/default.nix b/pkgs/development/python-modules/tkinter/default.nix
index afc6d765a4986..548c36625c4dc 100644
--- a/pkgs/development/python-modules/tkinter/default.nix
+++ b/pkgs/development/python-modules/tkinter/default.nix
@@ -8,7 +8,6 @@
   tcl,
   tclPackages,
   tk,
-  tkinter,
   xvfb-run,
 }:
 
@@ -64,8 +63,6 @@ buildPythonPackage {
     ];
   };
 
-  doCheck = false;
-
   nativeCheckInputs = [ xvfb-run ];
 
   preCheck = ''
@@ -81,8 +78,6 @@ buildPythonPackage {
     runHook postCheck
   '';
 
-  passthru.tests.unittests = tkinter.overridePythonAttrs { doCheck = true; };
-
   pythonImportsCheck = [ "tkinter" ];
 
   meta = {

From d4b01227d4fdeacb65a00d18f42186191e90e02f Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Thu, 11 Sep 2025 21:10:04 +0200
Subject: [PATCH 039/306] python313Packages.tkinter: enable tests for tcl and
 ttk

---
 pkgs/development/python-modules/tkinter/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/tkinter/default.nix b/pkgs/development/python-modules/tkinter/default.nix
index 548c36625c4dc..560ebf766649e 100644
--- a/pkgs/development/python-modules/tkinter/default.nix
+++ b/pkgs/development/python-modules/tkinter/default.nix
@@ -73,7 +73,7 @@ buildPythonPackage {
   checkPhase = ''
     runHook preCheck
     xvfb-run -w 10 -s "-screen 0 1920x1080x24" \
-      python -m unittest test.test_tkinter
+      python -m unittest test.test_tcl test.test_tkinter test.test_ttk test.test_ttk_textonly
 
     runHook postCheck
   '';

From 829b86801b3e432e466559a4cd0a8c652d461be5 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Thu, 11 Sep 2025 22:12:15 +0200
Subject: [PATCH 040/306] python313Packages.tkinter: fix test selection for
 darwin, older python

https://github.com/python/cpython/pull/94070
---
 .../python-modules/tkinter/default.nix        | 39 +++++++++++++++----
 1 file changed, 31 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/tkinter/default.nix b/pkgs/development/python-modules/tkinter/default.nix
index 560ebf766649e..8d58074939776 100644
--- a/pkgs/development/python-modules/tkinter/default.nix
+++ b/pkgs/development/python-modules/tkinter/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   replaceVars,
   setuptools,
@@ -63,20 +64,42 @@ buildPythonPackage {
     ];
   };
 
-  nativeCheckInputs = [ xvfb-run ];
+  nativeCheckInputs = lib.optional stdenv.hostPlatform.isLinux xvfb-run;
 
   preCheck = ''
     cd $NIX_BUILD_TOP/Python-*/Lib
     export HOME=$TMPDIR
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    xvfb-run -w 10 -s "-screen 0 1920x1080x24" \
-      python -m unittest test.test_tcl test.test_tkinter test.test_ttk test.test_ttk_textonly
-
-    runHook postCheck
-  '';
+  checkPhase =
+    let
+      testsNoGui = [
+        "test.test_tcl"
+        "test.test_ttk_textonly"
+      ];
+      testsGui =
+        if pythonOlder "3.12" then
+          [
+            "test.test_tk"
+            # "test.test_ttk_guionly"  # https://github.com/python/cpython/issues/124378
+          ]
+        else
+          [
+            "test.test_tkinter"
+            "test.test_ttk"
+          ];
+    in
+    ''
+      runHook preCheck
+      ${python.interpreter} -m unittest ${lib.concatStringsSep " " testsNoGui}
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      xvfb-run -w 10 -s "-screen 0 1920x1080x24" \
+        ${python.interpreter} -m unittest ${lib.concatStringsSep " " testsGui}
+    ''
+    + ''
+      runHook postCheck
+    '';
 
   pythonImportsCheck = [ "tkinter" ];
 

From 69b8cd945c645230ddf909784973d6c2136fac40 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Fri, 12 Sep 2025 14:15:21 +0200
Subject: [PATCH 041/306] python313Packages.tkinter: patch failing ttk test for
 python <3.12

https://github.com/python/cpython/issues/124378
https://github.com/python/cpython/pull/124542
---
 .../python-modules/tkinter/default.nix        | 15 ++++++++----
 .../tkinter/fix-ttk-notebook-test.patch       | 24 +++++++++++++++++++
 2 files changed, 34 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/development/python-modules/tkinter/fix-ttk-notebook-test.patch

diff --git a/pkgs/development/python-modules/tkinter/default.nix b/pkgs/development/python-modules/tkinter/default.nix
index 8d58074939776..233b2b2b0e4a9 100644
--- a/pkgs/development/python-modules/tkinter/default.nix
+++ b/pkgs/development/python-modules/tkinter/default.nix
@@ -27,23 +27,28 @@ buildPythonPackage {
     cp -rv Modules/clinic ../tkinter/
     cp -rv Lib/tkinter ../tkinter/
 
-    pushd $NIX_BUILD_TOP/tkinter
-
     # install our custom pyproject.toml
     cp ${
       replaceVars ./pyproject.toml {
         python_version = python.version;
         python_internal_dir = "${python}/include/${python.libPrefix}/internal";
       }
-    } ./pyproject.toml
+    } $NIX_BUILD_TOP/tkinter/pyproject.toml
 
   ''
   + lib.optionalString (pythonOlder "3.13") ''
-    substituteInPlace "tkinter/tix.py" --replace-fail \
+    substituteInPlace "$NIX_BUILD_TOP/tkinter/tkinter/tix.py" --replace-fail \
       "os.environ.get('TIX_LIBRARY')" \
       "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
   '';
 
+  # Adapted from https://github.com/python/cpython/pull/124542
+  patches = lib.optional (pythonOlder "3.12") ./fix-ttk-notebook-test.patch;
+
+  preConfigure = ''
+    pushd $NIX_BUILD_TOP/tkinter
+  '';
+
   build-system = [ setuptools ];
 
   buildInputs = [
@@ -81,7 +86,7 @@ buildPythonPackage {
         if pythonOlder "3.12" then
           [
             "test.test_tk"
-            # "test.test_ttk_guionly"  # https://github.com/python/cpython/issues/124378
+            "test.test_ttk_guionly"
           ]
         else
           [
diff --git a/pkgs/development/python-modules/tkinter/fix-ttk-notebook-test.patch b/pkgs/development/python-modules/tkinter/fix-ttk-notebook-test.patch
new file mode 100644
index 0000000000000..cf2ca0f7acdfa
--- /dev/null
+++ b/pkgs/development/python-modules/tkinter/fix-ttk-notebook-test.patch
@@ -0,0 +1,24 @@
+--- a/Lib/tkinter/test/test_ttk/test_widgets.py
++++ b/Lib/tkinter/test/test_ttk/test_widgets.py
+@@ -911,12 +911,20 @@ class ScrollbarTest(AbstractWidgetTest, unittest.TestCase):
+         return ttk.Scrollbar(self.root, **kwargs)
+ 
+ 
+-@add_standard_options(IntegerSizeTests, StandardTtkOptionsTests)
++@add_standard_options(StandardTtkOptionsTests)
+ class NotebookTest(AbstractWidgetTest, unittest.TestCase):
+     OPTIONS = (
+         'class', 'cursor', 'height', 'padding', 'style', 'takefocus', 'width',
+     )
+ 
++    def test_configure_height(self):
++        widget = self.create()
++        self.checkPixelsParam(widget, 'height', '10c', 402, -402, 0, conv=False)
++
++    def test_configure_width(self):
++        widget = self.create()
++        self.checkPixelsParam(widget, 'width', '10c', 402, -402, 0, conv=False)
++
+     def setUp(self):
+         super().setUp()
+         self.nb = self.create(padding=0)

From d8828896de09084ab1da69a805a219525322501c Mon Sep 17 00:00:00 2001
From: Guy Chronister <guychronister@outlook.com>
Date: Tue, 16 Sep 2025 00:43:04 +0000
Subject: [PATCH 042/306] bundler: 2.7.1 -> 2.7.2

---
 pkgs/by-name/bu/bundler/package.nix                     | 4 ++--
 pkgs/development/interpreters/ruby/rubygems/default.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/bu/bundler/package.nix b/pkgs/by-name/bu/bundler/package.nix
index e1e5c1fdbc36f..1789ef0c72038 100644
--- a/pkgs/by-name/bu/bundler/package.nix
+++ b/pkgs/by-name/bu/bundler/package.nix
@@ -13,8 +13,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.7.1";
-  source.sha256 = "sha256-CtWgAqh5d2sqmL5lL1V6yHMb4zU2EtY/pO8bJwbcHgs=";
+  version = "2.7.2";
+  source.sha256 = "sha256-Heyvni4ay5G2WGopJcjz9tojNKgnMaYv8t7RuDwoOHE=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 58295fb55547f..0e676a64c2d31 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-dQyMdxGA1B7SNYNE5UYe3ugxWMCoG3eZaaEzmWG8EWM=";
+    hash = "sha256-7+zgEiWlMvS1LPh2TSCgDg0p7W+Fsz2TAt9IlqkPpas=";
   };
 
   patches = [

From 15803a174832e8d00da07b387a2e548a651a5578 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Thu, 18 Sep 2025 15:33:24 +0200
Subject: [PATCH 043/306] jasp-desktop: fix build by not depending on removed
 cran package

---
 pkgs/by-name/ja/jasp-desktop/modules.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ja/jasp-desktop/modules.nix b/pkgs/by-name/ja/jasp-desktop/modules.nix
index 040b3a258947e..8b743c851d2b1 100644
--- a/pkgs/by-name/ja/jasp-desktop/modules.nix
+++ b/pkgs/by-name/ja/jasp-desktop/modules.nix
@@ -176,6 +176,7 @@ let
     {
       pname,
       version,
+      rev ? "refs/tags/${version}",
       hash,
       deps,
     }:
@@ -185,8 +186,7 @@ let
         name = "${pname}-${version}-source";
         owner = "jasp-stats";
         repo = pname;
-        tag = "v${version}";
-        inherit hash;
+        inherit rev hash;
       };
       propagatedBuildInputs = deps;
       # some packages have a .Rprofile that tries to activate renv
@@ -713,8 +713,9 @@ in
     };
     jaspRegression = buildJaspModule {
       pname = "jaspRegression";
-      version = "0.95.0";
-      hash = "sha256-9Q5Ei9vjFaDte//1seCj9++ftbDctkHzP8ZpGVETXH0=";
+      version = "0.95.0-unstable-2025-08-27";
+      rev = "b0ecad26bb248964e778ee6d4486d671b83930b2";
+      hash = "sha256-wm/Fz/wA7B96bzj8UylZjFgrrZgwOTdGnCsmfaCPGp0=";
       deps = [
         BAS
         boot
@@ -723,7 +724,6 @@ in
         emmeans
         ggplot2
         ggrepel
-        hmeasure
         jaspAnova
         jaspBase
         jaspDescriptives

From a1180e40d32e45924680af7043cd429c5676bb60 Mon Sep 17 00:00:00 2001
From: Connor Baker <ConnorBaker01@gmail.com>
Date: Thu, 18 Sep 2025 13:22:14 -0700
Subject: [PATCH 044/306] opencv: invalidate Nix store paths used in
 version_string.inc

Signed-off-by: Connor Baker <ConnorBaker01@gmail.com>
---
 ...s.cmake-invalidate-Nix-store-paths-b.patch | 34 +++++++++++++++++++
 pkgs/development/libraries/opencv/4.x.nix     |  6 +---
 2 files changed, 35 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/development/libraries/opencv/0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch

diff --git a/pkgs/development/libraries/opencv/0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch b/pkgs/development/libraries/opencv/0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch
new file mode 100644
index 0000000000000..03f912cef39a8
--- /dev/null
+++ b/pkgs/development/libraries/opencv/0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch
@@ -0,0 +1,34 @@
+From fcc689e1887bcbeb9d1c4441266a63ea2114ae9f Mon Sep 17 00:00:00 2001
+From: Connor Baker <ConnorBaker01@gmail.com>
+Date: Thu, 18 Sep 2025 13:15:43 -0700
+Subject: [PATCH] cmake/OpenCVUtils.cmake: invalidate Nix store paths before
+ including in version_string.inc
+
+Signed-off-by: Connor Baker <ConnorBaker01@gmail.com>
+---
+ cmake/OpenCVUtils.cmake | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/cmake/OpenCVUtils.cmake b/cmake/OpenCVUtils.cmake
+index 5886f4f3cb..9f3a3a74e9 100644
+--- a/cmake/OpenCVUtils.cmake
++++ b/cmake/OpenCVUtils.cmake
+@@ -956,6 +956,15 @@ function(ocv_output_status msg)
+     message(WARNING "String to be inserted to version_string.inc has an unexpected line break: '${msg}'")
+     string(REPLACE "\n" "\\n" msg "${msg}")
+   endif()
++  # The hash portion of Nix store paths are 32 characters long. Replace them with an invalid hash to avoid bloating
++  # the runtime closure by includnig references to the compiler and other build tools.
++  # https://fzakaria.com/2025/03/28/what-s-in-a-nix-store-path
++  # NOTE: This assumes the name of the Nix store is always /nix/store.
++  # NOTE: The regex [a-z0-9] is larger than Nix's base32, but it simplifies things.
++  # NOTE: This assumes all Nix store paths have additional characters after the hash.
++  # NOTE: CMake doesn't support fixed-length matching. See:
++  # https://cmake.org/cmake/help/latest/command/string.html#regex-specification
++  string(REGEX REPLACE "/nix/store/[a-z0-9]+-" "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-" msg "${msg}")
+   set(OPENCV_BUILD_INFO_STR "${OPENCV_BUILD_INFO_STR}\"${msg}\\n\"\n" CACHE INTERNAL "")
+ endfunction()
+ 
+-- 
+2.48.1
+
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 26a49c1ae1af8..8c169864bab25 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -298,6 +298,7 @@ effectiveStdenv.mkDerivation {
   # Ensures that we use the system OpenEXR rather than the vendored copy of the source included with OpenCV.
   patches = [
     ./cmake-don-t-use-OpenCVFindOpenEXR.patch
+    ./0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch
   ]
   ++ optionals enableCuda [
     ./cuda_opt_flow.patch
@@ -321,11 +322,6 @@ effectiveStdenv.mkDerivation {
       ${installExtraFiles wechat_qrcode}
     '');
 
-  postConfigure = ''
-    [ -e modules/core/version_string.inc ]
-    echo '"(build info elided)"' > modules/core/version_string.inc
-  '';
-
   buildInputs = [
     boost
     gflags

From 5881b5100a75ac9a65b1ce36e9e3634db7212cbd Mon Sep 17 00:00:00 2001
From: Fabian Affolter <fabian@affolter-engineering.ch>
Date: Tue, 2 Sep 2025 22:45:57 +0200
Subject: [PATCH 045/306] python313Packages.pytest-rerunfailures: 15.1 ->
 16.0.1

Diff: https://github.com/pytest-dev/pytest-rerunfailures/compare/15.1...16.0.1
---
 .../python-modules/pytest-rerunfailures/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index a219cb3752f41..572fbc3359ece 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "15.1";
+  version = "16.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "pytest-dev";
     repo = "pytest-rerunfailures";
     tag = version;
-    hash = "sha256-ab3n61zCf9ok2PWvKTwmaeoeGuMxl0sYE25djk/NDLk=";
+    hash = "sha256-4/BgvfVcs7MdULlhafZypNzzag4ITALStHI1tIoAPL4=";
   };
 
   build-system = [ setuptools ];

From 643f4f7e21f2459acb791a1d7fae74e6bd4c1e34 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <fabian@affolter-engineering.ch>
Date: Tue, 2 Sep 2025 22:49:18 +0200
Subject: [PATCH 046/306] python313Packages.pytest-rerunfailures: add changelog
 to meta

---
 pkgs/development/python-modules/pytest-rerunfailures/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index 572fbc3359ece..afd0505c9deed 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -34,6 +34,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pytest plugin to re-run tests to eliminate flaky failures";
     homepage = "https://github.com/pytest-dev/pytest-rerunfailures";
+    changelog = "https://github.com/pytest-dev/pytest-rerunfailures/blob/${src.tag}/CHANGES.rst";
     license = licenses.mpl20;
     maintainers = with maintainers; [ das-g ];
   };

From fef88af8e705a487ab4dedee77734b152be45c57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 20 Sep 2025 05:07:32 -0700
Subject: [PATCH 047/306] python3Packages.pytest-archon: 0.0.6 -> 0.0.7

Diff: https://github.com/jwbargsten/pytest-archon/compare/v0.0.6...v0.0.7
---
 pkgs/development/python-modules/pytest-archon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-archon/default.nix b/pkgs/development/python-modules/pytest-archon/default.nix
index 643d1ae988c78..9a5637f6bbc62 100644
--- a/pkgs/development/python-modules/pytest-archon/default.nix
+++ b/pkgs/development/python-modules/pytest-archon/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-archon";
-  version = "0.0.6";
+  version = "0.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jwbargsten";
     repo = "pytest-archon";
     tag = "v${version}";
-    hash = "sha256-ZKs7ifqgazEywszPGxkcPCf2WD2tEpEsbh8kHN/PL7s=";
+    hash = "sha256-0YBujBUBpW/FSIlJDRjL5mvYZfirHW07bRyygyoapw8=";
   };
 
   build-system = [

From ef3873099d532bd37f7075b882676e6366598a15 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 20 Sep 2025 10:49:44 +0100
Subject: [PATCH 048/306] libvdpau-va-gl: pull upstream `cmake-4` fix

Without the change the build fails on` staging` as:

       CMake Error at CMakeLists.txt:2 (cmake_minimum_required):
         Compatibility with CMake < 3.5 has been removed from CMake.

Co-authored-by: Grimmauld <soeren@benjos.de>
---
 pkgs/by-name/li/libvdpau-va-gl/package.nix | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/pkgs/by-name/li/libvdpau-va-gl/package.nix b/pkgs/by-name/li/libvdpau-va-gl/package.nix
index 7741308d9dc1a..b55f73762ac24 100644
--- a/pkgs/by-name/li/libvdpau-va-gl/package.nix
+++ b/pkgs/by-name/li/libvdpau-va-gl/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   pkg-config,
   libX11,
@@ -26,6 +27,25 @@ stdenv.mkDerivation rec {
     sha256 = "0asndybfv8xb0fx73sjjw5kydqrahqkm6n04lh589pbf18s5qlld";
   };
 
+  patches = [
+    # cmake-4 compatibility
+    (fetchpatch {
+      name = "cmake-4-1.patch";
+      url = "https://github.com/i-rinat/libvdpau-va-gl/commit/30c8ac91f3aa2843f7dc1c1d167e09fad447fd91.patch?full_index=1";
+      hash = "sha256-PFEqBg3NE0fVFBAW4zdDbh8eBfKyPX3BZ8P2M15Qq5A=";
+    })
+    (fetchpatch {
+      name = "cmake-4-2.patch";
+      url = "https://github.com/i-rinat/libvdpau-va-gl/commit/38c7d8fddb092824cbcdf2b11af519775930cc8b.patch?full_index=1";
+      hash = "sha256-XsX/GLIS2Ce7obQJ4uVhLDtTI1TrDAGi3ECxEH6oOFI=";
+    })
+    (fetchpatch {
+      name = "cmake-4-3.patch";
+      url = "https://github.com/i-rinat/libvdpau-va-gl/commit/a845e8720d900e4bcc89e7ee16106ce63b44af0.patch?full_index=1";
+      hash = "sha256-lhiZFDR2ytDmo9hQUT35IJS4KL4+nYWAOnxZlj7u3tM=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config

From 80925548d13a09b83f20942512e6ae471232d7b0 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Sun, 21 Sep 2025 12:47:58 +0200
Subject: [PATCH 049/306] lvm2: 2.03.34 -> 2.03.35

https://gitlab.com/lvmteam/lvm2/-/tags/v2_03_35
---
 pkgs/os-specific/linux/lvm2/2_03.nix   | 4 ++--
 pkgs/os-specific/linux/lvm2/common.nix | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 546913d7e88d1..19e62bd4a2f7d 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.34";
-  hash = "sha256-P05459bEkii00XPqCOvhWIc9VEV/un0x0qvr3d0Odbk=";
+  version = "2.03.35";
+  hash = "sha256-6/KLNCdTXitavZmRzYObYWIqDb+4yG3w968fadyqg3E=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index cd75479ab652e..e5c4809352309 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -204,6 +204,7 @@ stdenv.mkDerivation rec {
       moveToOutput bin/blkdeactivate $scripts
       moveToOutput bin/lvmdump $scripts
       moveToOutput bin/lvm_import_vdo $scripts
+      moveToOutput bin/lvmpersist $scripts
       moveToOutput libexec/lvresize_fs_helper $scripts/lib
     ''
     + lib.optionalString (!enableCmdlib) ''

From a3902628008fb572f3a03f37912db43cfaeca70a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sun, 21 Sep 2025 17:25:14 +0200
Subject: [PATCH 050/306] gss: properly autoreconf

Should let us drop the Darwin hack, and not have to apply it on other
platfomrs, like musl, too.

I used Nixpkgs' gnulib source because it works, but if it stops
working in future we could use fetchgit to get the gnulib submodule.

Fixes: 90805a436c47 ("gss: use autoreconfHook")
Closes: https://github.com/NixOS/nixpkgs/pull/436189
---
 pkgs/by-name/gs/gss/package.nix | 48 ++++++++++++++++++++++++++-------
 1 file changed, 39 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/gs/gss/package.nix b/pkgs/by-name/gs/gss/package.nix
index 8c45bf33b43b3..cbe7445f7e2b4 100644
--- a/pkgs/by-name/gs/gss/package.nix
+++ b/pkgs/by-name/gs/gss/package.nix
@@ -1,9 +1,17 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  autoreconfHook,
+  fetchzip,
+  autoconf,
+  automake,
+  gengetopt,
+  gettext,
+  gnulib,
   gtk-doc,
+  help2man,
+  libtool,
+  perl,
+  texinfo,
   withShishi ? !stdenv.hostPlatform.isDarwin,
   shishi,
 }:
@@ -12,9 +20,24 @@ stdenv.mkDerivation rec {
   pname = "gss";
   version = "1.0.4";
 
-  src = fetchurl {
-    url = "mirror://gnu/gss/gss-${version}.tar.gz";
-    hash = "sha256-7M6r3vTK4/znIYsuy4PrQifbpEtTthuMKy6IrgJBnHM=";
+  # The dist tarballs do not contain everything necessary to
+  # autoreconf.  Trying to use autoreconfHook with a dist tarball
+  # produces a broken result that fails to build for some platforms.
+  # If we want to autoreconf, we need to build from a git snapshot.
+  #
+  # See this explanation from the maintainer, about an existing
+  # package that exhibits the same problem (that we were able to
+  # produce when building for Darwin an musl.)
+  #
+  # https://lists.gnu.org/archive/html/help-libidn/2021-07/msg00009.html
+  src = fetchzip {
+    url = "https://gitweb.git.savannah.gnu.org/gitweb/?p=gss.git;a=snapshot;h=v${version};sf=tgz";
+    extension = "tar.gz";
+    hash = "sha256-yT19kwAhGzbIoMjRbrrsn6CyvkMH5v1nxxWpnGYmZUw=";
+  };
+
+  env = {
+    GNULIB_SRCDIR = gnulib.src;
   };
 
   # krb5context test uses certificates that expired on 2024-07-11.
@@ -24,15 +47,22 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [
-    autoreconfHook
+    autoconf
+    automake
+    gengetopt
+    gettext
     gtk-doc
+    help2man
+    libtool
+    perl
+    texinfo
   ];
 
   buildInputs = lib.optional withShishi shishi;
 
-  # ./stdint.h:89:5: error: expected value in expression
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export GNULIBHEADERS_OVERRIDE_WINT_T=0
+  preConfigure = ''
+    patchShebangs doc/gdoc
+    ./autogen.sh
   '';
 
   configureFlags = [

From 1c1e833764018088e38bac0da10b01b3a86b734d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 14 Sep 2025 00:30:48 +0000
Subject: [PATCH 051/306] utf8cpp: 4.0.6 -> 4.0.8

---
 pkgs/by-name/ut/utf8cpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/utf8cpp/package.nix b/pkgs/by-name/ut/utf8cpp/package.nix
index ebaff9ecb83da..b609e22aab5af 100644
--- a/pkgs/by-name/ut/utf8cpp/package.nix
+++ b/pkgs/by-name/ut/utf8cpp/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "utf8cpp";
-  version = "4.0.6";
+  version = "4.0.8";
 
   src = fetchFromGitHub {
     owner = "nemtrif";
     repo = "utfcpp";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-e8qH4eygLnQw7B8x+HN+vH8cr8fkxnTFz+PKtFJ8dGE=";
+    hash = "sha256-9lfs2tqsSDbf1appDC+S3qdmS4DipHhXoiJQluKytbM=";
   };
 
   nativeBuildInputs = [ cmake ];

From 0b2956ddcafe88e8c70ba180db4ff75df5d7de9f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 29 Jul 2025 00:16:52 +0000
Subject: [PATCH 052/306] harfbuzz: 11.2.1 -> 11.5.0

---
 pkgs/by-name/ha/harfbuzz/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ha/harfbuzz/package.nix b/pkgs/by-name/ha/harfbuzz/package.nix
index 080dac7b48ed6..cf7198d791327 100644
--- a/pkgs/by-name/ha/harfbuzz/package.nix
+++ b/pkgs/by-name/ha/harfbuzz/package.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "11.2.1";
+  version = "11.5.0";
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${finalAttrs.version}/harfbuzz-${finalAttrs.version}.tar.xz";
-    hash = "sha256-CTcUyFSKKFCUaF8L3JmeIC1ma1nus98v+SGraLgzakk=";
+    hash = "sha256-LTC6RcTI7E3mYaEAK0+I0IQf8aMIfzRiknX1Q21yIQk=";
   };
 
   postPatch = ''
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # ApplicationServices.framework headers have cast-align warnings.
     substituteInPlace src/hb.hh \
-      --replace '#pragma GCC diagnostic error   "-Wcast-align"' ""
+      --replace-fail '#pragma GCC diagnostic error   "-Wcast-align"' ""
   '';
 
   outputs = [

From b58d799df9fb0cacc1095b1a0d3b63e512b86221 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 2 Sep 2025 20:55:28 +0100
Subject: [PATCH 053/306] libxcb-cursor: 0.1.5 -> 0.1.6

Changes: https://cgit.freedesktop.org/xcb/util-cursor/log/
---
 pkgs/by-name/li/libxcb-cursor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libxcb-cursor/package.nix b/pkgs/by-name/li/libxcb-cursor/package.nix
index 8f8a61d6e5d7f..0afb6ae53ea35 100644
--- a/pkgs/by-name/li/libxcb-cursor/package.nix
+++ b/pkgs/by-name/li/libxcb-cursor/package.nix
@@ -13,7 +13,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxcb-cursor";
-  version = "0.1.5";
+  version = "0.1.6";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/xcb-util-cursor-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DK+ZsNYJcPgc5Bx7ppTl6q+DMie7LLzbL23JZmpmPFc=";
+    hash = "sha256-/euL0SeHNRm+XMcNzQ07XTO2Z4dyAPmSWln9ytj3qTM=";
   };
 
   strictDeps = true;

From 2add359f94aa1e1825e6dfef6f155286013d325d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Sep 2025 13:31:19 +0000
Subject: [PATCH 054/306] p11-kit: 0.25.5 -> 0.25.9

---
 pkgs/by-name/p1/p11-kit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/p1/p11-kit/package.nix b/pkgs/by-name/p1/p11-kit/package.nix
index c00c752997c9a..d770115b423d3 100644
--- a/pkgs/by-name/p1/p11-kit/package.nix
+++ b/pkgs/by-name/p1/p11-kit/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "p11-kit";
-  version = "0.25.5";
+  version = "0.25.9";
 
   src = fetchFromGitHub {
     owner = "p11-glue";
     repo = "p11-kit";
     tag = version;
-    hash = "sha256-2xDUvXGsF8x42uezgnvOXLVUdNNHcaE042HDDEJeplc=";
+    hash = "sha256-lvm//lsG5xSz1dBuvp4bJvNS+zCYTuAqXC22Po95JJg=";
     fetchSubmodules = true;
   };
 

From 47cbdfb1c75d64fe9dbdff9951b5d25cc301d574 Mon Sep 17 00:00:00 2001
From: dotlambda <nix@dotlambda.de>
Date: Sun, 21 Sep 2025 12:02:52 -0700
Subject: [PATCH 055/306] python3Packages.arelle: 2.30.25 -> 2.37.59 (#444607)

* python3Packages.arelle: 2.30.25 -> 2.37.59

Diff: https://github.com/Arelle/Arelle/compare/2.30.25...2.37.59

Changelog: https://github.com/Arelle/Arelle/releases/tag/2.37.59

* arelle: Add tests.cli

---------

Co-authored-by: Robert Hensing <robert@roberthensing.nl>
Co-authored-by: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
---
 .../python-modules/arelle/default.nix         | 238 ++++++++++--------
 .../python-modules/arelle/test-cli.nix        | 117 +++++++++
 2 files changed, 246 insertions(+), 109 deletions(-)
 create mode 100644 pkgs/development/python-modules/arelle/test-cli.nix

diff --git a/pkgs/development/python-modules/arelle/default.nix b/pkgs/development/python-modules/arelle/default.nix
index 36429cc7fd47d..b7d147c411a80 100644
--- a/pkgs/development/python-modules/arelle/default.nix
+++ b/pkgs/development/python-modules/arelle/default.nix
@@ -1,21 +1,26 @@
 {
+  callPackage,
   lib,
   buildPythonPackage,
-  pythonAtLeast,
   fetchFromGitHub,
 
   setuptools,
   setuptools-scm,
 
+  bottle,
   certifi,
   filelock,
   isodate,
+  jsonschema,
   lxml,
   numpy,
   openpyxl,
+  pillow,
   pyparsing,
   python-dateutil,
   regex,
+  truststore,
+  typing-extensions,
 
   gui ? true,
   tkinter,
@@ -43,116 +48,131 @@
   boto3,
 }:
 
-buildPythonPackage rec {
-  pname = "arelle${lib.optionalString (!gui) "-headless"}";
-  version = "2.30.25";
-  pyproject = true;
-
-  disabled = pythonAtLeast "3.13"; # Note: when updating, check if this is still needed
-
-  src = fetchFromGitHub {
-    owner = "Arelle";
-    repo = "Arelle";
-    tag = version;
-    hash = "sha256-xzTrFie97HDIqPZ4nzCh+0p/w0bTK12cS0FSsuIi7tY=";
-  };
-
-  outputs = [
-    "out"
-    "doc"
-  ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml --replace-fail \
-        'requires = ["setuptools~=73.0", "wheel~=0.44", "setuptools_scm[toml]~=8.1"]' \
-        'requires = ["setuptools", "wheel", "setuptools_scm[toml]"]'
-  '';
-
-  build-system = [
-    setuptools
-    setuptools-scm
-  ];
-
-  dependencies = [
-    certifi
-    filelock
-    isodate
-    lxml
-    numpy
-    openpyxl
-    pyparsing
-    python-dateutil
-    regex
-  ]
-  ++ lib.optionals gui [ tkinter ];
-
-  optional-dependencies = {
-    crypto = [ pycryptodome ];
-    db = [
-      pg8000
-      pymysql
-      pyodbc
-      rdflib
+# ideally we'd use finalAttrs.finalPackage instead of lib.fix for self-reference,
+# but buildPythonPackage doesn't support it yet
+lib.fix (
+  self:
+  buildPythonPackage rec {
+    pname = "arelle${lib.optionalString (!gui) "-headless"}";
+    version = "2.37.59";
+    pyproject = true;
+
+    src = fetchFromGitHub {
+      owner = "Arelle";
+      repo = "Arelle";
+      tag = version;
+      hash = "sha256-ao4OKe3e1V3Df7396gVn4nqmpKNAbs5ny2y/GsxQwcE=";
+    };
+
+    outputs = [
+      "out"
+      "doc"
     ];
-    efm = [
-      holidays
-      pytz
+
+    postPatch = ''
+      substituteInPlace pyproject.toml --replace-fail \
+          'requires = ["setuptools>=80.9,<81", "wheel>=0.45,<1", "setuptools_scm[toml]>=9.2,<10"]' \
+          'requires = ["setuptools", "wheel", "setuptools_scm[toml]"]'
+    '';
+
+    build-system = [
+      setuptools
+      setuptools-scm
     ];
-    esef = [ tinycss2 ];
-    objectmaker = [ graphviz ];
-    webserver = [
-      cheroot
-      cherrypy
-      tornado
+
+    dependencies = [
+      bottle
+      certifi
+      filelock
+      isodate
+      jsonschema
+      lxml
+      numpy
+      openpyxl
+      pillow
+      pyparsing
+      python-dateutil
+      regex
+      truststore
+      typing-extensions
+    ]
+    ++ lib.optionals gui [ tkinter ];
+
+    optional-dependencies = {
+      crypto = [ pycryptodome ];
+      db = [
+        pg8000
+        pymysql
+        pyodbc
+        rdflib
+      ];
+      efm = [
+        holidays
+        pytz
+      ];
+      esef = [ tinycss2 ];
+      objectmaker = [ graphviz ];
+      webserver = [
+        cheroot
+        cherrypy
+        tornado
+      ];
+    };
+
+    nativeBuildInputs = [
+      # deps for docs
+      sphinxHook
+      sphinx-autodoc2
+      myst-parser
+      sphinx-copybutton
+      furo
     ];
-  };
-
-  nativeBuildInputs = [
-    # deps for docs
-    sphinxHook
-    sphinx-autodoc2
-    myst-parser
-    sphinx-copybutton
-    furo
-  ];
-
-  # the arelleGUI executable doesn't work when the gui option is false
-  postInstall = lib.optionalString (!gui) ''
-    find $out/bin -name "*arelleGUI*" -delete
-  '';
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    boto3
-  ]
-  ++ lib.flatten (lib.attrValues optional-dependencies);
-
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
-  disabledTestPaths = [
-    "tests/integration_tests"
-  ]
-  ++ lib.optionals (!gui) [
-    # these tests import tkinter
-    "tests/unit_tests/arelle/test_updater.py"
-    "tests/unit_tests/arelle/test_import.py"
-  ];
-
-  meta = {
-    description = "Open source XBRL platform";
-    longDescription = ''
-      An open source facility for XBRL, the eXtensible Business Reporting
-      Language supporting various standards, exposed through a Python or
-      REST API ${lib.optionalString gui " and a graphical user interface"}.
+
+    # the arelleGUI executable doesn't work when the gui option is false
+    postInstall = lib.optionalString (!gui) ''
+      find $out/bin -name "*arelleGUI*" -delete
     '';
-    mainProgram = "arelle";
-    homepage = "http://arelle.org/";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      tomasajt
-      roberth
+
+    nativeCheckInputs = [
+      pytestCheckHook
+      boto3
+    ]
+    ++ lib.flatten (lib.attrValues optional-dependencies);
+
+    preCheck = ''
+      export HOME=$(mktemp -d)
+    '';
+
+    disabledTestPaths = [
+      "tests/integration_tests"
+    ]
+    ++ lib.optionals (!gui) [
+      # these tests import tkinter
+      "tests/unit_tests/arelle/test_updater.py"
+      "tests/unit_tests/arelle/test_import.py"
     ];
-  };
-}
+
+    passthru.hasGUI = gui;
+
+    passthru.tests = {
+      cli = callPackage ./test-cli.nix { arelle = self; };
+    };
+
+    meta = {
+      changelog = "https://github.com/Arelle/Arelle/releases/tag/${src.tag}";
+      description = "Open source XBRL platform";
+      longDescription = ''
+        An open source facility for XBRL, the eXtensible Business Reporting
+        Language supporting various standards, exposed through a Python or
+        REST API ${lib.optionalString gui " and a graphical user interface"}.
+      '';
+      mainProgram = "arelle";
+      homepage = "http://arelle.org/";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [
+        tomasajt
+        roberth
+      ];
+    };
+  }
+)
diff --git a/pkgs/development/python-modules/arelle/test-cli.nix b/pkgs/development/python-modules/arelle/test-cli.nix
new file mode 100644
index 0000000000000..17a0ebc0b6ce9
--- /dev/null
+++ b/pkgs/development/python-modules/arelle/test-cli.nix
@@ -0,0 +1,117 @@
+# Run with:
+#   cd nixpkgs
+#   nix-build -A python3Packages.arelle.passthru.tests.cli
+#
+# Note: These are uninteresting generated smoke tests to verify basic functionality
+{
+  lib,
+  runCommand,
+  arelle,
+}:
+
+runCommand "arelle-test-cli${lib.optionalString (!arelle.hasGUI) "-headless"}"
+  {
+    nativeBuildInputs = [ arelle ];
+  }
+  ''
+    # Set up temporary home directory
+    export HOME=$(mktemp -d)
+
+    # Test basic CLI commands work with proper assertions
+    arelleCmdLine --version --disablePersistentConfig 2>&1 | grep "Arelle(r) 2.37.59" > /dev/null
+    arelleCmdLine --help --disablePersistentConfig 2>&1 | grep "Usage: arelleCmdLine \[options\]" > /dev/null
+    arelleCmdLine --about --disablePersistentConfig 2>&1 | grep "An open source XBRL platform" > /dev/null
+
+    ${lib.optionalString arelle.hasGUI ''
+      # check if the arelleGUI command is available
+      command -v arelleGUI
+    ''}
+
+    # Create a simple but valid XBRL instance for testing validation functionality
+    cat > test-instance.xbrl << 'EOF'
+    <?xml version="1.0" encoding="UTF-8"?>
+    <xbrl xmlns="http://www.xbrl.org/2003/instance"
+          xmlns:link="http://www.xbrl.org/2003/linkbase"
+          xmlns:xlink="http://www.w3.org/1999/xlink">
+
+      <link:schemaRef xlink:href="http://www.xbrl.org/2003/xbrl-instance-2003-12-31.xsd" xlink:type="simple"/>
+
+      <context id="test_context">
+        <entity>
+          <identifier scheme="http://example.com/entities">TEST_ENTITY</identifier>
+        </entity>
+        <period>
+          <instant>2023-12-31</instant>
+        </period>
+      </context>
+
+    </xbrl>
+    EOF
+
+    # Also create a minimal test schema for more comprehensive testing
+    cat > test-schema.xsd << 'EOF'
+    <?xml version="1.0" encoding="UTF-8"?>
+    <schema xmlns="http://www.w3.org/2001/XMLSchema"
+            xmlns:xbrli="http://www.xbrl.org/2003/instance"
+            xmlns:link="http://www.xbrl.org/2003/linkbase"
+            xmlns:xlink="http://www.w3.org/1999/xlink"
+            xmlns:test="http://example.com/test"
+            targetNamespace="http://example.com/test"
+            elementFormDefault="qualified">
+
+      <import namespace="http://www.xbrl.org/2003/instance"
+              schemaLocation="http://www.xbrl.org/2003/xbrl-instance-2003-12-31.xsd"/>
+
+      <element name="TestElement" type="xbrli:stringItemType"
+                substitutionGroup="xbrli:item" xbrli:periodType="instant"/>
+
+    </schema>
+    EOF
+
+    # Test XBRL validation functionality
+    arelleCmdLine \
+      --file test-instance.xbrl \
+      --validate \
+      --disablePersistentConfig \
+      --internetConnectivity=offline \
+      --logLevel=info 2>&1 | grep "\[info\] validated in .* secs - .*test-instance.xbrl" > /dev/null
+
+    # Test with the built-in empty instance from arelle config
+    arelleCmdLine \
+      --file "${arelle}/lib/python3.13/site-packages/arelle/config/empty-instance.xml" \
+      --validate \
+      --disablePersistentConfig \
+      --internetConnectivity=offline \
+      --logLevel=info 2>&1 | grep "\[info\] validated in .* secs - .*empty-instance.xml" > /dev/null
+
+    # Test formula functionality (without running - just checking it loads)
+    arelleCmdLine \
+      --file test-instance.xbrl \
+      --formula=none \
+      --disablePersistentConfig \
+      --internetConnectivity=offline 2>&1 | grep "\[info\] loaded in .* secs.*test-instance.xbrl" > /dev/null
+
+    # Test facts output functionality
+    TEMP_DIR=$(mktemp -d)
+    arelleCmdLine \
+      --file test-instance.xbrl \
+      --facts="$TEMP_DIR/test-facts.csv" \
+      --disablePersistentConfig \
+      --internetConnectivity=offline 2>&1 | grep "\[info\] loaded in .* secs.*test-instance.xbrl" > /dev/null
+
+    # Test schema validation
+    arelleCmdLine \
+      --file test-schema.xsd \
+      --validate \
+      --disablePersistentConfig \
+      --internetConnectivity=offline \
+      --logLevel=info 2>&1 | grep "\[info\] validated in .* secs - .*test-schema.xsd" > /dev/null
+
+    # Test disclosure system validation option
+    arelleCmdLine \
+      --disclosureSystem=help \
+      --disablePersistentConfig 2>&1 | grep "Disclosure system choices:" > /dev/null
+
+    # Create success marker
+    touch $out
+  ''

From 7ebfdde615d679b8227d0f174246e3fcf2e39957 Mon Sep 17 00:00:00 2001
From: "Matthieu C." <886074+teto@users.noreply.github.com>
Date: Sun, 23 Mar 2025 22:51:47 +0100
Subject: [PATCH 056/306] nixos/ssh: fewer empty lines in generated ssh and
 sshd config files

Co-authored-by: r-vdp <ramses@well-founded.dev>
Co-authored-by:  Marie <tabmeier12@gmail.com>
---
 nixos/modules/programs/ssh.nix                | 50 ++++++++---------
 .../modules/services/networking/ssh/sshd.nix  | 55 ++++++++-----------
 2 files changed, 48 insertions(+), 57 deletions(-)

diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix
index cbf1800e8e3b7..88745a912521b 100644
--- a/nixos/modules/programs/ssh.nix
+++ b/nixos/modules/programs/ssh.nix
@@ -339,37 +339,37 @@ in
 
     # SSH configuration. Slight duplication of the sshd_config
     # generation in the sshd service.
-    environment.etc."ssh/ssh_config".text = ''
+    environment.etc."ssh/ssh_config".text = lib.concatStringsSep "\n" (
       # Custom options from `extraConfig`, to override generated options
-      ${cfg.extraConfig}
-
-      # Generated options from other settings
-      Host *
-      ${lib.optionalString cfg.systemd-ssh-proxy.enable ''
+      lib.optional (cfg.extraConfig != "") cfg.extraConfig
+      ++ [
+        ''
+          # Generated options from other settings
+          Host *
+        ''
+      ]
+      ++ lib.optional cfg.systemd-ssh-proxy.enable ''
         # See systemd-ssh-proxy(1)
         Include ${config.systemd.package}/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf
-      ''}
-
-      GlobalKnownHostsFile ${builtins.concatStringsSep " " knownHostsFiles}
-
-      ${lib.optionalString (!config.networking.enableIPv6) "AddressFamily inet"}
-      ${lib.optionalString cfg.setXAuthLocation "XAuthLocation ${pkgs.xorg.xauth}/bin/xauth"}
-      ${lib.optionalString (cfg.forwardX11 != null)
-        "ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}"
-      }
-
-      ${lib.optionalString (
+      ''
+      ++ [
+        "GlobalKnownHostsFile ${builtins.concatStringsSep " " knownHostsFiles}"
+      ]
+      ++ lib.optional (!config.networking.enableIPv6) "AddressFamily inet"
+      ++ lib.optional cfg.setXAuthLocation "XAuthLocation ${pkgs.xorg.xauth}/bin/xauth"
+      ++ lib.optional (cfg.forwardX11 != null) "ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}"
+      ++ lib.optional (
         cfg.pubkeyAcceptedKeyTypes != [ ]
-      ) "PubkeyAcceptedKeyTypes ${builtins.concatStringsSep "," cfg.pubkeyAcceptedKeyTypes}"}
-      ${lib.optionalString (
+      ) "PubkeyAcceptedKeyTypes ${builtins.concatStringsSep "," cfg.pubkeyAcceptedKeyTypes}"
+      ++ lib.optional (
         cfg.hostKeyAlgorithms != [ ]
-      ) "HostKeyAlgorithms ${builtins.concatStringsSep "," cfg.hostKeyAlgorithms}"}
-      ${lib.optionalString (
+      ) "HostKeyAlgorithms ${builtins.concatStringsSep "," cfg.hostKeyAlgorithms}"
+      ++ lib.optional (
         cfg.kexAlgorithms != null
-      ) "KexAlgorithms ${builtins.concatStringsSep "," cfg.kexAlgorithms}"}
-      ${lib.optionalString (cfg.ciphers != null) "Ciphers ${builtins.concatStringsSep "," cfg.ciphers}"}
-      ${lib.optionalString (cfg.macs != null) "MACs ${builtins.concatStringsSep "," cfg.macs}"}
-    '';
+      ) "KexAlgorithms ${builtins.concatStringsSep "," cfg.kexAlgorithms}"
+      ++ lib.optional (cfg.ciphers != null) "Ciphers ${builtins.concatStringsSep "," cfg.ciphers}"
+      ++ lib.optional (cfg.macs != null) "MACs ${builtins.concatStringsSep "," cfg.macs}"
+    );
 
     environment.etc."ssh/ssh_known_hosts".text = knownHostsText;
 
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 4b3ab053be7de..c56193cb4f832 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -21,7 +21,6 @@ let
     let
       # reports boolean as yes / no
       mkValueString =
-        with lib;
         v:
         if lib.isInt v then
           toString v
@@ -456,7 +455,7 @@ in
                 default = "none"; # upstream default
                 description = ''
                   Specifies a file that lists principal names that are accepted for certificate authentication. The default
-                  is `"none"`, i.e. not to use	a principals file.
+                  is `"none"`, i.e. not to use a principals file.
                 '';
               };
               LogLevel = lib.mkOption {
@@ -825,37 +824,29 @@ in
       authPrincipalsFiles != { }
     ) "/etc/ssh/authorized_principals.d/%u";
 
-    services.openssh.extraConfig = lib.mkOrder 0 ''
-      Banner ${if cfg.banner == null then "none" else pkgs.writeText "ssh_banner" cfg.banner}
-
-      AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
-      ${lib.concatMapStrings (port: ''
-        Port ${toString port}
-      '') cfg.ports}
-
-      ${lib.concatMapStrings (
-        { port, addr, ... }:
-        ''
-          ListenAddress ${addr}${lib.optionalString (port != null) (":" + toString port)}
+    services.openssh.extraConfig = lib.mkOrder 0 (
+      lib.concatStringsSep "\n" (
+        [
+          "Banner ${if cfg.banner == null then "none" else pkgs.writeText "ssh_banner" cfg.banner}"
+          "AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}"
+        ]
+        ++ lib.map (port: ''Port ${toString port}'') cfg.ports
+        ++ lib.map (
+          { port, addr, ... }:
+          ''ListenAddress ${addr}${lib.optionalString (port != null) (":" + toString port)}''
+        ) cfg.listenAddresses
+        ++ lib.optional cfgc.setXAuthLocation "XAuthLocation ${lib.getExe pkgs.xorg.xauth}"
+        ++ lib.optional cfg.allowSFTP ''Subsystem sftp ${cfg.sftpServerExecutable} ${lib.concatStringsSep " " cfg.sftpFlags}''
+        ++ [
+          "AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}"
+        ]
+        ++ lib.optional (cfg.authorizedKeysCommand != "none") ''
+          AuthorizedKeysCommand ${cfg.authorizedKeysCommand}
+          AuthorizedKeysCommandUser ${cfg.authorizedKeysCommandUser}
         ''
-      ) cfg.listenAddresses}
-
-      ${lib.optionalString cfgc.setXAuthLocation ''
-        XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
-      ''}
-      ${lib.optionalString cfg.allowSFTP ''
-        Subsystem sftp ${cfg.sftpServerExecutable} ${lib.concatStringsSep " " cfg.sftpFlags}
-      ''}
-      AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}
-      ${lib.optionalString (cfg.authorizedKeysCommand != "none") ''
-        AuthorizedKeysCommand ${cfg.authorizedKeysCommand}
-        AuthorizedKeysCommandUser ${cfg.authorizedKeysCommandUser}
-      ''}
-
-      ${lib.flip lib.concatMapStrings cfg.hostKeys (k: ''
-        HostKey ${k.path}
-      '')}
-    '';
+        ++ lib.map (k: "HostKey ${k.path}") cfg.hostKeys
+      )
+    );
 
     system.checks = [
       (pkgs.runCommand "check-sshd-config"

From 6ea010d62fd6b38516b63caffefb1d1ec1c389ff Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 22 Sep 2025 12:43:39 +0200
Subject: [PATCH 057/306] python3Packages.arelle.tests.cli: Unhardcode version

---
 pkgs/development/python-modules/arelle/test-cli.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/arelle/test-cli.nix b/pkgs/development/python-modules/arelle/test-cli.nix
index 17a0ebc0b6ce9..90b1572015a75 100644
--- a/pkgs/development/python-modules/arelle/test-cli.nix
+++ b/pkgs/development/python-modules/arelle/test-cli.nix
@@ -18,7 +18,7 @@ runCommand "arelle-test-cli${lib.optionalString (!arelle.hasGUI) "-headless"}"
     export HOME=$(mktemp -d)
 
     # Test basic CLI commands work with proper assertions
-    arelleCmdLine --version --disablePersistentConfig 2>&1 | grep "Arelle(r) 2.37.59" > /dev/null
+    arelleCmdLine --version --disablePersistentConfig 2>&1 | grep "Arelle(r) ${arelle.version}" > /dev/null
     arelleCmdLine --help --disablePersistentConfig 2>&1 | grep "Usage: arelleCmdLine \[options\]" > /dev/null
     arelleCmdLine --about --disablePersistentConfig 2>&1 | grep "An open source XBRL platform" > /dev/null
 

From 9a1da95d15e13a328fadd6de6f145e886c74e416 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sun, 21 Sep 2025 16:33:07 +0200
Subject: [PATCH 058/306] haskellPackages: restrict darwin int ptr workaround
 to affected GHCs

A fix was merged for GHC >= 9.10 which has been backported to GHC 9.8.2
and 9.6.5.

- http://gitlab.haskell.org/ghc/ghc/-/commit/a5a7a0cead6de89648d3a7323c2dc64c59a830fc
- https://gitlab.haskell.org/ghc/ghc/-/commit/92239edecc9b5c7462f9d261742ae7c19f67e757
---
 pkgs/development/haskell-modules/generic-builder.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index f2ea85774d60f..e4a846a289419 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -549,8 +549,10 @@ let
   }
   // env
   # Implicit pointer to integer conversions are errors by default since clang 15.
-  # Works around https://gitlab.haskell.org/ghc/ghc/-/issues/23456.
-  // optionalAttrs (stdenv.hasCC && stdenv.cc.isClang) {
+  # Works around https://gitlab.haskell.org/ghc/ghc/-/issues/23456. krank:ignore-line
+  # A fix was included in GHC 9.10.* and backported to 9.6.5 and 9.8.2 (but we no longer
+  # ship 9.8.1).
+  // optionalAttrs (lib.versionOlder ghc.version "9.6.5" && stdenv.hasCC && stdenv.cc.isClang) {
     NIX_CFLAGS_COMPILE =
       "-Wno-error=int-conversion"
       + lib.optionalString (env ? NIX_CFLAGS_COMPILE) (" " + env.NIX_CFLAGS_COMPILE);

From 2ea12938b987069eb884ea6df25d194c34e8127f Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 21 Apr 2025 18:51:52 -0400
Subject: [PATCH 059/306] apple-sdk: fix broken symlink check

---
 .../ap/apple-sdk/common/add-core-symbolication.nix        | 1 -
 pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix      | 8 ++++++--
 pkgs/by-name/ap/apple-sdk/package.nix                     | 6 ------
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix b/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix
index 68704a0d4a4c5..10935377cd220 100644
--- a/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix
@@ -42,7 +42,6 @@ in
 self: super: {
   buildPhase = super.buildPhase or "" + ''
     mkdir -p System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
-    ln -s A System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/Current
     ln -s Versions/Current/Headers System/Library/PrivateFrameworks/CoreSymbolication.framework/Headers
     cp '${CoreSymbolication}/include/'*.h System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
   '';
diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
index f993441c757e4..3a07fe78d803a 100644
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
@@ -38,11 +38,15 @@ self: super: {
     # Include `libtool` in the toolchain, so `xcrun -find libtool` can find it without requiring `cctools.libtool`
     # as a `nativeBuildInput`.
     mkdir -p "$toolchainsPath/usr/bin"
-    ln -s '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' "$toolchainsPath/usr/bin/libtool"
+    if [ -e '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' ]; then
+      ln -s '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' "$toolchainsPath/usr/bin/libtool"
+    fi
 
     # Include additional binutils required by some packages (such as Chromium).
     for tool in lipo nm otool size strip; do
-      ln -s '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool "$toolchainsPath/usr/bin/$tool"
+      if [ -e '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool ]; then
+        ln -s '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool "$toolchainsPath/usr/bin/$tool"
+      fi
     done
   '';
 }
diff --git a/pkgs/by-name/ap/apple-sdk/package.nix b/pkgs/by-name/ap/apple-sdk/package.nix
index 04b32f07a6424..1633010d4f3df 100644
--- a/pkgs/by-name/ap/apple-sdk/package.nix
+++ b/pkgs/by-name/ap/apple-sdk/package.nix
@@ -58,12 +58,6 @@ stdenvNoCC.mkDerivation (
 
     dontConfigure = true;
 
-    # TODO(@connorbaker):
-    # This is a quick fix unblock builds broken by https://github.com/NixOS/nixpkgs/pull/370750.
-    # Fails due to a reflexive symlink:
-    # $out/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/A
-    dontCheckForBrokenSymlinks = true;
-
     strictDeps = true;
 
     setupHooks = [

From 475f17b86511588080ce61cfcb2c36a9a243a868 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 21 Apr 2025 18:51:52 -0400
Subject: [PATCH 060/306] apple-sdk: link CUPS headers into the sysroot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Not having the CUPS headers in the sysroot causes problems for Swift’s
module importer when it tries to import AppKit, which depends on CUPS
headers. The module importer is effectively an unwrapped Clang, so the
headers need to be symlinked there instead of just propagated.
---
 pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix | 9 ++++++---
 pkgs/stdenv/darwin/default.nix                        | 1 +
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
index fe58181980b62..f9551b5b9bad1 100644
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
@@ -56,16 +56,19 @@ self: super: {
       darwin.libsbuf
       # Shipped with the SDK only as a library with no headers
       (lib.getLib darwin.libutil)
-      # Required by some SDK headers
-      cupsHeaders
     ]
     # x86_64-darwin links the object files from Csu when targeting very old releases
     ++ lib.optionals stdenvNoCC.hostPlatform.isx86_64 [ darwin.Csu ];
 
   # The Darwin module for Swift requires certain headers to be included in the SDK (and not just be propagated).
   buildPhase = super.buildPhase or "" + ''
-    for header in '${lib.getDev libiconv}/include/'* '${lib.getDev ncurses}/include/'*; do
+    for header in '${lib.getDev libiconv}/include/'* '${lib.getDev ncurses}/include/'* '${cupsHeaders}/include/'*; do
       ln -s "$header" "usr/include/$(basename "$header")"
     done
   '';
+
+  # Exported to allow the headers to pass the requisites check in the stdenv bootstrap.
+  passthru = (super.passthru or { }) // {
+    cups-headers = cupsHeaders;
+  };
 }
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 0edf63dbc71e2..0a5a29fad85b4 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -1121,6 +1121,7 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
             with prevStage;
             [
               apple-sdk
+              apple-sdk.cups-headers
               bashNonInteractive
               bzip2.bin
               bzip2.out

From 8b9d58978473e168bf42f4a116fa514da2d20e10 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 21 Apr 2025 18:51:52 -0400
Subject: [PATCH 061/306] apple-sdk: improve compatibility with Swift Build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Swift Build requires additional fields in `MacOSX.platform/Info.plist`,
or it won’t recognize the SDK as being from Xcode. Having it recognize
the SDK as from Xcode is required for it to use the SDK at all.
---
 pkgs/by-name/ap/apple-sdk/common/plists.nix   | 19 ++++++++++++++++---
 .../ap/apple-sdk/common/propagate-xcrun.nix   |  3 ++-
 pkgs/by-name/ap/apple-sdk/package.nix         |  2 +-
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ap/apple-sdk/common/plists.nix b/pkgs/by-name/ap/apple-sdk/common/plists.nix
index 33bb1f134c12a..70184d89429ba 100644
--- a/pkgs/by-name/ap/apple-sdk/common/plists.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/plists.nix
@@ -2,15 +2,28 @@
   lib,
   stdenvNoCC,
   xcodePlatform,
+  sdkVersion,
 }:
 
 let
   inherit (lib.generators) toPlist;
 
-  Info = {
-    CFBundleIdentifier = "com.apple.platform.${lib.toLower xcodePlatform}";
-    Type = "Platform";
+  Info = rec {
+    CFBundleIdentifier = "com.apple.platform.${Name}";
+    DefaultProperties = {
+      COMPRESS_PNG_FILES = "NO";
+      DEPLOYMENT_TARGET_SETTING_NAME = stdenvNoCC.hostPlatform.darwinMinVersionVariable;
+      STRIP_PNG_TEXT = "NO";
+    };
+    Description = if stdenvNoCC.hostPlatform.isMacOS then "macOS" else "iOS";
+    FamilyDisplayName = Description;
+    FamilyIdentifier = lib.toLower xcodePlatform;
+    FamilyName = Description;
+    Identifier = CFBundleIdentifier;
+    MinimumSDKVersion = stdenvNoCC.hostPlatform.darwinMinVersion;
     Name = lib.toLower xcodePlatform;
+    Type = "Platform";
+    Version = sdkVersion;
   };
 
   # These files are all based off of Xcode spec files found in
diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
index 3a07fe78d803a..ff0094df60e06 100644
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
@@ -3,11 +3,12 @@
   pkgsBuildHost,
   stdenv,
   stdenvNoCC,
+  sdkVersion,
 }:
 
 let
   plists = import ./plists.nix {
-    inherit lib stdenvNoCC;
+    inherit lib stdenvNoCC sdkVersion;
     xcodePlatform = if stdenvNoCC.hostPlatform.isMacOS then "MacOSX" else "iPhoneOS";
   };
   inherit (pkgsBuildHost) darwin cctools xcbuild;
diff --git a/pkgs/by-name/ap/apple-sdk/package.nix b/pkgs/by-name/ap/apple-sdk/package.nix
index 1633010d4f3df..f05b4c13d3437 100644
--- a/pkgs/by-name/ap/apple-sdk/package.nix
+++ b/pkgs/by-name/ap/apple-sdk/package.nix
@@ -41,7 +41,7 @@ let
     # Avoid infinite recursions by not propagating certain packages, so they can themselves build with the SDK.
     ++ lib.optionals (!enableBootstrap) [
       (callPackage ./common/propagate-inputs.nix { })
-      (callPackage ./common/propagate-xcrun.nix { })
+      (callPackage ./common/propagate-xcrun.nix { inherit sdkVersion; })
     ]
     # This has to happen last.
     ++ [

From c93f6d5545b3c5615129173ab61a81982d64c725 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 21 Apr 2025 18:51:52 -0400
Subject: [PATCH 062/306] apple-sdk: reduce spurious warnings when using
 SwiftPM

SwiftPM adds several SDK paths to the search path by default. Creating
empty paths in the SDK silences those warnings and reduces log spam.
---
 pkgs/by-name/ap/apple-sdk/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/ap/apple-sdk/package.nix b/pkgs/by-name/ap/apple-sdk/package.nix
index f05b4c13d3437..2a0dabd97ae0a 100644
--- a/pkgs/by-name/ap/apple-sdk/package.nix
+++ b/pkgs/by-name/ap/apple-sdk/package.nix
@@ -90,6 +90,11 @@ stdenvNoCC.mkDerivation (
         ln -s "${sdkName}" "$sdkpath/MacOSX${sdkMajor}.sdk"
         ln -s "${sdkName}" "$sdkpath/MacOSX.sdk"
 
+        # Swift adds these locations to its search paths. Avoid spurious warnings by making sure they exist.
+        mkdir -p "$platformPath/Developer/Library/Frameworks"
+        mkdir -p "$platformPath/Developer/Library/PrivateFrameworks"
+        mkdir -p "$platformPath/Developer/usr/lib"
+
         runHook postInstall
       '';
 

From 3ef36b4fd0a27122b3fea10101d5605332da59ad Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 17 Sep 2025 21:08:00 +0200
Subject: [PATCH 063/306] buildNpmPackage: add support for
 `npm-shrinkwrap.json`

---
 .../node/build-npm-package/hooks/npm-config-hook.sh         | 6 +++++-
 pkgs/by-name/ar/ares-cli/package.nix                        | 4 ----
 pkgs/by-name/ba/balena-cli/package.nix                      | 3 ---
 pkgs/by-name/bt/btc-rpc-explorer/package.nix                | 4 ----
 pkgs/by-name/fi/firebase-tools/package.nix                  | 4 ----
 pkgs/by-name/pa/particle-cli/package.nix                    | 4 ----
 pkgs/by-name/re/redoc-cli/package.nix                       | 4 ----
 pkgs/by-name/si/sitespeed-io/package.nix                    | 4 ----
 pkgs/by-name/x2/x2t/package.nix                             | 4 ----
 9 files changed, 5 insertions(+), 32 deletions(-)

diff --git a/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh b/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
index 7fabd80eec1fe..d954bb010df2d 100644
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
@@ -29,7 +29,11 @@ npmConfigHook() {
     fi
 
     local -r cacheLockfile="$npmDeps/package-lock.json"
-    local -r srcLockfile="$PWD/package-lock.json"
+    if [[ -f npm-shrinkwrap.json ]]; then
+        local -r srcLockfile="$PWD/npm-shrinkwrap.json"
+    else
+        local -r srcLockfile="$PWD/package-lock.json"
+    fi
 
     echo "Validating consistency between $srcLockfile and $cacheLockfile"
 
diff --git a/pkgs/by-name/ar/ares-cli/package.nix b/pkgs/by-name/ar/ares-cli/package.nix
index 8c5be1fea7eb1..adb13af633d1a 100644
--- a/pkgs/by-name/ar/ares-cli/package.nix
+++ b/pkgs/by-name/ar/ares-cli/package.nix
@@ -14,10 +14,6 @@ buildNpmPackage rec {
     hash = "sha256-L8suZDtXVchVyvp7KCv0UaceJqqGBdfopd5tZzwj3MY=";
   };
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   dontNpmBuild = true;
   npmDepsHash = "sha256-ATIxe/sulfOpz5KiWauDAPZrlfUOFyiTa+5ECFbVd+0=";
 
diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index e62e4be0a1b5c..36aaef1667b02 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -33,9 +33,6 @@ buildNpmPackage' rec {
 
   npmDepsHash = "sha256-SWtWXvWUuIzMqLoEDRTqVJyWNK/FXOA/LF73kCWfuz4=";
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
   makeCacheWritable = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bt/btc-rpc-explorer/package.nix b/pkgs/by-name/bt/btc-rpc-explorer/package.nix
index b8074f93fbc4a..93e32a9f67f53 100644
--- a/pkgs/by-name/bt/btc-rpc-explorer/package.nix
+++ b/pkgs/by-name/bt/btc-rpc-explorer/package.nix
@@ -20,10 +20,6 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-eYA2joO4wcV10xJeYLqCbvM2szWlqofmugoHHD9D30U=";
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   makeCacheWritable = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index 412d32c9e8d09..30ad95639ac02 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -21,10 +21,6 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-EhUJj1kSMslCXhgzCEiVn+4DSmRfvj/nh3OmaZCh/bk=";
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   nativeBuildInputs = [
     python3
   ]
diff --git a/pkgs/by-name/pa/particle-cli/package.nix b/pkgs/by-name/pa/particle-cli/package.nix
index ce2d2164d7e6b..5a1a482b77981 100644
--- a/pkgs/by-name/pa/particle-cli/package.nix
+++ b/pkgs/by-name/pa/particle-cli/package.nix
@@ -26,10 +26,6 @@ buildNpmPackage (finalAttrs: {
   dontNpmBuild = true;
   dontNpmPrune = true;
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   postInstall = ''
     install -D -t $out/etc/udev/rules.d \
       $out/lib/node_modules/particle-cli/assets/50-particle.rules
diff --git a/pkgs/by-name/re/redoc-cli/package.nix b/pkgs/by-name/re/redoc-cli/package.nix
index 15d3e4f84dad7..69d002db4bac6 100644
--- a/pkgs/by-name/re/redoc-cli/package.nix
+++ b/pkgs/by-name/re/redoc-cli/package.nix
@@ -19,10 +19,6 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-XL4D7+hb0zOxAr/aRo2UOg4UOip3oewbffsnkFddmWw=";
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   dontNpmBuild = true;
 
   meta = {
diff --git a/pkgs/by-name/si/sitespeed-io/package.nix b/pkgs/by-name/si/sitespeed-io/package.nix
index 0da1a79be71e9..63e79e1ed5fc4 100644
--- a/pkgs/by-name/si/sitespeed-io/package.nix
+++ b/pkgs/by-name/si/sitespeed-io/package.nix
@@ -35,10 +35,6 @@ buildNpmPackage rec {
     hash = "sha256-S7XYDxKODK6R/O9kNVq04pponYfcwTwsyVQO8yh598w=";
   };
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   # Don't try to download the browser drivers
   CHROMEDRIVER_SKIP_DOWNLOAD = true;
   GECKODRIVER_SKIP_DOWNLOAD = true;
diff --git a/pkgs/by-name/x2/x2t/package.nix b/pkgs/by-name/x2/x2t/package.nix
index e067a41fbe46d..3fbc08b902e4b 100644
--- a/pkgs/by-name/x2/x2t/package.nix
+++ b/pkgs/by-name/x2/x2t/package.nix
@@ -164,10 +164,6 @@ let
     };
     sourceRoot = "${finalAttrs.src.name}/build";
 
-    postPatch = ''
-      cp npm-shrinkwrap.json package-lock.json
-    '';
-
     npmDepsHash = "sha256-Hpf+z3RGqZ1LTdow6xP00hNmWf4xs+KnVBj4NbPW4uM=";
 
     dontNpmBuild = true;

From 96f7a260cc314ff3989625845fae549f3a282b13 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 22 Sep 2025 18:59:45 +0000
Subject: [PATCH 064/306] abseil-cpp: 20250814.0 -> 20250814.1

Diff: https://github.com/abseil/abseil-cpp/compare/20250814.0...20250814.1

Changelog: https://github.com/abseil/abseil-cpp/releases/tag/20250814.1
---
 pkgs/by-name/ab/abseil-cpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ab/abseil-cpp/package.nix b/pkgs/by-name/ab/abseil-cpp/package.nix
index 8fee318a49470..a264041af4413 100644
--- a/pkgs/by-name/ab/abseil-cpp/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abseil-cpp";
-  version = "20250814.0";
+  version = "20250814.1";
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-cpp";
     tag = finalAttrs.version;
-    hash = "sha256-6Ro7miql9+wcArsOKTjlyDSyD91rmmPsIfO5auk9kiI=";
+    hash = "sha256-SCQDORhmJmTb0CYm15zjEa7dkwc+lpW2s1d4DsMRovI=";
   };
 
   cmakeFlags = [

From d90a011f78f8bee8c57a940b5422e2de06ac8454 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 22 Sep 2025 21:04:09 +0200
Subject: [PATCH 065/306] meson: 1.9.0 -> 1.9.1

---
 pkgs/by-name/me/meson/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 52b186fcf432e..77b4a8b6c203c 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -16,14 +16,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.9.0";
+  version = "1.9.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     tag = version;
-    hash = "sha256-VMLcGtyJIH3jsTkHrIUhCpjwm6ljsRSyRECYhaafjD8=";
+    hash = "sha256-t4a/Zp8rC+DMjskdwVvYIfYDAT57zGVfVu7IApwRNGA=";
   };
 
   patches = [

From ad431eef52870866bc8c02581d81ee80297cd6cd Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 23 Sep 2025 08:03:27 +0800
Subject: [PATCH 066/306] uv: 0.8.19 -> 0.8.20

---
 pkgs/by-name/uv/uv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index f77377765b659..d6272d650891e 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.8.19";
+  version = "0.8.20";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-TbCkkZQoRItBmzwn7B8JbXWs72lYiqWV5mOfkvRarsg=";
+    hash = "sha256-k0otsop9KjjChlUIKBJn4yQStOHmv/v8GLol3Pz/3yU=";
   };
 
-  cargoHash = "sha256-09A40qwbRex8WEgCFC2yRZoq+6UnxurJAX8e27G+Rhg=";
+  cargoHash = "sha256-f/2DHdNWdbQEYt7kmDsBPDgerGcjFGKyVgU+bQ9qdlg=";
 
   buildInputs = [
     rust-jemalloc-sys

From daaa0f2d902ea2c74e82b50c90472d7f615fd8ef Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 20 Sep 2025 19:41:48 +0300
Subject: [PATCH 067/306] python3Packages.setproctitle: 1.3.6 -> 1.3.7

---
 .../python-modules/setproctitle/default.nix   | 33 ++++++++++---------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/setproctitle/default.nix b/pkgs/development/python-modules/setproctitle/default.nix
index e9aeda152d3ec..fdb412cb499e9 100644
--- a/pkgs/development/python-modules/setproctitle/default.nix
+++ b/pkgs/development/python-modules/setproctitle/default.nix
@@ -1,35 +1,38 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
   pytestCheckHook,
+  procps,
 }:
 
 buildPythonPackage rec {
   pname = "setproctitle";
-  version = "1.3.6";
+  version = "1.3.7";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-yfMrlscAuzhPM/fPB5VLtgnTXdgnUs71f7LuCWhAkWk=";
+  src = fetchFromGitHub {
+    owner = "dvarrazzo";
+    repo = "py-setproctitle";
+    tag = "version-${version}";
+    hash = "sha256-dfOdtfOXRAoCQLW307+YMsFIWRv4CupbKUxckev1oUw=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    procps
+  ];
 
-  # tries to compile programs with dependencies that aren't available
-  disabledTestPaths = [ "tests/setproctitle_test.py" ];
+  pythonImportsCheck = [ "setproctitle" ];
 
-  meta = with lib; {
+  meta = {
     description = "Allows a process to change its title (as displayed by system tools such as ps and top)";
     homepage = "https://github.com/dvarrazzo/py-setproctitle";
-    license = licenses.bsdOriginal;
-    maintainers = with maintainers; [ exi ];
+    changelog = "https://github.com/dvarrazzo/py-setproctitle/blob/${src.tag}/HISTORY.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ exi ];
   };
 }

From fd5cb983e00ebeff085cd28a7da0264bc490634c Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Tue, 23 Sep 2025 10:36:25 +0300
Subject: [PATCH 068/306] searxng: relax setproctitle

---
 pkgs/by-name/se/searxng/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index a4c214de36df8..c97ce8b2c1fd6 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -32,6 +32,7 @@ python.pkgs.toPythonModule (
       "httpx-socks"
       "lxml"
       "typer-slim"
+      "setproctitle"
     ];
 
     preBuild =

From fb37b13f54b5b7766158b2ea86082470c1bd9ffc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 23 Sep 2025 03:05:05 -0700
Subject: [PATCH 069/306] python3Packages.poetry-core: 2.2.0 -> 2.2.1

Diff: https://github.com/python-poetry/poetry-core/compare/2.2.0...2.2.1

Changelog: https://github.com/python-poetry/poetry-core/blob/2.2.1/CHANGELOG.md
---
 pkgs/development/python-modules/poetry-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index c26bd164c72c7..3cc932fa292f6 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = "poetry-core";
     tag = version;
-    hash = "sha256-WLPG8BiM+927qSC+ly5H2IAE2Htm8+wLEjK2AFnMJ58=";
+    hash = "sha256-l5WTjKa+A66QfWLmrjCQq7ZrSaeuylGIRZr8jsiYq+A=";
   };
 
   nativeCheckInputs = [

From 54a55469fbe1f64a65826282384e80efc1432f32 Mon Sep 17 00:00:00 2001
From: Lucy <git@lucy.giving>
Date: Tue, 23 Sep 2025 12:11:04 +0200
Subject: [PATCH 070/306] pango: 1.56.3 -> 1.56.4

---
 pkgs/by-name/pa/pango/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pa/pango/package.nix b/pkgs/by-name/pa/pango/package.nix
index a24383b6d805b..aa2a81bfe635b 100644
--- a/pkgs/by-name/pa/pango/package.nix
+++ b/pkgs/by-name/pa/pango/package.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pango";
-  version = "1.56.3";
+  version = "1.56.4";
 
   outputs = [
     "bin"
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/pango/${lib.versions.majorMinor finalAttrs.version}/pango-${finalAttrs.version}.tar.xz";
-    hash = "sha256-JgYlK8Jc2NJOG39+ksOicrN6zWc0NHtztHpIKDS6JJE=";
+    hash = "sha256-FwZeL8xfWlvb/8iEyVa/x8RRqW6MT7L4rYN8ZBPLWgE=";
   };
 
   depsBuildBuild = [

From 88a978dc5bb871107ca4f6fedfeddd572cfc29bb Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Tue, 23 Sep 2025 19:33:31 +0200
Subject: [PATCH 071/306] libxfont_2: add xorgproto to propagatedBuildInputs

i forgot it in #436179
---
 pkgs/by-name/li/libxfont_2/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libxfont_2/package.nix b/pkgs/by-name/li/libxfont_2/package.nix
index 2902d682931ff..9f1dbea7359e6 100644
--- a/pkgs/by-name/li/libxfont_2/package.nix
+++ b/pkgs/by-name/li/libxfont_2/package.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ];
 
+  propagatedBuildInputs = [ xorgproto ];
+
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
       #!/usr/bin/env nix-shell

From f8da5444ae47dbfcd376e19c420380fb29b2648a Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 15:32:58 +0200
Subject: [PATCH 072/306] libxp: refactor, move to pkgs/by-name and rename from
 xorg.libXp

---
 pkgs/by-name/li/libxp/package.nix             | 69 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           |  7 --
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 74 insertions(+), 48 deletions(-)
 create mode 100644 pkgs/by-name/li/libxp/package.nix

diff --git a/pkgs/by-name/li/libxp/package.nix b/pkgs/by-name/li/libxp/package.nix
new file mode 100644
index 0000000000000..076b7ddb55106
--- /dev/null
+++ b/pkgs/by-name/li/libxp/package.nix
@@ -0,0 +1,69 @@
+# TODO: remove this deprecated package
+# X.Org removed support for the Xprt server from the xorg-server releases in the 1.6.0 release in
+# 2009, and the standalone git repo it was moved to has been unmaintained since 2009, making it
+# difficult to actually use this library.
+# Some packages in nixpkgs still somehow depend on it tho.
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxau,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxp";
+  version = "1.0.4";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXp-${finalAttrs.version}.tar.xz";
+    hash = "sha256-HxnjuOgqNKj9mImn2a8KvoWIywP7V8N8VpY0zzud8aQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxau
+    libxext
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXp \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Print Client Library";
+    longDescription = ''
+      This library provides support for X11 clients to print via the X Print Extension, as
+      previously implemented in the Xprt server.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxp";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xp" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 8d98269160a12..05a46b3329f47 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -63,6 +63,7 @@
   libxft,
   libxi,
   libxmu,
+  libxp,
   libxpm,
   libxrandr,
   libxrender,
@@ -229,6 +230,7 @@ self: with self; {
   libXft = libxft;
   libXi = libxi;
   libXmu = libxmu;
+  libXp = libxp;
   libXpm = libxpm;
   libXrandr = libxrandr;
   libXrender = libxrender;
@@ -1051,46 +1053,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXp = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXau,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXp";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXp-1.0.4.tar.xz";
-        sha256 = "197iklxwyd4naryc6mzv0g5qi1dy1apxk9w9k3yshd1ax2wf668z";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXau
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xp" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXpresent = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 0eed02f53618c..0e3d2e3123c39 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -74,6 +74,7 @@
 $pcMap{"xi"} = "libXi";
 $pcMap{"xmu"} = "libXmu";
 $pcMap{"xmuu"} = "libXmu";
+$pcMap{"xp"} = "libXp";
 $pcMap{"xpm"} = "libXpm";
 $pcMap{"xrandr"} = "libXrandr";
 $pcMap{"xrender"} = "libXrender";
@@ -386,6 +387,7 @@
   libxft,
   libxi,
   libxmu,
+  libxp,
   libxpm,
   libxrandr,
   libxrender,
@@ -552,6 +554,7 @@
   libXft = libxft;
   libXi = libxi;
   libXmu = libxmu;
+  libXp = libxp;
   libXpm = libxpm;
   libXrandr = libxrandr;
   libXrender = libxrender;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 717a4d81f91a7..55330fbc087f7 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -205,13 +205,6 @@ self: super:
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
   });
 
-  libXp = super.libXp.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-  });
-
   libXpresent = super.libXpresent.overrideAttrs (attrs: {
     buildInputs = attrs.buildInputs ++ [
       xorg.libXext
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 273dacebc7104..b1d1981dbe402 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -87,7 +87,6 @@ mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
-mirror://xorg/individual/lib/libXp-1.0.4.tar.xz
 mirror://xorg/individual/lib/libXpresent-1.0.2.tar.xz
 mirror://xorg/individual/lib/libXres-1.2.3.tar.xz
 mirror://xorg/individual/lib/libXScrnSaver-1.2.5.tar.xz

From dc3924074b2175db56982efa3f69b501c25bd970 Mon Sep 17 00:00:00 2001
From: Lucy <git@lucy.giving>
Date: Tue, 23 Sep 2025 12:01:43 +0200
Subject: [PATCH 073/306] python3Packages.psutil: 7.0.0 -> 7.1.0

---
 pkgs/development/python-modules/psutil/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 76f178a3d65ff..20e3bf06c1d3c 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "7.0.0";
+  version = "7.1.0";
   pyproject = true;
 
   inherit stdenv;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e+nD66OL7Mtkleozr9mCpEB0t48oxDSh9RzAf9MVxFY=";
+    hash = "sha256-ZVcIs8BpOHyLd7By/EKaV9DiFCIdAcCnct99/tyzvNI=";
   };
 
   postPatch = ''

From 512533926e3e93025da420bb444a88d080374db8 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 15:48:45 +0200
Subject: [PATCH 074/306] libxpresent: refactor, move to pkgs/by-name and
 rename from xorg.libXpresent

relevant changes:
- add a few propagatedBuildInputs that are includes of libxpresents
  header file
---
 pkgs/by-name/li/libxpresent/package.nix       | 69 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 44 +-----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           |  9 ---
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 74 insertions(+), 52 deletions(-)
 create mode 100644 pkgs/by-name/li/libxpresent/package.nix

diff --git a/pkgs/by-name/li/libxpresent/package.nix b/pkgs/by-name/li/libxpresent/package.nix
new file mode 100644
index 0000000000000..10145497ef1df
--- /dev/null
+++ b/pkgs/by-name/li/libxpresent/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxfixes,
+  libxrandr,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxpresent";
+  version = "1.0.2";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXpresent-${finalAttrs.version}.tar.xz";
+    hash = "sha256-TlshtIEiBqSyIwE2Bq4xFwUCwQQwOHd6Hvj3DAnTdgI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxfixes
+    libxrandr
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    # header includes dependencies
+    libxfixes
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXpresent \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "library for the X Present Extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxpresent";
+    license = with lib.licenses; [
+      hpndSellVariant
+      mit
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xpresent" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 05a46b3329f47..572f15f357738 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -65,6 +65,7 @@
   libxmu,
   libxp,
   libxpm,
+  libxpresent,
   libxrandr,
   libxrender,
   libxt,
@@ -232,6 +233,7 @@ self: with self; {
   libXmu = libxmu;
   libXp = libxp;
   libXpm = libxpm;
+  libXpresent = libxpresent;
   libXrandr = libxrandr;
   libXrender = libxrender;
   libXt = libxt;
@@ -1053,48 +1055,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXpresent = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      libXfixes,
-      libXrandr,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXpresent";
-      version = "1.0.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXpresent-1.0.2.tar.xz";
-        sha256 = "00knsc4hrxzq3rx7ff1h0k0h418p66p0cdh14fra81i2h6s22nsf";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-        libXfixes
-        libXrandr
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xpresent" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXres = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 0e3d2e3123c39..3df582b38470b 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -76,6 +76,7 @@
 $pcMap{"xmuu"} = "libXmu";
 $pcMap{"xp"} = "libXp";
 $pcMap{"xpm"} = "libXpm";
+$pcMap{"xpresent"} = "libXpresent";
 $pcMap{"xrandr"} = "libXrandr";
 $pcMap{"xrender"} = "libXrender";
 $pcMap{"xt"} = "libXt";
@@ -389,6 +390,7 @@
   libxmu,
   libxp,
   libxpm,
+  libxpresent,
   libxrandr,
   libxrender,
   libxt,
@@ -556,6 +558,7 @@
   libXmu = libxmu;
   libXp = libxp;
   libXpm = libxpm;
+  libXpresent = libxpresent;
   libXrandr = libxrandr;
   libXrender = libxrender;
   libXt = libxt;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 55330fbc087f7..a42f0b4e69eb2 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -205,15 +205,6 @@ self: super:
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
   });
 
-  libXpresent = super.libXpresent.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXrandr
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ xorg.libXfixes ];
-  });
-
   libxkbfile = super.libxkbfile.overrideAttrs (attrs: {
     outputs = [
       "out"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index b1d1981dbe402..91981e66bc43a 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -87,7 +87,6 @@ mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
-mirror://xorg/individual/lib/libXpresent-1.0.2.tar.xz
 mirror://xorg/individual/lib/libXres-1.2.3.tar.xz
 mirror://xorg/individual/lib/libXScrnSaver-1.2.5.tar.xz
 mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz

From 741655d77aa56cd6d548d4300cabe714653de98e Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 16:07:31 +0200
Subject: [PATCH 075/306] libxres: refactor, move to pkgs/by-name and rename
 from xorg.libXres

---
 pkgs/by-name/li/libxres/package.nix           | 62 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 40 +-----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           | 10 ---
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 67 insertions(+), 49 deletions(-)
 create mode 100644 pkgs/by-name/li/libxres/package.nix

diff --git a/pkgs/by-name/li/libxres/package.nix b/pkgs/by-name/li/libxres/package.nix
new file mode 100644
index 0000000000000..1dbf4c937f6ca
--- /dev/null
+++ b/pkgs/by-name/li/libxres/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxres";
+  version = "1.2.3";
+  outputs = [
+    "out"
+    "dev"
+    "devdoc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXres-${finalAttrs.version}.tar.xz";
+    hash = "sha256-0t6PVAHWyGqJknkWVFR+uN71hd/cDAjMFuJO9q7radw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXres \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X-Resource extension client library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxres";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xres" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 572f15f357738..241955383f006 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -68,6 +68,7 @@
   libxpresent,
   libxrandr,
   libxrender,
+  libxres,
   libxt,
   libxv,
   libxvmc,
@@ -236,6 +237,7 @@ self: with self; {
   libXpresent = libxpresent;
   libXrandr = libxrandr;
   libXrender = libxrender;
+  libXres = libxres;
   libXt = libxt;
   libXv = libxv;
   libXvMC = libxvmc;
@@ -1055,44 +1057,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXres = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXres";
-      version = "1.2.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXres-1.2.3.tar.xz";
-        sha256 = "1p39xfpgckp22v60h36wvy2zbpmqgra585krja4nmj6n05a8zpnj";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xres" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXtst = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 3df582b38470b..ff662e0f4be98 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -79,6 +79,7 @@
 $pcMap{"xpresent"} = "libXpresent";
 $pcMap{"xrandr"} = "libXrandr";
 $pcMap{"xrender"} = "libXrender";
+$pcMap{"xres"} = "libXres";
 $pcMap{"xt"} = "libXt";
 $pcMap{"xtrans"} = "xtrans";
 $pcMap{"xv"} = "libXv";
@@ -393,6 +394,7 @@
   libxpresent,
   libxrandr,
   libxrender,
+  libxres,
   libxt,
   libxv,
   libxvmc,
@@ -561,6 +563,7 @@
   libXpresent = libxpresent;
   libXrandr = libxrandr;
   libXrender = libxrender;
+  libXres = libxres;
   libXt = libxt;
   libXv = libxv;
   libXvMC = libxvmc;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index a42f0b4e69eb2..c67a93cebc87e 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -190,16 +190,6 @@ self: super:
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
   });
 
-  libXres = super.libXres.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "devdoc"
-    ];
-    buildInputs = attrs.buildInputs ++ [ xorg.utilmacros ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-
   libXScrnSaver = super.libXScrnSaver.overrideAttrs (attrs: {
     buildInputs = attrs.buildInputs ++ [ xorg.utilmacros ];
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 91981e66bc43a..126b1507e7a7c 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -87,7 +87,6 @@ mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
-mirror://xorg/individual/lib/libXres-1.2.3.tar.xz
 mirror://xorg/individual/lib/libXScrnSaver-1.2.5.tar.xz
 mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2

From ab945fb3310d1a61f5ac38d333441443179314ad Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 21:13:14 +0200
Subject: [PATCH 076/306] libxscrnsaver: refactor, move to pkgs/by-name and
 rename from xorg.libxscrnsaver

---
 pkgs/by-name/li/libxscrnsaver/package.nix     | 57 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 40 +------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           |  5 --
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 62 insertions(+), 44 deletions(-)
 create mode 100644 pkgs/by-name/li/libxscrnsaver/package.nix

diff --git a/pkgs/by-name/li/libxscrnsaver/package.nix b/pkgs/by-name/li/libxscrnsaver/package.nix
new file mode 100644
index 0000000000000..e6a7163656382
--- /dev/null
+++ b/pkgs/by-name/li/libxscrnsaver/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxscrnsaver";
+  version = "1.2.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXScrnSaver-${finalAttrs.version}.tar.xz";
+    hash = "sha256-UFc2X4RyU+DidYcUQeEP94RsgyKl2I4eGH0ybeHNjQA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXScrnSaver \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X11 Screen Saver extension client library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxscrnsaver";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xscrnsaver" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 241955383f006..36eeac74ab32e 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -69,6 +69,7 @@
   libxrandr,
   libxrender,
   libxres,
+  libxscrnsaver,
   libxt,
   libxv,
   libxvmc,
@@ -238,6 +239,7 @@ self: with self; {
   libXrandr = libxrandr;
   libXrender = libxrender;
   libXres = libxres;
+  libXScrnSaver = libxscrnsaver;
   libXt = libxt;
   libXv = libxv;
   libXvMC = libxvmc;
@@ -941,44 +943,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXScrnSaver = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXScrnSaver";
-      version = "1.2.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXScrnSaver-1.2.5.tar.xz";
-        sha256 = "004drphnsckx30g8xn554a1nr17p1zhl2547fpif0lvjhigkcmsh";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xscrnsaver" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXTrap = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index ff662e0f4be98..958a76b60c98c 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -80,6 +80,7 @@
 $pcMap{"xrandr"} = "libXrandr";
 $pcMap{"xrender"} = "libXrender";
 $pcMap{"xres"} = "libXres";
+$pcMap{"xscrnsaver"} = "libXScrnSaver";
 $pcMap{"xt"} = "libXt";
 $pcMap{"xtrans"} = "xtrans";
 $pcMap{"xv"} = "libXv";
@@ -395,6 +396,7 @@
   libxrandr,
   libxrender,
   libxres,
+  libxscrnsaver,
   libxt,
   libxv,
   libxvmc,
@@ -564,6 +566,7 @@
   libXrandr = libxrandr;
   libXrender = libxrender;
   libXres = libxres;
+  libXScrnSaver = libxscrnsaver;
   libXt = libxt;
   libXv = libxv;
   libXvMC = libxvmc;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index c67a93cebc87e..0a3da33ecd2e7 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -190,11 +190,6 @@ self: super:
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
   });
 
-  libXScrnSaver = super.libXScrnSaver.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [ xorg.utilmacros ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-
   libxkbfile = super.libxkbfile.overrideAttrs (attrs: {
     outputs = [
       "out"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 126b1507e7a7c..1ea2ace0bf533 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -87,7 +87,6 @@ mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
-mirror://xorg/individual/lib/libXScrnSaver-1.2.5.tar.xz
 mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXtst-1.2.5.tar.xz

From b96325543a358a168dc1a7c0f2dcac02a7642dfd Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 27 Aug 2025 04:07:45 +0200
Subject: [PATCH 077/306] font-bitstream-100dpi: refactor, move to pkgs/by-name
 and rename from xorg.fontbitstream100dpi

the package output doesn't change
---
 .../fo/font-bitstream-100dpi/package.nix      | 56 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +-------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 60 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-bitstream-100dpi/package.nix

diff --git a/pkgs/by-name/fo/font-bitstream-100dpi/package.nix b/pkgs/by-name/fo/font-bitstream-100dpi/package.nix
new file mode 100644
index 0000000000000..70bdb81636aff
--- /dev/null
+++ b/pkgs/by-name/fo/font-bitstream-100dpi/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bitstream-100dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bitstream-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-LRzGgu/k9+vfX72Ilh2MoysnKZaHKGM96iChYnaQwac=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Bitstream Charter and Terminal 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bitstream-100dpi";
+    license = with lib.licenses; [
+      hpnd
+      # TODO: change this license or remove this comment when
+      # https://github.com/spdx/license-list-XML/issues/2824
+      # gets resolved
+      xfig
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 8d98269160a12..a8b8c67d084f1 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -15,6 +15,7 @@
   font-bh-lucidatypewriter-75dpi,
   font-bh-ttf,
   font-bh-type1,
+  font-bitstream-100dpi,
   font-cronyx-cyrillic,
   font-encodings,
   font-isas-misc,
@@ -197,6 +198,7 @@ self: with self; {
   fontbhlucidatypewriter75dpi = font-bh-lucidatypewriter-75dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
+  fontbitstream100dpi = font-bitstream-100dpi;
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
@@ -390,46 +392,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstream100dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bitstream-100dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bitstream-100dpi-1.0.4.tar.xz";
-        sha256 = "19y1j1v65890x8yn6a47jqljfax3ihfrd25xbzgypxz4xy1cc71d";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbitstream75dpi = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 0eed02f53618c..d6ab785a00670 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -338,6 +338,7 @@
   font-bh-lucidatypewriter-75dpi,
   font-bh-ttf,
   font-bh-type1,
+  font-bitstream-100dpi,
   font-cronyx-cyrillic,
   font-encodings,
   font-isas-misc,
@@ -520,6 +521,7 @@
   fontbhlucidatypewriter75dpi = font-bh-lucidatypewriter-75dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
+  fontbitstream100dpi = font-bitstream-100dpi;
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 273dacebc7104..e6abe0602c9fe 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -74,7 +74,6 @@ mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bitstream-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz
 mirror://xorg/individual/font/font-bitstream-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-cursor-misc-1.0.4.tar.xz

From e6a9281e35e2135f333717a1abcec32b939643f5 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 27 Aug 2025 04:12:56 +0200
Subject: [PATCH 078/306] font-bitstream-75dpi: refactor, move to pkgs/by-name
 and rename from xorg.fontbitstream75dpi

the package output doesn't change
---
 .../fo/font-bitstream-75dpi/package.nix       | 56 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +-------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 4 files changed, 60 insertions(+), 41 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-bitstream-75dpi/package.nix

diff --git a/pkgs/by-name/fo/font-bitstream-75dpi/package.nix b/pkgs/by-name/fo/font-bitstream-75dpi/package.nix
new file mode 100644
index 0000000000000..acdae17bca716
--- /dev/null
+++ b/pkgs/by-name/fo/font-bitstream-75dpi/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bitstream-75dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bitstream-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-qus02HQkqcKwzw6FkHBMkMtbQsajtqDvnkZ273c7+CY=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Bitstream Charter and Terminal 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bitstream-75dpi";
+    license = with lib.licenses; [
+      hpnd
+      # TODO: change this license or remove this comment when
+      # https://github.com/spdx/license-list-XML/issues/2824
+      # gets resolved
+      xfig
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index a8b8c67d084f1..01e94ad1bc943 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -16,6 +16,7 @@
   font-bh-ttf,
   font-bh-type1,
   font-bitstream-100dpi,
+  font-bitstream-75dpi,
   font-cronyx-cyrillic,
   font-encodings,
   font-isas-misc,
@@ -199,6 +200,7 @@ self: with self; {
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontbitstream100dpi = font-bitstream-100dpi;
+  fontbitstream75dpi = font-bitstream-75dpi;
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
@@ -392,46 +394,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstream75dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bitstream-75dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz";
-        sha256 = "09pq7dvyyxj6kvps1dm3qr15pjwh9iq9118fryqc5a94fkc39sxa";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbitstreamspeedo = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index d6ab785a00670..9e968dfb4c5a5 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -339,6 +339,7 @@
   font-bh-ttf,
   font-bh-type1,
   font-bitstream-100dpi,
+  font-bitstream-75dpi,
   font-cronyx-cyrillic,
   font-encodings,
   font-isas-misc,
@@ -522,6 +523,7 @@
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
   fontbitstream100dpi = font-bitstream-100dpi;
+  fontbitstream75dpi = font-bitstream-75dpi;
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index e6abe0602c9fe..a28379e513625 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -73,7 +73,6 @@ mirror://xorg/individual/driver/xf86-video-vmware-13.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz
 mirror://xorg/individual/font/font-bitstream-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-cursor-misc-1.0.4.tar.xz

From 9549cb44ea45b23c94122e2239de804be92377fb Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 27 Aug 2025 04:21:19 +0200
Subject: [PATCH 079/306] xorg.fontbitstreamspeedo: drop

---
 pkgs/servers/x11/xorg/default.nix   | 38 -----------------------------
 pkgs/servers/x11/xorg/overrides.nix |  6 +++++
 pkgs/servers/x11/xorg/tarballs.list |  1 -
 3 files changed, 6 insertions(+), 39 deletions(-)

diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 01e94ad1bc943..1c2bdcede515b 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -394,44 +394,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstreamspeedo = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bitstream-speedo";
-      version = "1.0.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz";
-        sha256 = "0wmy58cd3k7w2j4v20icnfs8z3b61qj3vqdx958z18w00h9mzsmf";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontbitstreamtype1 = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 717a4d81f91a7..a805b53477e9f 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1,6 +1,7 @@
 {
   callPackage,
   lib,
+  config,
   stdenv,
   makeWrapper,
   fetchurl,
@@ -919,3 +920,8 @@ self: super:
   mapNamesToAttrs (setLicense lib.licenses.unfreeRedistributable) redist
   // mapNamesToAttrs (setLicense lib.licenses.unfree) unfree
 )
+
+# deprecate some packages
+// lib.optionalAttrs config.allowAliases {
+  fontbitstreamspeedo = throw "Bitstream Speedo is an obsolete font format that hasn't been supported by Xorg since 2005";
+}
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index a28379e513625..608ee10df38a2 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -73,7 +73,6 @@ mirror://xorg/individual/driver/xf86-video-vmware-13.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz
 mirror://xorg/individual/font/font-bitstream-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-cursor-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-daewoo-misc-1.0.4.tar.xz

From 4c4fd26ced7988897342f6386cc73af6d267c227 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 27 Aug 2025 04:43:53 +0200
Subject: [PATCH 080/306] font-bitstream-type1: refactor, move to pkgs/by-name
 and rename from xorg.fontbitstreamtype1

the package output doesn't change
---
 lib/licenses.nix                              |  5 ++
 .../fo/font-bitstream-type1/package.nix       | 60 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 40 +------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           | 21 -------
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 6 files changed, 69 insertions(+), 60 deletions(-)
 create mode 100644 pkgs/by-name/fo/font-bitstream-type1/package.nix

diff --git a/lib/licenses.nix b/lib/licenses.nix
index b736baf7c5fab..62796ef1963e6 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -167,6 +167,11 @@ lib.mapAttrs mkLicense (
       fullName = "Apache License 2.0";
     };
 
+    bitstreamCharter = {
+      spdxId = "Bitstream-Charter";
+      fullName = "Bitstream Charter Font License";
+    };
+
     bitstreamVera = {
       spdxId = "Bitstream-Vera";
       fullName = "Bitstream Vera Font License";
diff --git a/pkgs/by-name/fo/font-bitstream-type1/package.nix b/pkgs/by-name/fo/font-bitstream-type1/package.nix
new file mode 100644
index 0000000000000..3e3d1eb6c35e9
--- /dev/null
+++ b/pkgs/by-name/fo/font-bitstream-type1/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  fontforge,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bitstream-type1";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bitstream-type1-${finalAttrs.version}.tar.xz";
+    hash = "sha256-3i8ji0zXLbQiigumeCnXait8A54imT1mpyLuOFJIxig=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    mkfontscale
+    fontforge
+  ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+
+  postBuild = ''
+    # convert Postscript (Type 1) font to otf
+    for i in $(find -type f -name '*.pfa' -o -name '*.pfb'); do
+        name=$(basename $i | cut -d. -f1)
+        fontforge -lang=ff -c "Open(\"$i\"); Generate(\"$name.otf\")"
+    done
+  '';
+
+  postInstall = ''
+    # install the otf fonts
+    fontDir="$out/lib/X11/fonts/misc"
+    install -Dm444 -t "$fontDir" *.otf
+    mkfontscale "$fontDir"
+  '';
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Bitstream Charter PostScript Type 1 and OpenType fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bitstream-type1";
+    license = lib.licenses.bitstreamCharter;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 1c2bdcede515b..dc45ac9dc1837 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -17,6 +17,7 @@
   font-bh-type1,
   font-bitstream-100dpi,
   font-bitstream-75dpi,
+  font-bitstream-type1,
   font-cronyx-cyrillic,
   font-encodings,
   font-isas-misc,
@@ -201,6 +202,7 @@ self: with self; {
   fontbhtype1 = font-bh-type1;
   fontbitstream100dpi = font-bitstream-100dpi;
   fontbitstream75dpi = font-bitstream-75dpi;
+  fontbitstreamtype1 = font-bitstream-type1;
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
@@ -394,44 +396,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstreamtype1 = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bitstream-type1";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bitstream-type1-1.0.4.tar.xz";
-        sha256 = "0a669193ivi2lxk3v692kq1pqavaswlpi9hbi8ib8bfp9j5j6byy";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontcursormisc = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 9e968dfb4c5a5..6e3c4e8b748a7 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -340,6 +340,7 @@
   font-bh-type1,
   font-bitstream-100dpi,
   font-bitstream-75dpi,
+  font-bitstream-type1,
   font-cronyx-cyrillic,
   font-encodings,
   font-isas-misc,
@@ -524,6 +525,7 @@
   fontbhtype1 = font-bh-type1;
   fontbitstream100dpi = font-bitstream-100dpi;
   fontbitstream75dpi = font-bitstream-75dpi;
+  fontbitstreamtype1 = font-bitstream-type1;
   fontcronyxcyrillic = font-cronyx-cyrillic;
   fontisasmisc = font-isas-misc;
   fontmicromisc = font-micro-misc;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index a805b53477e9f..1952faf1bd140 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -866,27 +866,6 @@ self: super:
   });
 
   xwd = addMainProgram super.xwd { };
-
-  # convert Type1 vector fonts to OpenType fonts
-  fontbitstreamtype1 = super.fontbitstreamtype1.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [ fontforge ];
-
-    postBuild = ''
-      # convert Postscript (Type 1) font to otf
-      for i in $(find -type f -name '*.pfa' -o -name '*.pfb'); do
-          name=$(basename $i | cut -d. -f1)
-          fontforge -lang=ff -c "Open(\"$i\"); Generate(\"$name.otf\")"
-      done
-    '';
-
-    postInstall = ''
-      # install the otf fonts
-      fontDir="$out/lib/X11/fonts/misc/"
-      install -D -m 644 -t "$fontDir" *.otf
-      mkfontscale "$fontDir"
-    '';
-  });
-
 }
 
 # mark some packages as unfree
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 608ee10df38a2..72b4d6c328795 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -73,7 +73,6 @@ mirror://xorg/individual/driver/xf86-video-vmware-13.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bitstream-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-cursor-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-daewoo-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-dec-misc-1.0.4.tar.xz

From 137e0f3d5e9f2fca93632a39e452f3f32ab54e46 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 23 Sep 2025 22:26:27 +0100
Subject: [PATCH 081/306] coreutils: 9.7 -> 9.8

Changes: https://lists.gnu.org/archive/html/coreutils-announce/2025-09/msg00000.html
---
 pkgs/tools/misc/coreutils/CVE-2025-5278.patch |  69 ------
 pkgs/tools/misc/coreutils/default.nix         |  15 +-
 ...loat-h-tests-port-to-C23-PowerPC-GCC.patch | 230 ------------------
 3 files changed, 2 insertions(+), 312 deletions(-)
 delete mode 100644 pkgs/tools/misc/coreutils/CVE-2025-5278.patch
 delete mode 100644 pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch

diff --git a/pkgs/tools/misc/coreutils/CVE-2025-5278.patch b/pkgs/tools/misc/coreutils/CVE-2025-5278.patch
deleted file mode 100644
index 197a77020fe2c..0000000000000
--- a/pkgs/tools/misc/coreutils/CVE-2025-5278.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 8c9602e3a145e9596dc1a63c6ed67865814b6633 Mon Sep 17 00:00:00 2001
-From: Pádraig Brady <P@draigBrady.com>
-Date: Tue, 20 May 2025 16:03:44 +0100
-Subject: sort: fix buffer under-read (CWE-127)
-
-* src/sort.c (begfield): Check pointer adjustment
-to avoid Out-of-range pointer offset (CWE-823).
-(limfield): Likewise.
-* tests/sort/sort-field-limit.sh: Add a new test,
-which triggers with ASAN or Valgrind.
-* tests/local.mk: Reference the new test.
-* NEWS: Mention bug fix introduced in v7.2 (2009).
-Fixes https://bugs.gnu.org/78507
----
- NEWS                           |  5 +++++
- src/sort.c                     | 12 ++++++++++--
- tests/local.mk                 |  1 +
- tests/sort/sort-field-limit.sh | 35 +++++++++++++++++++++++++++++++++++
- 4 files changed, 51 insertions(+), 2 deletions(-)
- create mode 100755 tests/sort/sort-field-limit.sh
-
-The new tests is NOT added in NixOS.
-
-diff --git a/NEWS b/NEWS
-index 6ff403206..923aa72f8 100644
---- a/NEWS
-+++ b/NEWS
-@@ -8,6 +8,11 @@ GNU coreutils NEWS                                    -*- outline -*-
-   copying to non-NFS files from NFSv4 files with trivial ACLs.
-   [bug introduced in coreutils-9.6]
- 
-+  sort with key character offsets of SIZE_MAX, could induce
-+  a read of 1 byte before an allocated heap buffer. For example:
-+  'sort +0.18446744073709551615R input' on 64 bit systems.
-+  [bug introduced in coreutils-7.2]
-+
- 
- * Noteworthy changes in release 9.7 (2025-04-09) [stable]
- 
-diff --git a/src/sort.c b/src/sort.c
-index b10183b6f..7af1a2512 100644
---- a/src/sort.c
-+++ b/src/sort.c
-@@ -1644,7 +1644,11 @@ begfield (struct line const *line, struct keyfield const *key)
-       ++ptr;
- 
-   /* Advance PTR by SCHAR (if possible), but no further than LIM.  */
--  ptr = MIN (lim, ptr + schar);
-+  size_t remaining_bytes = lim - ptr;
-+  if (schar < remaining_bytes)
-+    ptr += schar;
-+  else
-+    ptr = lim;
- 
-   return ptr;
- }
-@@ -1746,7 +1750,11 @@ limfield (struct line const *line, struct keyfield const *key)
-           ++ptr;
- 
-       /* Advance PTR by ECHAR (if possible), but no further than LIM.  */
--      ptr = MIN (lim, ptr + echar);
-+      size_t remaining_bytes = lim - ptr;
-+      if (echar < remaining_bytes)
-+        ptr += echar;
-+      else
-+        ptr = lim;
-     }
- 
-   return ptr;
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 57fb400332af2..07b17ff8ed556 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -48,24 +48,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "coreutils" + (optionalString (!minimal) "-full");
-  version = "9.7";
+  version = "9.8";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.xz";
-    hash = "sha256-6LsmrQKT+bWh/EP7QrqXDjEsZs6SwbCxZxPXUA2yUb8=";
+    hash = "sha256-5tT9LYUskUGhwqGKE9FGoM1+RRlfcik6TkwETsbMyhU=";
   };
 
-  patches = [
-    # Heap buffer overflow that's been here since coreutils 7.2 in 2009:
-    # https://www.openwall.com/lists/oss-security/2025/05/27/2
-    ./CVE-2025-5278.patch
-
-    # Fixes test-float-h failure on ppc64 with C23
-    # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html
-    # Multiple upstream commits squashed with adjustments, see header
-    ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
-  ];
-
   postPatch = ''
     # The test tends to fail on btrfs, f2fs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 77' -i ./tests/dd/sparse.sh
diff --git a/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch b/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
deleted file mode 100644
index 1b1e210efadda..0000000000000
--- a/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-Applies the following incremental gnulib commits:
-
-- 55a366a06fbd98bf13adc531579e3513cee97a32
-- 65ed9d3b24ad09fd61d326c83e7f1b05f6e9d65f
-- ce8e9de0bf34bc63dffc67ab384334c509175f64
-- 6164b4cb0887b5331a4e64449107decd37d32735
-
-With adjustments specific to the structure & differences in coreutils:
-
-- gnulib code is split across lib and gnulib-tests
-- A Makefile.in is used for the test flags instead of the fancy automake modules
-  in the upstream gnulib project, so we add -lm to the float test there.
-  Surrounding texts in this file are slightly different in every project.
----
-diff '--color=auto' -ruN a/gnulib-tests/Makefile.in b/gnulib-tests/Makefile.in
---- a/gnulib-tests/Makefile.in	2025-04-09 10:05:54.000000000 +0000
-+++ b/gnulib-tests/Makefile.in	2025-07-09 10:00:23.767927263 +0000
-@@ -1496,7 +1496,7 @@
- 	$(am__DEPENDENCIES_1)
- test_float_h_SOURCES = test-float-h.c
- test_float_h_OBJECTS = test-float-h.$(OBJEXT)
--test_float_h_LDADD = $(LDADD)
-+test_float_h_LDADD = $(LDADD) -lm
- test_float_h_DEPENDENCIES = libtests.a ../lib/libcoreutils.a \
- 	libtests.a ../lib/libcoreutils.a libtests.a \
- 	$(am__DEPENDENCIES_1)
-diff '--color=auto' -ruN a/gnulib-tests/test-float-h.c b/gnulib-tests/test-float-h.c
---- a/gnulib-tests/test-float-h.c	2025-01-01 09:32:30.000000000 +0000
-+++ b/gnulib-tests/test-float-h.c	2025-07-09 10:00:13.837937094 +0000
-@@ -101,6 +101,8 @@
- 
- /* ------------------------------------------------------------------------- */
- 
-+#include <math.h>
-+
- #include "fpucw.h"
- #include "isnanf-nolibm.h"
- #include "isnand-nolibm.h"
-@@ -396,6 +398,44 @@
- 
- /* -------------------- Check macros for 'long double' -------------------- */
- 
-+static int
-+test_isfinitel (long double volatile x)
-+{
-+  if (x != x)
-+    return 0;
-+  long double volatile zero = x * 0;
-+  return zero == 0;
-+}
-+
-+/* Return X after normalization.  This makes a difference on platforms
-+   where long double can represent unnormalized values.  For example,
-+   suppose x = 1 + 2**-106 on PowerPC with IBM long double where
-+   FLT_RADIX = 2, LDBL_MANT_DIG = 106, and LDBL_EPSILON = 2**-105.
-+   Then 1 < x < 1 + LDBL_EPSILON, and normalize_long_double (x) returns 1.  */
-+static long double
-+normalize_long_double (long double volatile x)
-+{
-+  if (FLT_RADIX == 2 && test_isfinitel (x))
-+    {
-+      int xexp;
-+      long double volatile
-+        frac = frexpl (x, &xexp),
-+        significand = frac * pow2l (LDBL_MANT_DIG),
-+        normalized_significand = truncl (significand),
-+        normalized_x = normalized_significand * pow2l (xexp - LDBL_MANT_DIG);
-+
-+      /* The test_isfinitel defends against PowerPC with IBM long double,
-+         which fritzes out near LDBL_MAX.  */
-+      if (test_isfinitel (normalized_x))
-+        x = normalized_x;
-+    }
-+  else
-+    {
-+      /* Hope that X is already normalized.  */
-+    }
-+  return x;
-+}
-+
- static void
- test_long_double (void)
- {
-@@ -455,7 +495,7 @@
-     for (n = 0; n <= 2 * LDBL_MANT_DIG; n++)
-       {
-         volatile long double half_n = pow2l (- n); /* 2^-n */
--        volatile long double x = me - half_n;
-+        volatile long double x = normalize_long_double (me - half_n);
-         if (x < me)
-           ASSERT (x <= 1.0L);
-       }
-@@ -483,8 +523,12 @@
-   ASSERT (!LDBL_IS_IEC_60559);
- #endif
- 
-+  printf("LDBL_NORM_MAX: %LF\n", LDBL_NORM_MAX);
-+  printf("LDBL_MAX: %LF\n", LDBL_MAX);
-+  printf("normalize_long_double(LDBL_MAX): %LF\n", normalize_long_double(LDBL_MAX));
-+
-   /* Check the value of LDBL_NORM_MAX.  */
--  ASSERT (LDBL_NORM_MAX == LDBL_MAX);
-+  ASSERT (LDBL_NORM_MAX == normalize_long_double (LDBL_MAX));
- 
-   /* Check the value of LDBL_SNAN.  */
-   ASSERT (isnanl (LDBL_SNAN));
-diff '--color=auto' -ruN a/lib/float.c b/lib/float.c
---- a/lib/float.c	2025-01-01 09:32:29.000000000 +0000
-+++ b/lib/float.c	2025-07-09 10:00:13.837937094 +0000
-@@ -23,7 +23,7 @@
- #if GNULIB_defined_long_double_union
- # if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
- const union gl_long_double_union gl_LDBL_MAX =
--  { { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL } };
-+  { { DBL_MAX, DBL_MAX / 0x1p53 } };
- # elif defined __i386__
- const union gl_long_double_union gl_LDBL_MAX =
-   { { 0xFFFFFFFF, 0xFFFFFFFF, 32766 } };
-diff '--color=auto' -ruN a/lib/float.in.h b/lib/float.in.h
---- a/lib/float.in.h	2025-01-01 09:32:29.000000000 +0000
-+++ b/lib/float.in.h	2025-07-09 10:00:13.837937094 +0000
-@@ -113,44 +113,38 @@
- # define LDBL_MAX_10_EXP 4932
- #endif
- 
--/* On AIX 7.1 with gcc 4.2, the values of LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX are
--   wrong.
--   On Linux/PowerPC with gcc 4.4, the value of LDBL_MAX is wrong.  */
--#if (defined _ARCH_PPC || defined _POWER) && defined _AIX && (LDBL_MANT_DIG == 106) && defined __GNUC__
-+/* On PowerPC with gcc 15 when using __ibm128 long double, the value of
-+   LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX, and LDBL_NORM_MAX are wrong.  */
-+#if ((defined _ARCH_PPC || defined _POWER) && LDBL_MANT_DIG == 106 \
-+     && defined __GNUC__)
- # undef LDBL_MIN_EXP
- # define LDBL_MIN_EXP DBL_MIN_EXP
- # undef LDBL_MIN_10_EXP
- # define LDBL_MIN_10_EXP DBL_MIN_10_EXP
- # undef LDBL_MIN
- # define LDBL_MIN 2.22507385850720138309023271733240406422e-308L /* DBL_MIN = 2^-1022 */
--#endif
--#if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
- # undef LDBL_MAX
--/* LDBL_MAX is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xFFFFFFFF }.
--   It is not easy to define:
--     #define LDBL_MAX 1.79769313486231580793728971405302307166e308L
--   is too small, whereas
--     #define LDBL_MAX 1.79769313486231580793728971405302307167e308L
--   is too large.  Apparently a bug in GCC decimal-to-binary conversion.
--   Also, I can't get values larger than
--     #define LDBL63 ((long double) (1ULL << 63))
--     #define LDBL882 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL945 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL1008 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL_MAX (LDBL1008 * 65535.0L + LDBL945 * (long double) 9223372036821221375ULL + LDBL882 * (long double) 4611686018427387904ULL)
--   which is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xF8000000 }.
--   So, define it like this through a reference to an external variable
-+/* LDBL_MAX is 2**1024 - 2**918, represented as: { 0x7FEFFFFF, 0xFFFFFFFF,
-+                                                   0x7C9FFFFF, 0xFFFFFFFF }.
-+
-+   Do not write it as a constant expression, as GCC would likely treat
-+   that as infinity due to the vagaries of this platform's funky arithmetic.
-+   Instead, define it through a reference to an external variable.
-+   Like the following, but using a union to avoid type mismatches:
- 
--     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL };
-+     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / 0x1p53 };
-      extern const long double LDBL_MAX;
- 
--   or through a pointer cast
-+   The following alternative would not work as well when GCC is optimizing:
-+
-+     #define LDBL_MAX (*(long double const *) (double[])
-+                       { DBL_MAX, DBL_MAX / 0x1p53 })
- 
--     #define LDBL_MAX \
--       (*(const long double *) (double[]) { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL })
-+   The following alternative would require GCC 6 or later:
- 
--   Unfortunately, this is not a constant expression, and the latter expression
--   does not work well when GCC is optimizing..  */
-+     #define LDBL_MAX __builtin_pack_longdouble (DBL_MAX, DBL_MAX / 0x1p53)
-+
-+   Unfortunately none of the alternatives are constant expressions.  */
- # if !GNULIB_defined_long_double_union
- union gl_long_double_union
-   {
-@@ -161,6 +155,8 @@
- # endif
- extern const union gl_long_double_union gl_LDBL_MAX;
- # define LDBL_MAX (gl_LDBL_MAX.ld)
-+# undef LDBL_NORM_MAX
-+# define LDBL_NORM_MAX LDBL_MAX
- #endif
- 
- /* On IRIX 6.5, with cc, the value of LDBL_MANT_DIG is wrong.
-@@ -181,6 +177,21 @@
- # endif
- #endif
- 
-+/* On PowerPC platforms, 'long double' has a double-double representation.
-+   Up to ISO C 17, this was outside the scope of ISO C because it can represent
-+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits>, such as
-+   1.0L + 4.94065645841246544176568792868221e-324L = 1 + 2^-1074; see
-+   ISO C 17 § 5.2.4.2.2.(3).
-+   In ISO C 23, wording has been included that makes this 'long double'
-+   representation compliant; see ISO C 23 § 5.2.5.3.3.(8)-(9).  In this setting,
-+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits> are
-+   called "unnormalized".  And since LDBL_EPSILON must be normalized (per
-+   ISO C 23 § 5.2.5.3.3.(33)), it must be 2^-105.  */
-+#if defined __powerpc__ && LDBL_MANT_DIG == 106
-+# undef LDBL_EPSILON
-+# define LDBL_EPSILON 2.46519032881566189191165176650870696773e-32L /* 2^-105 */
-+#endif
-+
- /* ============================ ISO C11 support ============================ */
- 
- /* 'float' properties */
-@@ -309,7 +320,11 @@
- # endif
- #endif
- #ifndef LDBL_NORM_MAX
--# define LDBL_NORM_MAX LDBL_MAX
-+# ifdef __LDBL_NORM_MAX__
-+#  define LDBL_NORM_MAX __LDBL_NORM_MAX__
-+# else
-+#  define LDBL_NORM_MAX LDBL_MAX
-+# endif
- #endif
- #ifndef LDBL_SNAN
- /* For sh, beware of <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111814>.  */

From 8210e54dacdcaa6aa1f7081c381dc79d7eb38e7f Mon Sep 17 00:00:00 2001
From: azahi <azat@bahawi.net>
Date: Tue, 2 Sep 2025 00:15:09 +0300
Subject: [PATCH 082/306] tree-sitter: 0.25.6 -> 0.25.10

---
 .../tools/parsing/tree-sitter/default.nix          |  6 +++---
 .../grammars/tree-sitter-beancount.json            | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-bitbake.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-bqn.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-c-sharp.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-clojure.json  | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-cmake.json    |  3 ++-
 .../grammars/tree-sitter-commonlisp.json           |  3 ++-
 .../tree-sitter/grammars/tree-sitter-cpp.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-crystal.json  | 14 ++++++++------
 .../tree-sitter/grammars/tree-sitter-css.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-cuda.json     | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-cue.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-dart.json     |  3 ++-
 .../grammars/tree-sitter-devicetree.json           |  3 ++-
 .../grammars/tree-sitter-dockerfile.json           |  3 ++-
 .../tree-sitter/grammars/tree-sitter-dot.json      |  3 ++-
 .../grammars/tree-sitter-earthfile.json            |  3 ++-
 .../tree-sitter/grammars/tree-sitter-eex.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-elisp.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-elixir.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-elm.json      |  3 ++-
 .../grammars/tree-sitter-embedded-template.json    | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-erlang.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-factor.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-fennel.json   | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-fish.json     | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-gdscript.json | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-gemini.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-gleam.json    | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-glimmer.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-glsl.json     |  3 ++-
 .../grammars/tree-sitter-go-template.json          | 10 +++++-----
 .../tree-sitter/grammars/tree-sitter-go.json       | 13 +++++++------
 .../grammars/tree-sitter-godot-resource.json       |  3 ++-
 .../tree-sitter/grammars/tree-sitter-gomod.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-gowork.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-graphql.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-haskell.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-heex.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-hjson.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-html.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-http.json     |  3 ++-
 .../grammars/tree-sitter-janet-simple.json         |  3 ++-
 .../tree-sitter/grammars/tree-sitter-java.json     |  3 ++-
 .../grammars/tree-sitter-javascript.json           | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-jsdoc.json    | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-json.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-json5.json    | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-jsonnet.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-julia.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-just.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-kdl.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-koka.json     | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-kotlin.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-latex.json    | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-ledger.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-lua.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-make.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-netlinx.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-nickel.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-nix.json      | 13 +++++++------
 .../grammars/tree-sitter-norg-meta.json            |  3 ++-
 .../tree-sitter/grammars/tree-sitter-norg.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-nu.json       | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-ocaml.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-org-nvim.json |  3 ++-
 .../tree-sitter/grammars/tree-sitter-perl.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-pgn.json      | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-php.json      | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-pioasm.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-prisma.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-proto.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-pug.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-python.json   | 13 +++++++------
 .../grammars/tree-sitter-ql-dbscheme.json          |  3 ++-
 .../tree-sitter/grammars/tree-sitter-ql.json       |  3 ++-
 .../tree-sitter/grammars/tree-sitter-r.json        | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-regex.json    | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-rego.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-river.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-rst.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-ruby.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-scala.json    | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-scheme.json   | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-scss.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-smithy.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-solidity.json |  3 ++-
 .../tree-sitter/grammars/tree-sitter-sparql.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-sql.json      | 13 +++++++------
 .../grammars/tree-sitter-supercollider.json        | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-surface.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-svelte.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-talon.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-templ.json    | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-tera.json     | 13 +++++++------
 .../tree-sitter/grammars/tree-sitter-tiger.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-tlaplus.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-toml.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-tsq.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-turtle.json   |  3 ++-
 .../tree-sitter/grammars/tree-sitter-twig.json     |  3 ++-
 .../grammars/tree-sitter-typescript.json           |  3 ++-
 .../tree-sitter/grammars/tree-sitter-typst.json    |  3 ++-
 .../tree-sitter/grammars/tree-sitter-uiua.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-verilog.json  |  3 ++-
 .../tree-sitter/grammars/tree-sitter-vim.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-vue.json      |  3 ++-
 .../tree-sitter/grammars/tree-sitter-wgsl.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-wing.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-yaml.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-yang.json     |  3 ++-
 .../tree-sitter/grammars/tree-sitter-zig.json      |  3 ++-
 113 files changed, 371 insertions(+), 259 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 499942477a8e9..5d5447dbc32a8 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -30,8 +30,8 @@ let
   # 2) nix-build -A tree-sitter.updater.update-all-grammars
   # 3) Set GITHUB_TOKEN env variable to avoid api rate limit (Use a Personal Access Token from https://github.com/settings/tokens It does not need any permissions)
   # 4) run the ./result script that is output by that (it updates ./grammars)
-  version = "0.25.6";
-  hash = "sha256-2/DF2xyiKi5HAqqeGt1TIMvAWFfZgcfVccK4zrTqq88=";
+  version = "0.25.10";
+  hash = "sha256-aHszbvLCLqCwAS4F4UmM3wbSb81QuG9FM7BDHTu1ZvM=";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
@@ -171,7 +171,7 @@ rustPlatform.buildRustPackage {
   pname = "tree-sitter";
   inherit src version;
 
-  cargoHash = "sha256-sGh16M7cbT5ct1sT2FcUUoIQFcoOftTuQ0aSCjtkTEs=";
+  cargoHash = "sha256-4R5Y9yancbg/w3PhACtsWq0+gieUd2j8YnmEj/5eqkg=";
 
   buildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
index 36bccb90e009a..2e65733a096f9 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/polarmutex/tree-sitter-beancount",
-  "rev": "321b12d0b02923c36e8cd9768afe6db5ced98e33",
-  "date": "2024-07-19T21:09:17-04:00",
-  "path": "/nix/store/v8yv84fm0n134mr5vmwbpr4cpyl71vxz-tree-sitter-beancount",
-  "sha256": "1milrdb8ka5vkypl0b44xgfdn0haydg2fz7489djcwpjkx7gfrsg",
-  "hash": "sha256-T2f3Tp/yciZbQuR8J17zCgLb3OuELECvn7uoiVbLNNY=",
+  "rev": "07bfb0ec6d9e255d776cdd3362128364d2b0bb2f",
+  "date": "2025-07-20T21:33:46-04:00",
+  "path": "/nix/store/7q88wczdhi0ralm2fzdz7y42mxnsc34c-tree-sitter-beancount",
+  "sha256": "0r2ql0n4wkwbcdjpklxhsk91xm8q8dl9n9rdlqk585xagmxf1w4b",
+  "hash": "sha256-i/Dgen2qF1Qmpi0nm2hDGNUe0tSw03llY4tPTiygWGQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json
index 582ed02c14128..cb8c9dbc93db2 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bqn.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bqn.json
index 65414bf90a02f..13bb6ec8a2e4a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bqn.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bqn.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
index b29372cbc0616..9d898a5537154 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-clojure.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-clojure.json
index e38432e270455..47467756a54b8 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-clojure.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-clojure.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/sogaiu/tree-sitter-clojure",
-  "rev": "40c5fc2e2a0f511a802a82002553c5de00feeaf4",
-  "date": "2025-05-26T17:10:02+09:00",
-  "path": "/nix/store/lkzsixjxwr6b2gwxsba0qah3k121axgi-tree-sitter-clojure",
-  "sha256": "163jm1qgrh9ha1xbjlbkcffcxkdbhsvj5kplknq4gcb080wlp6dp",
-  "hash": "sha256-t5lLOUBgsUewnfTOIreGq83OnGNzUbl6UDDB/HCocpg=",
+  "rev": "e43eff80d17cf34852dcd92ca5e6986d23a7040f",
+  "date": "2025-08-26T15:59:05+09:00",
+  "path": "/nix/store/gpvw9wn3mg5j7mzj91qvkxm8l5rlgid6-tree-sitter-clojure",
+  "sha256": "0bmclmbjk58w8092q52yra5axrr3q22v73yva9wvqh5fif81x2cf",
+  "hash": "sha256-jokekIuuQLx5UtuPs4XAI+euispeFCwSQByVKVelrC4=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json
index 07b7b433cd5a8..419cfe5c0ca4e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
index a13d53821c8c6..3b056e466f034 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
index b62ff93df2c3c..ddee6bf64d8d3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-crystal.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-crystal.json
index eb5e7cb50ed3a..0085e157c80f2 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-crystal.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-crystal.json
@@ -1,12 +1,14 @@
 {
   "url": "https://github.com/crystal-lang-tools/tree-sitter-crystal",
-  "rev": "cf69a6504a82fecc55ee1680983744a94a9edfaa",
-  "date": "2025-03-28T11:48:18-04:00",
-  "path": "/nix/store/c20hqk12him4k0675y3l5f53lfnaa37d-tree-sitter-crystal",
-  "sha256": "0jzmkjfhrz1f5pw274dj0f7avazsyhx0h6vbg4p5xxzkqch19wah",
-  "hash": "sha256-UPEUIMPz914ueWsbCDr0+qutjgOykSP4LS78DJ2c9Us=",
+  "rev": "f0ada43161f77d5bad18c4ce0b21d1dc9310e408",
+  "date": "2025-09-08T23:42:35-04:00",
+  "path": "/nix/store/q97l67605207fyavx1kdsnfylf49aj44-tree-sitter-crystal",
+  "sha256": "0j3xb6j67v4i4wdn14y1ac2004r71v4m0r01qfzhfv4cqwad3lz4",
+  "hash": "sha256-5NPRFMeMbAe/wwFkUMkOJxMABFPBk2AbJ5HsY6RZfUg=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
-  "leaveDotGit": false
+  "fetchTags": false,
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json
index e9e4a52ddf0c6..4054f5f8b63a1 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
index 36413eb77f40c..753f05604b878 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/thehamsta/tree-sitter-cuda",
-  "rev": "014628ae8d2df391b88ddb9fa0260fd97f770829",
-  "date": "2025-03-16T17:20:16+01:00",
-  "path": "/nix/store/w0cl4ga4bis992vyfmj8l0pq385z0cka-tree-sitter-cuda",
-  "sha256": "1qyh00rapch29czvnqs3364bx0bi4gyapfxb0v8m4r2m8kybnlff",
-  "hash": "sha256-zlG7/ERVZFLRBqu7q/wjcYG+iBlDY7s/SwKyqzIA0OM=",
+  "rev": "48b066f334f4cf2174e05a50218ce2ed98b6fd01",
+  "date": "2025-09-18T22:53:12+02:00",
+  "path": "/nix/store/01cw4243h6xyhg6nn8fgz7gjajkh0hjg-tree-sitter-cuda",
+  "sha256": "116fa26bjh6a88kdshqq5hp6fq4ik95dpaiidw8rn90xxwwl0zxi",
+  "hash": "sha256-sX9AOe8dJJsRbzGq20qakWBnLiwYQ90mQspAuYxQzoQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json
index f98691b115b09..96ddd49800cfd 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
index d3424c21a17ac..f65fae97f6293 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json
index 069c8263f262c..fe826138a3e06 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dockerfile.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dockerfile.json
index 045280a603718..def7d28b4a6b6 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dockerfile.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dockerfile.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json
index 10d9408ec72d2..96e220464cd5c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-earthfile.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-earthfile.json
index 945336f543acb..9117f8c0ae71e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-earthfile.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-earthfile.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-eex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-eex.json
index 799c8f70ca527..0e7efcc84c04b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-eex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-eex.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json
index 0a784c3ab43ba..b8eb1a40bfe21 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
index ea4fd28a95761..5af61d3990269 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json
index a0163c06c5fbe..4ff1421304f5c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json
index c60ca6e00877b..6c6e366f9c6c3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-embedded-template",
-  "rev": "332262529bc51abf5746317b2255ccc2fff778f8",
-  "date": "2024-11-11T01:51:07-05:00",
-  "path": "/nix/store/qfrdm02qnlllw3ric8pyv5gs0ahwnlbl-tree-sitter-embedded-template",
-  "sha256": "1vq9dywd9vcy59f6i5mk5n7vwk67g8j5x77czg7avpznskgfhqhb",
-  "hash": "sha256-C2Lo3tT2363O++ycXiR6x0y+jy2zlmhcKp7t1LhvCe8=",
+  "rev": "c70c1de07dedd532089c0c90835c8ed9fa694f5c",
+  "date": "2025-08-28T20:40:04-04:00",
+  "path": "/nix/store/l73zsvkpnrjpzncpwb4qcvhgqvx5zd35-tree-sitter-embedded-template",
+  "sha256": "0w1vkk1m2a52nqqx7agwcik7kbdb6bwpw18479inswqbgn51l54w",
+  "hash": "sha256-nBQain0Lc21jOgQFfvkyq615ZmT8qdMxtqIoUcOcO3A=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-erlang.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-erlang.json
index 72ac83411a6ec..1aac15dac9f85 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-erlang.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-erlang.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-factor.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-factor.json
index 5d8bd9e2b65d9..c7cde5b69b2dc 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-factor.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-factor.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
index 5364cadfcc4ca..bc474c396b555 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/travonted/tree-sitter-fennel",
-  "rev": "15e4f8c417281768db17080c4447297f8ff5343a",
-  "date": "2024-02-02T09:37:06-05:00",
-  "path": "/nix/store/cjqnj1i2z7s3xwivba9vgpqrs0lcinil-tree-sitter-fennel",
-  "sha256": "059avw3yhadqbfallflc5xxfzla81d5mc9wrc3ag09xj5w6n1n05",
-  "hash": "sha256-BdhgDS+yJ/DUYJknVksLSNHvei+MOkqVW7gp6AffKhU=",
+  "rev": "36eb796a84b4f57bdf159d0a99267260d4960c89",
+  "date": "2025-09-06T23:17:11-04:00",
+  "path": "/nix/store/jz4l1j6yy6ly6pgjhmjrqq0lhab1gb8l-tree-sitter-fennel",
+  "sha256": "0pg76nby16i7wvvhc9n7ahbg4l4rlldzw7ggm8szlxx40lz16mv8",
+  "hash": "sha256-aFcTPgWkd/o1qu8d/hulmVDyFlTHJgb35iea4Jc1510=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
index 907447c4ab309..a6744378376de 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/ram02z/tree-sitter-fish",
-  "rev": "70640c0696abde32622afc43291a385681afbd32",
-  "date": "2025-01-18T10:06:56Z",
-  "path": "/nix/store/f3yngwj4xrr9v6nchnl9sj3q7bx2463y-tree-sitter-fish",
-  "sha256": "12gga8gm7dyfa6srvi5sympszy647qcw7a9warrld5z71vgziv3p",
-  "hash": "sha256-d+z43w7nl0ZzVjypwxk+xPivb/W6xJ21Uc63Ux9S74k=",
+  "rev": "aa074a0bacde8b5823c592574d7138f156a95776",
+  "date": "2025-06-13T20:17:14+01:00",
+  "path": "/nix/store/8z4vmmfhxbc529rkjs84aij12xa8ag1w-tree-sitter-fish",
+  "sha256": "1l8qmmligfcpf4amqghdv9c4nvs5wbhiifhl7016l7793rfzl235",
+  "hash": "sha256-ZQj6XR7pHGoCOBS6GOHiRW9LWNoNPlwVcZe5F2mtGNE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json
index 5091a489397e9..45f484e3fa860 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/prestonknopp/tree-sitter-gdscript",
-  "rev": "e964ce912b5b835f1caedb600df9d5be77e803a8",
-  "date": "2025-05-14T11:22:28-07:00",
-  "path": "/nix/store/ab2prhn6ckp7kyfnxnymx8zvbna4jda2-tree-sitter-gdscript",
-  "sha256": "19rdpyd05x29b7isv8jnc8jlawlpzh91b11yggiqgjz6il0vkdww",
-  "hash": "sha256-nLe5AY3my4fjez6EFRL8l3JFJWJWoq3jWUn0Apq/Lac=",
+  "rev": "c370d711dc9ead679d40bb7e9364ceed0b3bfc28",
+  "date": "2025-07-17T11:29:39-07:00",
+  "path": "/nix/store/yzmn7h0mqpphjnwmrnnrijz6dmhl2rmq-tree-sitter-gdscript",
+  "sha256": "0qma5ffmfwh81dk4wafz9qqkqw6pyk18bg20sg70v7s3r7m0bq2b",
+  "hash": "sha256-S+AF6slDnw3O00C8hcL013A8MU7fKU5mCwhyV50rqmI=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gemini.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gemini.json
index e63a56c69a166..f4206540b7377 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gemini.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gemini.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json
index 1f4c1e5ab620a..c8455e82214d3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/gleam-lang/tree-sitter-gleam",
-  "rev": "6ece453acf8b14568c10f629f8cd25d3dde3794f",
-  "date": "2025-05-17T12:51:15Z",
-  "path": "/nix/store/aahaa06y7w5in76pfp787k5gyamx7599-tree-sitter-gleam",
-  "sha256": "00f481cjn1mz0319jq89775a81nlmqnkc6fvv3qblpiq37fplzcz",
-  "hash": "sha256-n3163Rk4Xrrw2NsZNi2u1AakyjkJYZnCAL8GK1lAxAE=",
+  "rev": "dae1551a9911b24f41d876c23f2ab05ece0a9d4c",
+  "date": "2025-07-21T17:56:49Z",
+  "path": "/nix/store/v0dwdaqlr17b6jry9ysd15m342ha8hxb-tree-sitter-gleam",
+  "sha256": "0d7z5bk6x0qi3wy4d8174a69wxsc4287c7fcdfabkn8dixpa920q",
+  "hash": "sha256-GIikbo8N2bmUa8wddpAgTHeejCInoEY8HxGDbuYq/zQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json
index 83e5e7b9c1c47..2c04f80d2f1ef 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
index adb5bb72ba90e..2263a37af864e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go-template.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go-template.json
index 4032f124945d8..1ea8ff82bfa93 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go-template.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go-template.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/ngalaiko/tree-sitter-go-template",
-  "rev": "5f19a36bb1eebb30454e277b222b278ceafed0dd",
-  "date": "2025-01-29T18:19:22Z",
-  "path": "/nix/store/lcgn1hzzsf5jhliy7454lxx7phkmrjfb-tree-sitter-go-template",
-  "sha256": "1nm9ybwb4if6g7cs911i6msb3q2f1plbl70k2y4icbxk2p57k5ka",
-  "hash": "sha256-apZ5yhWzLxaJFxMcuugNTuCxdDUxhKTZecZFsvjyqdo=",
+  "rev": "65f4f86c3aaa9dabab36e3482584e8a111cf7db1",
+  "date": "2025-08-23T12:29:37Z",
+  "path": "/nix/store/f5palcms6bafi6yc77z2yqa3yhb0pbhz-tree-sitter-go-template",
+  "sha256": "1wf0fswkd1fd2f0x6xz2qqvr7sdyz3h93vac9z6jad41sqx4w9md",
+  "hash": "sha256-rSZOOtaBNCXNT0ztkeD4vumTN8bid9OBE82FNrl2wPE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json
index db3cc5ace0525..bff23a2802184 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-go",
-  "rev": "3c3775faa968158a8b4ac190a7fda867fd5fb748",
-  "date": "2024-11-24T14:34:38-05:00",
-  "path": "/nix/store/zqi5mm5lx2jq40650gljdvn3sq0y34c1-tree-sitter-go",
-  "sha256": "0yi8if9mqzzcs4qflflz90hhaxkzlq54wia3s0iiqzfqxk24a61g",
-  "hash": "sha256-LxhFxOzYfRwj0ENFTgqmf3YFIUifOuow0ex/XJOLKHo=",
+  "rev": "1547678a9da59885853f5f5cc8a99cc203fa2e2c",
+  "date": "2025-08-29T02:17:40-04:00",
+  "path": "/nix/store/nb47mmxl1lwd2bgnv8w1m7zr04rpp326-tree-sitter-go",
+  "sha256": "0ag5cksnvrb8fg7b05pg1rq31sv6l8k985bk7qrzg91j7w8x7dnb",
+  "hash": "sha256-y7bTET8ypPczPnMVlCaiZuswcA7vFrDOc2jlbfVk5Sk=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-godot-resource.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-godot-resource.json
index dded3a02e4464..cb0e4e4463596 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-godot-resource.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-godot-resource.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json
index fdb0a4efeb8c3..e03e7b89f7381 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gowork.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gowork.json
index 92cff1e750676..4e5d2de4853c9 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gowork.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gowork.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-graphql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-graphql.json
index 55c44102e9450..f90c78ea33f10 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-graphql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-graphql.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
index 15f39a70a4405..a78b0c4fe7e16 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-heex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-heex.json
index af406a845f16e..9ac36a85bcb31 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-heex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-heex.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-hjson.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-hjson.json
index e4c8d8263c4ee..80b0b2a1f471e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-hjson.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-hjson.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json
index 23a6795667823..57e69ad931016 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json
index 2e05e32a1b6de..66a8fdf28dfae 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json
index 0687cb404e24e..99fa73b63fb5f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json
index b7aed2572e378..adad6e67b4061 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
index a0290d215193b..964acc3606434 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-javascript",
-  "rev": "3a837b6f3658ca3618f2022f8707e29739c91364",
-  "date": "2024-11-10T00:38:27-05:00",
-  "path": "/nix/store/hpvzw8l06lbvxsh0szkj44gshiqrjb02-tree-sitter-javascript",
-  "sha256": "03v1gpr5lnifrk4lns690fviid8p02wn7hfdwp3ynp7lh1cid63a",
-  "hash": "sha256-apgWWYD0XOvH5c3BY7kAF7UYtwPJaEvJzC5aWvJ9YQ8=",
+  "rev": "44c892e0be055ac465d5eeddae6d3e194424e7de",
+  "date": "2025-09-01T03:10:57-04:00",
+  "path": "/nix/store/l0h8gv70fj33dqcpkpclbv0khjgnhk8z-tree-sitter-javascript",
+  "sha256": "1qdjpfxw9z1icx3jc3k006yj76lcqydkvbk4ji3wk4xy854zz66q",
+  "hash": "sha256-2Jj/SUG+k8lHlGSuPZvHjJojvQFgDiZHZzH8xLu7suE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json
index 5153927b22dff..a3d1f78d20cd1 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-jsdoc",
-  "rev": "b253abf68a73217b7a52c0ec254f4b6a7bb86665",
-  "date": "2024-11-11T01:54:33-05:00",
-  "path": "/nix/store/w2hks666pc8yb031ydclz0qn7k0qsfa1-tree-sitter-jsdoc",
-  "sha256": "0vpvy5hnnr9l4ggii6fp6svv35l659b3n13028dzq0b363dxng03",
-  "hash": "sha256-Azzb2zBjAfwbEmAEO1YqhpaxtzbXmRjfIzRla2Hx+24=",
+  "rev": "658d18dcdddb75c760363faa4963427a7c6b52db",
+  "date": "2025-09-13T00:24:14-04:00",
+  "path": "/nix/store/l7zh6vli87n3bj7cq9lnfklkcwsay1am-tree-sitter-jsdoc",
+  "sha256": "1qrgan1xpj717qmwdbgb3lqjgffyhsw0qxhjwhdhqfv2lgkw4cn6",
+  "hash": "sha256-xjLC56NiOwwb5BJ2DLiG3rknMR3rrcYrPuHI24NVL+M=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
index 10187c1f96995..ea3673775726b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json
index 28f4996486d03..5c8bcfa51b897 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/joakker/tree-sitter-json5",
-  "rev": "ab0ba8229d639ec4f3fa5f674c9133477f4b77bd",
-  "date": "2024-04-30T19:40:01-04:00",
-  "path": "/nix/store/3ag1lv1h8wg3cvbjbigyqmvqr0jy1i48-tree-sitter-json5",
-  "sha256": "0n33v04d5q79j1qp1l26ygfqywl7vxfam38dap78g6i7ys78581d",
-  "hash": "sha256-LaCCjvYnmofOVQ2Nqlzfh3KP3fNG0HBxkOng0gjYY1g=",
+  "rev": "8cb4114a4d7e5bab75d74466422e032de31d83df",
+  "date": "2025-09-20T19:19:04-03:00",
+  "path": "/nix/store/gmjjsjdj4xrkw89zq1asva5pdw455dnd-tree-sitter-json5",
+  "sha256": "0ckxr80dbzaxkasn9dldwcl0klkyxs8kiiqibk82y9mx8x2ymz21",
+  "hash": "sha256-QfzqRUe9Ji/QXBHHOJHuftIJKOONtmS1ml391QDKfTI=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsonnet.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsonnet.json
index a8bd511ad98be..5194ddd86da7d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsonnet.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsonnet.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
index 2d0e55210dca2..c38a9d18feada 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
index 961b173484ff7..b84d6322d66ff 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kdl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kdl.json
index e218e748c0ade..78b834fb5824a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kdl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kdl.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-koka.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-koka.json
index ce53103c667c0..7a61e28411f1f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-koka.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-koka.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/mtoohey31/tree-sitter-koka",
-  "rev": "33c333f7ff4cac4138c0786198481b33d2880656",
-  "date": "2025-01-26T11:30:06-05:00",
-  "path": "/nix/store/dh0v9y2qc9dz8lqqpspnwbxvpikfjzpv-tree-sitter-koka",
-  "sha256": "12vr8xdsy8gpgwzcnvc2p5mzd4fsgv0lgqdwmzhs1b9hy7bvdkd6",
-  "hash": "sha256-ps221/EwraDhr7zhR8F+2pH2a7mCbcs+f/chr1tHeYs=",
+  "rev": "6dce132911ac375ac1a3591c868c47a2a84b30aa",
+  "date": "2025-07-26T15:26:41-04:00",
+  "path": "/nix/store/xvk32hz6j2yidxq4sj78phs4i1mqlwv8-tree-sitter-koka",
+  "sha256": "1l50l8m3ql2j6q772pgb8x3v1awvng12fd9rpv6p3cva1mg9ywj1",
+  "hash": "sha256-QXKfXg1qs3HNvjk1J8Kzm6uwR0frXXEONlJQPCqioNA=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json
index 8b67459fe23d0..304b38c8f1625 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json
index 810b0acc9964b..87bac66f83d03 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/latex-lsp/tree-sitter-latex",
-  "rev": "a834712c5e04029a451a262456bf6290b8ef6f37",
-  "date": "2024-04-01T14:31:04+02:00",
-  "path": "/nix/store/kn3vkfnysm170wc1dbjmb5y69hdlmyb4-tree-sitter-latex",
-  "sha256": "18dyda7299imb6i2jnjpr7z2jdrjn804c3958nkkpxzzfhbq39h7",
-  "hash": "sha256-B6aBF3T/9zunRSUNRgCyMjcp/slXWimiWTWmJI5qvqE=",
+  "rev": "7e0ecdc02926c7b9b2e0c76003d4fe7b0944f957",
+  "date": "2025-09-19T09:03:38+02:00",
+  "path": "/nix/store/jn7pw9992kbriq3z7nv27jh9yknqjsfq-tree-sitter-latex",
+  "sha256": "0sxxydq0lmfybvwfkzkvy5mp8hyqmadpl6pqxwqb5h6s44wnkgcx",
+  "hash": "sha256-nb1pOSHawLIw7/gaepuq2EN0a/F7/un4Xt5VCnDzvWs=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ledger.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ledger.json
index 24ea0a0a6df7c..840281cc9ac56 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ledger.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ledger.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json
index 6b29c432c482a..443c60090119a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-make.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-make.json
index 5fa65cec3ea8a..46a604c4a4721 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-make.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-make.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-netlinx.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-netlinx.json
index fc5819800286e..c9793de08e6ce 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-netlinx.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-netlinx.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json
index 13d0c4d6e287f..4e96fa190a1ec 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
index 3db68fc6a0a6e..7c69366c118c9 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/nix-community/tree-sitter-nix",
-  "rev": "ea1d87f7996be1329ef6555dcacfa63a69bd55c6",
-  "date": "2025-07-18T19:46:47+02:00",
-  "path": "/nix/store/mvq8m0v2cr2xns4807cby54h3wc7xjxr-tree-sitter-nix",
-  "sha256": "1aaq5yv1s8qq3abm0jm884hi4k6n2w0nzd1j3wizv1x1xk6qzlsl",
-  "hash": "sha256-VNOPzeyhh/0jHzK0bwEX1kwSIUGoSlCXGhgjHbYvWKk=",
+  "rev": "ff4e2b4c5a3598e8be3edf16bc69f6677af32145",
+  "date": "2025-08-11T14:30:35Z",
+  "path": "/nix/store/pv5yjrasf1k8pigwl0gnvbm7bwsg205q-tree-sitter-nix",
+  "sha256": "0bv38na2i53229lzkndbvchfgg8gmwdgpcw1ajq9rcqar8m1gyal",
+  "hash": "sha256-VPkXKsoKs5ywVIGz+xqvD73nINur2flpEmKUKJRFYy8=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json
index 93a878458f148..6c96638394e39 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
index b81123a662d89..d4cb96ea314eb 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
index a455eaf1e630e..b07ea1915d638 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/nushell/tree-sitter-nu",
-  "rev": "100d06e29d13a8ebfc3f29173c07a5c4f2050586",
-  "date": "2025-06-03T11:43:38Z",
-  "path": "/nix/store/3a41rx3rs29c625ywqv0pw7s7am4gwn5-tree-sitter-nu",
-  "sha256": "07aa73flw0z56fqgqv4y7xyf0akh50ydavjyzyczwc7hyl15mak4",
-  "hash": "sha256-ZKpaAvXwMP6Z/15u1TwocCrgfD+ebPywM+UDTt04Sh0=",
+  "rev": "0e6c59c46db3c246eaf86ce5b325da1247e971a5",
+  "date": "2025-09-19T12:13:52-05:00",
+  "path": "/nix/store/hzys3qbx0162dma003g6n4wzl5j8b4d1-tree-sitter-nu",
+  "sha256": "1l6l4s6w5dc1yrdwz9k1l4xzdzbkch8q4fr69461piibsd6r0qm8",
+  "hash": "sha256-qGKQTdMrxhsMSSY7ghFkc/32O6Fhps9b9oG1wo0m1NA=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
index a7d1784629367..fe29aa1e29ccd 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org-nvim.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org-nvim.json
index 0dba72be49a36..792216e7f848a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org-nvim.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org-nvim.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
index 35b384620faf5..cdaf509a9ca89 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pgn.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pgn.json
index 7255f39b0e4a9..56a78fac161a7 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pgn.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pgn.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/rolandwalker/tree-sitter-pgn",
-  "rev": "f86a119d21d01f6bf0dcd3247a366554e98dbbe5",
-  "date": "2024-09-14T21:47:45Z",
-  "path": "/nix/store/09rxvhnmdq63n4ghk00ngbdgnmqqs1k4-tree-sitter-pgn",
-  "sha256": "1ahl979ika0pyq4glz6am71hq6y360hcmwhxikn2l2gl8415701k",
-  "hash": "sha256-M4BTAkH0CSrsjB3yyiAwwxsMw6nKfPoI9heoGdNJFKo=",
+  "rev": "c5de0ccc528e1c36d354c00df422ed39fc582073",
+  "date": "2025-07-29T11:58:18-04:00",
+  "path": "/nix/store/laqz0v4pk90hqiy6apbxjf2lhbrf9n2h-tree-sitter-pgn",
+  "sha256": "0mazy9y80pd20a3a76b0nfxswh7xxdsnya0y0lzl86sh4w95f52p",
+  "hash": "sha256-VxRXEidQG0Q/BR4ob3Xr/UCuu7NgmaOGAqJdgHzyX1U=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
index c64e2aedce34c..86b2f91a67050 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-php",
-  "rev": "f7cf7348737d8cff1b13407a0bfedce02ee7b046",
-  "date": "2025-02-27T03:54:39-06:00",
-  "path": "/nix/store/6hwqa10mfcs32cqq5ab48c444yihm106-tree-sitter-php",
-  "sha256": "05qhz14vvqgwpxgdfr1skwgrv041zwc3wxjyx6y679965nn0lrji",
-  "hash": "sha256-UWYKrC0mpWO86V52Phj/gYCdH586ZNdev/zhvUn4EBc=",
+  "rev": "5b5627faaa290d89eb3d01b9bf47c3bb9e797dea",
+  "date": "2025-08-18T00:11:55-05:00",
+  "path": "/nix/store/sxyqch4xwnm2a1g5r7h9drp4x9bszzi8-tree-sitter-php",
+  "sha256": "1zf98g6zn29xci37scp3bmjl9dynhf3272aaqm6znjq7rb6z53lc",
+  "hash": "sha256-jI7yzcoHS/tNxUqJI4aD1rdEZV3jMn1GZD0J+81Dyf0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pioasm.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pioasm.json
index f9e43499a03a8..040c110a9b177 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pioasm.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pioasm.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-prisma.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-prisma.json
index bbdf72a731ccf..e5229a3327c31 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-prisma.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-prisma.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-proto.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-proto.json
index 7d14348180b83..98175e48e9d38 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-proto.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-proto.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pug.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pug.json
index e69c0abcd1c31..eccf116015705 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pug.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pug.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
index 208f595116b1a..91102dc7402ba 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-python",
-  "rev": "bffb65a8cfe4e46290331dfef0dbf0ef3679de11",
-  "date": "2024-12-22T18:06:13-05:00",
-  "path": "/nix/store/qr60c80rwd98hzbhlsfjbk0fninvbjr4-tree-sitter-python",
-  "sha256": "0a108sfqcsxrp54lapk7k3kq6fmz8745z5q99wpn3i1cqpi9slzg",
-  "hash": "sha256-71Od4sUsxGEvTwmXX8hBvzqD55hnXkVJublrhp1GICg=",
+  "rev": "293fdc02038ee2bf0e2e206711b69c90ac0d413f",
+  "date": "2025-09-11T02:45:17-04:00",
+  "path": "/nix/store/zka1fqm6l03k2z4ghiffkcisvcw96d5m-tree-sitter-python",
+  "sha256": "05kk1wlm5fgpgwqxw3m68sipkinw0gf2jq19cgq9cgp3agdwg58p",
+  "hash": "sha256-F5XH21PjPpbwYylgKdwD3MZ5o0amDt4xf/e5UikPcxY=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql-dbscheme.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql-dbscheme.json
index 68fa4bd7f0dae..6a433a1b517f8 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql-dbscheme.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql-dbscheme.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json
index f00559186659d..2741011aa215e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-r.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-r.json
index f7dda61658e5e..76b2d4f83d4a6 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-r.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-r.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/r-lib/tree-sitter-r",
-  "rev": "ac939363ced63a5fd39a8bd5e7891bbe06b5738d",
-  "date": "2024-09-06T16:53:09-04:00",
-  "path": "/nix/store/qj9nyda5grkjqkh23m9a3q3sgkmkgcdh-tree-sitter-r",
-  "sha256": "1jf14nvrfcznsnmxmlkbnn59bdykpsawxm5grph65p8vghi4fik7",
-  "hash": "sha256-Z0ZHInwb3WLgza/UzpW+07eVirVr0tqr1fYzl7clwck=",
+  "rev": "e9944e9801595ad484f49be492daf0c4c81547ef",
+  "date": "2025-06-05T15:17:25-04:00",
+  "path": "/nix/store/qdqwb87naqr211y5zps16abnv97a3430-tree-sitter-r",
+  "sha256": "15g5bkndhqv8vbiakl1vvsarl4kcqz3k9fc9hgnn899ghla8nh2a",
+  "hash": "sha256-SkCLFIUvJWTtg4m5NMfHbBKald470Kni2mhj2Oxc5ZU=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json
index 0ddb5f97a9633..27aca2758514b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-regex",
-  "rev": "4470c59041416e8a2a9fa343595ca28ed91f38b8",
-  "date": "2024-11-11T00:48:15-05:00",
-  "path": "/nix/store/2iwwqdj0zjxxqqc6aw2hwqi55aczbf5x-tree-sitter-regex",
-  "sha256": "098pkjicnw3a8bypb7f2xqwhqjlfvicibcmgx5nsb0icdyvagm8q",
-  "hash": "sha256-GNWntm8sgqVt6a+yFVncjkoMOe7CnXX9Qmpwy6KcFyU=",
+  "rev": "b2ac15e27fce703d2f37a79ccd94a5c0cbe9720b",
+  "date": "2025-09-13T00:57:50-04:00",
+  "path": "/nix/store/wx4xlyvffsgkvjy88r955f5lrps9r1iz-tree-sitter-regex",
+  "sha256": "0nhn94skvac3wid2xbxa456m1mgbi7h768imq280pxbm4klhl7bd",
+  "hash": "sha256-bR0K6SR19QuQwDUic+CJ69VQTSGqry5a5IOpPTVJFlo=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json
index 962eac562dad0..df313c6d6f4c3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-river.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-river.json
index d58e72454870b..87bf364f26d7b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-river.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-river.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
index c2db9a7aedcc1..bf815e548d2a9 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json
index 6f6d6eb72802e..b39f33c3a1596 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json
index c4e47bf15191f..1b06a4e99317f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-scala",
-  "rev": "d3b9553b47d7ab413a146c4b6498e527265b966e",
-  "date": "2024-12-26T23:42:00-05:00",
-  "path": "/nix/store/qzbrl51l89izishri72bjc59al88dy0a-tree-sitter-scala",
-  "sha256": "02awiraj5mmgyi31yzxyxarkkl41qksm3lm41pq9c6bmyqpir2y6",
-  "hash": "sha256-xoscL/Z1GZbwDaTSUfXEgdA5s+q+fx9G9K/WIlWOXAk=",
+  "rev": "2d55e74b0485fe05058ffe5e8155506c9710c767",
+  "date": "2025-06-08T14:05:03-04:00",
+  "path": "/nix/store/0ns5c1i34vlyrbvyajclw5dc0qyqmx0c-tree-sitter-scala",
+  "sha256": "16674bmcwp0r8y9xgfc0n5jmgk9bb0975kcqhkg1pnprjs7b6kv4",
+  "hash": "sha256-ZE+zjpb52hvehJjNchJYK81XZbGAudeTRxlczuoix5g=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
index d03302900db60..c85551d0a92b0 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/6cdh/tree-sitter-scheme",
-  "rev": "e35b41a183164f4a12e10da3d0c430e837c3d75a",
-  "date": "2025-05-25T19:18:44+08:00",
-  "path": "/nix/store/lg0zvr4w9pryyz725vd5hdf7gvg7idx1-tree-sitter-scheme",
-  "sha256": "12dclaaj4snar68hcwfc1kmnbww4ykf1ab2q81r3k9989m7f1ckn",
-  "hash": "sha256-drLgTk0opTlyQFgsFdz0hPNl6wzMcQaRycpqIpWirIk=",
+  "rev": "67b5c8d6ce19fd5265f13204fec0a3efa9e095d9",
+  "date": "2025-09-17T19:40:43+08:00",
+  "path": "/nix/store/019pq24f1wpqi9n9z5h3ih4w83am5sp4-tree-sitter-scheme",
+  "sha256": "12z3grdc92cvdvkcbk981nn976fscmdbc4fhrsrq2q0h03wfqcwy",
+  "hash": "sha256-njPs+AAQYIGzztARtlpl2pmTrA0ozcXmbpuJxFp+44s=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scss.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scss.json
index f25d2196fb473..512d80fbbb503 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scss.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scss.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-smithy.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-smithy.json
index f63a144843fdc..787003e933923 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-smithy.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-smithy.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
index 80e7839df85f8..b0e2dea9eacb0 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sparql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sparql.json
index a4d4f7bfe956d..b9ad674d5f66d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sparql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sparql.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json
index 9c3c7898b0cf9..10de150ee9a75 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/derekstride/tree-sitter-sql",
-  "rev": "8a4578bd200fd1ed73e8cbecbe3c5053a4bcf2f8",
-  "date": "2025-02-13T11:02:24-05:00",
-  "path": "/nix/store/jd7y0qspfvy7sc01i7awjwkr8dl3cnj0-tree-sitter-sql",
-  "sha256": "0cp0iaryxmshqdc4x8xg98ck096bqpk1xjg34dycbvkw7mpmn1zj",
-  "hash": "sha256-8gdbbz187sV8I+PJHubFyyQwGUqvo05Yw1DX7rOK4DI=",
+  "rev": "64d6707541898bf17a306033050b1932524e215f",
+  "date": "2025-09-23T13:22:41-04:00",
+  "path": "/nix/store/hgby3annavhkca58d82ixd1i0dgb4a3g-tree-sitter-sql",
+  "sha256": "0qv5pyz7yzy8bnvs8sc1wdp6wgl1wq4imynzwsihjg8yrxkdqbhc",
+  "hash": "sha256-DC7cZs8ePQmj5t/6GgnmgT5ubuOBaaS3Xch/f76/ZWM=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-supercollider.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-supercollider.json
index 7f47d64fd963c..646b61115996e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-supercollider.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-supercollider.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/madskjeldgaard/tree-sitter-supercollider",
-  "rev": "1a8ee0da9a4f2df5a8a22f4d637ac863623a78a7",
-  "date": "2024-09-21T12:39:28+02:00",
-  "path": "/nix/store/c94cwr855ai3b48ajw7nkxgrk6bs2n88-tree-sitter-supercollider",
-  "sha256": "051m7anq0w14qaj271x5ic4ilamrijx5f8np2g8kpgbkxmjc0v8v",
-  "hash": "sha256-G23AZO1zvTvRE9ciV7qMuSoaCYulhyOkwiRwgK06NRQ=",
+  "rev": "76b3cab1773f08bb7d3a185420b0a44c6da8c294",
+  "date": "2025-09-17T20:52:30+02:00",
+  "path": "/nix/store/hmc2f1w3xzdhas9gf0m6yz9bbp6ivpqa-tree-sitter-supercollider",
+  "sha256": "1lb8fbx0hhd6lmhjvszm96hrd802mgq6phj4977ag6qdi15zbfbn",
+  "hash": "sha256-drn1S4gNm6fOSUTCa/CrAqCWoUn16y1hpaZBCPpyaNE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-surface.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-surface.json
index 4e693c88f96c3..9e8861cc1f7d9 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-surface.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-surface.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json
index d7e1dce60b16e..46825eab17b40 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-talon.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-talon.json
index 967abcd46f396..826b26d04e418 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-talon.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-talon.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
index 634c62d4e732c..6ac7d582118c7 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/vrischmann/tree-sitter-templ",
-  "rev": "de35706f89beed5087670a9c4421b7794ef02411",
-  "date": "2025-06-01T21:02:54+02:00",
-  "path": "/nix/store/9m1jydr3j1m876dmazg9kzvs7878a7ly-tree-sitter-templ",
-  "sha256": "0vbhks5879b7bpygxr9zba142zsb760j4im1gzbgcl6yj6q59j30",
-  "hash": "sha256-YMhUsJHeUPbWf6FGIoE5S39Bglo/5f78XWelg4qecG0=",
+  "rev": "27a1fc62c8dd4c49669e03629491f66449c6c435",
+  "date": "2025-09-14T18:21:44+02:00",
+  "path": "/nix/store/zvhrnj22cjvykp2xpgs3dill5mb2p13x-tree-sitter-templ",
+  "sha256": "1lwvyvvdkyy2anckz284fqkl5w26v6ppdwm8ajfkkdbf1cyls7fs",
+  "hash": "sha256-2h1NPQtutTmdVKjydq/ZRvBCJ3YEiT+ZVcL72fb2m9M=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tera.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tera.json
index eaa3810597b85..35a64f282e31a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tera.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tera.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/uncenter/tree-sitter-tera",
-  "rev": "d006172998fa8b81f96b0f2fc7fa2bf25207c46b",
-  "date": "2025-04-16T08:51:56-04:00",
-  "path": "/nix/store/364masbjrvf29v30h4hbzwds1j438k7a-tree-sitter-tera",
-  "sha256": "0cwihdzlm8jk8g006j234pjnw0apv3l8ixn4kmdc60hzh3bb9ypr",
-  "hash": "sha256-+fq01oAfAsNancT2iOjYVwFu5SVDSAPAQ1OiSn+DkTM=",
+  "rev": "692937d52c8dfd91ce0dde722b9b4febbc9bc712",
+  "date": "2025-07-22T07:31:49-04:00",
+  "path": "/nix/store/yk1s71npnbz0vvfkpl4q6gs26xbcfjh3-tree-sitter-tera",
+  "sha256": "0zqkxiybrqrkj55cnpp5xbpw82c99zr752qb4wk7yj159yp1m5fx",
+  "hash": "sha256-3ZUark8lSH8mJwuLcvJPiQnE7+rlXstKkTPjvHzsE38=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tiger.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tiger.json
index f8c71de32cc2d..624aeb633dd35 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tiger.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tiger.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
index 31f805c26b874..d37e5a6b9f41c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-toml.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-toml.json
index 46c62e91c5aeb..9e9bc79672da1 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-toml.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-toml.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json
index b38bdb4efa695..7076b788e36aa 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-turtle.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-turtle.json
index cf7e1a6389c62..48be60fc7096e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-turtle.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-turtle.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-twig.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-twig.json
index d832cc7844365..8bfe5d5eeafc1 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-twig.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-twig.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
index 1dedf08f9884b..d0a0ed3fcea50 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
index ff9c3b0644a2d..5ad8f460b6dbe 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json
index a6e730e442ed6..1af3e2b44c605 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
index ee51cfb865687..e2327dcd4a519 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json
index fced9927e7c07..28989fd89ea59 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vue.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vue.json
index e54a956a03164..4241e897b6427 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vue.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vue.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wgsl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wgsl.json
index 5aaece48adf59..e01d33e4fc00b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wgsl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wgsl.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
index 55c6653c18da9..f0ad17112a215 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yaml.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yaml.json
index 94b8ac0f1cf3b..0bb9817bf2374 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yaml.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yaml.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yang.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yang.json
index e9f5b2ba1e629..82e6259a3fe38 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yang.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yang.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json
index 8363525841c7d..52cd35bef573a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }

From fd1114a3b51539f32910afe9d44c397fd780694f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 24 Sep 2025 00:47:03 -0700
Subject: [PATCH 083/306] python3Packages.coverage: 7.10.6 -> 7.10.7

Diff: https://github.com/nedbat/coveragepy/compare/7.10.6...7.10.7

Changelog: https://github.com/nedbat/coveragepy/blob/7.10.7/CHANGES.rst
---
 pkgs/development/python-modules/coverage/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index 030d2bad3028f..7dd1e7d6fa5f0 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "7.10.6";
+  version = "7.10.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nedbat";
     repo = "coveragepy";
     tag = version;
-    hash = "sha256-16t29ftyYBkGvzlV6+imjO+HM1UD/Nrhn+n4pK3h5iU=";
+    hash = "sha256-u62kfYE1yk/cIfyklWJz8vehPe9PL9uN+03bZZraw/U=";
   };
 
   build-system = [ setuptools ];

From 45a1cbb1256e02f48c1fc0f82585da90d0b6a582 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 24 Sep 2025 12:30:04 +0200
Subject: [PATCH 084/306] krb5: fix build on FreeBSD

Failed with:

```
packet.c:481:16: error: use of undeclared identifier 'ENODATA'
  481 |         return ENODATA;
      |                ^
1 error generated.
```

Fixed by applying a patch from FreeBSD ports.
---
 pkgs/development/libraries/kerberos/krb5.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 514fe01558262..ef1eeeeec2894 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   bootstrap_cmds,
   byacc, # can also use bison, but byacc has fewer dependencies
   keyutils,
@@ -42,6 +43,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-GogyuMrZI+u/E5T2fi789B46SfRgKFpm41reyPoAU68=";
   };
 
+  patches = lib.optionals stdenv.hostPlatform.isFreeBSD [
+    (fetchpatch {
+      name = "fix-missing-ENODATA.patch";
+      url = "https://cgit.freebsd.org/ports/plain/security/krb5-122/files/patch-lib_krad_packet.c?id=0501f716c4aff7880fde56e42d641ef504593b7d";
+      extraPrefix = "";
+      hash = "sha256-l8ev+WrDKbTqwgBRYhfJGELkCCE8mJTqVHFBvvCPvgE=";
+    })
+  ];
+
   outputs = [
     "out"
     "lib"

From dcb41fbcee185223ba2bb8c0135b75994a6494c8 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 24 Sep 2025 09:18:26 +0200
Subject: [PATCH 085/306] libpq: 17.6 -> 18.0

---
 pkgs/servers/sql/postgresql/libpq.nix | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index f71d254ae7b6e..3048e467397b5 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -20,6 +20,15 @@
   postgresql,
   buildPackages,
 
+  # Curl
+  curlSupport ?
+    lib.meta.availableOn stdenv.hostPlatform curl
+    # Building statically fails with:
+    # configure: error: library 'curl' does not provide curl_multi_init
+    # https://www.postgresql.org/message-id/487dacec-6d8d-46c0-a36f-d5b8c81a56f1%40technowledgy.de
+    && !stdenv.hostPlatform.isStatic,
+  curl,
+
   # GSSAPI
   gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic,
   libkrb5,
@@ -31,14 +40,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpq";
-  version = "17.6";
+  version = "18.0";
 
   src = fetchFromGitHub {
     owner = "postgres";
     repo = "postgres";
     # rev, not tag, on purpose: see generic.nix.
-    rev = "refs/tags/REL_17_6";
-    hash = "sha256-/7C+bjmiJ0/CvoAc8vzTC50vP7OsrM6o0w+lmmHvKvU=";
+    rev = "refs/tags/REL_18_0";
+    hash = "sha256-xA6gbJe4tIV9bYRFrdI4Rfy20ZwTkvyyjt7ZxvCFEec=";
   };
 
   __structuredAttrs = true;
@@ -61,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
     openssl
   ]
+  ++ lib.optionals curlSupport [ curl ]
   ++ lib.optionals gssSupport [ libkrb5 ]
   ++ lib.optionals nlsSupport [ gettext ];
 
@@ -109,6 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--without-perl"
     "--without-readline"
   ]
+  ++ lib.optionals curlSupport [ "--with-libcurl" ]
   ++ lib.optionals gssSupport [ "--with-gssapi" ]
   ++ lib.optionals nlsSupport [ "--enable-nls" ];
 
@@ -134,6 +145,11 @@ stdenv.mkDerivation (finalAttrs: {
     make -C src/common install pg_config.env
     make -C src/include install
     make -C src/interfaces/libpq install
+  ''
+  + lib.optionalString curlSupport ''
+    make -C src/interfaces/libpq-oauth install
+  ''
+  + ''
     make -C src/port install
 
     substituteInPlace src/common/pg_config.env \

From 781cbbf25837da89eaf6bcca747d69fb648322f3 Mon Sep 17 00:00:00 2001
From: Zitrone <general@dev.quantenzitrone.eu>
Date: Sun, 8 Jun 2025 19:24:47 +0200
Subject: [PATCH 086/306] libwindowswm: refactor and migrate to pkgs/by-name
 from xorg.libWindowsWM

---
 pkgs/by-name/li/libwindowswm/package.nix      | 55 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 40 +-------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           |  4 --
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 59 insertions(+), 43 deletions(-)
 create mode 100644 pkgs/by-name/li/libwindowswm/package.nix

diff --git a/pkgs/by-name/li/libwindowswm/package.nix b/pkgs/by-name/li/libwindowswm/package.nix
new file mode 100644
index 0000000000000..f195e4bbd76bd
--- /dev/null
+++ b/pkgs/by-name/li/libwindowswm/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libwindowswm";
+  version = "1.0.1";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libWindowsWM-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-JfB8+EfL6R02wg80i0uUlMRQT+ApZujN9lz1YxanDtw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libWindowsWM \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "library for Cygwin/X rootless window management extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libwindowswm";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    pkgConfigModules = [ "windowswm" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 36eeac74ab32e..a7af923d13433 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -40,6 +40,7 @@
   libpciaccess,
   libpthread-stubs,
   libsm,
+  libwindowswm,
   libx11,
   libxau,
   libxaw,
@@ -219,6 +220,7 @@ self: with self; {
   libICE = libice;
   libpthreadstubs = libpthread-stubs;
   libSM = libsm;
+  libWindowsWM = libwindowswm;
   libX11 = libx11;
   libXau = libxau;
   libXaw = libxaw;
@@ -905,44 +907,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libWindowsWM = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libWindowsWM";
-      version = "1.0.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2";
-        sha256 = "1p0flwb67xawyv6yhri9w17m1i4lji5qnd0gq8v1vsfb8zw7rw15";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "windowswm" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXTrap = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 958a76b60c98c..2518892829983 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -367,6 +367,7 @@
   libpciaccess,
   libpthread-stubs,
   libsm,
+  libwindowswm,
   libx11,
   libxau,
   libxaw,
@@ -546,6 +547,7 @@
   libICE = libice;
   libpthreadstubs = libpthread-stubs;
   libSM = libsm;
+  libWindowsWM = libwindowswm;
   libX11 = libx11;
   libXau = libxau;
   libXaw = libxaw;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 0a3da33ecd2e7..b6abd401a7665 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -146,10 +146,6 @@ self: super:
     };
   });
 
-  libWindowsWM = super.libWindowsWM.overrideAttrs (attrs: {
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-
   xdpyinfo = super.xdpyinfo.overrideAttrs (attrs: {
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
     preConfigure =
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 1ea2ace0bf533..bb42a1636c507 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -84,7 +84,6 @@ mirror://xorg/individual/font/font-ibm-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
 mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz

From 67af63a0765d43a7eb08c62da06fecc61d31cc36 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sun, 31 Aug 2025 17:06:56 +0200
Subject: [PATCH 087/306] libxinerama: refactor, move to pkgs/by-name and
 rename from xorg.libXinerama

---
 pkgs/by-name/li/libxinerama/package.nix       | 69 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 40 +----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           |  8 ---
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 74 insertions(+), 47 deletions(-)
 create mode 100644 pkgs/by-name/li/libxinerama/package.nix

diff --git a/pkgs/by-name/li/libxinerama/package.nix b/pkgs/by-name/li/libxinerama/package.nix
new file mode 100644
index 0000000000000..8708e49b3dec3
--- /dev/null
+++ b/pkgs/by-name/li/libxinerama/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxinerama";
+  version = "1.1.5";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXinerama-${finalAttrs.version}.tar.xz";
+    hash = "sha256-UJTR8PzBgoyxaW0NOdnoZq4yUgxU0B9hjxo8HjDCCFw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXinerama \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Library for Xinerama extension to X11 Protocol";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxinerama";
+    license = with lib.licenses; [
+      mit
+      mitOpenGroup
+      # TODO: change this to a new license depending on if this
+      # https://github.com/spdx/license-list-XML/issues/2831
+      # actually creates a new license or just new markup for X11
+      x11
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xinerama" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index a7af923d13433..792d8ffdd9da2 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -63,6 +63,7 @@
   libxfont_2,
   libxft,
   libxi,
+  libxinerama,
   libxmu,
   libxp,
   libxpm,
@@ -234,6 +235,7 @@ self: with self; {
   libXfont = libxfont_1;
   libXft = libxft;
   libXi = libxi;
+  libXinerama = libxinerama;
   libXmu = libxmu;
   libXp = libxp;
   libXpm = libxpm;
@@ -947,44 +949,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXinerama = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXinerama";
-      version = "1.1.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz";
-        sha256 = "0p08q8q1wg0sixhizl2l1i935bk6x3ckj3bdd6qqr0n1zkqd352h";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXext
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xinerama" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXtst = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 2518892829983..eb998cb9c0b38 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -72,6 +72,7 @@
 $pcMap{"xfont2"} = "libXfont2";
 $pcMap{"xft"} = "libXft";
 $pcMap{"xi"} = "libXi";
+$pcMap{"xinerama"} = "libXinerama";
 $pcMap{"xmu"} = "libXmu";
 $pcMap{"xmuu"} = "libXmu";
 $pcMap{"xp"} = "libXp";
@@ -390,6 +391,7 @@
   libxfont_2,
   libxft,
   libxi,
+  libxinerama,
   libxmu,
   libxp,
   libxpm,
@@ -561,6 +563,7 @@
   libXfont = libxfont_1;
   libXft = libxft;
   libXi = libxi;
+  libXinerama = libxinerama;
   libXmu = libxmu;
   libXp = libxp;
   libXpm = libxpm;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index b6abd401a7665..797ffeab54609 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -178,14 +178,6 @@ self: super:
     };
   });
 
-  libXinerama = super.libXinerama.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-
   libxkbfile = super.libxkbfile.overrideAttrs (attrs: {
     outputs = [
       "out"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index bb42a1636c507..8658679b0368c 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -84,7 +84,6 @@ mirror://xorg/individual/font/font-ibm-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
 mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2

From dbdc0d8f06ca7201917501056d0c6cc8a1a4a0a4 Mon Sep 17 00:00:00 2001
From: Zitrone <general@dev.quantenzitrone.eu>
Date: Sun, 8 Jun 2025 23:33:49 +0200
Subject: [PATCH 088/306] libxkbfile: refactor and migrate to pkgs/by-name from
 xorg namespace

---
 pkgs/by-name/li/libxkbfile/package.nix        | 60 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 38 +-----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           |  7 ---
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 65 insertions(+), 44 deletions(-)
 create mode 100644 pkgs/by-name/li/libxkbfile/package.nix

diff --git a/pkgs/by-name/li/libxkbfile/package.nix b/pkgs/by-name/li/libxkbfile/package.nix
new file mode 100644
index 0000000000000..93cd9028b3795
--- /dev/null
+++ b/pkgs/by-name/li/libxkbfile/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxkbfile";
+  version = "1.1.3";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libxkbfile-${finalAttrs.version}.tar.xz";
+    hash = "sha256-qbY+6pl6u57mqLT7tRWDHIQfRxr4RaCd5EOygAOHS+w=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "XKB file handling routines";
+    longDescription = ''
+      libxkbfile is used by the X servers and utilities to parse the XKB configuration data files.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxkbfile";
+    license = with lib.licenses; [
+      hpnd
+      mitOpenGroup
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xkbfile" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 792d8ffdd9da2..280ffcf34b1fc 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -64,6 +64,7 @@
   libxft,
   libxi,
   libxinerama,
+  libxkbfile,
   libxmu,
   libxp,
   libxpm,
@@ -145,6 +146,7 @@ self: with self; {
     libpciaccess
     libxcb
     libxcvt
+    libxkbfile
     listres
     lndir
     luit
@@ -989,42 +991,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libxkbfile = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libxkbfile";
-      version = "1.1.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz";
-        sha256 = "1v2bhw1q1cj3wjfs0igq393iz10whcavbyxlm3k9xfvsk7m3xdm9";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xkbfile" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libxshmfence = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index eb998cb9c0b38..dda0433cf8a89 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -73,6 +73,7 @@
 $pcMap{"xft"} = "libXft";
 $pcMap{"xi"} = "libXi";
 $pcMap{"xinerama"} = "libXinerama";
+$pcMap{"xkbfile"} = "libxkbfile";
 $pcMap{"xmu"} = "libXmu";
 $pcMap{"xmuu"} = "libXmu";
 $pcMap{"xp"} = "libXp";
@@ -392,6 +393,7 @@
   libxft,
   libxi,
   libxinerama,
+  libxkbfile,
   libxmu,
   libxp,
   libxpm,
@@ -473,6 +475,7 @@
     libpciaccess
     libxcb
     libxcvt
+    libxkbfile
     listres
     lndir
     luit
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 797ffeab54609..c96906407fa7f 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -178,13 +178,6 @@ self: super:
     };
   });
 
-  libxkbfile = super.libxkbfile.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ]; # mainly to avoid propagation
-  });
-
   libxshmfence = super.libxshmfence.overrideAttrs (attrs: {
     outputs = [
       "out"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 8658679b0368c..edac8733edcc0 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -84,7 +84,6 @@ mirror://xorg/individual/font/font-ibm-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
 mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXtst-1.2.5.tar.xz

From b72cbd7789c88bf92c560514f8bc2f1ef62a50d7 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 10 Sep 2025 11:47:07 +0200
Subject: [PATCH 089/306] libxshmfence: refactor & move to pkgs/by-name from
 xorg namespace

---
 pkgs/by-name/li/libxshmfence/package.nix      | 57 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 34 +----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           |  7 ---
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 62 insertions(+), 40 deletions(-)
 create mode 100644 pkgs/by-name/li/libxshmfence/package.nix

diff --git a/pkgs/by-name/li/libxshmfence/package.nix b/pkgs/by-name/li/libxshmfence/package.nix
new file mode 100644
index 0000000000000..1d771b05060ba
--- /dev/null
+++ b/pkgs/by-name/li/libxshmfence/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxshmfence";
+  version = "1.3.3";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libxshmfence-${finalAttrs.version}.tar.xz";
+    hash = "sha256-1KTfCWq6lv6gLAKe46ROEaR+t/chPBpym+g+hew/3hA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ xorgproto ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Shared memory 'SyncFence' synchronization primitive library";
+    longDescription = ''
+      This library offers a CPU-based synchronization primitive compatible with the X SyncFence
+      objects that can be shared between processes using file descriptor passing.
+      There are two underlying implementations:
+      - On Linux, the library uses futexes
+      - On other systems, the library uses posix mutexes and condition variables.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxshmfence";
+    license = lib.licenses.hpndSellVariant;
+    maintainers = [ ];
+    pkgConfigModules = [ "xshmfence" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 280ffcf34b1fc..2690f84c6480a 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -73,6 +73,7 @@
   libxrender,
   libxres,
   libxscrnsaver,
+  libxshmfence,
   libxt,
   libxv,
   libxvmc,
@@ -147,6 +148,7 @@ self: with self; {
     libxcb
     libxcvt
     libxkbfile
+    libxshmfence
     listres
     lndir
     luit
@@ -991,38 +993,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libxshmfence = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libxshmfence";
-      version = "1.3.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz";
-        sha256 = "046y7zn8agp8kdr1lg11yyvpx90i9sjf77h25jhgx5msd84xz96l";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ xorgproto ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xshmfence" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   oclock = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index dda0433cf8a89..826f0c2aca434 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -83,6 +83,7 @@
 $pcMap{"xrender"} = "libXrender";
 $pcMap{"xres"} = "libXres";
 $pcMap{"xscrnsaver"} = "libXScrnSaver";
+$pcMap{"xshmfence"} = "libxshmfence";
 $pcMap{"xt"} = "libXt";
 $pcMap{"xtrans"} = "xtrans";
 $pcMap{"xv"} = "libXv";
@@ -402,6 +403,7 @@
   libxrender,
   libxres,
   libxscrnsaver,
+  libxshmfence,
   libxt,
   libxv,
   libxvmc,
@@ -476,6 +478,7 @@
     libxcb
     libxcvt
     libxkbfile
+    libxshmfence
     listres
     lndir
     luit
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index c96906407fa7f..2cf3f4b3adb43 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -178,13 +178,6 @@ self: super:
     };
   });
 
-  libxshmfence = super.libxshmfence.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ]; # mainly to avoid propagation
-  });
-
   setxkbmap = super.setxkbmap.overrideAttrs (attrs: {
     postInstall = ''
       mkdir -p $out/share/man/man7
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index edac8733edcc0..37432f01021b7 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -84,7 +84,6 @@ mirror://xorg/individual/font/font-ibm-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXtst-1.2.5.tar.xz
 mirror://xorg/individual/xserver/xorg-server-21.1.18.tar.xz

From 19d5fe041003703206072988771ebe0de2d8e275 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 10 Sep 2025 12:03:51 +0200
Subject: [PATCH 090/306] libxtst: refactor, move to pkgs/by-name and rename
 from xorg.libXtst

---
 pkgs/by-name/li/libxtst/package.nix           | 66 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 42 +-----------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  3 +
 pkgs/servers/x11/xorg/overrides.nix           |  6 --
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 71 insertions(+), 47 deletions(-)
 create mode 100644 pkgs/by-name/li/libxtst/package.nix

diff --git a/pkgs/by-name/li/libxtst/package.nix b/pkgs/by-name/li/libxtst/package.nix
new file mode 100644
index 0000000000000..6cd9ababca26b
--- /dev/null
+++ b/pkgs/by-name/li/libxtst/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxi,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxtst";
+  version = "1.2.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXtst-${finalAttrs.version}.tar.xz";
+    hash = "sha256-tQ1MJblwCadEcGwQOcWY9NjmSRDJ/eOBmU4criNdkkI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxi
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXtst \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Library for the XTEST and RECORD X11 extensions";
+    longDescription = ''
+      The XTEST extension is a minimal set of client and server extensions required to completely
+      test the X11 server with no user intervention. This extension is not intended to support
+      general journaling and playback of user actions.
+      The RECORD extension supports the recording and reporting of all core X protocol and arbitrary
+      X extension protocol.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxtst";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpndSellVariant
+      hpndDoc
+      x11
+      hpndDocSell
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xtst" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 2690f84c6480a..81c277c3cb89f 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -75,6 +75,7 @@
   libxscrnsaver,
   libxshmfence,
   libxt,
+  libxtst,
   libxv,
   libxvmc,
   libxxf86dga,
@@ -249,6 +250,7 @@ self: with self; {
   libXres = libxres;
   libXScrnSaver = libxscrnsaver;
   libXt = libxt;
+  libXtst = libxtst;
   libXv = libxv;
   libXvMC = libxvmc;
   libXxf86dga = libxxf86dga;
@@ -953,46 +955,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXtst = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      libXi,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXtst";
-      version = "1.2.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXtst-1.2.5.tar.xz";
-        sha256 = "0hljblisw72fk60y7zf9214ydn7lk32kj43cf12af2bhp4jlq3dm";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-        libXi
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xtst" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   oclock = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 826f0c2aca434..1b47a0645c698 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -86,6 +86,7 @@
 $pcMap{"xshmfence"} = "libxshmfence";
 $pcMap{"xt"} = "libXt";
 $pcMap{"xtrans"} = "xtrans";
+$pcMap{"xtst"} = "libXtst";
 $pcMap{"xv"} = "libXv";
 $pcMap{"xvmc"} = "libXvMC";
 $pcMap{"xvmc-wrapper"} = "libXvMC";
@@ -405,6 +406,7 @@
   libxscrnsaver,
   libxshmfence,
   libxt,
+  libxtst,
   libxv,
   libxvmc,
   libxxf86dga,
@@ -579,6 +581,7 @@
   libXres = libxres;
   libXScrnSaver = libxscrnsaver;
   libXt = libxt;
+  libXtst = libxtst;
   libXv = libxv;
   libXvMC = libxvmc;
   libXxf86dga = libxxf86dga;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 2cf3f4b3adb43..a2da706b02d85 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -140,12 +140,6 @@ self: super:
 
   mkfontdir = xorg.mkfontscale;
 
-  libXtst = super.libXtst.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      pkgConfigModules = [ "xtst" ];
-    };
-  });
-
   xdpyinfo = super.xdpyinfo.overrideAttrs (attrs: {
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
     preConfigure =
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 37432f01021b7..5429bf15b1aa6 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -85,5 +85,4 @@ mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXtst-1.2.5.tar.xz
 mirror://xorg/individual/xserver/xorg-server-21.1.18.tar.xz

From e9742cf527bd947cfbf6674430efdf74aee0f12c Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 13 Sep 2025 23:53:11 +0200
Subject: [PATCH 091/306] font-bitstream-{100dpi,75dpi,type1}: move font output
 from $out/lib to $out/share

---
 pkgs/by-name/fo/font-bitstream-100dpi/package.nix | 2 +-
 pkgs/by-name/fo/font-bitstream-75dpi/package.nix  | 2 +-
 pkgs/by-name/fo/font-bitstream-type1/package.nix  | 4 +---
 pkgs/servers/x11/xorg/overrides.nix               | 2 +-
 4 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/fo/font-bitstream-100dpi/package.nix b/pkgs/by-name/fo/font-bitstream-100dpi/package.nix
index 70bdb81636aff..380c99a834013 100644
--- a/pkgs/by-name/fo/font-bitstream-100dpi/package.nix
+++ b/pkgs/by-name/fo/font-bitstream-100dpi/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ font-util ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
 
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
diff --git a/pkgs/by-name/fo/font-bitstream-75dpi/package.nix b/pkgs/by-name/fo/font-bitstream-75dpi/package.nix
index acdae17bca716..3dd6e249b0df2 100644
--- a/pkgs/by-name/fo/font-bitstream-75dpi/package.nix
+++ b/pkgs/by-name/fo/font-bitstream-75dpi/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ font-util ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
 
   passthru = {
     updateScript = writeScript "update-${finalAttrs.pname}" ''
diff --git a/pkgs/by-name/fo/font-bitstream-type1/package.nix b/pkgs/by-name/fo/font-bitstream-type1/package.nix
index 3e3d1eb6c35e9..0fe3b97a951a1 100644
--- a/pkgs/by-name/fo/font-bitstream-type1/package.nix
+++ b/pkgs/by-name/fo/font-bitstream-type1/package.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
     fontforge
   ];
 
-  configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-
   postBuild = ''
     # convert Postscript (Type 1) font to otf
     for i in $(find -type f -name '*.pfa' -o -name '*.pfb'); do
@@ -34,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     # install the otf fonts
-    fontDir="$out/lib/X11/fonts/misc"
+    fontDir="$out/share/fonts/X11/otf"
     install -Dm444 -t "$fontDir" *.otf
     mkfontscale "$fontDir"
   '';
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 1952faf1bd140..215effdaa9862 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -902,5 +902,5 @@ self: super:
 
 # deprecate some packages
 // lib.optionalAttrs config.allowAliases {
-  fontbitstreamspeedo = throw "Bitstream Speedo is an obsolete font format that hasn't been supported by Xorg since 2005";
+  fontbitstreamspeedo = throw "Bitstream Speedo is an obsolete font format that hasn't been supported by Xorg since 2005"; # added 2025-09-24
 }

From 201086487dc236e20a6164c3971e888b34bde684 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 24 Sep 2025 08:01:42 -0700
Subject: [PATCH 092/306] nghttp3: 1.11.0 -> 1.12.0

Diff: https://github.com/ngtcp2/nghttp3/compare/v1.11.0...v1.12.0

Changelog: https://github.com/ngtcp2/nghttp3/releases/tag/v1.12.0
---
 pkgs/by-name/ng/nghttp3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index 784e5c3ecf6af..048a71bac3400 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nghttp3";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "https://github.com/ngtcp2/nghttp3/releases/download/v${finalAttrs.version}/nghttp3-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-AAKlyoVtsFmqbcac9zL7sA2aHnPteISPXUjyYh8gyoo=";
+    hash = "sha256-KFl4NTevIT1npc5Cd923nIlBrUXtv6XM3VLZz0/6Qi0=";
   };
 
   outputs = [

From 4cc11e680666d397cd24bf1dd82275e8664ecb57 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 10 Sep 2025 16:45:40 +0200
Subject: [PATCH 093/306] x11perf: 1.6.1 -> 1.7.0, refactor & move to
 pkgs/by-name from xorg namespace

relevant changes:
- fix x11perfcomp containing reference to /bin/cat
---
 pkgs/by-name/x1/x11perf/package.nix           | 64 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 46 +------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           | 10 ---
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 68 insertions(+), 55 deletions(-)
 create mode 100644 pkgs/by-name/x1/x11perf/package.nix

diff --git a/pkgs/by-name/x1/x11perf/package.nix b/pkgs/by-name/x1/x11perf/package.nix
new file mode 100644
index 0000000000000..f707af8810e3b
--- /dev/null
+++ b/pkgs/by-name/x1/x11perf/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxft,
+  libxmu,
+  libxrender,
+  freetype,
+  fontconfig,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "x11perf";
+  version = "1.7.0";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/test/x11perf-${finalAttrs.version}.tar.xz";
+    hash = "sha256-JPgNhLDpYXGpmJMv8Adpj9F3bamXXtQuUdV7nPypGCg=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxft
+    libxmu
+    libxrender
+    freetype
+    fontconfig
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/bin/x11perfcomp \
+      --replace-fail "/bin/cat" "cat"
+  '';
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/test/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "X11 server performance test program";
+    homepage = "https://gitlab.freedesktop.org/xorg/test/x11perf";
+    license = lib.licenses.hpnd;
+    mainProgram = "x11perf";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 36eeac74ab32e..3c62b4ed54ac2 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -88,6 +88,7 @@
   transset,
   util-macros,
   viewres,
+  x11perf,
   xauth,
   xbacklight,
   xbitmaps,
@@ -153,6 +154,7 @@ self: with self; {
     smproxy
     transset
     viewres
+    x11perf
     xauth
     xbacklight
     xbitmaps
@@ -1213,50 +1215,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  x11perf = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      libXft,
-      libXmu,
-      xorgproto,
-      libXrender,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "x11perf";
-      version = "1.6.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/x11perf-1.6.1.tar.bz2";
-        sha256 = "0d3wh6z6znwhfdiv0zaggfj0xgish98xa10yy76b9517zj7hnzhw";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXext
-        libXft
-        libXmu
-        xorgproto
-        libXrender
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcalc = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 958a76b60c98c..b3f806abf926a 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -415,6 +415,7 @@
   transset,
   util-macros,
   viewres,
+  x11perf,
   xauth,
   xbacklight,
   xbitmaps,
@@ -480,6 +481,7 @@
     smproxy
     transset
     viewres
+    x11perf
     xauth
     xbacklight
     xbitmaps
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 0a3da33ecd2e7..f8b3c9bb3e554 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -217,16 +217,6 @@ self: super:
 
   oclock = addMainProgram super.oclock { };
 
-  x11perf = super.x11perf.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [
-      freetype
-      fontconfig
-    ];
-    meta = attrs.meta // {
-      mainProgram = "x11perf";
-    };
-  });
-
   xcalc = addMainProgram super.xcalc { };
 
   xf86inputevdev = super.xf86inputevdev.overrideAttrs (attrs: {
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 1ea2ace0bf533..ca1f3a68fb23b 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -4,7 +4,6 @@ mirror://xorg/individual/app/fonttosfnt-1.2.4.tar.xz
 mirror://xorg/individual/app/iceauth-1.0.10.tar.xz
 mirror://xorg/individual/app/oclock-1.0.6.tar.xz
 mirror://xorg/individual/app/setxkbmap-1.3.4.tar.xz
-mirror://xorg/individual/app/x11perf-1.6.1.tar.bz2
 mirror://xorg/individual/app/xcalc-1.1.2.tar.xz
 mirror://xorg/individual/app/xclock-1.1.1.tar.xz
 mirror://xorg/individual/app/xcompmgr-1.1.10.tar.xz

From 69c34bfba44abb1b5f12e7cc41443fbe337296fb Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 23 Aug 2025 00:20:25 +0200
Subject: [PATCH 094/306] xcalc: refactor and move to pkgs/by-name from xorg
 namespace

---
 pkgs/by-name/xc/xcalc/package.nix             | 60 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 46 +-------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           |  2 -
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 64 insertions(+), 47 deletions(-)
 create mode 100644 pkgs/by-name/xc/xcalc/package.nix

diff --git a/pkgs/by-name/xc/xcalc/package.nix b/pkgs/by-name/xc/xcalc/package.nix
new file mode 100644
index 0000000000000..a784ed745d132
--- /dev/null
+++ b/pkgs/by-name/xc/xcalc/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  wrapWithXFileSearchPathHook,
+  libx11,
+  libxaw,
+  libxt,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xcalc";
+  version = "1.1.2";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xcalc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-hXjfoUV+lCifbW7WFGcUMH2Kc6G1TS9CrxMhtiX8HNQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapWithXFileSearchPathHook
+  ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxaw
+    libxt
+  ];
+
+  installFlags = [ "appdefaultdir=$(out)/share/X11/app-defaults" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Scientific calculator X11 client that can emulate a TI-30 or an HP-10C";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xcalc";
+    license = with lib.licenses; [
+      x11
+      hpndSellVariant
+    ];
+    mainProgram = "xcalc";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 3c62b4ed54ac2..c46dffee19f92 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -92,6 +92,7 @@
   xauth,
   xbacklight,
   xbitmaps,
+  xcalc,
   xcb-proto,
   xcmsdb,
   xconsole,
@@ -158,6 +159,7 @@ self: with self; {
     xauth
     xbacklight
     xbitmaps
+    xcalc
     xcmsdb
     xconsole
     xcursorgen
@@ -1215,50 +1217,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcalc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXaw,
-      xorgproto,
-      libXt,
-      wrapWithXFileSearchPathHook,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcalc";
-      version = "1.1.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xcalc-1.1.2.tar.xz";
-        sha256 = "1m0wzhjvc88kmx12ykdml5rqlz9h2iki9mkfdngji53y8nhxyy45";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        wrapWithXFileSearchPathHook
-      ];
-      buildInputs = [
-        libX11
-        libXaw
-        xorgproto
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xclock = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index b3f806abf926a..ee82809994254 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -419,6 +419,7 @@
   xauth,
   xbacklight,
   xbitmaps,
+  xcalc,
   xcb-proto,
   xcmsdb,
   xconsole,
@@ -485,6 +486,7 @@
     xauth
     xbacklight
     xbitmaps
+    xcalc
     xcmsdb
     xconsole
     xcursorgen
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index f8b3c9bb3e554..c81b580849e57 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -217,8 +217,6 @@ self: super:
 
   oclock = addMainProgram super.oclock { };
 
-  xcalc = addMainProgram super.xcalc { };
-
   xf86inputevdev = super.xf86inputevdev.overrideAttrs (attrs: {
     outputs = [
       "out"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index ca1f3a68fb23b..beabc520243db 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -4,7 +4,6 @@ mirror://xorg/individual/app/fonttosfnt-1.2.4.tar.xz
 mirror://xorg/individual/app/iceauth-1.0.10.tar.xz
 mirror://xorg/individual/app/oclock-1.0.6.tar.xz
 mirror://xorg/individual/app/setxkbmap-1.3.4.tar.xz
-mirror://xorg/individual/app/xcalc-1.1.2.tar.xz
 mirror://xorg/individual/app/xclock-1.1.1.tar.xz
 mirror://xorg/individual/app/xcompmgr-1.1.10.tar.xz
 mirror://xorg/individual/app/xdm-1.1.17.tar.xz

From 63640282de5a4a32dfcbbaeb14b664d9287c1e60 Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 10 Sep 2025 17:27:35 +0200
Subject: [PATCH 095/306] xcompmgr: refactor & move to pkgs/by-name from xorg
 namespace

---
 pkgs/by-name/xc/xcompmgr/package.nix          | 59 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 46 +--------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           |  1 -
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 pkgs/top-level/all-packages.nix               |  2 -
 6 files changed, 63 insertions(+), 48 deletions(-)
 create mode 100644 pkgs/by-name/xc/xcompmgr/package.nix

diff --git a/pkgs/by-name/xc/xcompmgr/package.nix b/pkgs/by-name/xc/xcompmgr/package.nix
new file mode 100644
index 0000000000000..e40cc7b807f30
--- /dev/null
+++ b/pkgs/by-name/xc/xcompmgr/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxrender,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xcompmgr";
+  version = "1.1.10";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xcompmgr-${finalAttrs.version}.tar.xz";
+    hash = "sha256-eCT3CcTyJDLq6nVC7JM4Tl3Uj2/LhcEv+C1yFCOwuY8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libxcomposite
+    libxdamage
+    libxext
+    libxfixes
+    libxrender
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Sample X11 compositing manager";
+    longDescription = ''
+      xcompmgr is a sample compositing manager for X servers supporting the XFIXES, DAMAGE, RENDER
+      and COMPOSITE extensions. It enables basic eye-candy effects.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xcompmgr";
+    license = lib.licenses.hpndSellVariant;
+    mainProgram = "xcompmgr";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index c46dffee19f92..9698be43cffa9 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -95,6 +95,7 @@
   xcalc,
   xcb-proto,
   xcmsdb,
+  xcompmgr,
   xconsole,
   xcursorgen,
   xcursor-themes,
@@ -161,6 +162,7 @@ self: with self; {
     xbitmaps
     xcalc
     xcmsdb
+    xcompmgr
     xconsole
     xcursorgen
     xdriinfo
@@ -1269,50 +1271,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcompmgr = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libXcomposite,
-      libXdamage,
-      libXext,
-      libXfixes,
-      xorgproto,
-      libXrender,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcompmgr";
-      version = "1.1.10";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xcompmgr-1.1.10.tar.xz";
-        sha256 = "13xrn0ii8widz0pw31fbdy7x8paf729yqhkmxbm3497jqh4zf93q";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libXcomposite
-        libXdamage
-        libXext
-        libXfixes
-        xorgproto
-        libXrender
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xdm = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index ee82809994254..30fe7403d84de 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -422,6 +422,7 @@
   xcalc,
   xcb-proto,
   xcmsdb,
+  xcompmgr,
   xconsole,
   xcursorgen,
   xcursor-themes,
@@ -488,6 +489,7 @@
     xbitmaps
     xcalc
     xcmsdb
+    xcompmgr
     xconsole
     xcursorgen
     xdriinfo
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index c81b580849e57..1b11317279222 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -720,7 +720,6 @@ self: super:
   });
 
   xclock = addMainProgram super.xclock { };
-  xcompmgr = addMainProgram super.xcompmgr { };
 
   xinit =
     (super.xinit.override {
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index beabc520243db..69f7cc3e3e829 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -5,7 +5,6 @@ mirror://xorg/individual/app/iceauth-1.0.10.tar.xz
 mirror://xorg/individual/app/oclock-1.0.6.tar.xz
 mirror://xorg/individual/app/setxkbmap-1.3.4.tar.xz
 mirror://xorg/individual/app/xclock-1.1.1.tar.xz
-mirror://xorg/individual/app/xcompmgr-1.1.10.tar.xz
 mirror://xorg/individual/app/xdm-1.1.17.tar.xz
 mirror://xorg/individual/app/xdpyinfo-1.3.4.tar.xz
 mirror://xorg/individual/app/xeyes-1.3.0.tar.xz
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5b37605f35c31..677cc7f08e32d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13357,8 +13357,6 @@ with pkgs;
 
   xca = qt6Packages.callPackage ../applications/misc/xca { };
 
-  inherit (xorg) xcompmgr;
-
   xdg-desktop-portal = callPackage ../development/libraries/xdg-desktop-portal { };
 
   xdg-desktop-portal-hyprland =

From 3ccc4089b6a1a9edd2be3ac472688e65be67b24c Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Wed, 10 Sep 2025 17:35:18 +0200
Subject: [PATCH 096/306] xeyes: 1.3.0 -> 1.3.1, refactor & move to
 pkgs/by-name from xorg namespace

---
 pkgs/by-name/xe/xeyes/package.nix             | 59 +++++++++++++++++++
 pkgs/servers/x11/xorg/default.nix             | 50 +---------------
 .../x11/xorg/generate-expr-from-tarballs.pl   |  2 +
 pkgs/servers/x11/xorg/overrides.nix           |  2 -
 pkgs/servers/x11/xorg/tarballs.list           |  1 -
 5 files changed, 63 insertions(+), 51 deletions(-)
 create mode 100644 pkgs/by-name/xe/xeyes/package.nix

diff --git a/pkgs/by-name/xe/xeyes/package.nix b/pkgs/by-name/xe/xeyes/package.nix
new file mode 100644
index 0000000000000..b23c50e764aee
--- /dev/null
+++ b/pkgs/by-name/xe/xeyes/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxcb,
+  libxext,
+  libxi,
+  libxmu,
+  libxrender,
+  libxt,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xeyes";
+  version = "1.3.1";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xeyes-${finalAttrs.version}.tar.xz";
+    hash = "sha256-VgjXa3sarF7X8i8ba1rXTvmMhpMiDzK0uH3M7kqVbqo=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxcb
+    libxext
+    libxi
+    libxmu
+    libxrender
+    libxt
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "A \"follow the mouse\" X demo, using the X SHAPE extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xeyes";
+    license = lib.licenses.x11;
+    mainProgram = "xeyes";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 9698be43cffa9..7b1b67bd6429b 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -101,6 +101,7 @@
   xcursor-themes,
   xdriinfo,
   xev,
+  xeyes,
   xfontsel,
   xfsinfo,
   xgamma,
@@ -167,6 +168,7 @@ self: with self; {
     xcursorgen
     xdriinfo
     xev
+    xeyes
     xfontsel
     xfsinfo
     xgamma
@@ -1389,54 +1391,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xeyes = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libxcb,
-      libXext,
-      libXi,
-      libXmu,
-      xorgproto,
-      libXrender,
-      libXt,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xeyes";
-      version = "1.3.0";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xeyes-1.3.0.tar.xz";
-        sha256 = "08rhfp5xlmdbyxkvxhgjxdn6vwzrbrjyd7jkk8b7wi1kpw0ccl09";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libxcb
-        libXext
-        libXi
-        libXmu
-        xorgproto
-        libXrender
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputevdev = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 30fe7403d84de..2c5a41fb9da20 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -428,6 +428,7 @@
   xcursor-themes,
   xdriinfo,
   xev,
+  xeyes,
   xfontsel,
   xfsinfo,
   xgamma,
@@ -494,6 +495,7 @@
     xcursorgen
     xdriinfo
     xev
+    xeyes
     xfontsel
     xfsinfo
     xgamma
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 1b11317279222..e8b86dc703aaa 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -411,8 +411,6 @@ self: super:
     };
   });
 
-  xeyes = addMainProgram super.xeyes { };
-
   xkbcomp = super.xkbcomp.overrideAttrs (attrs: {
     configureFlags = [ "--with-xkb-config-root=${xorg.xkeyboardconfig}/share/X11/xkb" ];
     meta = attrs.meta // {
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 69f7cc3e3e829..fe66e12856b97 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -7,7 +7,6 @@ mirror://xorg/individual/app/setxkbmap-1.3.4.tar.xz
 mirror://xorg/individual/app/xclock-1.1.1.tar.xz
 mirror://xorg/individual/app/xdm-1.1.17.tar.xz
 mirror://xorg/individual/app/xdpyinfo-1.3.4.tar.xz
-mirror://xorg/individual/app/xeyes-1.3.0.tar.xz
 mirror://xorg/individual/app/xfd-1.1.4.tar.xz
 mirror://xorg/individual/app/xfs-1.2.2.tar.xz
 mirror://xorg/individual/app/xinit-1.4.4.tar.xz

From 45439ecf584b1c6597f066109d17833e4d294b71 Mon Sep 17 00:00:00 2001
From: Alois Wohlschlager <alois1@gmx-topmail.de>
Date: Wed, 24 Sep 2025 18:35:23 +0200
Subject: [PATCH 097/306] nlohmann_json: make musl support patch unconditional

Mass rebuild cleanup after https://github.com/NixOS/nixpkgs/pull/445699 .
---
 pkgs/by-name/nl/nlohmann_json/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/nl/nlohmann_json/package.nix b/pkgs/by-name/nl/nlohmann_json/package.nix
index e11fa98c83730..23b36c48cffda 100644
--- a/pkgs/by-name/nl/nlohmann_json/package.nix
+++ b/pkgs/by-name/nl/nlohmann_json/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-cECvDOLxgX7Q9R3IE86Hj9JJUxraDQvhoyPDF03B2CY=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isMusl [
+  patches = [
     # Musl does not support LC_NUMERIC, causing a test failure.
     # Turn the error into a warning to make the test succeed.
     # https://github.com/nlohmann/json/pull/4770

From 5b502715d2f49dc7a6caa29ed666d83c779cd822 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 24 Sep 2025 09:51:41 -0700
Subject: [PATCH 098/306] python3Packages.numpy: use fetchFromGitHub

---
 pkgs/development/python-modules/numpy/2.nix | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index b6fd45abd9617..46b338fb2ff1f 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchPypi,
+  fetchFromGitHub,
   python,
   numpy_2,
   pythonAtLeast,
@@ -64,10 +64,12 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.11";
 
-  src = fetchPypi {
-    inherit pname version;
-    extension = "tar.gz";
-    hash = "sha256-3cfDlye6YrgN/b7fQA0cEN36ju+9fsjcsRi+i1bTECk=";
+  src = fetchFromGitHub {
+    owner = "numpy";
+    repo = "numpy";
+    tag = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-6RMzF5vOWSX7gL3mps9ECClJF3mNqL1mexM6j8/yfdc=";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [
@@ -176,7 +178,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/numpy/numpy/releases/tag/v${version}";
+    changelog = "https://github.com/numpy/numpy/releases/tag/${src.tag}";
     description = "Scientific tools for Python";
     homepage = "https://numpy.org/";
     license = lib.licenses.bsd3;

From e205e2baf6853e90079a834c59430210e5dde4ef Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 25 Sep 2025 00:06:07 +0200
Subject: [PATCH 099/306] expat: 2.7.2 -> 2.7.3

https://github.com/libexpat/libexpat/blob/R_2_7_3/expat/Changes
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index ba5a46d034f84..d650a64b19fc8 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.7.2";
+  version = "2.7.3";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-Ibd4s07IN8KsKFrvNA+ftfoGOoEbIepNJBKpcCyImVw=";
+    hash = "sha256-cd+PQHBqe7CoClNnB56nXZHaT4xlxY7Fm837997Nq58=";
   };
 
   strictDeps = true;

From eb0701c0379b56cb19f0eebb81f83de0d3537f03 Mon Sep 17 00:00:00 2001
From: misilelab <misileminecord@gmail.com>
Date: Mon, 1 Sep 2025 19:29:07 +0900
Subject: [PATCH 100/306] python3Packages.typing-extensions: 4.14.1 -> 4.15.0

https://github.com/python/typing_extensions/blob/4.15.0/CHANGELOG.md#release-4150-august-25-2025
Signed-off-by: misilelab <misileminecord@gmail.com>
---
 .../python-modules/typing-extensions/default.nix            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index 662ad9c5eb9a8..a85bb03489760 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -11,17 +11,17 @@
 
 buildPythonPackage rec {
   pname = "typing-extensions";
-  version = "4.14.1";
+  version = "4.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python";
     repo = "typing_extensions";
     tag = version;
-    hash = "sha256-KzfxVUgPN1cLg73A3TC2zQjYfeLc8x9TtbLmOfmlOkY=";
+    hash = "sha256-3oAlwvNSJ7NhPiHekh4SJI99cPFh29KCCR9314QzsvQ=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ flit-core ];
 
   pythonImportsCheck = [ "typing_extensions" ];
 

From 0714665a367c4ef1f855d6c47cb81afd9babd925 Mon Sep 17 00:00:00 2001
From: "git@71rd.net" <git@71rd.net>
Date: Wed, 24 Sep 2025 20:14:46 +0000
Subject: [PATCH 101/306] softhsm: switch backend to openssl

Switching softhsm to use OpenSSL instead of botan2 for cryptography.
Botan2 has been end-of-life since January 2025 and can not be built with gcc-15, and softhsm does not support botan3.
---
 pkgs/by-name/so/softhsm/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/so/softhsm/package.nix b/pkgs/by-name/so/softhsm/package.nix
index 9a7d3746d7cf9..77a2e6a56f074 100644
--- a/pkgs/by-name/so/softhsm/package.nix
+++ b/pkgs/by-name/so/softhsm/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  botan2,
+  openssl,
   sqlite,
   autoreconfHook,
 }:
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "--with-crypto-backend=botan"
-    "--with-botan=${lib.getDev botan2}"
+    "--with-crypto-backend=openssl"
+    "--with-openssl=${lib.getDev openssl}"
     "--with-objectstore-backend-db"
     "--sysconfdir=$out/etc"
     "--localstatedir=$out/var"
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    botan2
+    openssl
     sqlite
   ];
 

From 94a62b70da0de0a365e9998d1a7f8fc9e3f195cd Mon Sep 17 00:00:00 2001
From: Jacek Galowicz <jacek@galowicz.de>
Date: Wed, 24 Sep 2025 15:42:39 +0200
Subject: [PATCH 102/306] iproute2: Don't add python dependency by default

---
 pkgs/by-name/ip/iproute2/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index ab399a44c343b..c298e3452a354 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation rec {
   outputs = [
     "out"
     "dev"
+    "scripts"
   ];
 
   configureFlags = [
@@ -87,6 +88,10 @@ stdenv.mkDerivation rec {
     "CONFDIR=$(out)/etc/iproute2"
   ];
 
+  postInstall = ''
+    moveToOutput sbin/routel "$scripts"
+  '';
+
   depsBuildBuild = [ buildPackages.stdenv.cc ]; # netem requires $HOSTCC
   nativeBuildInputs = [
     bison

From b7b1ce197f43b6b916ac8e8cc4b2cc736a5e8f05 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 24 Sep 2025 15:13:33 +0200
Subject: [PATCH 103/306] nodejs_22: 22.19.0 -> 22.20.0

---
 pkgs/development/web/nodejs/nodejs.nix |  4 ++++
 pkgs/development/web/nodejs/v22.nix    | 16 +++++++---------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index fad46782599c8..863be3a828f37 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -420,6 +420,10 @@ let
             ]
             # Those are annoyingly flaky, but not enough to be marked as such upstream.
             ++ lib.optional (majorVersion == "22") "test-child-process-stdout-flush-exit"
+            ++ lib.optionals (majorVersion == "22" && stdenv.buildPlatform.isDarwin) [
+              "test-cluster-dgram-1"
+              "test/sequential/test-http-server-request-timeouts-mixed.js"
+            ]
           )
         }"
       ];
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index 0a794f6e3e419..182103df4262d 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -15,12 +15,16 @@ let
     python = python3;
   };
 
-  gypPatches = if stdenv.buildPlatform.isDarwin then callPackage ./gyp-patches.nix { } else [ ];
+  gypPatches =
+    if stdenv.buildPlatform.isDarwin then
+      callPackage ./gyp-patches.nix { patch_tools = false; }
+    else
+      [ ];
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.19.0";
-  sha256 = "0272acfce50ce9ad060288321b1092719a7f19966f81419835410c59c09daa46";
+  version = "22.20.0";
+  sha256 = "ff7a6a6e8a1312af5875e40058351c4f890d28ab64c32f12b2cc199afa22002d";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -53,11 +57,5 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
-
-      # TODO: remove when included in a release
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/499a5c345165f0d4a94b98d08f1ace7268781564.patch?full_index=1";
-        hash = "sha256-wF4+CytC1OB5egJGOfLm1USsYY12f9kADymVrxotezE=";
-      })
     ];
 }

From b95b6d641ef6f188fc0bcf8f114fa7f6805e491d Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Tue, 16 Sep 2025 19:58:22 +0300
Subject: [PATCH 104/306] python27: fix build with gcc15

- add " -std=gnu17" to `env.NIX_CFLAGS_COMPILE`

Fixes build failure with gcc15:
```
In file included from Include/Python-ast.h:3,
                 from Python/bltinmodule.c:4:
Include/asdl.h:9:15: error: cannot use keyword 'false' as enumeration constant
    9 | typedef enum {false, true} bool;
      |               ^~~~~
Include/asdl.h:9:15: note: 'false' is a keyword with '-std=c23' onwards
Include/asdl.h:9:28: error: expected ';', identifier or '(' before 'bool'
    9 | typedef enum {false, true} bool;
      |                            ^~~~
Include/asdl.h:9:28: warning: useless type name in empty declaration
In file included from Include/Python-ast.h:3,
                 from Python/compile.c:26:
Include/asdl.h:9:15: error: cannot use keyword 'false' as enumeration constant
    9 | typedef enum {false, true} bool;
      |               ^~~~~
Include/asdl.h:9:15: note: 'false' is a keyword with '-std=c23' onwards
Include/asdl.h:9:28: error: expected ';', identifier or '(' before 'bool'
    9 | typedef enum {false, true} bool;
      |                            ^~~~
```
---
 pkgs/development/interpreters/python/cpython/2.7/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 94ff0c97dfa8b..2c2b3b597991e 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -319,7 +319,8 @@ stdenv.mkDerivation (
 
     env.NIX_CFLAGS_COMPILE =
       lib.optionalString (stdenv.targetPlatform.system == "x86_64-darwin") "-msse2"
-      + lib.optionalString stdenv.hostPlatform.isMusl " -DTHREAD_STACK_SIZE=0x100000";
+      + lib.optionalString stdenv.hostPlatform.isMusl " -DTHREAD_STACK_SIZE=0x100000"
+      + " -std=gnu17";
     DETERMINISTIC_BUILD = 1;
 
     setupHook = python-setup-hook sitePackages;

From 27ad68cde0af3d74d5d0350f2d2776de41fa363e Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Tue, 16 Sep 2025 14:24:55 +0300
Subject: [PATCH 105/306] graphite2: fix build with gcc15

- add patch from fedora, that adds missing `#include <stdint.h>`

Fixes build failure with gcc15:
```
/build/graphite2-1.3.14/tests/featuremap/featuremaptest.cpp: In function 'void testFeatTable(const T&, const std::string&)':
/build/graphite2-1.3.14/tests/featuremap/featuremaptest.cpp:310:14: error: 'uint16_t' was not declared in this scope [-Wtemplate-body]
  310 |         for (uint16_t j = 0; j < table.m_defs[i].m_numFeatSettings; j++)
      |              ^~~~~~~~
/build/graphite2-1.3.14/tests/featuremap/featuremaptest.cpp:310:14: note: 'uint16_t' is defined in header '<cstdint>'; this is probably fixable by adding '#include <cstdint>'
/build/graphite2-1.3.14/tests/featuremap/featuremaptest.cpp:310:30: error: 'j' was not declared in this scope [-Wtemplate-body]
  310 |         for (uint16_t j = 0; j < table.m_defs[i].m_numFeatSettings; j++)
      |                              ^
```
---
 pkgs/development/libraries/silgraphite/graphite2.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index 5a25cb3571d74..768e4a0ec359b 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   llvmPackages,
+  fetchpatch,
   fetchurl,
   pkg-config,
   freetype,
@@ -39,7 +40,14 @@ stdenv.mkDerivation (finalAttrs: {
     }
   );
 
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
+  patches = [
+    # Fix build with gcc15
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/graphite2/raw/deba28323b0a3b7a3dcfd06df1efc2195b102ed7/f/graphite2-1.3.14-gcc15.patch";
+      hash = "sha256-vkkGkHkcsj1mD3OHCHLWWgpcmFDv8leC4YQm+TsbIUw=";
+    })
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
   postPatch = ''
     # disable broken 'nametabletest' test, fails on gcc-13:
     #   https://github.com/silnrsi/graphite/pull/74

From ab31528a5c2dfd91daa05eb70b13ea1be0c9ca19 Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Tue, 16 Sep 2025 15:14:31 +0300
Subject: [PATCH 106/306] botan2: fix build with gcc15

- add patch from fedora that adds `#include <cstdint.h>` to cli.h

Fixes build failure with gcc15:
```
In file included from src/cli/argon2.cpp:7:
src/cli/cli.h:125:71: error: 'uint8_t' does not name a type
  125 |       static std::string format_blob(const std::string& format, const uint8_t bits[], size_t len);
      |                                                                       ^~~~~~~
src/cli/cli.h:18:1: note: 'uint8_t' is defined in header '<cstdint>';
this is probably fixable by adding '#include <cstdint>'
   17 | #include "cli_exceptions.h"
  +++ |+#include <cstdint>
   18 |
```
---
 pkgs/development/libraries/botan/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/botan/default.nix b/pkgs/development/libraries/botan/default.nix
index acf68d135c38e..9cfa9570b7f9b 100644
--- a/pkgs/development/libraries/botan/default.nix
+++ b/pkgs/development/libraries/botan/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchpatch,
   fetchurl,
   pkgsStatic,
   python3,
@@ -172,5 +173,13 @@ in
   botan2 = common {
     version = "2.19.5";
     hash = "sha256-3+6g4KbybWckxK8B2pp7iEh62y2Bunxy/K9S21IsmtQ=";
+    patches = [
+      # Fix build with gcc15
+      (fetchpatch {
+        name = "botan2-add-include-cstdint-gcc15.patch";
+        url = "https://src.fedoraproject.org/rpms/botan2/raw/c3fb7a3800df117e7ef8a7617ac8eacb31a4464a/f/f765f0b312f2998498f629d93369babfb2c975b4.patch";
+        hash = "sha256-8Yhxd5TCgxUMtRiv3iq5sQaVjDF+b9slppm38/6l6lw=";
+      })
+    ];
   };
 }

From c529f16459b0f725dc15d2d33bc0e012551bc1be Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Tue, 16 Sep 2025 15:25:37 +0300
Subject: [PATCH 107/306] assimp: fix build with gcc15

- add patch from merged upstream PR:
https://www.github.com/assimp/assimp/pull/6283

Fixes build failure with gcc15:
```
/build/source/code/AssetLib/X3D/X3DGeoHelper.cpp: In static member
function 'static void Assimp::X3DGeoHelper::coordIdx_str2lines_arr(const std::vector<int>&, std::vector<aiFace>&)':
/build/source/code/AssetLib/X3D/X3DGeoHelper.cpp:194:20: error: array
subscript -1 is outside array bounds of 'int [2305843009213693951]' [-Werror=array-bounds=]
  194 |     if (f_data.back() != (-1)) {
      |         ~~~~~~~~~~~^~
In file included from /nix/store/9jzssiinw6a2dib6k3hzd48j6ywck4iw-gcc-15.2.0/include/c++/15.2.0/x86_64-unknown-linux-gnu/bits/c++allocator.h:33,
                 from /nix/store/9jzssiinw6a2dib6k3hzd48j6ywck4iw-gcc-15.2.0/include/c++/15.2.0/bits/allocator.h:46,
                 from /nix/store/9jzssiinw6a2dib6k3hzd48j6ywck4iw-gcc-15.2.0/include/c++/15.2.0/string:45,
                 from /build/source/include/assimp/types.h:78,
                 from /build/source/code/AssetLib/X3D/X3DGeoHelper.h:6,
                 from /build/source/code/AssetLib/X3D/X3DGeoHelper.cpp:1:
```
---
 pkgs/by-name/as/assimp/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/as/assimp/package.nix b/pkgs/by-name/as/assimp/package.nix
index 183254f193887..98efe5c597ea2 100644
--- a/pkgs/by-name/as/assimp/package.nix
+++ b/pkgs/by-name/as/assimp/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   zlib,
   nix-update-script,
@@ -23,6 +24,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ixtqK+3iiL17GEbEVHz5S6+gJDDQP7bVuSfRMJMGEOY=";
   };
 
+  patches = [
+    # Fix build with gcc15
+    # https://github.com/assimp/assimp/pull/6283
+    (fetchpatch {
+      name = "assimp-fix-invalid-vector-gcc15.patch";
+      url = "https://github.com/assimp/assimp/commit/59bc03d931270b6354690512d0c881eec8b97678.patch";
+      hash = "sha256-O+JPwcOdyFtmFE7eZojHo1DUavF5EhLYlUyxtYo/KF4=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [

From 666a42cdf57e7d64d108b9ae96e013cebf3f6c02 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Thu, 25 Sep 2025 23:52:06 +0200
Subject: [PATCH 108/306] onetbb: build tbbbind

---
 pkgs/by-name/on/onetbb/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/on/onetbb/package.nix b/pkgs/by-name/on/onetbb/package.nix
index 6cebaf75422c1..29e59fdb0512a 100644
--- a/pkgs/by-name/on/onetbb/package.nix
+++ b/pkgs/by-name/on/onetbb/package.nix
@@ -4,7 +4,9 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
+  hwloc,
   ninja,
+  pkg-config,
   ctestCheckHook,
 }:
 
@@ -55,6 +57,11 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     ctestCheckHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    hwloc
   ];
 
   doCheck = true;
@@ -74,6 +81,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'tbb_add_test(SUBDIR conformance NAME conformance_resumable_tasks DEPENDENCIES TBB::tbb)' ""
   '';
 
+  cmakeFlags = [
+    (lib.cmakeBool "TBB_DISABLE_HWLOC_AUTOMATIC_SEARCH" false)
+  ];
+
   env = {
     # Fix build with modern gcc
     # In member function 'void std::__atomic_base<_IntTp>::store(__int_type, std::memory_order) [with _ITp = bool]',

From 0d3a9e16a7576a548c321aa47179274c31d47d37 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Sep 2025 01:17:47 +0000
Subject: [PATCH 109/306] glslang: 15.4.0 -> 16.0.0

---
 pkgs/by-name/gl/glslang/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gl/glslang/package.nix b/pkgs/by-name/gl/glslang/package.nix
index a4e3e5a6987d5..51a7e8699a672 100644
--- a/pkgs/by-name/gl/glslang/package.nix
+++ b/pkgs/by-name/gl/glslang/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "15.4.0";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = version;
-    hash = "sha256-sPc+G7/ua7LQ7scuSvqWs7Q7Q+gFvXQ5wGQsEXbWH6w=";
+    hash = "sha256-/DwdyuSGCx22zsXZrcZGTECfsIqvzPQzTZ2mU8EkjxY=";
   };
 
   outputs = [

From 74dd1a10a1b29bdd4a71ce0b7e62bf6c5fcfc256 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 26 Sep 2025 06:22:47 +0100
Subject: [PATCH 110/306] ell: 0.79 -> 0.80

Changes: https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ChangeLog?h=0.80
---
 pkgs/by-name/el/ell/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/el/ell/package.nix b/pkgs/by-name/el/ell/package.nix
index 57ced639540a1..85795193b0d99 100644
--- a/pkgs/by-name/el/ell/package.nix
+++ b/pkgs/by-name/el/ell/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.79";
+  version = "0.80";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-5NqzuUDimairQJjHsSy0sbpqiDfNDvrt3BEV9e1bF1E=";
+    hash = "sha256-B7Dz5H49d8kQaHfPQt7Y3f9D6EdqLOBMK+378g4E46U=";
   };
 
   nativeBuildInputs = [

From 5c81ed24ab3b6739d7063d2518a76864cb24c003 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Sep 2025 03:33:41 -0700
Subject: [PATCH 111/306] python3Packages.pyyaml: 6.0.2 -> 6.0.3

Diff: https://github.com/yaml/pyyaml/compare/6.0.2...6.0.3

Changelog: https://github.com/yaml/pyyaml/blob/refs/tags/6.0.3/CHANGES
---
 pkgs/development/python-modules/pyyaml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyyaml/default.nix b/pkgs/development/python-modules/pyyaml/default.nix
index 141fe5570f5be..51c2eecdacb86 100644
--- a/pkgs/development/python-modules/pyyaml/default.nix
+++ b/pkgs/development/python-modules/pyyaml/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyyaml";
-  version = "6.0.2";
+  version = "6.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "yaml";
     repo = "pyyaml";
     tag = version;
-    hash = "sha256-IQoZd9Lp0ZHLAQN3PFwMsZVTsIVJyIaT9D6fpkzA8IA=";
+    hash = "sha256-jUooIBp80cLxvdU/zLF0X8Yjrf0Yp9peYeiFjuV8AHA=";
   };
 
   build-system = [

From a6a095bc4665526e28eb219dd7d2f0e4a08228aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Sep 2025 03:44:10 -0700
Subject: [PATCH 112/306] python3Packages.trove-classifiers: 2025.8.26.11 ->
 2025.9.11.17

Changelog: https://github.com/pypa/trove-classifiers/releases/tag/2025.9.11.17
---
 pkgs/development/python-modules/trove-classifiers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 5cea96d34d29a..2b5ec73544c38 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -10,13 +10,13 @@
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2025.8.26.11";
+    version = "2025.9.11.17";
     pyproject = true;
 
     src = fetchPypi {
       pname = "trove_classifiers";
       inherit version;
-      hash = "sha256-5z7/8xfEkqeZAJL5wSZ2xwW/bP5AolipP2P0tMmUFDI=";
+      hash = "sha256-kxyphBpenJQIvCrme1DSis+FvvViGbVoYIdt0fLQJN0=";
     };
 
     postPatch = ''

From 4b90ae30ff87b210e9a7da58b449a2d33fe93ec9 Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Tue, 16 Sep 2025 17:19:32 +0300
Subject: [PATCH 113/306] hotdoc: fix build with gcc15
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- add patch from merged upstream commit:
https://github.com/hotdoc/hotdoc/commit/adf8518431fafb78c9b47862a0a9a58824b6a421

Fixes build failure with gcc15:
```
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l: In function ‘yylex’:
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l:49:10:
error: too many arguments to function ‘parse_comment’; expected 0, have 1
   49 | "/*"                            { return parse_comment (comments);}
      |          ^~~~~~~~~~~~~  ~~~~~~~~
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l:37:12: note: declared here
   37 | static int parse_comment ();
      |            ^~~~~~~~~~~~~
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l:50:10:
error: too many arguments to function ‘parse_define’; expected 0, have 1
   50 | {HASH}{SPACE}*"define"{SPACE}*  { return parse_define (comments); }
      |          ^~~~~~~~~~~~  ~~~~~~~~
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l:38:12: note: declared here
   38 | static int parse_define ();
      |            ^~~~~~~~~~~~
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l: At top level:
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l:80:1:
error: conflicting types for ‘parse_define’; have ‘int(PyObject *)’ {aka ‘int(struct _object *)’}
   80 | parse_define (PyObject *comments)
      | ^~~~~~~~~~~~
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l:38:12:
note: previous declaration of ‘parse_define’ with type ‘int(void)’
   38 | static int parse_define ();
      |            ^~~~~~~~~~~~
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l:126:1:
error: conflicting types for ‘parse_comment’; have ‘int(PyObject *)’ {aka ‘int(struct _object *)’}
  126 | parse_comment (PyObject *comments)
      | ^~~~~~~~~~~~~
/build/hotdoc-0.17.4/hotdoc/parsers/c_comment_scanner/scanner.l:37:12:
note: previous declaration of ‘parse_comment’ with type ‘int(void)’
   37 | static int parse_comment ();
      |            ^~~~~~~~~~~~~
```
---
 pkgs/development/tools/hotdoc/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/development/tools/hotdoc/default.nix
index 505182bc06aa5..b6ee390228d9a 100644
--- a/pkgs/development/tools/hotdoc/default.nix
+++ b/pkgs/development/tools/hotdoc/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   buildPythonApplication,
+  fetchpatch,
   fetchPypi,
   replaceVars,
   clang,
@@ -45,6 +46,13 @@ buildPythonApplication rec {
       clang = lib.getExe clang;
       libclang = "${lib.getLib libclang}/lib/libclang${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
+
+    # Fix build with gcc15
+    (fetchpatch {
+      name = "hotdoc-fix-c_comment_scanner-function-prototypes-gcc15.patch";
+      url = "https://github.com/hotdoc/hotdoc/commit/adf8518431fafb78c9b47862a0a9a58824b6a421.patch";
+      hash = "sha256-5y50Yk+AjV3aSk8H3k9od/Yvy09FyQQOcVOAcstQnw8=";
+    })
   ];
 
   build-system = [ setuptools ];

From efaef9f99689d58ea69b1e1622ce2887b4581365 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 26 Sep 2025 18:39:52 +0200
Subject: [PATCH 114/306] jdk11: 11.0.28+6 -> 11.0.29+5

---
 pkgs/development/compilers/openjdk/11/source.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/11/source.json b/pkgs/development/compilers/openjdk/11/source.json
index f6a4db45ee480..ab37d28ec1bee 100644
--- a/pkgs/development/compilers/openjdk/11/source.json
+++ b/pkgs/development/compilers/openjdk/11/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-yJljuO6jflh6kbe4ipflPiNDbKvKyA4grMAFu4UCM+Y=",
+  "hash": "sha256-u8SWC0T4rmQVV3TKfEW1/rCT8KWNsL5hZtUW3pXBIfA=",
   "owner": "openjdk",
   "repo": "jdk11u",
-  "rev": "refs/tags/jdk-11.0.28+6"
+  "rev": "refs/tags/jdk-11.0.29+5"
 }

From 6488cc76a8ab3a31f3c357f93790922f4afff72a Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 26 Sep 2025 18:40:04 +0200
Subject: [PATCH 115/306] jdk17: 17.0.16+8 -> 17.0.17+8

---
 pkgs/development/compilers/openjdk/17/source.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/17/source.json b/pkgs/development/compilers/openjdk/17/source.json
index 5a27a56c47149..2b5813a3fd68e 100644
--- a/pkgs/development/compilers/openjdk/17/source.json
+++ b/pkgs/development/compilers/openjdk/17/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-YN9mPfi3oMGjeRIren2cdWWySpYXsIcOnP29Zh3ym8c=",
+  "hash": "sha256-xwi7Co0DiEx9IohwiQHpislv/50NdGuHVQINJcasBdY=",
   "owner": "openjdk",
   "repo": "jdk17u",
-  "rev": "refs/tags/jdk-17.0.16+8"
+  "rev": "refs/tags/jdk-17.0.17+8"
 }

From b4325a34fa63f49a84e8d02d28b246659b813d8c Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 26 Sep 2025 18:40:17 +0200
Subject: [PATCH 116/306] jdk21: 21.0.8+9 -> 21.0.9+8

---
 pkgs/development/compilers/openjdk/21/source.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/21/source.json b/pkgs/development/compilers/openjdk/21/source.json
index a514f2dc908e4..438a484ff2b6a 100644
--- a/pkgs/development/compilers/openjdk/21/source.json
+++ b/pkgs/development/compilers/openjdk/21/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-8wUwxjhAGIp1bzny2e86vPH9q4vw1kLDoTjO7FrJbx4=",
+  "hash": "sha256-NgunrSUchIlHkaXM9h75U4xcf44ukCuhhPPHHGVOKXo=",
   "owner": "openjdk",
   "repo": "jdk21u",
-  "rev": "refs/tags/jdk-21.0.8+9"
+  "rev": "refs/tags/jdk-21.0.9+8"
 }

From 80487ae22424cb80545462068e6c099986f9d8c8 Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Tue, 16 Sep 2025 18:43:29 +0300
Subject: [PATCH 117/306] freeglut: fix build with gcc15

- add patch from merged upstream PR:
https://www.github.com/freeglut/freeglut/pull/187

Fixes build failure with gcc15:
```
/build/freeglut-3.6.0/src/x11/fg_init_x11.c:297:6: error: conflicting
types for 'fgPlatformDestroyContext'; have 'void(SFG_PlatformDisplay,
struct __GLXcontextRec *)' {aka 'void(struct tagSFG_PlatformDisplay,
struct __GLXcontextRec *)'}
  297 | void fgPlatformDestroyContext ( SFG_PlatformDisplay pDisplay, SFG_WindowContextType MContext )
      |      ^~~~~~~~~~~~~~~~~~~~~~~~
In file included from /build/freeglut-3.6.0/src/x11/fg_init_x11.c:34:
/build/freeglut-3.6.0/src/egl/fg_init_egl.h:31:13: note: previous
declaration of 'fgPlatformDestroyContext' with type 'void(void)'
   31 | extern void fgPlatformDestroyContext();
      |             ^~~~~~~~~~~~~~~~~~~~~~~~
/build/freeglut-3.6.0/src/x11/fg_init_x11.c:297:6: error: conflicting
types for 'fgPlatformDestroyContext'; have 'void(SFG_PlatformDisplay,
struct __GLXcontextRec *)' {aka 'void(struct tagSFG_PlatformDisplay,
struct __GLXcontextRec *)'}
  297 | void fgPlatformDestroyContext ( SFG_PlatformDisplay pDisplay, SFG_WindowContextType MContext )
      |      ^~~~~~~~~~~~~~~~~~~~~~~~
In file included from /build/freeglut-3.6.0/src/x11/fg_init_x11.c:34:
/build/freeglut-3.6.0/src/egl/fg_init_egl.h:31:13: note: previous
declaration of 'fgPlatformDestroyContext' with type 'void(void)'
   31 | extern void fgPlatformDestroyContext();
      |             ^~~~~~~~~~~~~~~~~~~~~~~~
```
---
 pkgs/by-name/fr/freeglut/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/fr/freeglut/package.nix b/pkgs/by-name/fr/freeglut/package.nix
index e112d25a82fe8..4397b47e08d5c 100644
--- a/pkgs/by-name/fr/freeglut/package.nix
+++ b/pkgs/by-name/fr/freeglut/package.nix
@@ -29,6 +29,14 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/freeglut/freeglut/commit/2294389397912c9a6505a88221abb7dca0a4fb79.patch";
       hash = "sha256-buNhlVUbDekklnar6KFWN/GUKE+jMEqTGrY3LY0LwVs=";
     })
+
+    # Fix build with gcc15
+    # https://github.com/freeglut/freeglut/pull/187
+    (fetchpatch {
+      name = "freeglut-fix-fgPlatformDestroyContext-prototype-for-C23.patch";
+      url = "https://github.com/freeglut/freeglut/commit/800772e993a3ceffa01ccf3fca449d3279cde338.patch";
+      hash = "sha256-agXw3JHq81tx5514kkorvuU5mX4E3AV930hy1OJl4L0=";
+    })
   ];
 
   outputs = [

From c1896dd80ba20f72e2b7036bd4cbb582bf19714c Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sat, 27 Sep 2025 13:13:42 +0200
Subject: [PATCH 118/306] grpc: 1.75.0 -> 1.75.1

---
 pkgs/by-name/gr/grpc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/grpc/package.nix b/pkgs/by-name/gr/grpc/package.nix
index f52a2cdfb1a53..0e71063ec0b0b 100644
--- a/pkgs/by-name/gr/grpc/package.nix
+++ b/pkgs/by-name/gr/grpc/package.nix
@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.75.0"; # N.B: if you change this, please update:
+  version = "1.75.1"; # N.B: if you change this, please update:
   # pythonPackages.grpcio
   # pythonPackages.grpcio-channelz
   # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     tag = "v${version}";
-    hash = "sha256-2SeL/O6FaAnrPXMHAPKCSzx3hlcKLuC5y+ljJ1gewkE=";
+    hash = "sha256-SnKK52VLO4MM/ftfmzRV/LeLfOucdIyHMyWk6EKRfvM=";
     fetchSubmodules = true;
   };
 

From d614f230f09fbe79cde5663c09aa8280444ea5f7 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sat, 27 Sep 2025 13:13:47 +0200
Subject: [PATCH 119/306] python3Packages.grpcio: 1.75.0 -> 1.75.1

---
 pkgs/development/python-modules/grpcio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 81a5e604af724..f8d67db96e648 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -19,14 +19,14 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uYnosJSJR4wtGf7MdEopiTD0DYsnw2OK+/6E0i82zk4=";
+    hash = "sha256-PoHYns6ZuaziOmkWiAusphPAOnmZJa+yhXiH76ixs9I=";
   };
 
   outputs = [

From 3ef539296933d80162f85dced711e85308f6cf51 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sat, 27 Sep 2025 13:14:10 +0200
Subject: [PATCH 120/306] python3Packages.grpcio-channelz: 1.75.0 -> 1.75.1

---
 pkgs/development/python-modules/grpcio-channelz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index 8503cf2e76ced..012af3877b96b 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_channelz";
     inherit version;
-    hash = "sha256-1SGXOjQ4Bqg4S/h86uk88unxD4+rAsEr56Lj1dDk5o8=";
+    hash = "sha256-4MqgbU3j62LT/cVOXJ3JADqj7iHpxQ9dNTiuqFTSdvI=";
   };
 
   build-system = [ setuptools ];

From 76c6a6a4cf7db4f0d7ba9fe036256530d2ea8393 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sat, 27 Sep 2025 13:14:13 +0200
Subject: [PATCH 121/306] python3Packages.grpcio-health-checking: 1.75.0 ->
 1.75.1

---
 .../python-modules/grpcio-health-checking/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index 419872582d454..fe84d0817569e 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -11,13 +11,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.75.0";
+  version = "1.75.1";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_health_checking";
     inherit version;
-    hash = "sha256-TeXrJwlihA9g4Ynr3b/P4jK17Pz2GN1TQRam9mhLQL8=";
+    hash = "sha256-iI6huGrWXALIVHSG6VJjVi4UU2Pj1UAPUkT38sUyPmM=";
   };
 
   propagatedBuildInputs = [

From 2b524f18a948d0ce40567d584c50bb1c6894b035 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sat, 27 Sep 2025 13:14:17 +0200
Subject: [PATCH 122/306] python3Packages.grpcio-reflection: 1.75.0 -> 1.75.1

---
 pkgs/development/python-modules/grpcio-reflection/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index 3d5886bfc494f..4b6290afd7915 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_reflection";
     inherit version;
-    hash = "sha256-YLuYZfVBGtWJQg6tzdfgwzjAqr7fXUzQc2PVv32pyXI=";
+    hash = "sha256-K+PyC3uT5uaRoLx2H9fpmWqUC0yWxo9spPf7xHw/S2Q=";
   };
 
   build-system = [ setuptools ];

From 9d63aed19a3b655e1ccd1d8cd1c93a2ff97fc20d Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sat, 27 Sep 2025 13:14:20 +0200
Subject: [PATCH 123/306] python3Packages.grpcio-status: 1.75.0 -> 1.75.1

---
 pkgs/development/python-modules/grpcio-status/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 4c26accf3eba3..51294793b6397 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -13,7 +13,7 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.75.0";
+  version = "1.75.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "grpcio_status";
     inherit version;
-    hash = "sha256-adW5G+G4uSbwhsHEg1GalowUZAdzoMzdbAQoJRXb7fc=";
+    hash = "sha256-gWKvohgzoghckQicw5WtiA+sE3ih1gIz2XZkntcky/g=";
   };
 
   postPatch = ''

From 85bfe3589496a7f6a3a121cc1ceb59fec17aac13 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sat, 27 Sep 2025 13:14:24 +0200
Subject: [PATCH 124/306] python3Packages.grpcio-testing: 1.75.0 -> 1.75.1

---
 pkgs/development/python-modules/grpcio-testing/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 5537e6a1caca6..6edd72430bfaf 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -13,7 +13,7 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "grpcio_testing";
     inherit version;
-    hash = "sha256-UuDE9gL6rQAK4a/PnZVDdyd+t8lhTMXJ+CspAHbEBbs=";
+    hash = "sha256-RUF4XosbetXbFVEyGsFE3WOM/z0fsC+St9ZRHFhLmKg=";
   };
 
   postPatch = ''

From e24e2e500e85f9d25487e47934c7a298dfca6937 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sat, 27 Sep 2025 13:14:27 +0200
Subject: [PATCH 125/306] python3Packages.grpcio-tools: 1.75.0 -> 1.75.1

---
 pkgs/development/python-modules/grpcio-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index c8af7dfff6913..254f2f94b5ede 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_tools";
     inherit version;
-    hash = "sha256-615AJQNNkto8gf1eNGjDPVrnVxsHpyw4W17BdGZYVz8=";
+    hash = "sha256-u3iWDPPViUHh/scMvazPJVkYvu0Tw0ESppFabY+s69E=";
   };
 
   outputs = [

From 1cc4f76aa7f7d12cf0d3a1b8125bad5c2b38900a Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Tue, 16 Sep 2025 18:32:32 +0300
Subject: [PATCH 126/306] ppp: fix build with gcc15

- add patch from merged upstream PR:
https://www.github.com/ppp-project/ppp/pull/548

Fixes build failure with gcc15:
```
pppdump.c:81:9: error: too many arguments to function 'dumplog'; expected 0, have 1
   81 |         dumplog(stdin);
      |         ^~~~~~~ ~~~~~
pppdump.c:45:6: note: declared here
   45 | void dumplog();
      |      ^~~~~~~
pppdump.c:90:17: error: too many arguments to function 'dumpppp'; expected 0, have 1
   90 |                 dumpppp(f);
      |                 ^~~~~~~ ~
pppdump.c:46:6: note: declared here
   46 | void dumpppp();
      |      ^~~~~~~
pppdump.c:92:17: error: too many arguments to function 'dumplog'; expected 0, have 1
   92 |                 dumplog(f);
      |                 ^~~~~~~ ~
pppdump.c:45:6: note: declared here
   45 | void dumplog();
      |      ^~~~~~~
pppdump.c: In function 'dumplog':
pppdump.c:102:1: error: number of arguments doesn't match prototype
  102 | {
      | ^
pppdump.c:45:6: error: prototype declaration
   45 | void dumplog();
      |      ^~~~~~~
pppdump.c:175:13: error: too many arguments to function 'show_time'; expected 0, have 2
  175 |             show_time(f, c);
      |             ^~~~~~~~~ ~
pppdump.c:47:6: note: declared here
   47 | void show_time();
      |      ^~~~~~~~~
pppdump.c: In function 'dumpppp':
pppdump.c:246:1: error: number of arguments doesn't match prototype
  246 | {
      | ^
pppdump.c:46:6: error: prototype declaration
   46 | void dumpppp();
      |      ^~~~~~~
pppdump.c:369:13: error: too many arguments to function 'show_time'; expected 0, have 2
  369 |             show_time(f, c);
      |             ^~~~~~~~~ ~
pppdump.c:47:6: note: declared here
   47 | void show_time();
      |      ^~~~~~~~~
pppdump.c: In function 'show_time':
pppdump.c:381:1: error: number of arguments doesn't match prototype
  381 | {
      | ^
pppdump.c:47:6: error: prototype declaration
   47 | void show_time();
      |      ^~~~~~~~~
```
---
 pkgs/by-name/pp/ppp/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/pp/ppp/package.nix b/pkgs/by-name/pp/ppp/package.nix
index 280fa0522e897..b49ba381d5363 100644
--- a/pkgs/by-name/pp/ppp/package.nix
+++ b/pkgs/by-name/pp/ppp/package.nix
@@ -2,6 +2,7 @@
   autoreconfHook,
   bash,
   fetchFromGitHub,
+  fetchpatch,
   lib,
   libpcap,
   libxcrypt,
@@ -25,6 +26,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-NV8U0F8IhHXn0YuVbfFr992ATQZaXA16bb5hBIwm9Gs=";
   };
 
+  patches = [
+    # Fix build with gcc15
+    # https://github.com/ppp-project/ppp/pull/548
+    (fetchpatch {
+      url = "https://github.com/ppp-project/ppp/commit/05361692ee7d6260ce5c04c9fa0e5a1aa7565323.patch";
+      hash = "sha256-ybuWyA1t9IJ1Sg06a0b0tin4qssr0qzmenfGoA1X0BE=";
+    })
+  ];
+
   configureFlags = [
     "--localstatedir=/var"
     "--sysconfdir=/etc"

From aa4a715d84e3e65f1eae4b511e369f1c0a1e7da7 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 27 Sep 2025 17:54:16 +0200
Subject: [PATCH 127/306] expat: 2.7.2 -> 2.7.3

https://github.com/libexpat/libexpat/blob/R_2_7_3/expat/Changes
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index ba5a46d034f84..d650a64b19fc8 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.7.2";
+  version = "2.7.3";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-Ibd4s07IN8KsKFrvNA+ftfoGOoEbIepNJBKpcCyImVw=";
+    hash = "sha256-cd+PQHBqe7CoClNnB56nXZHaT4xlxY7Fm837997Nq58=";
   };
 
   strictDeps = true;

From d75645baa769264daaca223464052ed46c879234 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 27 Sep 2025 21:12:49 +0200
Subject: [PATCH 128/306] python3Packages.markupsafe: 3.0.2 -> 3.0.3

https://markupsafe.palletsprojects.com/page/changes/#version-3-0-3
---
 pkgs/development/python-modules/markupsafe/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/markupsafe/default.nix b/pkgs/development/python-modules/markupsafe/default.nix
index 96cee74b4ab80..3e9582f7fc315 100644
--- a/pkgs/development/python-modules/markupsafe/default.nix
+++ b/pkgs/development/python-modules/markupsafe/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "markupsafe";
-  version = "3.0.2";
+  version = "3.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "pallets";
     repo = "markupsafe";
     tag = version;
-    hash = "sha256-BqCkQqPhjEx3qB/k3d3fSirR/HDBa7e4kpx3/VSwXJM=";
+    hash = "sha256-2d64cItemqVM25WJIKrjExKz6v4UW2wVxM6phH1g1sE=";
   };
 
   build-system = [ setuptools ];

From 5c3433cf6a392c7af0211ea7012479bcd2fe2fe9 Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Tue, 16 Sep 2025 18:34:35 +0300
Subject: [PATCH 129/306] libsndfile: fix build with gcc15

- add patch from merged upstream PR:
https://www.github.com/libsndfile/libsndfile/pull/1055

Fixes build failure with gcc15:
```
src/ALAC/alac_decoder.c:42:9: error: cannot use keyword 'false' as enumeration constant
   42 | {       false = 0,
      |         ^~~~~
src/ALAC/alac_decoder.c:42:9: note: 'false' is a keyword with '-std=c23' onwards
src/ALAC/alac_decoder.c:44:3: error: expected ';', identifier or '(' before 'bool'
   44 | } bool ;
      |   ^~~~
src/ALAC/alac_decoder.c:44:3: warning: useless type name in empty declaration
make[2]: *** [Makefile:2615: src/ALAC/alac_decoder.lo] Error 1
make[2]: *** Waiting for unfinished jobs....
src/ALAC/alac_encoder.c:49:9: error: cannot use keyword 'false' as enumeration constant
   49 |         false = 0,
      |         ^~~~~
src/ALAC/alac_encoder.c:49:9: note: 'false' is a keyword with '-std=c23' onwards
src/ALAC/alac_encoder.c:51:3: error: expected ';', identifier or '(' before 'bool'
   51 | } bool ;
      |   ^~~~
```
---
 pkgs/by-name/li/libsndfile/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/li/libsndfile/package.nix b/pkgs/by-name/li/libsndfile/package.nix
index 3e894e8e40f4f..4884e3480e499 100644
--- a/pkgs/by-name/li/libsndfile/package.nix
+++ b/pkgs/by-name/li/libsndfile/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   autogen,
   pkg-config,
@@ -35,6 +36,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-MOOX/O0UaoeMaQPW9PvvE0izVp+6IoE5VbtTx0RvMkI=";
   };
 
+  patches = [
+    # Fix build with gcc15
+    # https://github.com/libsndfile/libsndfile/pull/1055
+    (fetchpatch {
+      url = "https://github.com/libsndfile/libsndfile/commit/2251737b3b175925684ec0d37029ff4cb521d302.patch";
+      hash = "sha256-LaeptEicnjpVBExlK4dNMlN8+AAJhW8dIvemF6S4W2M=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     autogen

From f751823dce159c2f1507f1cbee9a909babf67f80 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Sep 2025 03:18:47 +0200
Subject: [PATCH 130/306] python3Packages.trio: 0.30.0 -> 0.31.0

https://github.com/python-trio/trio/blob/v0.31.0/docs/source/history.rst
---
 pkgs/development/python-modules/trio/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/trio/default.nix b/pkgs/development/python-modules/trio/default.nix
index 0dc38d643bf34..99a6a5e5d2212 100644
--- a/pkgs/development/python-modules/trio/default.nix
+++ b/pkgs/development/python-modules/trio/default.nix
@@ -21,6 +21,7 @@
   pyopenssl,
   pytestCheckHook,
   pytest-trio,
+  pyyaml,
   trustme,
 }:
 
@@ -35,7 +36,7 @@ let
 in
 buildPythonPackage rec {
   pname = "trio";
-  version = "0.30.0";
+  version = "0.31.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -44,7 +45,7 @@ buildPythonPackage rec {
     owner = "python-trio";
     repo = "trio";
     tag = "v${version}";
-    hash = "sha256-spYHwVq3iNhnZQf2z7aTyDuSCiSl3X5PD6siXqLC4EA=";
+    hash = "sha256-cl1GstWVHDD3nWx835k2hnswt/+AnoTLXjxVIfLP6Es=";
   };
 
   build-system = [ setuptools ];
@@ -66,6 +67,7 @@ buildPythonPackage rec {
     pyopenssl
     pytestCheckHook
     pytest-trio'
+    pyyaml
     trustme
   ];
 

From cde3cab7eed2dd4074d2e47f154a8dc17a7624a6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Sep 2025 03:19:46 +0200
Subject: [PATCH 131/306] python3Packages.anyio: 4.10.0 -> 4.11.0

https://github.com/agronholm/anyio/blob/4.11.0/docs/versionhistory.rst
---
 pkgs/development/python-modules/anyio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 99fd7ff5dcabd..f5e02b9d2067c 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "4.10.0";
+  version = "4.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "agronholm";
     repo = "anyio";
     tag = version;
-    hash = "sha256-9nOGQTqdO3VzA9c97BpZqqwpll5O5+3gRvF/l2Y2ars=";
+    hash = "sha256-TOXg9J/Z2S5/X7OBgU+J0HZNB3BDluaWTqDiqp3O4ek=";
   };
 
   build-system = [ setuptools-scm ];

From 61965ae0d79fb88d4b6f995a07d9fc98dacad8c0 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 28 Sep 2025 10:16:09 +0100
Subject: [PATCH 132/306] libunistring: 1.3 -> 1.4

Changes: https://savannah.gnu.org/news/?id=10818
---
 pkgs/development/libraries/libunistring/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 1d703fa5f89fe..43db16eb28f60 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -22,11 +22,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libunistring";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchurl {
     url = "mirror://gnu/libunistring/libunistring-${finalAttrs.version}.tar.gz";
-    hash = "sha256-jqjM+GwJ3YAcjKwZh46ATlT3B89piENxEw0gveaDhrc=";
+    hash = "sha256-9+Od3soYhY7N0Cxg0dU3T83LvNtraKOR+El8scss8/c=";
   };
 
   outputs = [

From 310a6343224bb8bdef3265987a5b6d07da0fa41d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 28 Sep 2025 15:04:33 +0200
Subject: [PATCH 133/306] python313Packages.dnspython: 2.7.0 -> 2.8.0

Changelog: https://github.com/rthalley/dnspython/blob/v2.8.0/doc/whatsnew.rst
---
 pkgs/development/python-modules/dnspython/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dnspython/default.nix b/pkgs/development/python-modules/dnspython/default.nix
index 469838fe4f2b2..6204b0dd25e3a 100644
--- a/pkgs/development/python-modules/dnspython/default.nix
+++ b/pkgs/development/python-modules/dnspython/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "dnspython";
-  version = "2.7.0";
+  version = "2.8.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zpxDLtoNyRz2GKXO3xpOFCZRGWu80sgOie1akH5c+vE=";
+    hash = "sha256-GB08aZZFLLEYnEBGxhWZuEpahuCZVi/9530mmE/ybQ8=";
   };
 
   build-system = [ hatchling ];

From 990f560a45630d26b5e23edac9d655485dd7905b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <fabian@affolter-engineering.ch>
Date: Tue, 23 Sep 2025 09:24:52 +0200
Subject: [PATCH 134/306] dnsdiag: 2.6.0 -> 2.7.0

Diff: https://github.com/farrokhi/dnsdiag/compare/v2.6.0...v2.7.0

Changelog: https://github.com/farrokhi/dnsdiag/releases/tag/v2.7.0
---
 pkgs/by-name/dn/dnsdiag/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dn/dnsdiag/package.nix b/pkgs/by-name/dn/dnsdiag/package.nix
index 8ae326177f879..ae1da2edbd498 100644
--- a/pkgs/by-name/dn/dnsdiag/package.nix
+++ b/pkgs/by-name/dn/dnsdiag/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dnsdiag";
-  version = "2.6.0";
+  version = "2.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "farrokhi";
     repo = "dnsdiag";
     tag = "v${version}";
-    hash = "sha256-6TDs+ncbVa7LWtGLlqEXJb9zzXZ+nAhbi4QGyCSu3ho=";
+    hash = "sha256-VTxIKqc7yFTLx7VLEjb4UwPKAmSD+4X+ZHrmriScVGA=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

From 92a7bc42ea4475cdfd3d0509e8b3207adead2572 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Sep 2025 21:31:49 +0200
Subject: [PATCH 135/306] python3Packages.zlib-ng: 0.5.1 -> 1.0.0

https://github.com/pycompression/python-zlib-ng/blob/v1.0.0/CHANGELOG.rst
---
 .../python-modules/zlib-ng/default.nix           | 15 ++++-----------
 .../python-modules/zlib-ng/version.patch         | 16 ----------------
 2 files changed, 4 insertions(+), 27 deletions(-)
 delete mode 100644 pkgs/development/python-modules/zlib-ng/version.patch

diff --git a/pkgs/development/python-modules/zlib-ng/default.nix b/pkgs/development/python-modules/zlib-ng/default.nix
index 15380edc65fa9..f17959460b610 100644
--- a/pkgs/development/python-modules/zlib-ng/default.nix
+++ b/pkgs/development/python-modules/zlib-ng/default.nix
@@ -2,12 +2,11 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  replaceVars,
 
   # build-system
   cmake,
   setuptools,
-  versioningit,
+  setuptools-scm,
 
   # native dependencies
   zlib-ng,
@@ -18,26 +17,20 @@
 
 buildPythonPackage rec {
   pname = "zlib-ng";
-  version = "0.5.1";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pycompression";
     repo = "python-zlib-ng";
     rev = "v${version}";
-    hash = "sha256-UsdZgpRI7h6GemT1+1g/cP/8uhLykZ//saH4JMwwlY4=";
+    hash = "sha256-t/PSby1LUTyp+7XXKZTWjRrPvAei1ZrGSGU2CIcAQBc=";
   };
 
-  patches = [
-    (replaceVars ./version.patch {
-      inherit version;
-    })
-  ];
-
   build-system = [
     cmake
     setuptools
-    versioningit
+    setuptools-scm
   ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/zlib-ng/version.patch b/pkgs/development/python-modules/zlib-ng/version.patch
deleted file mode 100644
index e1f3355256462..0000000000000
--- a/pkgs/development/python-modules/zlib-ng/version.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index 28ae41d..05ad409 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -2,9 +2,8 @@
- requires = ["setuptools>=64", "versioningit>=1.1.0"]
- build-backend = "setuptools.build_meta"
- 
--[tool.versioningit.vcs]
--method="git"
--default-tag = "v0.0.0"
-+[tool.versioningit]
-+default-version = "@version@"
- 
- [tool.versioningit.write]
- file = "src/zlib_ng/_version.py"

From 3e86adaa2530d528346a518dc80294595373eab2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Sep 2025 22:11:20 +0200
Subject: [PATCH 136/306] python3Packages.voluptuous-openapi: 0.1.0 -> 0.2.0

https://github.com/home-assistant-libs/voluptuous-openapi/releases/tag/0.2.0
---
 .../python-modules/voluptuous-openapi/default.nix           | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/voluptuous-openapi/default.nix b/pkgs/development/python-modules/voluptuous-openapi/default.nix
index 98d29e05eeced..215c495de8057 100644
--- a/pkgs/development/python-modules/voluptuous-openapi/default.nix
+++ b/pkgs/development/python-modules/voluptuous-openapi/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "voluptuous-openapi";
-  version = "0.1.0";
+  version = "0.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "voluptuous-openapi";
-    tag = "v${version}";
-    hash = "sha256-cfunRVEFz8gMLEtZ6nhH7w/rW5ea0JaaV+W/4gm4mwo=";
+    tag = version;
+    hash = "sha256-uIW+WyfSNdGxD7tA6ERf3nTp1tFhWd+lxFUNQM0O3nU=";
   };
 
   build-system = [ setuptools ];

From f85d20b66517b3aa01ee8e20e98cb0faf03508c7 Mon Sep 17 00:00:00 2001
From: Luna <git@lunnova.dev>
Date: Sun, 28 Sep 2025 21:07:43 -0700
Subject: [PATCH 137/306] llvmPackages.openmp: clean up rebuild avoidance

---
 pkgs/development/compilers/llvm/common/openmp/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/openmp/default.nix b/pkgs/development/compilers/llvm/common/openmp/default.nix
index ad4b485085ff7..1dcf4fe50a7bd 100644
--- a/pkgs/development/compilers/llvm/common/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/common/openmp/default.nix
@@ -46,9 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  # TODO: Remove on `staging`.
-  patchFlags = null;
-
   patches =
     lib.optional (lib.versionOlder release_version "19") (getVersionFile "openmp/fix-find-tool.patch")
     ++ [

From 35b7ec7f2dca74fcc2d38429a6a1bb4ec38f71c0 Mon Sep 17 00:00:00 2001
From: Tristan Ross <tristan.ross@determinate.systems>
Date: Sun, 28 Sep 2025 21:08:38 -0700
Subject: [PATCH 138/306] llvmPackages_21: 21.1.1 -> 21.1.2

---
 pkgs/development/compilers/llvm/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index a508347ba23b3..25b0efb1b7815 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -25,7 +25,7 @@ let
     "18.1.8".officialRelease.sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE=";
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
-    "21.1.1".officialRelease.sha256 = "sha256-IB9Z3bIMwfgw2W2Vxo89CmtCM9DfOyV2Ei64nqgHrgc=";
+    "21.1.2".officialRelease.sha256 = "sha256-SgZdBL0ivfv6/4EqmPQ+I57qT2t6i/rqnm20+T1BsFY=";
     "22.0.0-git".gitRelease = {
       rev = "e396dab01f3da49df16c710d105a409973df5a03";
       rev-version = "22.0.0-unstable-2025-09-21";

From 5b47e46becbe01740e8e219e7f4489f6168a1c0e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 21 Aug 2025 16:24:37 +0000
Subject: [PATCH 139/306] geos: 3.13.1 -> 3.14.0

---
 pkgs/development/libraries/geos/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/geos/default.nix b/pkgs/development/libraries/geos/default.nix
index a11d8097b8e8c..422269bea2477 100644
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geos";
-  version = "3.13.1";
+  version = "3.14.0";
 
   src = fetchFromGitHub {
     owner = "libgeos";
     repo = "geos";
     tag = finalAttrs.version;
-    hash = "sha256-zPVP01AMIBKMnKi6Sq++CIaVZb5JA1v8/QAdGzKdL8Y=";
+    hash = "sha256-tPuAYNi2Gfc/2hj8SFqnvuDztXkSAEoGPcvXVULrLKg=";
   };
 
   nativeBuildInputs = [ cmake ];

From 3a69acacdad1f2a648a36750923a9414e6c68e4e Mon Sep 17 00:00:00 2001
From: Ivan Mincik <ivan.mincik@gmail.com>
Date: Sat, 23 Aug 2025 11:50:23 +0200
Subject: [PATCH 140/306] python3Packages.shapely: fix tests for geos 3.14

---
 .../python-modules/shapely/default.nix          | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/development/python-modules/shapely/default.nix b/pkgs/development/python-modules/shapely/default.nix
index ccad45bbac48c..09b8911c172f2 100644
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   pytestCheckHook,
   pythonOlder,
 
@@ -27,6 +28,22 @@ buildPythonPackage rec {
     hash = "sha256-qIITlPym92wfq0byqjRxofpmYYg7vohbi1qPVEu6hRg=";
   };
 
+  patches = [
+    # Fix tests for GEOS 3.14
+    (fetchpatch {
+      url = "https://github.com/shapely/shapely/commit/a561132c4e13c1fde597f56a8a7133c3c09b9928.patch";
+      hash = "sha256-a9gDfw2Dw+fd82T9f0BufYd/+gxE+ALvWyLm4vHygzU=";
+    })
+    (fetchpatch {
+      url = "https://github.com/shapely/shapely/commit/56e16e6eb27c54c6c24b9a251c12414e289fb7d0.patch";
+      hash = "sha256-JyjPVcJswEozF4C73QotKsPou55H41Ct9oVgkxhDhbk=";
+    })
+    (fetchpatch {
+      url = "https://github.com/shapely/shapely/commit/19f807961da0a14ac707e4540c91b8d60d52dd08.patch";
+      hash = "sha256-3NHNiIOf9tbhFS/RAsRw1Yp/Bxy957WpsT+R5Vwp8uU=";
+    })
+  ];
+
   nativeBuildInputs = [
     cython
     geos # for geos-config

From 9386ff26ad67bbe477a4d4b44a00455d0558f4fa Mon Sep 17 00:00:00 2001
From: Augustin Trancart <augustin.trancart@gmail.com>
Date: Mon, 22 Sep 2025 11:51:18 +0200
Subject: [PATCH 141/306] pythonPackages.shapely: remove already applied patch

---
 pkgs/development/python-modules/shapely/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/development/python-modules/shapely/default.nix b/pkgs/development/python-modules/shapely/default.nix
index 09b8911c172f2..ecfe86b2e352e 100644
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@@ -38,10 +38,6 @@ buildPythonPackage rec {
       url = "https://github.com/shapely/shapely/commit/56e16e6eb27c54c6c24b9a251c12414e289fb7d0.patch";
       hash = "sha256-JyjPVcJswEozF4C73QotKsPou55H41Ct9oVgkxhDhbk=";
     })
-    (fetchpatch {
-      url = "https://github.com/shapely/shapely/commit/19f807961da0a14ac707e4540c91b8d60d52dd08.patch";
-      hash = "sha256-3NHNiIOf9tbhFS/RAsRw1Yp/Bxy957WpsT+R5Vwp8uU=";
-    })
   ];
 
   nativeBuildInputs = [

From 723c21585be774432e8accaf3e23fb269fa8d7b4 Mon Sep 17 00:00:00 2001
From: Augustin Trancart <augustin.trancart@oslandia.com>
Date: Fri, 26 Sep 2025 18:22:54 +0000
Subject: [PATCH 142/306] python3Packages.geopandas: fix tests for geos 3.14

---
 pkgs/development/python-modules/geopandas/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/python-modules/geopandas/default.nix b/pkgs/development/python-modules/geopandas/default.nix
index 3c9c36b0311bd..a7f5a5012ac71 100644
--- a/pkgs/development/python-modules/geopandas/default.nix
+++ b/pkgs/development/python-modules/geopandas/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   pytestCheckHook,
   setuptools,
 
@@ -38,6 +39,15 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
+  patches = [
+    # fix tests for geos 3.14
+    # see https://github.com/geopandas/geopandas/pull/3645
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/geopandas/geopandas/pull/3645.patch";
+      hash = "sha256-TLJixFRR+g739PLgwhTGuwYTVJ4SRr2BMGD14CLgmcY=";
+    })
+  ];
+
   dependencies = [
     packaging
     pandas

From d38939069a387cbea93e0d5f41d492d66f059ee0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 29 Sep 2025 03:43:02 -0700
Subject: [PATCH 143/306] python3Packages.syrupy: 4.9.1 -> 5.0.0

Diff: https://github.com/syrupy-project/syrupy/compare/v4.9.1...v5.0.0

Changelog: https://github.com/syrupy-project/syrupy/blob/v5.0.0/CHANGELOG.md
---
 pkgs/development/python-modules/syrupy/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/syrupy/default.nix b/pkgs/development/python-modules/syrupy/default.nix
index 36f4c0b81a71f..a213f3a3f547a 100644
--- a/pkgs/development/python-modules/syrupy/default.nix
+++ b/pkgs/development/python-modules/syrupy/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "syrupy";
-  version = "4.9.1";
+  version = "5.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "syrupy-project";
     repo = "syrupy";
     tag = "v${version}";
-    hash = "sha256-AK4cB7MiL52oRUV6ArNj94srMsEpk/YQdjJ5tnjrAYM=";
+    hash = "sha256-TRwU9+2RvZB2gbVm82DzLge8QoDflxjavcRdYZUgVfs=";
   };
 
   build-system = [ poetry-core ];
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/syrupy-project/syrupy/blob/${src.tag}/CHANGELOG.md";
     description = "Pytest Snapshot Test Utility";
     homepage = "https://github.com/syrupy-project/syrupy";
-    license = lib.licenses.asl20;
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
 }

From abc7e7f7e177c9e0ca0ca7079b5871129526e443 Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Mon, 29 Sep 2025 16:42:14 +0200
Subject: [PATCH 144/306] pkgsMusl.mailutils: fix build (#436206)

---
 .../don-t-use-descrypt-password-in-the-test-suite.patch         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ma/mailutils/don-t-use-descrypt-password-in-the-test-suite.patch b/pkgs/by-name/ma/mailutils/don-t-use-descrypt-password-in-the-test-suite.patch
index ac85496018ade..7f224c73954bb 100644
--- a/pkgs/by-name/ma/mailutils/don-t-use-descrypt-password-in-the-test-suite.patch
+++ b/pkgs/by-name/ma/mailutils/don-t-use-descrypt-password-in-the-test-suite.patch
@@ -31,7 +31,7 @@ index 930861d8a..3b67844d2 100644
  }
  
  set POP3D_ETC_DIR "$MU_DATA_DIR/etc"
-+set MU_PASSWD_HASH [exec mkpasswd --method=yescrypt guessme]
++set MU_PASSWD_HASH [exec mkpasswd -m yescrypt guessme]
  mu_makespool "$MU_RC_DIR" "$POP3D_ETC_DIR"
  mu_create_config pop3d
  

From a7dee2baa9993d6c6c4493cb3ad0cd28fc497ac3 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sun, 19 Jan 2025 15:49:36 +0100
Subject: [PATCH 145/306] linux_5_4.configfile: fix build for aarch64

Fixes: 37789d9eaa56 ("linuxManualConfig: forbid config errors on aarch64")
Closes: https://github.com/NixOS/nixpkgs/issues/446528
---
 .../linux/kernel/common-config.nix            | 59 ++++++++++++++++---
 1 file changed, 50 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 069f4b6c94a35..2c8bbc8165e09 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -319,6 +319,7 @@ let
       IPV6_SEG6_LWTUNNEL = yes;
       IPV6_SEG6_HMAC = yes;
       IPV6_SEG6_BPF = yes;
+      NET_CLS_ACT = yes;
       NET_CLS_BPF = module;
       NET_ACT_BPF = module;
       NET_SCHED = yes;
@@ -486,7 +487,15 @@ let
 
     video =
       let
-        whenHasDevicePrivate = lib.mkIf (!stdenv.hostPlatform.isx86_32);
+        whenHasDevicePrivate = lib.mkIf (
+          with stdenv.hostPlatform;
+          isLoongArch64
+          || isPower64
+          || isS390x
+          || isx86_64
+          || (lib.versionAtLeast version "5.7" && isAarch64)
+          || (lib.versionAtLeast version "6.11" && isRiscV64)
+        );
       in
       {
         # compile in DRM so simpledrm can load before initrd if necessary
@@ -520,9 +529,9 @@ let
         DRM_DP_AUX_CHARDEV = whenOlder "6.10" yes;
         DRM_DISPLAY_DP_AUX_CHARDEV = whenAtLeast "6.10" yes;
         # amdgpu display core (DC) support
-        DRM_AMD_DC_DCN1_0 = whenOlder "5.6" yes;
-        DRM_AMD_DC_DCN2_0 = whenOlder "5.6" yes;
-        DRM_AMD_DC_DCN2_1 = whenOlder "5.6" yes;
+        DRM_AMD_DC_DCN1_0 = lib.mkIf stdenv.hostPlatform.isx86 (whenOlder "5.6" yes);
+        DRM_AMD_DC_DCN2_0 = lib.mkIf stdenv.hostPlatform.isx86 (whenOlder "5.6" yes);
+        DRM_AMD_DC_DCN2_1 = lib.mkIf stdenv.hostPlatform.isx86 (whenOlder "5.6" yes);
         DRM_AMD_DC_DCN3_0 = lib.mkIf (with stdenv.hostPlatform; isx86) (whenBetween "5.9" "5.11" yes);
         DRM_AMD_DC_DCN = lib.mkIf (with stdenv.hostPlatform; isx86 || isPower64) (
           whenBetween "5.11" "6.4" yes
@@ -800,7 +809,10 @@ let
 
       SECURITY_DMESG_RESTRICT = yes;
 
-      RANDOM_TRUST_CPU = whenOlder "6.2" yes; # allow RDRAND to seed the RNG
+      RANDOM_TRUST_CPU = lib.mkIf (
+        with stdenv.hostPlatform;
+        isPower64 || isS390 || isx86 || (lib.versionAtLeast version "5.6" && isAarch64)
+      ) (whenOlder "6.2" yes); # allow RDRAND to seed the RNG
       RANDOM_TRUST_BOOTLOADER = whenOlder "6.2" yes; # allow the bootloader to seed the RNG
 
       MODULE_SIG = no; # r13y, generates a random key during build and bakes it in
@@ -1073,7 +1085,11 @@ let
       {
         # stdenv.hostPlatform.linux-kernel.target assumes uncompressed on RISC-V.
         KERNEL_UNCOMPRESSED = lib.mkIf stdenv.hostPlatform.isRiscV yes;
-        KERNEL_XZ = lib.mkIf (!stdenv.hostPlatform.isRiscV && !useZstd) yes;
+
+        KERNEL_XZ = lib.mkIf (
+          with stdenv.hostPlatform; (isAarch32 || isMips || isPower || isS390 || isx86) && !useZstd
+        ) yes;
+
         KERNEL_ZSTD = lib.mkIf (
           with stdenv.hostPlatform;
           (isMips || isS390 || isx86 || (lib.versionAtLeast version "6.1" && isAarch64 || isLoongArch64))
@@ -1241,7 +1257,15 @@ let
         NVME_TARGET_AUTH = whenAtLeast "6.0" yes;
         NVME_TARGET_TCP_TLS = whenAtLeast "6.7" yes;
 
-        PCI_P2PDMA = lib.mkIf (stdenv.hostPlatform.is64bit) yes;
+        PCI_P2PDMA = lib.mkIf (
+          with stdenv.hostPlatform;
+          isLoongArch64
+          || isPower64
+          || isS390x
+          || isx86_64
+          || (lib.versionAtLeast version "5.7" && isAarch64)
+          || (lib.versionAtLeast version "6.11" && isRiscV64)
+        ) yes;
 
         PSI = yes;
 
@@ -1308,7 +1332,15 @@ let
 
         # Enable AMD's ROCm GPU compute stack
         HSA_AMD = lib.mkIf stdenv.hostPlatform.is64bit (yes);
-        ZONE_DEVICE = lib.mkIf stdenv.hostPlatform.is64bit (yes);
+        ZONE_DEVICE = lib.mkIf (
+          with stdenv.hostPlatform;
+          isLoongArch64
+          || isPower64
+          || isS390x
+          || isx86_64
+          || (lib.versionAtLeast version "5.7" && isAarch64)
+          || (lib.versionAtLeast version "6.11" && isRiscV64)
+        ) yes;
         HMM_MIRROR = yes;
         DRM_AMDGPU_USERPTR = yes;
 
@@ -1385,7 +1417,15 @@ let
             MEMORY_HOTPLUG = yes;
             MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.14" yes;
             MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.14" yes;
-            MEMORY_HOTREMOVE = yes;
+            MEMORY_HOTREMOVE = lib.mkIf (
+              with stdenv.hostPlatform;
+              isLoongArch64
+              || isPower
+              || isS390
+              || isx86
+              || (lib.versionAtLeast version "5.7" && isAarch64)
+              || (lib.versionAtLeast version "6.11" && isRiscV)
+            ) yes;
             HOTPLUG_CPU = yes;
             MIGRATION = yes;
             SPARSEMEM = yes;
@@ -1404,6 +1444,7 @@ let
             CROS_EC_I2C = module;
             CROS_EC_SPI = module;
             CROS_KBD_LED_BACKLIGHT = module;
+            MFD_CROS_EC = whenOlder "5.10" module;
             TCG_TIS_SPI_CR50 = whenAtLeast "5.5" yes;
           }
       //

From 1ee16b1900afa9b8071adcfd8a38702af9f026c2 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Mon, 29 Sep 2025 17:31:27 +0200
Subject: [PATCH 146/306] kbdVlock: split out of kbd

This removes a dependency cycle from systemd, removing a rebuild. At the
same time it is just as convenience for users. They need to include the
`kbdVlock` package now instead of the `vlock` output.
---
 doc/release-notes/rl-2511.section.md       |  2 ++
 pkgs/by-name/kb/kbd/package.nix            | 16 +++++-----------
 pkgs/os-specific/linux/systemd/default.nix |  9 +++------
 pkgs/top-level/all-packages.nix            |  2 ++
 4 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index b7ca5caa6555f..1d6795a19bad7 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -36,6 +36,8 @@
 
 - LLVM 12, 13, 14, 15, 16, and 17 have been removed, as they have reached end‐of‐life upstream and are no longer supported.
 
+- The `vlock` output from kbd has been removed. Instead a new package `kbdVlock` has been introduced. Use this package now instead of the output.
+
 - GHCJS 8.10, exposed via `haskell.compiler.ghcjs` and `haskell.compiler.ghcjs810`, has been removed. Downstream users should migrate their projects to the new JavaScript backend of GHC proper which can be used via `pkgsCross.ghcjs` from Nixpkgs. Haskell packaging code, like `haskellPackages.mkDerivation`, `ghcWithPackages` and `hoogleWithPackages`, also no longer supports GHCJS.
 
 - GHC 8.6, 8.10, 9.0, 9.2, and their package sets have been removed.
diff --git a/pkgs/by-name/kb/kbd/package.nix b/pkgs/by-name/kb/kbd/package.nix
index 5e89ce36d19b6..4b0d29ed563e7 100644
--- a/pkgs/by-name/kb/kbd/package.nix
+++ b/pkgs/by-name/kb/kbd/package.nix
@@ -20,11 +20,12 @@
   zstd,
   gitUpdater,
   pkgsCross,
-  withVlock ? true,
+  withVlock ? false,
+  kbdVlock,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "kbd";
+  pname = "kbd" + lib.optionalString withVlock "-vlock";
   version = "2.9.0";
 
   __structuredAttrs = true;
@@ -35,16 +36,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-uUECxFdm/UhoHKLHLFe6/ygCQ+4mrQOZExKl+ReaTNw=";
   };
 
-  # vlock is moved into its own output, since it depends on pam. This
-  # reduces closure size for most use cases.
   outputs = [
     "out"
     "dev"
     "scripts"
     "man"
-  ]
-  ++ lib.optionals withVlock [
-    "vlock"
   ];
 
   patches = [
@@ -112,10 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     moveToOutput bin/unicode_start $scripts
     moveToOutput bin/unicode_stop $scripts
-  ''
-  + lib.optionalString withVlock ''
-    moveToOutput bin/vlock $vlock
-    moveToOutput etc/pam.d/vlock $vlock
   '';
 
   outputChecks.out.disallowedRequisites = [
@@ -137,6 +129,8 @@ stdenv.mkDerivation (finalAttrs: {
         pkgsCross.${systemString}.kbd;
       inherit (nixosTests) keymap kbd-setfont-decompress kbd-update-search-paths-patch;
     };
+    # For backwards compatibility. Remove after 26.05.
+    vlock = kbdVlock;
   };
 
   meta = {
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 090da26ed77c1..37b871f3c30b5 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -200,8 +200,6 @@ let
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
   releaseTimestamp = "1734643670";
-
-  kbd' = if withPam then kbd else kbd.override { withVlock = false; };
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
@@ -475,8 +473,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "pkgconfigdatadir" "${placeholder "dev"}/share/pkgconfig")
 
     # Keyboard
-    (lib.mesonOption "loadkeys-path" "${kbd'}/bin/loadkeys")
-    (lib.mesonOption "setfont-path" "${kbd'}/bin/setfont")
+    (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys")
+    (lib.mesonOption "setfont-path" "${kbd}/bin/setfont")
 
     # SBAT
     (lib.mesonOption "sbat-distro" "nixos")
@@ -928,10 +926,9 @@ stdenv.mkDerivation (finalAttrs: {
       withUtmp
       util-linux
       kmod
+      kbd
       ;
 
-    kbd = kbd';
-
     # Many TPM2-related units are only installed if this trio of features are
     # enabled. See https://github.com/systemd/systemd/blob/876ee10e0eb4bbb0920bdab7817a9f06cc34910f/units/meson.build#L521
     withTpm2Units = withTpm2Tss && withBootloader && withOpenSSL;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 349ec204bb2e7..623eebae49dcb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3265,6 +3265,8 @@ with pkgs;
 
   kbfs = callPackage ../tools/security/keybase/kbfs.nix { };
 
+  kbdVlock = callPackage ../../pkgs/by-name/kb/kbd/package.nix { withVlock = true; };
+
   keybase-gui = callPackage ../tools/security/keybase/gui.nix { };
 
   keystore-explorer = callPackage ../applications/misc/keystore-explorer {

From 4904f13346f104051032c8737833fee59ebcf67c Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 29 Sep 2025 21:15:02 +0100
Subject: [PATCH 147/306] iproute2: 6.16.0 -> 6.17.0

Changes: https://lore.kernel.org/netdev/20250929095042.48200315@hermes.local/T/#u
---
 pkgs/by-name/ip/iproute2/package.nix | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index ab399a44c343b..79d4f33718368 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   buildPackages,
   bison,
   flex,
@@ -19,24 +18,14 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.16.0";
+  version = "6.17.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-WQDMwV+aw797fq6B3rWTcSPfNemTR6fxGiKBhILwqNA=";
+    hash = "sha256-l4HllBCrfeqOn3m7EP8UiOY9EPy7cFA7lEJronqOLew=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "color-assume-background-is-dark-if-unknown.patch";
-      url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git/patch/?id=cc0f1109d2864686180ba2ce6fba5fcb3bf437bf";
-      hash = "sha256-BGD70cXKnDvk7IEU5RQA+pn1dErWjgr74GeSkYtFXoI=";
-    })
-    (fetchpatch {
-      name = "color-do-not-use-dark-blue-in-dark-background-palette.patch";
-      url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git/patch/?id=46a4659313c2610427a088d8f03b731819f2b87a";
-      hash = "sha256-TXrmGZNsYWdYLsLoBXZEr3cd8HT4EhRg+jACRrC0gKE=";
-    })
     (fetchurl {
       name = "musl-endian.patch";
       url = "https://lore.kernel.org/netdev/20240712191209.31324-1-contact@hacktivis.me/raw";

From 28b7ac2382f89fad4165dc5930d983274f15ed88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 30 Sep 2025 08:08:37 +0200
Subject: [PATCH 148/306] inetutils: clean up conditional patching

Fixes #423347
---
 pkgs/by-name/in/inetutils/package.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/by-name/in/inetutils/package.nix b/pkgs/by-name/in/inetutils/package.nix
index 655d43a187d31..ee1a08aee9469 100644
--- a/pkgs/by-name/in/inetutils/package.nix
+++ b/pkgs/by-name/in/inetutils/package.nix
@@ -27,9 +27,7 @@ stdenv.mkDerivation rec {
   patches = [
     # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
     ./inetutils-1_9-PATH_PROCNET_DEV.patch
-  ]
-  # FIXME: apply unconditionally
-  ++ lib.optionals (stdenv.isAarch64 && stdenv.isLinux) [
+
     ./tests-libls.sh.patch
   ];
 

From dc02d4a40cc853a5695efb4b79309b5d54c4dc34 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 30 Sep 2025 11:54:03 +0200
Subject: [PATCH 149/306] libwebp: Apply patch to fix behaviour on big-endian

---
 pkgs/by-name/li/libwebp/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/li/libwebp/package.nix b/pkgs/by-name/li/libwebp/package.nix
index b814308b8ae03..d20b25693a885 100644
--- a/pkgs/by-name/li/libwebp/package.nix
+++ b/pkgs/by-name/li/libwebp/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   threadingSupport ? true, # multi-threading
   openglSupport ? false,
@@ -44,6 +45,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-7i4fGBTsTjAkBzCjVqXqX4n22j6dLgF/0mz4ajNA45U=";
   };
 
+  patches = [
+    # Fixes endianness-related behaviour in build result when targeting big-endian via CMake
+    # https://groups.google.com/a/webmproject.org/g/webp-discuss/c/wvBsO8n8BKA/m/eKpxLuagAQAJ
+    (fetchpatch {
+      name = "0001-libwebp-Fix-endianness-with-CMake.patch";
+      url = "https://github.com/webmproject/libwebp/commit/0e5f4ee3deaba5c4381877764005d981f652791f.patch";
+      hash = "sha256-VNiLv1y3cjSDCNen9KxqbdrldI6EhshTSnsq8g9x8HA=";
+    })
+  ];
+
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" true)
     (lib.cmakeBool "WEBP_USE_THREAD" threadingSupport)

From d884c9a687031b3f28858dbcee9cc6493b7b865a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Tue, 30 Sep 2025 11:49:56 +0200
Subject: [PATCH 150/306] Reapply "linux: default
 stdenv.hostPlatform.linux-kernel"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit ddaa949afe18949396a1de532df60ffaea5bf2a3.

This was reverted as part of a bulk revert of all kernel changes in a
certain time period — as far as I know there was no actual
justification for reverting this change in particular.  The original
rationale for making this change stands: it's nice for new platforms
not to have to copy the defaults over and over in
lib/systems/platforms.nix.
---
 pkgs/os-specific/linux/kernel/generic.nix       |  7 +++----
 pkgs/os-specific/linux/kernel/manual-config.nix | 12 +++++-------
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 5f6111e5f7fab..14ee7ac55a12f 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -65,7 +65,7 @@ let
       # optionally be compressed with gzip or bzip2.
       kernelPatches ? [ ],
       ignoreConfigErrors ?
-        !lib.elem stdenv.hostPlatform.linux-kernel.name [
+        !lib.elem stdenv.hostPlatform.linux-kernel.name or "" [
           "aarch64-multiplatform"
           "pc"
         ],
@@ -78,7 +78,7 @@ let
       isHardened ? false,
 
       # easy overrides to stdenv.hostPlatform.linux-kernel members
-      autoModules ? stdenv.hostPlatform.linux-kernel.autoModules,
+      autoModules ? stdenv.hostPlatform.linux-kernel.autoModules or true,
       preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false,
       kernelArch ? stdenv.hostPlatform.linuxArch,
       kernelTests ? { },
@@ -205,10 +205,9 @@ let
 
         RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
 
-        platformName = stdenv.hostPlatform.linux-kernel.name;
         # e.g. "defconfig"
         kernelBaseConfig =
-          if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
+          if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
 
         makeFlags = import ./common-flags.nix {
           inherit
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index cd207f1d610c5..42ee8450455c5 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -160,6 +160,8 @@ lib.makeOverridable (
         isModular = config.isYes "MODULES";
         withRust = config.isYes "RUST";
 
+        target = kernelConf.target or "vmlinux";
+
         buildDTBs = kernelConf.DTB or false;
 
         # Dependencies that are required to build kernel modules
@@ -332,7 +334,7 @@ lib.makeOverridable (
 
         buildFlags = [
           "KBUILD_BUILD_VERSION=1-NixOS"
-          kernelConf.target
+          target
           "vmlinux" # for "perf" and things like that
           "scripts_gdb"
         ]
@@ -413,14 +415,10 @@ lib.makeOverridable (
         # Some image types need special install targets (e.g. uImage is installed with make uinstall on arm)
         installTargets = [
           (kernelConf.installTarget or (
-            if kernelConf.target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then
+            if target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then
               "uinstall"
             else if
-              (
-                kernelConf.target == "zImage"
-                || kernelConf.target == "Image.gz"
-                || kernelConf.target == "vmlinuz.efi"
-              )
+              (target == "zImage" || target == "Image.gz" || target == "vmlinuz.efi")
               && builtins.elem stdenv.hostPlatform.linuxArch [
                 "arm"
                 "arm64"

From b16d25f75b96c0076d6d8de5540d11e11056d388 Mon Sep 17 00:00:00 2001
From: Zsolt Dollenstein <zsol.zsol@gmail.com>
Date: Tue, 30 Sep 2025 10:56:15 +0100
Subject: [PATCH 151/306] uv: 0.8.20 -> 0.8.22

---
 pkgs/by-name/uv/uv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index d6272d650891e..41edda5835afb 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.8.20";
+  version = "0.8.22";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-k0otsop9KjjChlUIKBJn4yQStOHmv/v8GLol3Pz/3yU=";
+    hash = "sha256-7/WOjsyfkDTZLNJY0+rNdRUmMabJsSFvKi2yh/WqViQ=";
   };
 
-  cargoHash = "sha256-f/2DHdNWdbQEYt7kmDsBPDgerGcjFGKyVgU+bQ9qdlg=";
+  cargoHash = "sha256-RubSyxQjWlkoHMItYLjiyJ5Whz3oMXgioqbuewi1fcM=";
 
   buildInputs = [
     rust-jemalloc-sys

From b697572ab907c6c57702822ca8be4090b436d45c Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 30 Sep 2025 17:21:45 +0200
Subject: [PATCH 152/306] strace: 6.16 -> 6.17

ChangeLog: https://github.com/strace/strace/releases/tag/v6.17
---
 pkgs/by-name/st/strace/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index bb08112461f04..23b9b4b359e80 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "strace";
-  version = "6.16";
+  version = "6.17";
 
   src = fetchurl {
     url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-PXrufk8ESy9n89UainbtoYB26fsndN5UrDUdd31Ov/o=";
+    hash = "sha256-Cnx77cfvwHbzJCoDEK8q5jwpKjbdQjbweeiKk+mMucA=";
   };
 
   separateDebugInfo = true;

From a398b4e09f0b6cee440cc77b881eec1f6939c106 Mon Sep 17 00:00:00 2001
From: Luna <git@lunnova.dev>
Date: Sun, 28 Sep 2025 21:07:53 -0700
Subject: [PATCH 153/306] llvmPackages.libclang: clean up rebuild avoidance

---
 .../compilers/llvm/common/clang/default.nix   | 38 ++++++-------------
 1 file changed, 11 insertions(+), 27 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index 8950500ba1df0..1df8a8204413c 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -95,16 +95,17 @@ stdenv.mkDerivation (
       (lib.cmakeFeature "CLANG_INSTALL_PACKAGE_DIR" "${placeholder "dev"}/lib/cmake/clang")
       (lib.cmakeBool "CLANGD_BUILD_XPC" false)
       (lib.cmakeBool "LLVM_ENABLE_RTTI" true)
+      (lib.cmakeBool "LLVM_INCLUDE_TESTS" false)
       (lib.cmakeFeature "LLVM_TABLEGEN_EXE" "${buildLlvmTools.tblgen}/bin/llvm-tblgen")
       (lib.cmakeFeature "CLANG_TABLEGEN" "${buildLlvmTools.tblgen}/bin/clang-tblgen")
+      (lib.cmakeFeature "CLANG_TIDY_CONFUSABLE_CHARS_GEN" "${buildLlvmTools.tblgen}/bin/clang-tidy-confusable-chars-gen")
     ]
+    ++ lib.optional (lib.versionAtLeast release_version "20") (
+      lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm"
+    )
     ++ lib.optionals (lib.versionAtLeast release_version "21") [
       (lib.cmakeFeature "CLANG_RESOURCE_DIR" "${placeholder "lib"}/lib/clang/${lib.versions.major release_version}")
     ]
-    # TODO: Clean up on `staging`.
-    ++ [
-      (lib.cmakeBool "LLVM_INCLUDE_TESTS" false)
-    ]
     ++ lib.optionals enableManpages [
       (lib.cmakeBool "CLANG_INCLUDE_DOCS" true)
       (lib.cmakeBool "LLVM_ENABLE_SPHINX" true)
@@ -112,20 +113,10 @@ stdenv.mkDerivation (
       (lib.cmakeBool "SPHINX_OUTPUT_HTML" false)
       (lib.cmakeBool "SPHINX_WARNINGS_AS_ERRORS" false)
     ]
-    # TODO: Clean up on `staging`.
-    ++ [
-      # Added in LLVM15:
-      # `clang-tidy-confusable-chars-gen`: https://github.com/llvm/llvm-project/commit/c3574ef739fbfcc59d405985a3a4fa6f4619ecdb
-      # `clang-pseudo-gen`: https://github.com/llvm/llvm-project/commit/cd2292ef824591cc34cc299910a3098545c840c7
-      (lib.cmakeFeature "CLANG_TIDY_CONFUSABLE_CHARS_GEN" "${buildLlvmTools.tblgen}/bin/clang-tidy-confusable-chars-gen")
-    ]
     ++ lib.optionals (lib.versionOlder release_version "20") [
       # clang-pseudo removed in LLVM20: https://github.com/llvm/llvm-project/commit/ed8f78827895050442f544edef2933a60d4a7935
       (lib.cmakeFeature "CLANG_PSEUDO_GEN" "${buildLlvmTools.tblgen}/bin/clang-pseudo-gen")
     ]
-    ++ lib.optional (lib.versionAtLeast release_version "20") (
-      lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm"
-    )
     ++ devExtraCmakeFlags;
 
     postPatch = ''
@@ -173,20 +164,13 @@ stdenv.mkDerivation (
       patchShebangs $python/bin
 
       mkdir -p $dev/bin
-    ''
-    # TODO(@LunNova): Clean up this rebuild avoidance in staging
-    + lib.optionalString enableClangToolsExtra (
-      if lib.versionOlder release_version "20" then
-        ''
-          cp bin/{clang-tblgen,clang-tidy-confusable-chars-gen,clang-pseudo-gen} $dev/bin
-        ''
-      else
-        ''
-          cp bin/{clang-tblgen,clang-tidy-confusable-chars-gen} $dev/bin
-        ''
-    )
-    + lib.optionalString (!enableClangToolsExtra) ''
       cp bin/clang-tblgen $dev/bin
+    ''
+    + lib.optionalString enableClangToolsExtra ''
+      cp bin/clang-tidy-confusable-chars-gen $dev/bin
+    ''
+    + lib.optionalString (enableClangToolsExtra && lib.versionOlder release_version "20") ''
+      cp bin/clang-pseudo-gen $dev/bin
     '';
 
     env =

From 636157636f634c51cb4ca96d811fb2fdd9b9e7b2 Mon Sep 17 00:00:00 2001
From: Luna <git@lunnova.dev>
Date: Sun, 28 Sep 2025 21:07:58 -0700
Subject: [PATCH 154/306] llvmPackages.libllvm: clean up rebuild avoidance

---
 pkgs/development/compilers/llvm/common/llvm/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index 279be22f7757e..7715a7f2d2e8c 100644
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -85,9 +85,6 @@ stdenv.mkDerivation (
     pname = "llvm";
     inherit version;
 
-    # TODO: Remove on `staging`.
-    shortVersion = lib.concatStringsSep "." (lib.take 1 (lib.splitString "." release_version));
-
     src =
       if monorepoSrc != null then
         runCommand "llvm-src-${version}" { inherit (monorepoSrc) passthru; } (

From 43135fcdc6febccb497ad7039571c9989fd6689e Mon Sep 17 00:00:00 2001
From: Luna <git@lunnova.dev>
Date: Sun, 28 Sep 2025 21:08:46 -0700
Subject: [PATCH 155/306] llvmPackages.libcxx: clean up rebuild avoidance

---
 pkgs/development/compilers/llvm/common/libcxx/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/libcxx/default.nix b/pkgs/development/compilers/llvm/common/libcxx/default.nix
index b591616838424..be38ae92d8ec8 100644
--- a/pkgs/development/compilers/llvm/common/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/common/libcxx/default.nix
@@ -143,9 +143,6 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs utils/cat_files.py
   '';
 
-  # TODO: Remove on `staging`.
-  patches = [ ];
-
   nativeBuildInputs = [
     cmake
     ninja

From 11f69a77db190f2eafd3d3e6ac4377011814e9f8 Mon Sep 17 00:00:00 2001
From: Luna <git@lunnova.dev>
Date: Sun, 28 Sep 2025 21:08:59 -0700
Subject: [PATCH 156/306] llvmPackages.libunwind: clean up rebuild avoidance

---
 .../compilers/llvm/common/libunwind/default.nix            | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/libunwind/default.nix b/pkgs/development/compilers/llvm/common/libunwind/default.nix
index cc73f02be4e62..cab7f978e3cd5 100644
--- a/pkgs/development/compilers/llvm/common/libunwind/default.nix
+++ b/pkgs/development/compilers/llvm/common/libunwind/default.nix
@@ -21,9 +21,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   inherit version;
 
-  # TODO: Remove on `staging`.
-  patches = [ ];
-
   src =
     if monorepoSrc != null then
       runCommand "libunwind-src-${version}" { inherit (monorepoSrc) passthru; } ''
@@ -60,10 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ devExtraCmakeFlags;
 
-  # TODO: Remove on `staging`.
-  prePatch = "";
-  postPatch = "";
-
   postInstall =
     lib.optionalString (enableShared && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows)
       ''

From 1c2e2696ce12050cd1f2f34764e1f28612ed95e9 Mon Sep 17 00:00:00 2001
From: Luna <git@lunnova.dev>
Date: Sun, 28 Sep 2025 21:09:10 -0700
Subject: [PATCH 157/306] llvmPackages.lldb: clean up rebuild avoidance

---
 .../compilers/llvm/common/lldb/default.nix          | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/lldb/default.nix b/pkgs/development/compilers/llvm/common/lldb/default.nix
index 9fbcbb0f38391..f67da50426674 100644
--- a/pkgs/development/compilers/llvm/common/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/common/lldb/default.nix
@@ -74,6 +74,7 @@ stdenv.mkDerivation (
 
     nativeBuildInputs = [
       cmake
+      ninja
       python3
       which
       swig
@@ -84,10 +85,6 @@ stdenv.mkDerivation (
     ++ lib.optionals enableManpages [
       python3.pkgs.sphinx
       python3.pkgs.myst-parser
-    ]
-    # TODO: Clean up on `staging`.
-    ++ [
-      ninja
     ];
 
     buildInputs = [
@@ -112,6 +109,7 @@ stdenv.mkDerivation (
       (lib.cmakeBool "LLVM_ENABLE_RTTI" false)
       (lib.cmakeFeature "Clang_DIR" "${lib.getDev libclang}/lib/cmake")
       (lib.cmakeFeature "LLVM_EXTERNAL_LIT" "${lit}/bin/lit")
+      (lib.cmakeFeature "CLANG_RESOURCE_DIR" "../../../../${lib.getLib libclang}")
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       (lib.cmakeBool "LLDB_USE_SYSTEM_DEBUGSERVER" true)
@@ -119,10 +117,6 @@ stdenv.mkDerivation (
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       (lib.cmakeFeature "LLDB_CODESIGN_IDENTITY" "") # codesigning makes nondeterministic
     ]
-    # TODO: Clean up on `staging`.
-    ++ [
-      (lib.cmakeFeature "CLANG_RESOURCE_DIR" "../../../../${lib.getLib libclang}")
-    ]
     ++ lib.optionals enableManpages [
       (lib.cmakeBool "LLVM_ENABLE_SPHINX" true)
       (lib.cmakeBool "SPHINX_OUTPUT_MAN" true)
@@ -184,9 +178,6 @@ stdenv.mkDerivation (
   // lib.optionalAttrs enableManpages {
     pname = "lldb-manpages";
 
-    # TODO: Remove on `staging`.
-    buildPhase = "";
-
     ninjaFlags = [ "docs-lldb-man" ];
 
     propagatedBuildInputs = [ ];

From 3a4c1a332b60c5b5000921abfa8b0ba9bfc984e8 Mon Sep 17 00:00:00 2001
From: Luna <git@lunnova.dev>
Date: Sun, 28 Sep 2025 21:09:22 -0700
Subject: [PATCH 158/306] llvmPackages.lld: clean up rebuild avoidance

---
 pkgs/development/compilers/llvm/common/lld/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/lld/default.nix b/pkgs/development/compilers/llvm/common/lld/default.nix
index 13ed24cdc7019..015e6e23e48d3 100644
--- a/pkgs/development/compilers/llvm/common/lld/default.nix
+++ b/pkgs/development/compilers/llvm/common/lld/default.nix
@@ -63,9 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ devExtraCmakeFlags;
 
-  # TODO: Remove on `staging`.
-  postPatch = "";
-
   # Musl's default stack size is too small for lld to be able to link Firefox.
   LDFLAGS = lib.optionalString stdenv.hostPlatform.isMusl "-Wl,-z,stack-size=2097152";
 

From 957d7fea186e0d6488c8ab4192e41099fbdeb14e Mon Sep 17 00:00:00 2001
From: Luna <git@lunnova.dev>
Date: Sun, 28 Sep 2025 21:09:33 -0700
Subject: [PATCH 159/306] llvmPackages: clean up rebuild avoidance

---
 .../compilers/llvm/common/default.nix         | 20 ++++++++-----------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/default.nix b/pkgs/development/compilers/llvm/common/default.nix
index e8c7f768267b4..a09b7af98a498 100644
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@@ -374,18 +374,14 @@ let
 
       # This is an "oddly ordered" bootstrap just for Darwin. Probably
       # don't want it otherwise.
-      clangNoCompilerRtWithLibc =
-        wrapCCWith rec {
-          cc = tools.clang-unwrapped;
-          libcxx = null;
-          bintools = bintools';
-          extraPackages = [ ];
-          extraBuildCommands = mkExtraBuildCommands0 cc;
-        }
-        # FIXME: This should be inside the `wrapCCWith` call.
-        // lib.optionalAttrs stdenv.targetPlatform.isWasm {
-          nixSupport.cc-cflags = [ "-fno-exceptions" ];
-        };
+      clangNoCompilerRtWithLibc = wrapCCWith rec {
+        cc = tools.clang-unwrapped;
+        libcxx = null;
+        bintools = bintools';
+        extraPackages = [ ];
+        extraBuildCommands = mkExtraBuildCommands0 cc;
+        nixSupport.cc-cflags = lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      };
 
       # Aliases
       clangNoCompilerRt = tools.clangNoLibcNoRt;

From 02746ead92b6d56d02fb22efacd59402d1a95878 Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Tue, 16 Sep 2025 17:45:30 +0300
Subject: [PATCH 160/306] haskell.compiler.ghc{948,967,984,9101,9121,9122}: fix
 build with gcc15
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- add patch from fedora (rebase of latest fix from upstream):
https://gitlab.haskell.org/ghc/ghc/-/issues/25662
https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13863

ghc versions excluded from patch:
9.10.2 - has previous fix with `extern void* malloc(size_t);`
9.10.3 - has latest fix with `#include <stdlib.h>`
9.12.3 - has latest fix with `#include <stdlib.h>`

Fixes build failure with gcc15, building utils/hp2ps/Utilities.c:
```
utils/hp2ps/Utilities.c:6:14: error:
warning: conflicting types for built-in function ‘malloc’;
expected ‘void *(long unsigned int)’ [-Wbuiltin-declaration-mismatch]
        6 | extern void* malloc();
          |              ^~~~~~
...
utils/hp2ps/Utilities.c:92:18: error:
warning: conflicting types for built-in function ‘realloc’;
expected ‘void *(void *, long unsigned int)’ [-Wbuiltin-declaration-mismatch]
       92 |     extern void *realloc();
          |                  ^~~~~~~
```
---
 .../development/compilers/ghc/common-hadrian.nix | 16 ++++++++++++++++
 .../compilers/ghc/common-make-native-bignum.nix  | 11 +++++++++++
 2 files changed, 27 insertions(+)

diff --git a/pkgs/development/compilers/ghc/common-hadrian.nix b/pkgs/development/compilers/ghc/common-hadrian.nix
index b8064fd4ee79e..9d2c4afef2175 100644
--- a/pkgs/development/compilers/ghc/common-hadrian.nix
+++ b/pkgs/development/compilers/ghc/common-hadrian.nix
@@ -261,6 +261,22 @@
           hash = "sha256-L3FQvcm9QB59BOiR2g5/HACAufIG08HiT53EIOjj64g=";
         })
       ]
+      # Fix build with gcc15
+      # https://gitlab.haskell.org/ghc/ghc/-/issues/25662
+      # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13863
+      ++
+        lib.optionals
+          (
+            lib.versionOlder version "9.12.3"
+            && !(lib.versionAtLeast version "9.10.2" && lib.versionOlder version "9.12")
+          )
+          [
+            (fetchpatch {
+              name = "ghc-hp2ps-c-gnu17.patch";
+              url = "https://src.fedoraproject.org/rpms/ghc/raw/9c26d7c3c3de73509a25806e5663b37bcf2e0b4e/f/hp2ps-C-gnu17.patch";
+              hash = "sha256-Vr5wkiSE1S5e+cJ8pWUvG9KFpxtmvQ8wAy08ElGNp5E=";
+            })
+          ]
       # Fixes stack overrun in rts which crashes an process whenever
       # freeHaskellFunPtr is called with nixpkgs' hardening flags.
       # https://gitlab.haskell.org/ghc/ghc/-/issues/25485
diff --git a/pkgs/development/compilers/ghc/common-make-native-bignum.nix b/pkgs/development/compilers/ghc/common-make-native-bignum.nix
index 922875e6b4e1a..cf9bd6e7e5309 100644
--- a/pkgs/development/compilers/ghc/common-make-native-bignum.nix
+++ b/pkgs/development/compilers/ghc/common-make-native-bignum.nix
@@ -345,6 +345,17 @@ stdenv.mkDerivation (
       })
     ]
 
+    # Fix build with gcc15
+    # https://gitlab.haskell.org/ghc/ghc/-/issues/25662
+    # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13863
+    ++ lib.optionals (lib.versions.majorMinor version == "9.4") [
+      (fetchpatch {
+        name = "ghc-hp2ps-c-gnu17.patch";
+        url = "https://src.fedoraproject.org/rpms/ghc/raw/9c26d7c3c3de73509a25806e5663b37bcf2e0b4e/f/hp2ps-C-gnu17.patch";
+        hash = "sha256-Vr5wkiSE1S5e+cJ8pWUvG9KFpxtmvQ8wAy08ElGNp5E=";
+      })
+    ]
+
     ++ [
       # Don't generate code that doesn't compile when --enable-relocatable is passed to Setup.hs
       # Can be removed if the Cabal library included with ghc backports the linked fix

From bcfe9e71f769ced3cc0d23d565f6dd2f43c4f91c Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 30 Sep 2025 21:37:22 +0100
Subject: [PATCH 161/306] btrfs-progs: 6.16.1 -> 6.17

Changes: https://github.com/kdave/btrfs-progs/releases/tag/v6.17
---
 pkgs/by-name/bt/btrfs-progs/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bt/btrfs-progs/package.nix b/pkgs/by-name/bt/btrfs-progs/package.nix
index 5527d82577c8a..ffa5dac48db6b 100644
--- a/pkgs/by-name/bt/btrfs-progs/package.nix
+++ b/pkgs/by-name/bt/btrfs-progs/package.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.16.1";
+  version = "6.17";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-cKo/lUAXynQ1KYKN6yoQ3Oqy1BMhWDrRV+lnhH3bJPw=";
+    hash = "sha256-J31pbJ15cT/1r7U8fv69zq0uamAHeJsXQuxBH05Moik=";
   };
 
   nativeBuildInputs = [

From 4d44f8fa53518ecf5e8eafd54f8151921c53f75a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Tue, 30 Sep 2025 21:54:06 +0200
Subject: [PATCH 162/306] llvmPackages.compiler-rt: clean up libxcrypt fix

This is unnecessary since LLVM commit d7bead833631 ("[sanitizer]
Remove crypt and crypt_r interceptors"), included in LLVM 18, the
oldest version we still have in Nixpkgs.
---
 .../compilers/llvm/common/compiler-rt/default.nix            | 4 ----
 pkgs/development/compilers/llvm/common/default.nix           | 5 -----
 2 files changed, 9 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
index dc097c02b50e4..f9bfdbed62c11 100644
--- a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
@@ -15,7 +15,6 @@
   libcxx,
   linuxHeaders,
   freebsd,
-  libxcrypt,
 
   # Some platforms have switched to using compiler-rt, but still want a
   # libgcc.a for ABI compat purposes. The use case would be old code that
@@ -123,9 +122,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CMAKE_C_COMPILER_TARGET" stdenv.hostPlatform.config)
     (lib.cmakeFeature "CMAKE_ASM_COMPILER_TARGET" stdenv.hostPlatform.config)
   ]
-  ++ lib.optionals (haveLibc && stdenv.hostPlatform.libc == "glibc") [
-    (lib.cmakeFeature "SANITIZER_COMMON_CFLAGS" "-I${libxcrypt}/include")
-  ]
   ++ lib.optionals (useLLVM && haveLibc && stdenv.cc.libcxx == libcxx) [
     (lib.cmakeFeature "SANITIZER_CXX_ABI" "libcxxabi")
     (lib.cmakeFeature "SANITIZER_CXX_ABI_LIBNAME" "libcxxabi")
diff --git a/pkgs/development/compilers/llvm/common/default.nix b/pkgs/development/compilers/llvm/common/default.nix
index a09b7af98a498..40250af957283 100644
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@@ -425,11 +425,6 @@ let
           {
             inherit stdenv;
           }
-          // lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
-            libxcrypt = (libxcrypt.override { inherit stdenv; }).overrideAttrs (old: {
-              configureFlags = old.configureFlags ++ [ "--disable-symvers" ];
-            });
-          }
         );
 
         compiler-rt-no-libc = callPackage ./compiler-rt {

From b8cf634aa1f64ff828a2fe5c729ddce490deab28 Mon Sep 17 00:00:00 2001
From: David McFarland <corngood@gmail.com>
Date: Tue, 30 Sep 2025 19:05:25 -0300
Subject: [PATCH 163/306] Revert "treewide: undo changes causing rebuilds"

This reverts commit e098bea39d9d1c15214aa026bb50893a7459b2b0.
---
 .../compilers/gcc/patches/default.nix         |  2 +-
 pkgs/stdenv/generic/make-derivation.nix       | 21 +++++++------------
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 2c0fa1b40852b..619b3a922f315 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -224,7 +224,7 @@ in
   .${majorVersion} or [ ]
 )
 
-++ optional targetPlatform.isCygwin (fetchpatch {
+++ optional (targetPlatform.isWindows || targetPlatform.isCygwin) (fetchpatch {
   name = "libstdc-fix-compilation-in-freestanding-win32.patch";
   url = "https://inbox.sourceware.org/gcc-patches/20250922182808.2599390-2-corngood@gmail.com/raw";
   hash = "sha256-+EYW9lG8CviVX7RyNHp+iX+8BRHUjt5b07k940khbbY=";
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index bbd4c0a14f654..8c291ccf4920a 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -706,19 +706,14 @@ let
               __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
             }
           )
-          // optionalAttrs (isWindows || isCygwin) (
-            let
-              dlls =
-                allowedImpureDLLs
-                ++ lib.optionals isCygwin [
-                  "KERNEL32.dll"
-                  "cygwin1.dll"
-                ];
-            in
-            {
-              allowedImpureDLLs = if dlls != [ ] then dlls else null;
-            }
-          )
+          // optionalAttrs (isWindows || isCygwin) {
+            allowedImpureDLLs =
+              allowedImpureDLLs
+              ++ lib.optionals isCygwin [
+                "KERNEL32.dll"
+                "cygwin1.dll"
+              ];
+          }
           // (
             if !__structuredAttrs then
               makeOutputChecks attrs

From ccbbeaa032818277e03ec9f28aeaef000d8b6cda Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 29 Sep 2025 21:12:43 +0100
Subject: [PATCH 164/306] libnotify: 0.8.6 -> 0.8.7

Changes: https://gitlab.gnome.org/GNOME/libnotify/-/blob/0.8.7/NEWS?ref_type=tags
Diff: https://gitlab.gnome.org/GNOME/libnotify/-/compare/0.8.6...0.8.7
---
 pkgs/by-name/li/libnotify/package.nix | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libnotify/package.nix b/pkgs/by-name/li/libnotify/package.nix
index 8345b27ae222f..5403b0d072180 100644
--- a/pkgs/by-name/li/libnotify/package.nix
+++ b/pkgs/by-name/li/libnotify/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -19,7 +20,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libnotify";
-  version = "0.8.6";
+  version = "0.8.7";
 
   outputs = [
     "out"
@@ -29,11 +30,20 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-xVQKrvtg4dY7HFh8BfIoTr5y7OfQwOXkp3jP1YRLa1g=";
+    hash = "sha256-S+FSAuxBhPzhrBWZfs5VMNK+Mv6Vc4da6xDjtXOFh0g=";
   };
 
+  patches = [
+    # build: Do not use GDesktopAppInfo if not available
+    # https://gitlab.gnome.org/GNOME/libnotify/-/issues/62
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/libnotify/-/commit/13de65ad2a76255ffde5d6da91d246cd7226583b.patch";
+      hash = "sha256-a1wiUQnrncPqL2OTY1sUWyvVcoI54bXPvkIkZAcC6kI=";
+    })
+  ];
+
   mesonFlags = [
-    # disable tests as we don't need to depend on GTK (2/3)
+    # disable tests as we don't need to depend on GTK 4
     "-Dtests=false"
     "-Ddocbook_docs=disabled"
     "-Dgtk_doc=false"

From 96e5424f74a91b44c0d5ca3c02d59de802501ddf Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Mon, 15 Sep 2025 17:22:40 +0200
Subject: [PATCH 165/306] openssl: Enable tests

Makes the build take about 13 instead of 5 minutes
---
 pkgs/development/libraries/openssl/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 05207dd04f101..58550c8b4676f 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -246,6 +246,11 @@ let
 
       enableParallelBuilding = true;
 
+      doCheck = true;
+      preCheck = ''
+        patchShebangs util
+      '';
+
       postInstall =
         (
           if static then

From 1453647d2294bdaa8942aa9ace7256ff4fa230af Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Mon, 15 Sep 2025 17:23:37 +0200
Subject: [PATCH 166/306] openssl: Add missing comments for patches

Markus Theil: Changed reference to NIX_SSL_CERT_FILE commit
---
 pkgs/development/libraries/openssl/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 58550c8b4676f..1d114d12996c5 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -375,12 +375,15 @@ in
     hash = "sha256-39135OobV/86bb3msL3D8x21rJnn/dTq+eH7tuwtuM4=";
 
     patches = [
+      # Support for NIX_SSL_CERT_FILE, motivation:
+      # https://github.com/NixOS/nixpkgs/commit/942dbf89c6120cb5b52fb2ab456855d1fbf2994e
       ./3.0/nix-ssl-cert-file.patch
 
       # openssl will only compile in KTLS if the current kernel supports it.
       # This patch disables build-time detection.
       ./3.0/openssl-disable-kernel-detection.patch
 
+      # Look up SSL certificates in /etc rather than the immutable installation directory
       (
         if stdenv.hostPlatform.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch
       )
@@ -398,12 +401,15 @@ in
     hash = "sha256-xTpH5eRByTDDkoz3v2+wDl0Sm2MOCqhzsIJYZW5zRew=";
 
     patches = [
+      # Support for NIX_SSL_CERT_FILE, motivation:
+      # https://github.com/NixOS/nixpkgs/commit/942dbf89c6120cb5b52fb2ab456855d1fbf2994e
       ./3.0/nix-ssl-cert-file.patch
 
       # openssl will only compile in KTLS if the current kernel supports it.
       # This patch disables build-time detection.
       ./3.0/openssl-disable-kernel-detection.patch
 
+      # Look up SSL certificates in /etc rather than the immutable installation directory
       (
         if stdenv.hostPlatform.isDarwin then
           ./3.5/use-etc-ssl-certs-darwin.patch

From 9e4cf668a33a2478058b4b64b8e4ec1a88876645 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Wed, 1 Oct 2025 13:18:01 +0200
Subject: [PATCH 167/306] openssl_3: 3.0.17 -> 3.0.18

Changelog:
https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md#changes-between-3017-and-3018-30-sep-2025

Fixed CVEs:
- CVE-2025-9230
- CVE-2025-9232

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/development/libraries/openssl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 1d114d12996c5..963e223858b08 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -371,8 +371,8 @@ in
   };
 
   openssl_3 = common {
-    version = "3.0.17";
-    hash = "sha256-39135OobV/86bb3msL3D8x21rJnn/dTq+eH7tuwtuM4=";
+    version = "3.0.18";
+    hash = "sha256-2Aw09c+QLczx8bXfXruG0DkuNwSeXXPfGzq65y5P/os=";
 
     patches = [
       # Support for NIX_SSL_CERT_FILE, motivation:

From 87c0c5e50cc5252a609a3e2445b7e67a8c822dff Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Wed, 1 Oct 2025 13:18:18 +0200
Subject: [PATCH 168/306] openssl: 3.5.2 -> 3.6.0

Changelog (security fixes):
https://github.com/openssl/openssl/blob/openssl-3.5/CHANGES.md#changes-between-353-and-354-30-sep-2025

Changelog (features):
https://github.com/openssl/openssl/blob/openssl-3.6/CHANGES.md#changes-between-35-and-360-1-oct-2025

Notably:
- more work on PQC algorithms (LMS)
- performance improvements for some assembly implementations

Fixed CVEs:
- CVE-2025-9230
- CVE-2025-9231
- CVE-2025-9232

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/development/libraries/openssl/default.nix | 6 +++---
 pkgs/top-level/all-packages.nix                | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 963e223858b08..02805a54003be 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -396,9 +396,9 @@ in
     };
   };
 
-  openssl_3_5 = common {
-    version = "3.5.2";
-    hash = "sha256-xTpH5eRByTDDkoz3v2+wDl0Sm2MOCqhzsIJYZW5zRew=";
+  openssl_3_6 = common {
+    version = "3.6.0";
+    hash = "sha256-tqX0S362nj+jXb8VUkQFtEg3pIHUPYHa3d4/8h/LuOk=";
 
     patches = [
       # Support for NIX_SSL_CERT_FILE, motivation:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 24b72e37e98ce..3976f2e5cf6fd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8462,7 +8462,7 @@ with pkgs;
 
   libressl = libressl_4_1;
 
-  openssl = openssl_3_5;
+  openssl = openssl_3_6;
 
   openssl_legacy = openssl.override {
     conf = ../development/libraries/openssl/3.0/legacy.cnf;
@@ -8471,7 +8471,7 @@ with pkgs;
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_1
     openssl_3
-    openssl_3_5
+    openssl_3_6
     ;
 
   pcre = callPackage ../development/libraries/pcre { };

From 9ba559c8d90ac55b795f51bc6d0d6ec9fb2a7f9f Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 30 Sep 2025 21:07:54 +0100
Subject: [PATCH 169/306] nixosTests.installer.swraid: enable --bitmap=internal
 (fix interactive hang)

Co-authored-by: Philip Taron <philip.taron@gmail.com>
---
 nixos/tests/installer.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index e68b8eca5f215..893595ec29231 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -1451,9 +1451,9 @@ in
           "cat /proc/partitions >&2",
           "udevadm control --stop-exec-queue",
           "mdadm --create --force /dev/md0 --metadata 1.2 --level=raid1 "
-          + "--raid-devices=2 /dev/vda5 /dev/vda6",
+          + "--raid-devices=2 --bitmap=internal /dev/vda5 /dev/vda6",
           "mdadm --create --force /dev/md1 --metadata 1.2 --level=raid1 "
-          + "--raid-devices=2 /dev/vda7 /dev/vda8",
+          + "--raid-devices=2 --bitmap=internal /dev/vda7 /dev/vda8",
           "udevadm control --start-exec-queue",
           "udevadm settle",
           "mkswap -f /dev/md1 -L swap",

From 693d4474a35984967f4014c07e6c33b2f315df15 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 30 Sep 2025 21:09:00 +0100
Subject: [PATCH 170/306] nixosTests.systemd-initrd-swraid: enable
 --bitmap=internal (fix interactive hang)

---
 nixos/tests/systemd-initrd-swraid.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/systemd-initrd-swraid.nix b/nixos/tests/systemd-initrd-swraid.nix
index 933b2ad410560..1a504a4ae4e0a 100644
--- a/nixos/tests/systemd-initrd-swraid.nix
+++ b/nixos/tests/systemd-initrd-swraid.nix
@@ -48,7 +48,7 @@
 
   testScript = ''
     # Create RAID
-    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90")
+    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90 --bitmap=internal")
     machine.succeed("mkfs.ext4 -L testraid /dev/md0")
     machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")
 

From 80ef20e21030152b8cf5ca32f7a446445808946e Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 29 Aug 2025 21:47:30 +0100
Subject: [PATCH 171/306] mdadm: 4.3 -> 4.4

While at it added trivial updater and `nixosTests`
broken by this `mdadm` update.

Changes: https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/tree/CHANGELOG.md?h=mdadm-4.4
---
 pkgs/by-name/md/mdadm4/package.nix | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/md/mdadm4/package.nix b/pkgs/by-name/md/mdadm4/package.nix
index 7806e313f5834..f2d69266ac172 100644
--- a/pkgs/by-name/md/mdadm4/package.nix
+++ b/pkgs/by-name/md/mdadm4/package.nix
@@ -8,15 +8,17 @@
   system-sendmail,
   udev,
   udevCheckHook,
+  gitUpdater,
+  nixosTests,
 }:
 
 stdenv.mkDerivation rec {
   pname = "mdadm";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/raid/mdadm/mdadm-${version}.tar.xz";
-    sha256 = "sha256-QWcnrh8QgOpuMJDOo23QdoJvw2kVHjarc2VXupIZb58=";
+    sha256 = "sha256-m0iPNe0VPfmZJLX+Qe7TgOhRLejxihGGKMrN1oGx1XM=";
   };
 
   patches = [
@@ -32,10 +34,6 @@ stdenv.mkDerivation rec {
       url = "https://lore.kernel.org/linux-raid/20240220165158.3521874-1-raj.khem@gmail.com/raw";
       hash = "sha256-JOZ8n7zi+nq236NPpB4e2gUy8I3l3DbcoLhpeL73f98=";
     })
-    (fetchurl {
-      url = "https://github.com/md-raid-utilities/mdadm/commit/9dbd11e091f84eb0bf9d717283774816c4c4453d.patch";
-      hash = "sha256-8GdjP1ceVwejTOFXcHXG8wkIF9/D6hOUGD6btvuqs24=";
-    })
   ];
 
   makeFlags = [
@@ -80,6 +78,17 @@ stdenv.mkDerivation rec {
     grep -r $out $out/bin && false || true
   '';
 
+  passthru = {
+    tests = {
+      inherit (nixosTests) systemd-initrd-swraid;
+      installer-swraid = nixosTests.installer.swraid;
+    };
+    updateScript = gitUpdater {
+      url = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git";
+      rev-prefix = "mdadm-";
+    };
+  };
+
   meta = with lib; {
     description = "Programs for managing RAID arrays under Linux";
     homepage = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git";

From bf08457bd10357977e402db44a11570776164fe7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 1 Oct 2025 14:48:24 -0700
Subject: [PATCH 172/306] python3Packages.libpass: 1.9.1.post0 -> 1.9.2

Diff: https://github.com/ThirVondukr/passlib/compare/1.9.1.post0...1.9.2

Changelog: https://github.com/notypecheck/passlib/releases/tag/1.9.2
---
 pkgs/development/python-modules/libpass/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/libpass/default.nix b/pkgs/development/python-modules/libpass/default.nix
index 80480c9e22c85..834d0b512b9eb 100644
--- a/pkgs/development/python-modules/libpass/default.nix
+++ b/pkgs/development/python-modules/libpass/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "libpass";
-  version = "1.9.1.post0";
+  version = "1.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ThirVondukr";
     repo = "passlib";
     tag = version;
-    hash = "sha256-4J18UktqllRA8DVdHL4AJUuAkjZRdUjiql9a71XXhCA=";
+    hash = "sha256-xL+92LdZxCH+yu2vz2AC44b4EYiGJbWfPkoSO3mSSjw=";
   };
 
   build-system = [ hatchling ];

From 5d91f7b013cd8cadb481abf2fa3cdfe892e04c5e Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 2 Oct 2025 06:56:28 +0100
Subject: [PATCH 173/306] libdrm: 2.4.125 -> 2.4.126

Changes: https://lists.x.org/archives/xorg-announce/2025-October/003632.html
---
 pkgs/by-name/li/libdrm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libdrm/package.nix b/pkgs/by-name/li/libdrm/package.nix
index ccd9f305f5649..748ff4e811dc4 100644
--- a/pkgs/by-name/li/libdrm/package.nix
+++ b/pkgs/by-name/li/libdrm/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.125";
+  version = "2.4.126";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-1LrpJ5elD4GpNSR2LgQQpJzYTPoPmXeVvAFyrI+x2Wo=";
+    hash = "sha256-bKsW1NJZtqvJ9IUjOGNFQRSjwwfsqAZnmq0+2+lnv0I=";
   };
 
   outputs = [

From 685f0347ce824bae281065c3678206c26be46afc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 15 Jul 2025 21:19:51 -0700
Subject: [PATCH 174/306] python3Packages.pytest-xdist: use fetchFromGitHub

---
 .../python-modules/pytest-xdist/default.nix   | 24 +++++++++----------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index 3fd5f57fc93cd..55fcd3b061620 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -1,8 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pythonOlder,
+  fetchFromGitHub,
   setuptools,
   setuptools-scm,
   pytestCheckHook,
@@ -16,14 +15,13 @@
 buildPythonPackage rec {
   pname = "pytest-xdist";
   version = "3.8.0";
-  disabled = pythonOlder "3.7";
-
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "pytest_xdist";
-    inherit version;
-    hash = "sha256-fleBJeybxgUIYaqT8tWfHY0IVZXWVRwskLb0+tjTqfE=";
+  src = fetchFromGitHub {
+    owner = "pytest-dev";
+    repo = "pytest-xdist";
+    tag = "v${version}";
+    hash = "sha256-2x3znm92wo8DCshf5sYK0stnESg0oVXbxsWRAaTj6oQ=";
   };
 
   build-system = [
@@ -66,11 +64,11 @@ buildPythonPackage rec {
 
   setupHook = ./setup-hook.sh;
 
-  meta = with lib; {
-    changelog = "https://github.com/pytest-dev/pytest-xdist/blob/v${version}/CHANGELOG.rst";
-    description = "Pytest xdist plugin for distributed testing and loop-on-failing modes";
+  meta = {
+    changelog = "https://github.com/pytest-dev/pytest-xdist/blob/${src.tag}/CHANGELOG.rst";
+    description = "Pytest plugin for distributed testing";
     homepage = "https://github.com/pytest-dev/pytest-xdist";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }

From 12db2344c7d68571d2b9cebb6e396a724b897e6f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Oct 2025 17:41:32 +0200
Subject: [PATCH 175/306] python3Packages.django_4: 4.2.24 -> 4.2.25
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://docs.djangoproject.com/en/4.2/releases/4.2.25/
https://www.djangoproject.com/weblog/2025/oct/01/security-releases/

Fixes: CVE-2025-59681, CVE-2025-59682
---
 pkgs/development/python-modules/django/4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 6cba9d6d9b655..a661b22f939fc 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -45,7 +45,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "4.2.24";
+  version = "4.2.25";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-zDPK30u2QFbHCqnlTMqF1w9iN2sPDphhyKU1u+Mp5ho=";
+    hash = "sha256-HUNKvLDLZ1VmcyIN0QVMUJZgmd1zBulhzGzGgkZ/84E=";
   };
 
   patches = [

From c017fa968d5d83c443e172c9dbfe3b3cf8dcff51 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sat, 20 Sep 2025 13:03:27 +0200
Subject: [PATCH 176/306] libxml2: 2.14.6 -> 2.15.0

Rel notes: https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.15.0

closes https://github.com/NixOS/nixpkgs/issues/444172
---
 pkgs/development/libraries/libxml2/common.nix | 47 +++++++++----------
 .../development/libraries/libxml2/default.nix | 11 ++++-
 2 files changed, 32 insertions(+), 26 deletions(-)

diff --git a/pkgs/development/libraries/libxml2/common.nix b/pkgs/development/libraries/libxml2/common.nix
index eb16734eede45..4b2f04bbc8f08 100644
--- a/pkgs/development/libraries/libxml2/common.nix
+++ b/pkgs/development/libraries/libxml2/common.nix
@@ -5,19 +5,11 @@
   pkg-config,
   autoreconfHook,
   python3,
+  doxygen,
   ncurses,
   findXMLCatalogs,
   libiconv,
-  # Python limits cross-compilation to an allowlist of host OSes.
-  # https://github.com/python/cpython/blob/dfad678d7024ab86d265d84ed45999e031a03691/configure.ac#L534-L562
-  pythonSupport ?
-    enableShared
-    && (
-      stdenv.hostPlatform == stdenv.buildPlatform
-      || stdenv.hostPlatform.isCygwin
-      || stdenv.hostPlatform.isLinux
-      || stdenv.hostPlatform.isWasi
-    ),
+  pythonSupport ? false,
   icuSupport ? false,
   icu,
   zlibSupport ? false,
@@ -52,27 +44,21 @@ stdenv'.mkDerivation (finalAttrs: {
     "bin"
     "dev"
     "out"
-    "devdoc"
   ]
   ++ lib.optional pythonSupport "py"
   ++ lib.optional (enableStatic && enableShared) "static";
   outputMan = "bin";
 
-  patches = [
-    # Unmerged ABI-breaking patch required to fix the following security issues:
-    # - https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
-    # - https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
-    # See also https://gitlab.gnome.org/GNOME/libxml2/-/issues/906
-    # Source: https://github.com/chromium/chromium/blob/4fb4ae8ce3daa399c3d8ca67f2dfb9deffcc7007/third_party/libxml/chromium/xml-attr-extra.patch
-    ./xml-attr-extra.patch
-  ]
-  ++ extraPatches;
+  patches = [ ] ++ extraPatches;
 
   strictDeps = true;
 
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
+  ]
+  ++ lib.optionals pythonSupport [
+    doxygen
   ];
 
   buildInputs =
@@ -101,10 +87,10 @@ stdenv'.mkDerivation (finalAttrs: {
     (lib.withFeature icuSupport "icu")
     (lib.withFeature pythonSupport "python")
     (lib.optionalString pythonSupport "PYTHON=${python3.pythonOnBuildForHost.interpreter}")
-  ]
-  # avoid rebuilds, can be merged into list in version bumps
-  ++ lib.optional enableHttp "--with-http"
-  ++ lib.optional zlibSupport "--with-zlib";
+    (lib.withFeature enableHttp "http")
+    (lib.withFeature zlibSupport "zlib")
+    (lib.withFeature false "docs") # docs are built with xsltproc, which would be a cyclic dependency
+  ];
 
   installFlags = lib.optionals pythonSupport [
     "pythondir=\"${placeholder "py"}/${python3.sitePackages}\""
@@ -159,6 +145,19 @@ stdenv'.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
     pkgConfigModules = [ "libxml-2.0" ];
+    # Python limits cross-compilation to an allowlist of host OSes.
+    # https://github.com/python/cpython/blob/dfad678d7024ab86d265d84ed45999e031a03691/configure.ac#L534-L562
+    broken =
+      pythonSupport
+      && !(
+        enableShared
+        && (
+          stdenv.hostPlatform == stdenv.buildPlatform
+          || stdenv.hostPlatform.isCygwin
+          || stdenv.hostPlatform.isLinux
+          || stdenv.hostPlatform.isWasi
+        )
+      );
   }
   // extraMeta;
 })
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 08c1cbe5fd033..bcd56ff6e54d7 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -34,6 +34,13 @@ let
         # same as upstream, fixed conflicts
         # https://gitlab.gnome.org/GNOME/libxml2/-/commit/c340e419505cf4bf1d9ed7019a87cc00ec200434
         ./CVE-2025-6170.patch
+
+        # Unmerged ABI-breaking patch required to fix the following security issues:
+        # - https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
+        # - https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
+        # See also https://gitlab.gnome.org/GNOME/libxml2/-/issues/906
+        # Source: https://github.com/chromium/chromium/blob/4fb4ae8ce3daa399c3d8ca67f2dfb9deffcc7007/third_party/libxml/chromium/xml-attr-extra.patch
+        ./xml-attr-extra.patch
       ];
       freezeUpdateScript = true;
       extraMeta = {
@@ -43,13 +50,13 @@ let
       };
     };
     libxml2 = callPackage ./common.nix {
-      version = "2.14.6";
+      version = "2.15.0";
       src = fetchFromGitLab {
         domain = "gitlab.gnome.org";
         owner = "GNOME";
         repo = "libxml2";
         tag = "v${packages.libxml2.version}";
-        hash = "sha256-EIcNL5B/o74hyc1N+ShrlKsPL5tHhiGgkCR1D7FcDjw=";
+        hash = "sha256-jumHSiIMDzqG2hvPUdcBP8LsszcU+loOY+vqEh/0Yqo=";
       };
       extraMeta = {
         maintainers = with lib.maintainers; [

From d462677dc758ec8a23d6c8e70b6d756f598fe13a Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sat, 20 Sep 2025 13:04:57 +0200
Subject: [PATCH 177/306] libxslt: remove broken patch (was fixed in libxml)

---
 pkgs/development/libraries/libxslt/default.nix | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index 8427fe49597d9..d31337777f262 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -39,16 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
     # https://gitlab.gnome.org/GNOME/libxslt/-/issues/144
     # Source: https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77
     ./77-Use-a-dedicated-node-type-to-maintain-the-list-of-cached-rv-ts.patch
-
-    # Fix type confusion in xmlNode.psvi between stylesheet and source nodes
-    # https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
-    # Fix heap-use-after-free in xmlFreeID caused by `atype` corruption
-    # https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
-    #
-    # Depends on unmerged libxml2 patch that breaks ABI.
-    #
-    # Source: https://github.com/chromium/chromium/blob/4fb4ae8ce3daa399c3d8ca67f2dfb9deffcc7007/third_party/libxslt/chromium/new-unified-atype-extra.patch
-    ./new-unified-atype-extra.patch
   ];
 
   strictDeps = true;

From f6d8ba3220b0952ed8000f59eae809e25a9d37b2 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sat, 20 Sep 2025 13:05:40 +0200
Subject: [PATCH 178/306] python3Packages.lxml: 6.0.1 -> 6.0.2

---
 pkgs/development/python-modules/lxml/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index fee77d75aa2e8..8780137b1c040 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -17,16 +17,21 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "6.0.1";
+  version = "6.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lxml";
     repo = "lxml";
     tag = "lxml-${version}";
-    hash = "sha256-iY47nhAbA8ScnjmK2/7lVCBP8f65v1zOs3TcgQULlQ0=";
+    hash = "sha256-Ri5SzfQJFghRcMAKHS5QKD365OZlio895fSlumq83vs=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'Cython>=3.1.4' 'Cython'
+  '';
+
   build-system = [
     cython
     setuptools

From 0d73b69f003641339874bcac4fcbdab9678a133f Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sat, 20 Sep 2025 23:26:49 +0200
Subject: [PATCH 179/306] xmlsec: fix bad const qualifier

---
 pkgs/by-name/xm/xmlsec/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/xm/xmlsec/package.nix b/pkgs/by-name/xm/xmlsec/package.nix
index f1b8f9b472e34..2a2b52ee337af 100644
--- a/pkgs/by-name/xm/xmlsec/package.nix
+++ b/pkgs/by-name/xm/xmlsec/package.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   fetchurl,
+  fetchpatch,
   libxml2,
   gnutls,
   libxslt,
@@ -33,6 +34,11 @@ lib.fix (
     patches = [
       ./lt_dladdsearchdir.patch
       ./remove_bsd_base64_decode_flag.patch
+      (fetchpatch {
+        # xmlDoc.encoding is no longer const in libxml 2.15, so fetch the fix
+        url = "https://github.com/lsh123/xmlsec/commit/ef0e3b5cac04db13ce070b1e5bcad7dd7b0eb49b.patch?full_index=1";
+        hash = "sha256-Hv8PaJXkXLq++NuCAJ4IvsYBPj8wkN7dBTniYucq18o=";
+      })
     ];
 
     postPatch = ''

From 30f67da31523894ad850c28baf062f5d0a512ea0 Mon Sep 17 00:00:00 2001
From: Alois Wohlschlager <alois1@gmx-topmail.de>
Date: Thu, 2 Oct 2025 20:59:25 +0200
Subject: [PATCH 180/306] nghttp3: simplify static conditionals

Mass-rebuild cleanup after https://github.com/NixOS/nixpkgs/pull/445602 .
---
 pkgs/by-name/ng/nghttp3/package.nix | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index 9652a25a7ce82..cff35f454d3a4 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -23,16 +23,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags =
-    if stdenv.hostPlatform.isStatic then
-      [
-        (lib.cmakeBool "ENABLE_SHARED_LIB" false)
-        (lib.cmakeBool "ENABLE_STATIC_LIB" true)
-      ]
-    else
-      [
-        (lib.cmakeBool "ENABLE_STATIC_LIB" false)
-      ];
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_SHARED_LIB" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "ENABLE_STATIC_LIB" stdenv.hostPlatform.isStatic)
+  ];
 
   doCheck = true;
 

From 28b566547ea43bdff051a0e173c3f76a1021c49e Mon Sep 17 00:00:00 2001
From: Alois Wohlschlager <alois1@gmx-topmail.de>
Date: Thu, 2 Oct 2025 20:59:25 +0200
Subject: [PATCH 181/306] ngtcp2: simplify static conditionals

Mass-rebuild cleanup after https://github.com/NixOS/nixpkgs/pull/445602 .
---
 pkgs/development/libraries/ngtcp2/default.nix | 20 +++++++------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index 9de9314dc37dd..1f88deb6363f1 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -36,19 +36,13 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withJemalloc jemalloc;
 
-  cmakeFlags =
-    if stdenv.hostPlatform.isStatic then
-      [
-        # The examples try to link against `ngtcp2_crypto_ossl` and `ngtcp2` libraries.
-        # This works in the dynamic case where the targets have the same name, but not here where they're suffixed with `_static`.
-        (lib.cmakeBool "ENABLE_LIB_ONLY" true)
-        (lib.cmakeBool "ENABLE_SHARED_LIB" false)
-        (lib.cmakeBool "ENABLE_STATIC_LIB" true)
-      ]
-    else
-      [
-        (lib.cmakeBool "ENABLE_STATIC_LIB" false)
-      ];
+  cmakeFlags = [
+    # The examples try to link against `ngtcp2_crypto_ossl` and `ngtcp2` libraries.
+    # This works in the dynamic case where the targets have the same name, but not here where they're suffixed with `_static`.
+    (lib.cmakeBool "ENABLE_LIB_ONLY" stdenv.hostPlatform.isStatic)
+    (lib.cmakeBool "ENABLE_SHARED_LIB" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "ENABLE_STATIC_LIB" stdenv.hostPlatform.isStatic)
+  ];
 
   doCheck = true;
 

From 60d7923ecec0a1db1df48d6df57695ab17156707 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@veniogames.com>
Date: Thu, 2 Oct 2025 22:50:17 +0200
Subject: [PATCH 182/306] libressl_4_0: 4.0.0 -> 4.0.1

Includes a fix for CVE-2025-9230, see the release notes at
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.0.1-relnotes.txt
---
 pkgs/development/libraries/libressl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix
index fe8731c0a38f0..ac528cfcfa019 100644
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@@ -133,8 +133,8 @@ in
   };
 
   libressl_4_0 = generic {
-    version = "4.0.0";
-    hash = "sha256-TYQZVfCsw9/HHQ49018oOvRhIiNQ4mhD/qlzHAJGoeQ=";
+    version = "4.0.1";
+    hash = "sha256-IClLh3eMJidIk4Y5Q8hjWJebSZ03tJl31r+Gj3tZfL0=";
     # Fixes build on loongarch64
     # https://github.com/libressl/portable/pull/1146
     patches = [

From a0b7ed298ac2965639eb7eb2f82946d702e47962 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@veniogames.com>
Date: Thu, 2 Oct 2025 22:50:50 +0200
Subject: [PATCH 183/306] libressl_4_1: 4.1.0 -> 4.1.1

Includes a fix for CVE-2025-9230, see the release notes at
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.1.1-relnotes.txt
---
 pkgs/development/libraries/libressl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix
index ac528cfcfa019..e85a06aefff7d 100644
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@@ -153,8 +153,8 @@ in
   };
 
   libressl_4_1 = generic {
-    version = "4.1.0";
-    hash = "sha256-D3HBa9NL2qzNy5al2UpJIb+2EuxuDrp6gNiFTu/Yu2E=";
+    version = "4.1.1";
+    hash = "sha256-x/96fWddX1dzCUDlzP8dvi3NW3QFtTl+D3/9ZqXtVnk=";
     # Fixes build on loongarch64
     # https://github.com/libressl/portable/pull/1184
     postPatch = ''

From 2277092388c1d317e05a8948a2657a42db0fbd7b Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@veniogames.com>
Date: Thu, 2 Oct 2025 22:57:58 +0200
Subject: [PATCH 184/306] libressl_3_9: remove unsupported package

The current supported versions are 4.0 and 4.1. 3.9 is no longer
supported, and has not received the fix for CVE-2025-9230 that 4.0 and
4.1 did receive. I think it's better to remove it at this point.
---
 pkgs/development/libraries/libressl/default.nix | 14 --------------
 pkgs/top-level/all-packages.nix                 |  1 -
 2 files changed, 15 deletions(-)

diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix
index e85a06aefff7d..af6fcb0d06727 100644
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@@ -118,20 +118,6 @@ let
     };
 in
 {
-  libressl_3_9 = generic {
-    version = "3.9.2";
-    hash = "sha256-ewMdrGSlnrbuMwT3/7ddrTOrjJ0nnIR/ksifuEYGj5c=";
-
-    patches = [
-      # Fixes build on ppc64
-      # https://github.com/libressl/portable/pull/1073
-      (fetchpatch {
-        url = "https://github.com/libressl/portable/commit/e6c7de3f03c51fbdcf5ad88bf12fe9e128521f0d.patch";
-        hash = "sha256-LJy3fjbnc9h5DG3/+8bLECwJeBpPxy3hU8sPuhovmcw=";
-      })
-    ];
-  };
-
   libressl_4_0 = generic {
     version = "4.0.1";
     hash = "sha256-IClLh3eMJidIk4Y5Q8hjWJebSZ03tJl31r+Gj3tZfL0=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c8e36b72bd8a1..40ebcf37fc321 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8489,7 +8489,6 @@ with pkgs;
   zunclient = with python313Packages; toPythonApplication python-zunclient;
 
   inherit (callPackages ../development/libraries/libressl { })
-    libressl_3_9
     libressl_4_0
     libressl_4_1
     ;

From ecd55fb26a14252b32a82e70db7dcf57c4c0d6cc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Oct 2025 21:32:23 +0000
Subject: [PATCH 185/306] pyright: 1.1.403 -> 1.1.406

---
 pkgs/by-name/py/pyright/package-lock.json | 51 +++++++----------------
 pkgs/by-name/py/pyright/package.nix       | 10 ++---
 2 files changed, 21 insertions(+), 40 deletions(-)

diff --git a/pkgs/by-name/py/pyright/package-lock.json b/pkgs/by-name/py/pyright/package-lock.json
index 221d0e3ff742f..4505415580bf4 100644
--- a/pkgs/by-name/py/pyright/package-lock.json
+++ b/pkgs/by-name/py/pyright/package-lock.json
@@ -6,7 +6,7 @@
     "": {
       "name": "pyright-root",
       "devDependencies": {
-        "glob": "^7.2.3",
+        "glob": "^8.1.0",
         "jsonc-parser": "^3.3.1"
       }
     },
@@ -18,23 +18,15 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
+        "balanced-match": "^1.0.0"
       }
     },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
@@ -43,9 +35,9 @@
       "license": "ISC"
     },
     "node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
+      "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==",
       "deprecated": "Glob versions prior to v9 are no longer supported",
       "dev": true,
       "license": "ISC",
@@ -53,12 +45,11 @@
         "fs.realpath": "^1.0.0",
         "inflight": "^1.0.4",
         "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+        "minimatch": "^5.0.1",
+        "once": "^1.3.0"
       },
       "engines": {
-        "node": "*"
+        "node": ">=12"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -91,16 +82,16 @@
       "license": "MIT"
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
+      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^1.1.7"
+        "brace-expansion": "^2.0.1"
       },
       "engines": {
-        "node": "*"
+        "node": ">=10"
       }
     },
     "node_modules/once": {
@@ -113,16 +104,6 @@
         "wrappy": "1"
       }
     },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
diff --git a/pkgs/by-name/py/pyright/package.nix b/pkgs/by-name/py/pyright/package.nix
index 9e649914c0bd4..dea2ba75cea09 100644
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -7,13 +7,13 @@
 }:
 
 let
-  version = "1.1.403";
+  version = "1.1.406";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "pyright";
     tag = version;
-    hash = "sha256-vqE/3wK0rtFT9f399djm4QElRccXdOXyODsQMQySa9k=";
+    hash = "sha256-hSPnUjIZf9od1u7PwgEFDXGWmizjdqSiXjb45wZIM9Q=";
   };
 
   patchedPackageJSON = runCommand "package.json" { } ''
@@ -27,7 +27,7 @@ let
     pname = "pyright-root";
     inherit version src;
     sourceRoot = "${src.name}"; # required for update.sh script
-    npmDepsHash = "sha256-1OrUBARwNvT8pTH66W7GAKG8B5fX8/6jtOOYVU6IgSw=";
+    npmDepsHash = "sha256-4DVWWoLnNXoJ6eWeQuOzAVjcvo75Y2nM/HwQvAEN4ME=";
     dontNpmBuild = true;
     postPatch = ''
       cp ${patchedPackageJSON} ./package.json
@@ -44,7 +44,7 @@ let
     pname = "pyright-internal";
     inherit version src;
     sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-Tc7v6sDu0PR//ukvw9hULX0KGpRkA0hEaeuKlPnpYl4=";
+    npmDepsHash = "sha256-BzyZEJUOEqPBpPrVNhf/kDOBS3Q4Hgkpfz+JDccHr4g=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -58,7 +58,7 @@ buildNpmPackage rec {
   inherit version src;
 
   sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-wzjdeZr6tbaBuOWDJXeTFkQRUHnxYryvI7sfGsSEpVQ=";
+  npmDepsHash = "sha256-Ye8r7m4755GfU74G8Neetu+BlrHQWoQe7y2TyOjvBOo=";
 
   postPatch = ''
     chmod +w ../../

From 1c5d47dd782dd7e63d16978d4bc0c6065361bcd8 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Wed, 23 Jul 2025 18:31:22 -0400
Subject: [PATCH 186/306] systemd: v257.9 -> v258

---
 nixos/modules/services/hardware/udev.nix      |  3 +-
 ...ts-for-uninitialised-encrypted-devic.patch |  8 +--
 ...on-t-try-to-unmount-nix-or-nix-store.patch |  8 +--
 .../systemd/0003-Fix-NixOS-containers.patch   |  8 +--
 ...some-NixOS-specific-unit-directories.patch | 22 +++----
 ...f-a-useless-message-in-user-sessions.patch |  4 +-
 ...d-timedated-disable-methods-that-cha.patch | 22 +++----
 ...e-usr-share-zoneinfo-to-etc-zoneinfo.patch | 59 ++++++++++++-------
 ...calectl-use-etc-X11-xkb-for-list-x11.patch |  6 +-
 ...9-add-rootprefix-to-lookup-dir-paths.patch |  4 +-
 ...-execute-scripts-in-etc-systemd-syst.patch |  2 +-
 ...ecute-scripts-in-etc-systemd-system-.patch |  4 +-
 ...-placeholder-for-DEFAULT_PATH_NORMAL.patch |  4 +-
 ...-environment-when-calling-generators.patch |  4 +-
 ...014-core-don-t-taint-on-unmerged-usr.patch |  4 +-
 ...ontext_init-fix-driver-name-checking.patch |  4 +-
 ...uggest-systemdctl-edit-runtime-on-sy.patch |  4 +-
 ....build-do-not-create-systemdstatedir.patch |  4 +-
 .../0018-meson-Don-t-link-ssh-dropins.patch   |  4 +-
 ...nit_file_exists_full-follow-symlinks.patch |  4 +-
 ...e-NSCD-when-DNSSEC-validation-is-dis.patch |  6 +-
 pkgs/os-specific/linux/systemd/default.nix    | 14 +++--
 22 files changed, 112 insertions(+), 90 deletions(-)

diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index ca9464d091c1f..9370fb0bf207d 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -179,7 +179,8 @@ let
         for i in $packages; do
           echo "Adding hwdb files for package $i"
           for j in $i/{etc,lib}/udev/hwdb.d/*; do
-            ln -s $j etc/udev/hwdb.d/$(basename $j)
+            # This must be a copy, not a symlink, because --root below will chase links within the root argument.
+            cp $j etc/udev/hwdb.d/$(basename $j)
           done
         done
 
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index d242ff7c92878..02845eb126f67 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,7 +13,7 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 882cda0dcd..8e8d1f04ce 100644
+index bebc4d7d09..60278a0da7 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
 @@ -30,10 +30,6 @@ SUBSYSTEM=="block", ACTION=="add", KERNEL=="dm-*", ENV{DM_NAME}!="?*", ENV{SYSTE
@@ -24,6 +24,6 @@ index 882cda0dcd..8e8d1f04ce 100644
 -# we are probably still calling mke2fs or mkswap on it.
 -SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
 -
- # add symlink to GPT root disk
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
+ # Ignore raid devices that are not yet assembled and started
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 9e34969868597..d1dcbfd37a0ff 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -14,10 +14,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index d6a256c4a7..f74d5198f1 100644
+index 57ab68deb6..8e281b8f2c 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -66,6 +66,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -72,6 +72,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -27,10 +27,10 @@ index d6a256c4a7..f74d5198f1 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 84da5eed63..d6e2f36d52 100644
+index 45c6db9245..d7283b7fa6 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -175,8 +175,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {
+@@ -178,8 +178,10 @@ int mount_points_list_get(FILE *f, MountPoint **head) {
  static bool nonunmountable_path(const char *path) {
          assert(path);
  
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 7cc2804a05bbb..3815c140d4953 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 6f90f2f418..74b2a237d3 100644
+index ab8746c442..480a9c55c6 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -6189,6 +6189,7 @@ static int run(int argc, char *argv[]) {
+@@ -6165,6 +6165,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,11 +21,11 @@ index 6f90f2f418..74b2a237d3 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -6208,6 +6209,7 @@ static int run(int argc, char *argv[]) {
+@@ -6184,6 +6185,7 @@ static int run(int argc, char *argv[]) {
                                  log_error_errno(r, "Unable to determine if %s looks like it has an OS tree (i.e. whether /usr/ exists): %m", arg_directory);
                                  goto finish;
                          }
 +#endif
                  }
  
-         } else {
+                 if (arg_userns_mode == USER_NAMESPACE_MANAGED) {
diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index 2657eb9089d1e..81d17a57fb2f9 100644
--- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -16,10 +16,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 7 insertions(+), 21 deletions(-)
 
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index f3b85b0190..f7aa5fca50 100644
+index 58f2463104..0c263430a7 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
-@@ -43,10 +43,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
+@@ -46,10 +46,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
  systemd_user_conf_dir=${sysconfdir}/systemd/user
  systemduserconfdir=${systemd_user_conf_dir}
  
@@ -32,7 +32,7 @@ index f3b85b0190..f7aa5fca50 100644
  systemduserunitpath=${systemd_user_unit_path}
  
  systemd_system_generator_dir=${prefix}/lib/systemd/system-generators
-@@ -55,10 +55,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
+@@ -58,10 +58,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
  systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
  systemdusergeneratordir=${systemd_user_generator_dir}
  
@@ -46,10 +46,10 @@ index f3b85b0190..f7aa5fca50 100644
  
  systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
 diff --git a/src/libsystemd/sd-path/path-lookup.c b/src/libsystemd/sd-path/path-lookup.c
-index a3b09208cb..91a085c6bc 100644
+index 3ddbda0e9f..3eddc80c90 100644
 --- a/src/libsystemd/sd-path/path-lookup.c
 +++ b/src/libsystemd/sd-path/path-lookup.c
-@@ -69,11 +69,7 @@ int runtime_directory(RuntimeScope scope, const char *suffix, char **ret) {
+@@ -64,11 +64,7 @@ int runtime_directory(RuntimeScope scope, const char *suffix, char **ret) {
  }
  
  static const char* const user_data_unit_paths[] = {
@@ -61,7 +61,7 @@ index a3b09208cb..91a085c6bc 100644
          NULL
  };
  
-@@ -481,16 +477,13 @@ int lookup_paths_init(
+@@ -476,16 +472,13 @@ int lookup_paths_init(
                                         persistent_config,
                                         SYSTEM_CONFIG_UNIT_DIR,
                                         "/etc/systemd/system",
@@ -79,7 +79,7 @@ index a3b09208cb..91a085c6bc 100644
                                         STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -508,13 +501,10 @@ int lookup_paths_init(
+@@ -503,13 +496,10 @@ int lookup_paths_init(
                          add = strv_new(persistent_config,
                                         USER_CONFIG_UNIT_DIR,
                                         "/etc/systemd/user",
@@ -95,7 +95,7 @@ index a3b09208cb..91a085c6bc 100644
                          break;
  
                  case RUNTIME_SCOPE_USER:
-@@ -653,7 +643,6 @@ void lookup_paths_log(LookupPaths *lp) {
+@@ -648,7 +638,6 @@ void lookup_paths_log(LookupPaths *lp) {
  static const char* const system_generator_paths[] = {
          "/run/systemd/system-generators",
          "/etc/systemd/system-generators",
@@ -103,7 +103,7 @@ index a3b09208cb..91a085c6bc 100644
          SYSTEM_GENERATOR_DIR,
          NULL,
  };
-@@ -661,7 +650,6 @@ static const char* const system_generator_paths[] = {
+@@ -656,7 +645,6 @@ static const char* const system_generator_paths[] = {
  static const char* const user_generator_paths[] = {
          "/run/systemd/user-generators",
          "/etc/systemd/user-generators",
@@ -111,7 +111,7 @@ index a3b09208cb..91a085c6bc 100644
          USER_GENERATOR_DIR,
          NULL,
  };
-@@ -669,7 +657,6 @@ static const char* const user_generator_paths[] = {
+@@ -664,7 +652,6 @@ static const char* const user_generator_paths[] = {
  static const char* const system_env_generator_paths[] = {
          "/run/systemd/system-environment-generators",
          "/etc/systemd/system-environment-generators",
@@ -119,7 +119,7 @@ index a3b09208cb..91a085c6bc 100644
          SYSTEM_ENV_GENERATOR_DIR,
          NULL,
  };
-@@ -677,7 +664,6 @@ static const char* const system_env_generator_paths[] = {
+@@ -672,7 +659,6 @@ static const char* const system_env_generator_paths[] = {
  static const char* const user_env_generator_paths[] = {
          "/run/systemd/user-environment-generators",
          "/etc/systemd/user-environment-generators",
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index 6c4a41ab06098..2f71399112206 100644
--- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 4ccaba9054..9577b89783 100644
+index d85896577f..2a4782a55e 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1672,7 +1672,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1575,7 +1575,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 44bd2263ddf0d..b43dddb3d4209 100644
--- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,10 +11,10 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index ba50b59f92..9827487453 100644
+index 06fb3f2878..b656e511b7 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -1115,6 +1115,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -1388,6 +1388,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index ba50b59f92..9827487453 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -1177,6 +1180,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -1454,6 +1457,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -35,10 +35,10 @@ index ba50b59f92..9827487453 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 062744519d..95bde4b1c3 100644
+index 11d9130bbc..dd4d9e59ea 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
-@@ -226,6 +226,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+@@ -221,6 +221,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
  
          use_localegen = locale_gen_check_available();
  
@@ -48,7 +48,7 @@ index 062744519d..95bde4b1c3 100644
          /* If single locale without variable name is provided, then we assume it is LANG=. */
          if (strv_length(l) == 1 && !strchr(l[0], '=')) {
                  if (!locale_is_valid(l[0]))
-@@ -343,6 +346,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+@@ -338,6 +341,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -58,7 +58,7 @@ index 062744519d..95bde4b1c3 100644
          vc_context_empty_to_null(&in);
  
          r = vc_context_verify_and_warn(&in, LOG_ERR, error);
-@@ -460,6 +466,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+@@ -455,6 +461,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -69,10 +69,10 @@ index 062744519d..95bde4b1c3 100644
  
          r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index c79bb864df..cbd30214b7 100644
+index 662cc29ac5..57f3413dc6 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -676,6 +676,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -678,6 +678,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index c79bb864df..cbd30214b7 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -754,6 +758,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -756,6 +760,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index c79bb864df..cbd30214b7 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -948,6 +955,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -954,6 +961,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 1f4184e928360..21589efdd8494 100644
--- a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -7,10 +7,10 @@ NixOS uses this path.
 ---
  man/localtime.xml         | 4 ++--
  src/basic/time-util.c     | 8 ++++----
- src/firstboot/firstboot.c | 2 +-
+ src/firstboot/firstboot.c | 9 +++------
  src/nspawn/nspawn.c       | 4 ++--
  src/timedate/timedated.c  | 8 ++++----
- 5 files changed, 13 insertions(+), 13 deletions(-)
+ 5 files changed, 15 insertions(+), 18 deletions(-)
 
 diff --git a/man/localtime.xml b/man/localtime.xml
 index 3a13e04a27..4fd58068a1 100644
@@ -35,10 +35,10 @@ index 3a13e04a27..4fd58068a1 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 29afb08ebc..398ff340cd 100644
+index 55931a2546..2e00bd7539 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1418,7 +1418,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1410,7 +1410,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 29afb08ebc..398ff340cd 100644
          if (!f)
                  return -errno;
  
-@@ -1459,7 +1459,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1451,7 +1451,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
  
          assert(ret);
  
@@ -56,7 +56,7 @@ index 29afb08ebc..398ff340cd 100644
          if (!f)
                  return -errno;
  
-@@ -1570,7 +1570,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1562,7 +1562,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 29afb08ebc..398ff340cd 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1622,7 +1622,7 @@ int get_timezone(char **ret) {
+@@ -1614,7 +1614,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* Return EINVAL if not a symlink */
  
@@ -75,23 +75,38 @@ index 29afb08ebc..398ff340cd 100644
                  return -EINVAL;
          if (!timezone_is_valid(e, LOG_DEBUG))
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index a389eeae10..c817e91991 100644
+index 5ed6d3a9d2..f922d91a9d 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -598,7 +598,7 @@ static int process_timezone(int rfd) {
+@@ -618,7 +618,7 @@ static int prompt_timezone(int rfd) {
+ 
+ static int process_timezone(int rfd) {
+         _cleanup_close_ int pfd = -EBADF;
+-        _cleanup_free_ char *f = NULL, *relpath = NULL;
++        _cleanup_free_ char *f = NULL;
+         const char *e;
+         int r;
+ 
+@@ -664,12 +664,9 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
--        e = strjoina("../usr/share/zoneinfo/", arg_timezone);
+-        e = strjoina("/usr/share/zoneinfo/", arg_timezone);
+-        r = path_make_relative_parent(etc_localtime(), e, &relpath);
+-        if (r < 0)
+-                return r;
 +        e = strjoina("zoneinfo/", arg_timezone);
  
-         r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
+-        r = symlinkat_atomic_full(relpath, pfd, f, SYMLINK_LABEL);
++        r = symlinkat_atomic_full(e, pfd, f, SYMLINK_LABEL);
          if (r < 0)
+                 return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
+ 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 74b2a237d3..cf9eabf0f2 100644
+index 480a9c55c6..02c9ae6608 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1851,8 +1851,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1821,8 +1821,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,10 +118,10 @@ index 74b2a237d3..cf9eabf0f2 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index cbd30214b7..b9b2f533a4 100644
+index 57f3413dc6..6a456fe601 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -280,7 +280,7 @@ static int context_read_data(Context *c) {
+@@ -266,7 +266,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
@@ -115,24 +130,24 @@ index cbd30214b7..b9b2f533a4 100644
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -304,7 +304,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -290,7 +290,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
 -                if (access("/usr/share/zoneinfo/UTC", F_OK) < 0) {
 +                if (access("/etc/zoneinfo/UTC", F_OK) < 0) {
  
-                         if (unlink("/etc/localtime") < 0 && errno != ENOENT)
+                         if (unlink(etc_localtime()) < 0 && errno != ENOENT)
                                  return -errno;
-@@ -312,9 +312,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -298,9 +298,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  
--                source = "../usr/share/zoneinfo/UTC";
-+                source = "../etc/zoneinfo/UTC";
+-                source = "/usr/share/zoneinfo/UTC";
++                source = "/etc/zoneinfo/UTC";
          } else {
--                p = path_join("../usr/share/zoneinfo", c->zone);
-+                p = path_join("../etc/zoneinfo", c->zone);
+-                p = path_join("/usr/share/zoneinfo", c->zone);
++                p = path_join("/etc/zoneinfo", c->zone);
                  if (!p)
                          return -ENOMEM;
  
diff --git a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
index c670f076c34af..6c348219872fd 100644
--- a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,15 +10,15 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index 36dbeb9daa..265eda2751 100644
+index c595f81b40..90033f6566 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
-@@ -301,7 +301,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+@@ -302,7 +302,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
          } state = NONE, look_for;
          int r;
  
 -        f = fopen("/usr/share/X11/xkb/rules/base.lst", "re");
 +        f = fopen("/etc/X11/xkb/rules/base.lst", "re");
          if (!f)
-                 return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
+                 return log_error_errno(errno, "Failed to open keyboard mapping list: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
index bf9f028d6300f..beb8acc617323 100644
--- a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,10 +12,10 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index 5aaf8f535c..934175fb51 100644
+index 7a09fbf878..ee3378f109 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
-@@ -62,13 +62,15 @@
+@@ -40,13 +40,15 @@
          "/etc/" n "\0"                          \
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
diff --git a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 20b4641ac0002..b05fc609d6ed3 100644
--- a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,7 +10,7 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index e26a8579c5..af814cd551 100644
+index 3317068e47..021a3c0699 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
 @@ -358,6 +358,7 @@ static void notify_supervisor(void) {
diff --git a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 13578115a0141..bfded1bba554c 100644
--- a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 181bb4ccef..2b1410d8a1 100644
+index 3390ebe0c0..affc823bc4 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -218,6 +218,7 @@ static int execute(
+@@ -248,6 +248,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 9e29c34efcd77..1168d1249858a 100644
--- a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,10 +10,10 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index dff5a3a549..01344e5cf6 100644
+index 45518c07e5..94bef2f4b4 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -17,10 +17,10 @@
+@@ -9,10 +9,10 @@
  #define PATH_MERGED_BIN(x) x "bin"
  #define PATH_MERGED_BIN_NULSTR(x) x "bin\0"
  
diff --git a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
index 856fdee934756..1c4ce37dde343 100644
--- a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 9577b89783..9cfd2798b9 100644
+index 2a4782a55e..8dfdc227a1 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4158,9 +4158,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3977,9 +3977,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
index fbaaed99cb61b..445b08d2289fd 100644
--- a/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
@@ -17,10 +17,10 @@ See also: https://github.com/systemd/systemd/issues/24191
  1 file changed, 8 deletions(-)
 
 diff --git a/src/core/taint.c b/src/core/taint.c
-index b7a1c647a2..c04864c478 100644
+index 8872a224b2..bc736e2ef8 100644
 --- a/src/core/taint.c
 +++ b/src/core/taint.c
-@@ -41,14 +41,6 @@ char** taint_strv(void) {
+@@ -42,14 +42,6 @@ char** taint_strv(void) {
  
          _cleanup_free_ char *bin = NULL, *usr_sbin = NULL, *var_run = NULL;
  
diff --git a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
index fe8ac0ddd913a..9f73ff0de5477 100644
--- a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
@@ -27,10 +27,10 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index 5b6b3ea93c..8ab04241b6 100644
+index 57e7a91f93..faf45e4807 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -721,7 +721,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+@@ -724,7 +724,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
diff --git a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
index 50dd842cc221e..de846e9410b32 100644
--- a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+++ b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
@@ -30,10 +30,10 @@ are written into `$XDG_CONFIG_HOME/systemd/user`.
  1 file changed, 3 insertions(+)
 
 diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
-index 7165fa1cf7..7498cf9f4c 100644
+index 53bc57186a..0ed12ce931 100644
 --- a/src/systemctl/systemctl-edit.c
 +++ b/src/systemctl/systemctl-edit.c
-@@ -323,6 +323,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
+@@ -330,6 +330,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
          sd_bus *bus;
          int r;
  
diff --git a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
index 65cd257a8a418..2e3ada02a9011 100644
--- a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
+++ b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] meson.build: do not create systemdstatedir
  1 file changed, 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index a4730f0570..b5aaecd669 100644
+index 238b935372..b0b67c9b99 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2815,7 +2815,6 @@ install_data('LICENSE.GPL2',
+@@ -2791,7 +2791,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
diff --git a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch b/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
index da170d869ad75..472bd260caf39 100644
--- a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
+++ b/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] meson: Don't link ssh dropins
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index b5aaecd669..91b23f2d72 100644
+index b0b67c9b99..4721b7482b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -207,13 +207,13 @@ sshconfdir = get_option('sshconfdir')
+@@ -219,13 +219,13 @@ sshconfdir = get_option('sshconfdir')
  if sshconfdir == ''
          sshconfdir = sysconfdir / 'ssh/ssh_config.d'
  endif
diff --git a/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch b/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
index 4d7ceedcbab09..7372b5214e59c 100644
--- a/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
+++ b/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] install: unit_file_exists_full: follow symlinks
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/install.c b/src/shared/install.c
-index 6d87858a3c..8da022eb64 100644
+index 8195436564..dfbc35f357 100644
 --- a/src/shared/install.c
 +++ b/src/shared/install.c
-@@ -3226,7 +3226,7 @@ int unit_file_exists_full(RuntimeScope scope, const LookupPaths *lp, const char
+@@ -3227,7 +3227,7 @@ int unit_file_exists_full(RuntimeScope scope, const LookupPaths *lp, const char
                          &c,
                          lp,
                          name,
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
index a1b1575a51d28..be03316306b69 100644
--- a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+++ b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -13,10 +13,10 @@ directly.
  1 file changed, 11 insertions(+)
 
 diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
-index d002501d29..9b835dc031 100644
+index 40305c046b..c3ed57c54e 100644
 --- a/src/timesync/timesyncd.c
 +++ b/src/timesync/timesyncd.c
-@@ -23,6 +23,11 @@
+@@ -25,6 +25,11 @@
  #include "timesyncd-conf.h"
  #include "timesyncd-manager.h"
  #include "user-util.h"
@@ -28,7 +28,7 @@ index d002501d29..9b835dc031 100644
  
  static int advance_tstamp(int fd, usec_t epoch) {
          assert(fd >= 0);
-@@ -201,6 +206,12 @@ static int run(int argc, char *argv[]) {
+@@ -203,6 +208,12 @@ static int run(int argc, char *argv[]) {
          if (r < 0)
                  return log_error_errno(r, "Failed to parse fallback server strings: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 090da26ed77c1..07fe2194d044b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -56,7 +56,6 @@
   elfutils,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   gnutls,
-  iptables,
   withSelinux ? false,
   libselinux,
   withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
@@ -205,7 +204,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "257.9";
+  version = "258";
 
   # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
   # This has proven to be less error-prone than the previous systemd fork.
@@ -213,7 +212,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3Ig5TXhK99iOu41k4c5CgC4R3HhBftSAb9UbXvFY6lo=";
+    hash = "sha256-xtGZaVNsBNxkidgfVBu8xtvj0SxpY6OyJCUE+gq59qE=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -225,6 +224,12 @@ stdenv.mkDerivation (finalAttrs: {
   # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all
   # patches
   patches = [
+    # https://github.com/systemd/systemd/pull/39094
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/0f44a6c64aebc64a0611a605831206afee9cb730.patch";
+      hash = "sha256-DO6q17mE2U8iLezMYt4PX5Ror20N1gCrUbXeQmrW1is=";
+    })
+
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch
@@ -373,6 +378,7 @@ stdenv.mkDerivation (finalAttrs: {
         jinja2
       ]
       ++ lib.optional withEfi ps.pyelftools
+      ++ lib.optional (withUkify && finalAttrs.finalPackage.doCheck) ps.pefile
     ))
   ]
   ++ lib.optionals withLibBPF [
@@ -854,7 +860,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     ${lib.optionalString (
       !buildLibsOnly
-    ) "$out/bin/udevadm verify --resolve-names=never --no-style $out/lib/udev/rules.d"}
+    ) "$out/bin/udevadm verify --resolve-names=late --no-style $out/lib/udev/rules.d"}
 
     runHook postInstallCheck
   '';

From 5da25f9301751108d30562b4e86561a36f3cebcf Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Thu, 25 Sep 2025 18:27:54 -0400
Subject: [PATCH 187/306] systemd: Patch journald's Audit setting

https://github.com/systemd/systemd/pull/39069
---
 nixos/modules/system/boot/systemd/journald.nix | 7 +++++--
 pkgs/os-specific/linux/systemd/default.nix     | 6 ++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix
index 4d2ca7f11f213..279da8f47c0bc 100644
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -79,8 +79,11 @@ in
     };
 
     services.journald.audit = lib.mkOption {
-      default = null;
-      type = lib.types.nullOr lib.types.bool;
+      default = "keep";
+      type = lib.types.oneOf [
+        lib.types.bool
+        (lib.types.enum [ "keep" ])
+      ];
       description = ''
         If enabled systemd-journald will turn on auditing on start-up.
         If disabled it will turn it off. If unset it will neither enable nor disable it, leaving the previous state unchanged.
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 07fe2194d044b..72f9de3462310 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -230,6 +230,12 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-DO6q17mE2U8iLezMYt4PX5Ror20N1gCrUbXeQmrW1is=";
     })
 
+    # https://github.com/systemd/systemd/pull/39069
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/b5fdfedf729712b9824a5cb457a07d5699d2946c.patch";
+      hash = "sha256-0SvAn9Dl4z80PRIvDbIVIjKp5DsT/IUoHa5IiH1HHFY=";
+    })
+
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch

From 2203cd2a7c9f18f55f1bb9e1c5466433dfe8c93e Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Thu, 2 Oct 2025 17:10:41 -0400
Subject: [PATCH 188/306] udevCheckHook: Use `--resolve-names=late`

With systemd 258, `--resolve-names=never` causes any udev rules such
as `ENV{FOO}=="*?", GROUP=foo` to fail due to name resolution. Restore
old behvaior using the new `late` option.
---
 pkgs/by-name/ud/udevCheckHook/hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ud/udevCheckHook/hook.sh b/pkgs/by-name/ud/udevCheckHook/hook.sh
index bdb8e9c1f746f..06740394a2778 100644
--- a/pkgs/by-name/ud/udevCheckHook/hook.sh
+++ b/pkgs/by-name/ud/udevCheckHook/hook.sh
@@ -12,7 +12,7 @@ udevCheckHook() {
     for output in $(getAllOutputNames); do
         for path in etc lib ; do
             if [ -d "${!output}/$path/udev/rules.d" ]; then
-                @udevadm@ verify --resolve-names=never --no-style "${!output}/$path/udev/rules.d"
+                @udevadm@ verify --resolve-names=late --no-style "${!output}/$path/udev/rules.d"
             fi
         done
     done

From 4d813741b522a9faea4ca12c21e8e891642e014e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 3 Oct 2025 01:22:16 +0200
Subject: [PATCH 189/306] python3Packages.cython: 3.1.2 -> 3.1.4

https://github.com/cython/cython/blob/3.1.4/CHANGES.rst
---
 pkgs/development/python-modules/cython/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cython/default.nix b/pkgs/development/python-modules/cython/default.nix
index f62acbab3b90c..decea832cb463 100644
--- a/pkgs/development/python-modules/cython/default.nix
+++ b/pkgs/development/python-modules/cython/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "cython";
-  version = "3.1.2";
+  version = "3.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cython";
     repo = "cython";
     tag = version;
-    hash = "sha256-lP8ILCzAZuoPzFhCqGXwIpifN8XoWz93SJ7c3XVe69Y=";
+    hash = "sha256-qFj7w0fQY6X1oADLsAgwFefzx92/Pmgv9j5S6v0sdPg=";
   };
 
   build-system = [

From 280f6acc409676ae8b4ec35d3ddde1b8489eaee2 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Thu, 2 Oct 2025 23:58:25 -0400
Subject: [PATCH 190/306] nixos/systemd-stage-1: Add `dmi_memory_id`

It's unclear why we didn't get the error message about this binary not
existing before, because the udev rule requiring it has always been in
systemd initrd.
---
 nixos/modules/services/hardware/udev.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index 9370fb0bf207d..efc9b486149b2 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -462,6 +462,7 @@ in
       "${config.boot.initrd.systemd.package}/lib/systemd/systemd-udevd"
       "${config.boot.initrd.systemd.package}/lib/udev/ata_id"
       "${config.boot.initrd.systemd.package}/lib/udev/cdrom_id"
+      "${config.boot.initrd.systemd.package}/lib/udev/dmi_memory_id"
       "${config.boot.initrd.systemd.package}/lib/udev/scsi_id"
       "${config.boot.initrd.systemd.package}/lib/udev/rules.d"
     ]

From c9115a3792c31b50cae5561ab324cd863a509429 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Wed, 17 Sep 2025 21:10:44 -0400
Subject: [PATCH 191/306] nixos/tests/machinectl: Slightly changed ID shift
 message

---
 nixos/tests/systemd-machinectl.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index 03ffc25b91137..6a3a47d938bc6 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -171,7 +171,7 @@ in
     machine.succeed("ping -n -c 1 ${containerName}");
 
     # Test systemd-nspawn uses a user namespace
-    machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
+    machine.succeed("test $(machinectl status ${containerName} | grep 'ID Shift: ' | wc -l) = 1")
 
     # Test systemd-nspawn reboot
     machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/reboot");

From 95ec87adcbff90ca8f011406a325a6e5dfce1b29 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Thu, 18 Sep 2025 12:01:37 -0400
Subject: [PATCH 192/306] nixos/tests/systemd: Slightly changed IP accounting
 message

---
 nixos/tests/systemd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index fbece2a73dfcc..f0bbdef76c616 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -244,7 +244,7 @@
           assert "0B read, 0B written" not in output
 
       with subtest("systemd per-unit accounting works"):
-          assert "IP traffic received: 84B sent: 84B" in output_ping
+          assert "IP Traffic: received 84B, sent 84B" in output_ping
 
       with subtest("systemd environment is properly set"):
           machine.systemctl("daemon-reexec")  # Rewrites /proc/1/environ

From f75a8b7e9a613ff37fa3d84b2ce0f85dde433de6 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Wed, 23 Jul 2025 18:03:05 -0400
Subject: [PATCH 193/306] nixos/users-groups: New clock system group

---
 nixos/modules/config/users-groups.nix | 2 ++
 nixos/modules/misc/ids.nix            | 1 +
 2 files changed, 3 insertions(+)

diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 59f1b44483df8..ad61a4116ef1c 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -871,6 +871,7 @@ in
         render.gid = ids.gids.render;
         sgx.gid = ids.gids.sgx;
         shadow.gid = ids.gids.shadow;
+        clock.gid = ids.gids.clock;
       };
 
       system.activationScripts.users =
@@ -1033,6 +1034,7 @@ in
           cdrom = { };
           tape = { };
           kvm = { };
+          clock = { };
         };
       };
 
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 949531d9a83c0..b3cf6a0633561 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -690,6 +690,7 @@ in
       rstudio-server = 324;
       localtimed = 325;
       automatic-timezoned = 326;
+      clock = 327;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

From 107893c8f366230a9297dcb27fa7e646293d861e Mon Sep 17 00:00:00 2001
From: Ali Rizvi <contact@frontear.dev>
Date: Wed, 10 Sep 2025 19:59:22 -0400
Subject: [PATCH 194/306] nixos/systemd-oomd: drop old `After=` dependency

---
 nixos/modules/system/boot/systemd/oomd.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/system/boot/systemd/oomd.nix b/nixos/modules/system/boot/systemd/oomd.nix
index 82a87f00e97bc..b69cfd472165b 100644
--- a/nixos/modules/system/boot/systemd/oomd.nix
+++ b/nixos/modules/system/boot/systemd/oomd.nix
@@ -52,7 +52,6 @@ in
 
     systemd.services.systemd-oomd.after = [
       "swap.target" # TODO: drop after systemd v258
-      "systemd-sysusers.service" # TODO: drop after systemd v257.8
     ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 

From 6160af2a3605afa9ffe7c322199cfbdd53215764 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Fri, 3 Oct 2025 01:35:50 -0400
Subject: [PATCH 195/306] nixos/systemd-oomd: Drop swap ordering

This ordering is present in the upstream unit in 258
---
 nixos/modules/system/boot/systemd/oomd.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/nixos/modules/system/boot/systemd/oomd.nix b/nixos/modules/system/boot/systemd/oomd.nix
index b69cfd472165b..90c786ec5c22c 100644
--- a/nixos/modules/system/boot/systemd/oomd.nix
+++ b/nixos/modules/system/boot/systemd/oomd.nix
@@ -50,9 +50,6 @@ in
       "systemd-oomd.socket"
     ];
 
-    systemd.services.systemd-oomd.after = [
-      "swap.target" # TODO: drop after systemd v258
-    ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 
     environment.etc."systemd/oomd.conf".text = utils.systemdUtils.lib.settingsToSections cfg.settings;

From ba18d8224ce1ca6ced12b21f1a497944322916db Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 3 Oct 2025 06:41:30 +0100
Subject: [PATCH 196/306] sdl3: 3.2.22 -> 3.2.24

Changes: https://github.com/libsdl-org/SDL/releases/tag/release-3.2.24
---
 pkgs/by-name/sd/sdl3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index b03ebd819ddda..8488b53452588 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -62,7 +62,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.2.22";
+  version = "3.2.24";
 
   outputs = [
     "lib"
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-4jGfw2hNZTGuae2DMLz8xJBtfNu5abIN5GlNIKDOUpw=";
+    hash = "sha256-LUkj9Rrf+zOW0IdV7aGccb/5bKh3TWf1IGtQkCDHd4k=";
   };
 
   postPatch =

From a5823575a8e0825fa1ab37481adbafb14abd5b91 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 3 Oct 2025 04:55:50 -0700
Subject: [PATCH 197/306] python3Packages.typing-inspection: 0.4.1 -> 0.4.2

Diff: https://github.com/pydantic/typing-inspection/compare/v0.4.1...v0.4.2

Changelog: https://github.com/pydantic/typing-inspection/blob/v0.4.2/HISTORY.md
---
 pkgs/development/python-modules/typing-inspection/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/typing-inspection/default.nix b/pkgs/development/python-modules/typing-inspection/default.nix
index 9c09a8fdcfec4..ce85c5b0d5b6d 100644
--- a/pkgs/development/python-modules/typing-inspection/default.nix
+++ b/pkgs/development/python-modules/typing-inspection/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "typing-inspection";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "typing-inspection";
     tag = "v${version}";
-    hash = "sha256-MzOXl1i+rmr08TSH3Nxc0fFkcjATY6i9dFRLsYp+5m0=";
+    hash = "sha256-aGScO+FLEJ5IyI6hBqdsiKJRN7vEG36V5131nhVZEbc=";
   };
 
   build-system = [ hatchling ];

From 4dd4e54e2ce4a669d1bc139ae2783f24fa18c580 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Fri, 3 Oct 2025 21:17:19 +0200
Subject: [PATCH 198/306] nixos/tests/systemd-initrd-luks-tpm2: Fix on
 aarch64-linux

Systemd wants you to run tpm unlock on a machine with the TCG
bits of OVMF enabled. If not it just bails out with

No TPM2 hardware discovered and EFI firmware does not see it either, falling back to traditional unlocking
---
 nixos/tests/systemd-initrd-luks-tpm2.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/tests/systemd-initrd-luks-tpm2.nix b/nixos/tests/systemd-initrd-luks-tpm2.nix
index 20e203b0e86b6..6cc42bbbda731 100644
--- a/nixos/tests/systemd-initrd-luks-tpm2.nix
+++ b/nixos/tests/systemd-initrd-luks-tpm2.nix
@@ -11,6 +11,7 @@
         useBootLoader = true;
         # Booting off the TPM2-encrypted device requires an available init script
         mountHostNixStore = true;
+        efi.OVMF = pkgs.OVMFFull; # this really should be the default. Only OVMFFull contains TCG
         useEFIBoot = true;
         tpm.enable = true;
       };

From 506887da094540d9891dd21d03fc10c846fca893 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Fri, 3 Oct 2025 21:22:37 +0200
Subject: [PATCH 199/306] systemd: remove systemd-lock-handler from
 passthru.tests

it's not an official systemd thing and we're not the maintainers of it.
Also the test is broken. But that is not our problem
---
 pkgs/os-specific/linux/systemd/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 72f9de3462310..bb477c9e34b90 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1004,7 +1004,6 @@ stdenv.mkDerivation (finalAttrs: {
             systemd-journal
             systemd-journal-gateway
             systemd-journal-upload
-            systemd-lock-handler
             systemd-machinectl
             systemd-networkd
             systemd-networkd-bridge

From 521c833c169df2962d0f6a9c16dcff0225306572 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sun, 21 Sep 2025 23:53:22 +0200
Subject: [PATCH 200/306] librsvg: patch too_many_elements test to accept any
 error

libxml 2.15 no longer updates the element count
before throwing an error in case of too many elements.
This makes librsvg unable to report `TooManyLoadedElements`,
instead failing with a generic error.
---
 .../expect-any-error-too-many-elements.patch  | 23 +++++++++++++++++++
 pkgs/by-name/li/librsvg/package.nix           | 11 +++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 pkgs/by-name/li/librsvg/expect-any-error-too-many-elements.patch

diff --git a/pkgs/by-name/li/librsvg/expect-any-error-too-many-elements.patch b/pkgs/by-name/li/librsvg/expect-any-error-too-many-elements.patch
new file mode 100644
index 0000000000000..94f145bb744ce
--- /dev/null
+++ b/pkgs/by-name/li/librsvg/expect-any-error-too-many-elements.patch
@@ -0,0 +1,23 @@
+diff --git a/rsvg/tests/errors.rs b/rsvg/tests/errors.rs
+index 02b134bee..46391fa5d 100644
+--- a/rsvg/tests/errors.rs
++++ b/rsvg/tests/errors.rs
+@@ -14,15 +14,12 @@ use rsvg::{CairoRenderer, ImplementationLimit, Loader, LoadingError, RenderingEr
+ 
+ #[ignore]
+ #[test]
++#[should_panic]
+ fn too_many_elements() {
+     let name = "tests/fixtures/errors/bug515-too-many-elements.svgz";
+ 
+-    assert!(matches!(
+-        Loader::new().read_path(name),
+-        Err(LoadingError::LimitExceeded(
+-            ImplementationLimit::TooManyLoadedElements
+-        ))
+-    ));
++    // libxml2 might return an error without updating the element count, so just expect any error, not specifically too many elements
++    Loader::new().read_path(name).unwrap();
+ }
+ 
+ fn rendering_instancing_limit(name: &str) {
diff --git a/pkgs/by-name/li/librsvg/package.nix b/pkgs/by-name/li/librsvg/package.nix
index fde58ccc80a48..4317c8cbb3197 100644
--- a/pkgs/by-name/li/librsvg/package.nix
+++ b/pkgs/by-name/li/librsvg/package.nix
@@ -64,6 +64,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-vBu81BkSCwmNsovqVTNdneJHDU5qn27pcge0EPwVhn0=";
   };
 
+  patches = [
+    # too_many_elements test fails with libxml 2.15.0,
+    # because libxml2 no longer updates the element count
+    # before erroring out, which breaks the librsvg limit check.
+    #
+    # This is okay, because the error is still detected.
+    # The error is simply not reported accurately.
+    # https://gitlab.gnome.org/GNOME/librsvg/-/issues/1201
+    ./expect-any-error-too-many-elements.patch
+  ];
+
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";

From 5f76ca70fa5981fd3d15250e7d421a24dac47ab5 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sat, 4 Oct 2025 00:18:11 +0200
Subject: [PATCH 201/306] systemdLibs: disable nspawn build

`nspawn` is not installed in `systemdLibs`, so building
it is unnecessary and can be skipped.
---
 pkgs/os-specific/linux/systemd/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index be02ac358833e..5e0fe8846540e 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -587,7 +587,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "gnutls" false)
     (lib.mesonEnable "xkbcommon" false)
     (lib.mesonEnable "man" true)
-    # (lib.mesonEnable "nspawn" withNspawn) # nspawn build can be turned off on systemd 258, on 257.x it will just not be installed in systemdLibs but the build is unconditional
+    (lib.mesonEnable "nspawn" withNspawn)
 
     (lib.mesonBool "analyze" withAnalyze)
     (lib.mesonBool "logind" withLogind)

From da17ce8811d84a704bcdb2a2513623702d6f93cd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 4 Oct 2025 01:24:18 +0200
Subject: [PATCH 202/306] python3Packages.pytest: 8.4.1 -> 8.4.2

https://github.com/pytest-dev/pytest/releases/tag/8.4.2
---
 pkgs/development/python-modules/pytest/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 17d42090876cd..edd68ff232b80 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -29,12 +29,12 @@
 
 buildPythonPackage rec {
   pname = "pytest";
-  version = "8.4.1";
+  version = "8.4.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fGf9aRdIdzWe2Tcew6+KPSsEdBgYxR5emcwXQiUfqTw=";
+    hash = "sha256-hsDQuTMGuWHVjWKk20h58n/iVRPUuWnfNRq93bPDDgE=";
   };
 
   outputs = [

From 3de7af93a564800c009959ae78a7761eaf8ff7fb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 4 Oct 2025 10:57:08 +0300
Subject: [PATCH 203/306] qt6: 6.9.2 -> 6.9.3

---
 pkgs/development/libraries/qt-6/fetch.sh      |   2 +-
 .../libraries/qt-6/modules/qtmqtt.nix         |   4 +-
 pkgs/development/libraries/qt-6/srcs.nix      | 312 +++++++++---------
 3 files changed, 159 insertions(+), 159 deletions(-)

diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index 87d5916f3e38c..b5a099e317550 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.9/6.9.2/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.9/6.9.3/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index 6b7385bd8e71c..1339e43f52bfc 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.9.2";
+  version = "6.9.3";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-/qz93JmMkJW3+lzT+QKvb/VL+xmbg5H8kKaXK+XN2nE=";
+    hash = "sha256-xzh2cNPlGe0VlCdNN1u8vBi+Uq+U2oa2bskAJQTt0ik=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 190e64e037d94..9cabeda268167 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,315 +4,315 @@
 
 {
   qt3d = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qt3d-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0ndn5fbsfj2vbcq3siq1gnk2rgblicd6ri2jrh9g41anicxh4vma";
-      name = "qt3d-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qt3d-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1zvzc88gykbqmks5q06zl9113lvy07gxsxmzmvpd8y8sybfn91ky";
+      name = "qt3d-everywhere-src-6.9.3.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qt5compat-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0q2vly836wgs462czw7lg0ysf2h48iwbdy43wwf2gz49qq2rja6b";
-      name = "qt5compat-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qt5compat-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0qa4s1m9f0qzs6msrilpi12wv5hpkgw211s0cqsiqaf24hhsq789";
+      name = "qt5compat-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtactiveqt-everywhere-src-6.9.2.tar.xz";
-      sha256 = "003vgfxswi6cpdp9i8kdzm1n34cbrbzlap4sg9h1ap0i9is51s1w";
-      name = "qtactiveqt-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtactiveqt-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1kzc0pqwyi1h1s8qk8agplfkrib2s9cg7bwpl41z8icngwj76h6v";
+      name = "qtactiveqt-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtbase = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtbase-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0h149x8l2ywfr5m034n20z6cjxnldary39x0vv22jhg0ryg9rgj4";
-      name = "qtbase-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtbase-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0vnwp12wvsab1vsn8zhi4mcvrpg5iacq59xzzs0w0vimc3va58f5";
+      name = "qtbase-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtcharts-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0jzzlh0jq5fidgs9r4aqpilyj0nan30r1d0pigp1hgz7cigz20cz";
-      name = "qtcharts-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtcharts-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0lsckms5s0av6dy8mll7bnspsigz6hpvbddm79n2wshxnfywpmr9";
+      name = "qtcharts-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtconnectivity-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0qq4d8hn6s8bb9r2gglb6gzq6isbb13knqh7n2s2wsnx8rqwdzwa";
-      name = "qtconnectivity-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtconnectivity-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1xfp3p5xkypxfgzvq2a5zcnyc7ms5gav99z5qmb48k0pzdgbl6z2";
+      name = "qtconnectivity-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtdatavis3d-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0p6bvia085hx3jb1la06c2q48m9i897r1a1mf6bi2hbmm2hirzsx";
-      name = "qtdatavis3d-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtdatavis3d-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1v5zdwjpz8j7s1nrkg7sp452vmdmhq09kdxvbsya2ad6jsw4ajxa";
+      name = "qtdatavis3d-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtdeclarative-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0r16qima008y2999r1djvwry01l295nmwwhqg081d2fr1cn2szs7";
-      name = "qtdeclarative-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtdeclarative-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0q52z2iiqdchsvvcs7w6mq38v0ahv2h5jyvbjxfbzbr9f8i1n1ss";
+      name = "qtdeclarative-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtdoc-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0qng2lsqmrrj8n85aqh8vl4nlzc23va9hynvvf6gqr35anvbpniz";
-      name = "qtdoc-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtdoc-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0am13lnmfxqj8ayx9ml5sm2qagl5s6hrki3bvdxfmzfkl07ds694";
+      name = "qtdoc-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtgraphs-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0wsa4iar52dhiilyl053j7lmsw3xdn47b0pjrylb5a0ij1izp057";
-      name = "qtgraphs-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtgraphs-everywhere-src-6.9.3.tar.xz";
+      sha256 = "13041r244h3mgs95zcyw5x7lfginf4gxs59spz030p0jap867p2h";
+      name = "qtgraphs-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtgrpc-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0r1z6lbjcsgxhvzylpr8z8wl44ql14ajf99n1hfvf4gy4f43qgd4";
-      name = "qtgrpc-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtgrpc-everywhere-src-6.9.3.tar.xz";
+      sha256 = "00py189v3ihpy9cj51sxapl2dp3ci7k04ikjl6zbxmbjrdwwhqvr";
+      name = "qtgrpc-everywhere-src-6.9.3.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qthttpserver-everywhere-src-6.9.2.tar.xz";
-      sha256 = "06a0f7j1b309xffw3rwydz8lpzxnf5jg67savswskzbd3lfzlhqk";
-      name = "qthttpserver-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qthttpserver-everywhere-src-6.9.3.tar.xz";
+      sha256 = "13rfvmh42h4zd2slb2d0xqdy7wgsy05q8jqy3ldbikx5vf9qg9vs";
+      name = "qthttpserver-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtimageformats-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0fciahs4i0nn5z0j624gkfncqg6byxswj45bw81drpjp5xz3y0la";
-      name = "qtimageformats-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtimageformats-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1zigaz2418sy6m3na91rddxvlfn3257535kq120f9f6lzgdnpcjg";
+      name = "qtimageformats-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtlanguageserver-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1vlb0qn53y1b4zf7zkpxdvdh5ikr1cidq5gv8blvf6pyw6pnw6vq";
-      name = "qtlanguageserver-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtlanguageserver-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0cwx6rlp9nm0qbzjamfcqhhylbmh2f5kk3z749ln49fbz32ads68";
+      name = "qtlanguageserver-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtlocation-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1ybk3ig69p6zyrxabcfkb4pcyc251gy1m2brkf4q52cmcwcysias";
-      name = "qtlocation-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtlocation-everywhere-src-6.9.3.tar.xz";
+      sha256 = "018nwyr1idh3rfp22w86pw3i25xbj7mv49wir5s1akmgzp8jf4hl";
+      name = "qtlocation-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtlottie-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1iiigsb4p1zwkxm1x9c4pbx5rgwz35krdqi3vkql4nawvp997px4";
-      name = "qtlottie-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtlottie-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0cyzj0xhdhlgkra1pqb4vdazxjfii05sc7r5h0ml9fzhfiai0vhi";
+      name = "qtlottie-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtmultimedia-everywhere-src-6.9.2.tar.xz";
-      sha256 = "04mbwl1mg4rjgai027chldslpjnqrx52c3jxn20j2hx7ayda3y3v";
-      name = "qtmultimedia-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtmultimedia-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1xc6kgqm88rkzr8qzdi8yj8dm4dqfsfzkkba4d8iijb0xbkvwxd2";
+      name = "qtmultimedia-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtnetworkauth-everywhere-src-6.9.2.tar.xz";
-      sha256 = "114c65gyg56v70byyl3if1q7mzhp5kkv1g8sp4y9zaxqirbdjr91";
-      name = "qtnetworkauth-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtnetworkauth-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1ivyrha9ibc2iz4lvrz5309pdqxyccwzbpmyg2m24ghkxm3xrnb7";
+      name = "qtnetworkauth-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtpositioning-everywhere-src-6.9.2.tar.xz";
-      sha256 = "06mwzlyprwz11ks6fsvzh03ilk5fxy3scr1gqqb4p85xzw0ri6j8";
-      name = "qtpositioning-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtpositioning-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1d1mb1fni42vgfyj9ghk0g6602nx8lwa1y0bmynpmh84yy0ck1qc";
+      name = "qtpositioning-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquick3d-everywhere-src-6.9.2.tar.xz";
-      sha256 = "002888xfnkxmvn8413fllidl3mm2fcwc4gbzdnbvpjlysaq9f3ig";
-      name = "qtquick3d-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtquick3d-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0wyfran9vwl6fm2i9nc149fpvv8r5k3yvrn2f1rjpb9qkw271cli";
+      name = "qtquick3d-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquick3dphysics-everywhere-src-6.9.2.tar.xz";
-      sha256 = "12yc0lswcmyaw19yyxzy73j95ncgqw8mlx8svhrwsllgcf2n9z47";
-      name = "qtquick3dphysics-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtquick3dphysics-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0vjs7calgc0vc7fv6hnbghhi37cfiapxim650av9w92xfhnv5myw";
+      name = "qtquick3dphysics-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquickeffectmaker-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1yfq1pp0k2d6438x8pn2y73y29bqwg45bjh6msiy64fldr4z31br";
-      name = "qtquickeffectmaker-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtquickeffectmaker-everywhere-src-6.9.3.tar.xz";
+      sha256 = "04lrlp1fakn8kv160ln8j1fsqsfdcjf1dzwlknx5r1m04hfkdw3b";
+      name = "qtquickeffectmaker-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquicktimeline-everywhere-src-6.9.2.tar.xz";
-      sha256 = "09n51qw0y8v1q83xs1ybwwm4a49j2qhshqrasdkzz25mij6nhrdw";
-      name = "qtquicktimeline-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtquicktimeline-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1xqidk7njn1xiiz3i27ddzwd568caigq8p2ja4ks67x7bsk4nkr8";
+      name = "qtquicktimeline-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtremoteobjects-everywhere-src-6.9.2.tar.xz";
-      sha256 = "09lby6dqc2sfig1krcszg6fkypgxlz2r7hgjjfi95g7g9gqlwqnz";
-      name = "qtremoteobjects-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtremoteobjects-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0nyqmapypw0y745zg58rq9183vcrbm2c71dc3p9sdqflal07r64q";
+      name = "qtremoteobjects-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtscxml-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1dpb687zbw4akx42kfpbb5cpdlq3hcqn8l3l0x7sd5i9061z2sp0";
-      name = "qtscxml-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtscxml-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1drlbdgicqx76gyqi79ri1gy2vrya6l99gig76p8x46za70c12gk";
+      name = "qtscxml-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtsensors-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0qj4674vim2p34mq3kp99spjyf82qvs75w625namzqp274pshk4n";
-      name = "qtsensors-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtsensors-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0s1gz66nar27c3l5cbqqdnza1pxbd7nylz88mnj32xpkwml53nx2";
+      name = "qtsensors-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtserialbus-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0xia9xcz7sjrbf1c4m63qnhz3ggdxr06pycslmsnqizlzb10f7lm";
-      name = "qtserialbus-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtserialbus-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1ksvfwfk0az47sgfcaqbac936y75lcaga5fip5lbgz0s0zd3k08a";
+      name = "qtserialbus-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtserialport-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0sz2dkas4qjdd6lkfb9g89vi94q18aiq9xdchlqb2yn0qbqb544b";
-      name = "qtserialport-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtserialport-everywhere-src-6.9.3.tar.xz";
+      sha256 = "16427sa9qhk8hsyxjr69fhqmvzlg9n4pdizmqfc4cr7j1w1yq62b";
+      name = "qtserialport-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtshadertools-everywhere-src-6.9.2.tar.xz";
-      sha256 = "158lpzb1nqspwm0n48d3nfr81q85zka1igrjp6xj8cjlv7wqlrqp";
-      name = "qtshadertools-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtshadertools-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0rs553abb8sdla4cywfpgfh3vvyafm8spy8nnvj06md3hvp09632";
+      name = "qtshadertools-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtspeech-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1cc8l2h1frlraay0m40r5a91nsc7b53n6vksa52pwqqia4vngdmj";
-      name = "qtspeech-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtspeech-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0gmbr65s4j2bka13iln3fmjrhl1i46lp5vlhdv66rf1gfi65lvzq";
+      name = "qtspeech-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtsvg-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1985asvnkd2ar30nh2zyi490qz0vkz6z1f752lfald33yawcm16r";
-      name = "qtsvg-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtsvg-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1qi6f3lvp0r7n79m1iw80690366bd53gyxm5gp76zgnbb0rslxnv";
+      name = "qtsvg-everywhere-src-6.9.3.tar.xz";
     };
   };
   qttools = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qttools-everywhere-src-6.9.2.tar.xz";
-      sha256 = "12d4czfwvh9rfjwnkpsiwzrpx4ga69c6vz85aabhpk3hx7lggdyq";
-      name = "qttools-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qttools-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1sdla2blvk9r4g7v67dhwqjxx7kflyh7cm9pw5f7ziazjw7apxqc";
+      name = "qttools-everywhere-src-6.9.3.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qttranslations-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1mky3xj2yhcsrmpz8m28v7pky6ryn7hvdcglakww0rfk3qlbcfy7";
-      name = "qttranslations-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qttranslations-everywhere-src-6.9.3.tar.xz";
+      sha256 = "18chqjzy7ji76crfisl1rya8ds3my97bgsxkg7yldcc1crg58vgk";
+      name = "qttranslations-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtvirtualkeyboard-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1qqizh7kyqbqqnrm1mmlf2709rm1rnflbqdl1bi75yms07d00hbv";
-      name = "qtvirtualkeyboard-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtvirtualkeyboard-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0d2m87fvd11ckjjzy3lj1mbfisig4x9c263phq4fczwy3k4xb851";
+      name = "qtvirtualkeyboard-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwayland-everywhere-src-6.9.2.tar.xz";
-      sha256 = "10bpxwpam56gvymz9vjxkppbqsj1369ddzl3k4pz2s2maq39imya";
-      name = "qtwayland-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwayland-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1pfsfdjqw985d8220jw13sqacyiip26bzpk1ax30ms33jayd84z4";
+      name = "qtwayland-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebchannel-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0rcf7i1wamdf1qynq3yi88r77ch5dg1jinxywlfjlb2dmlvn72l7";
-      name = "qtwebchannel-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwebchannel-everywhere-src-6.9.3.tar.xz";
+      sha256 = "01d3dy0fjz4vfy8s1yzpmd31b8mhvqf15z61fzr9qgd1wp0vnmwl";
+      name = "qtwebchannel-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebengine-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1aq35nkgbvhlsmglnjizbkavr7kb0ymf5n3kkllrpqy2mf90gjwr";
-      name = "qtwebengine-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwebengine-everywhere-src-6.9.3.tar.xz";
+      sha256 = "0rl9v936sq6spvb3sfkpmc51wwmljrn4ssy3ii0pdn0xsl8kn2ym";
+      name = "qtwebengine-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebsockets-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1vh82w96436pqrp4daf324mqs2zjvn51z78b3ksc5mnqgrk3z0xy";
-      name = "qtwebsockets-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwebsockets-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1i428awzws4x4cmv6zpdgb27c2m71cs8dqcjbwiwqcfbyf6dlzg2";
+      name = "qtwebsockets-everywhere-src-6.9.3.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.9.2";
+    version = "6.9.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebview-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1w8z3d7w7z2xjfb5l15gb37v9w6pa7d71jalkrqda8l2wr5d3ksc";
-      name = "qtwebview-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwebview-everywhere-src-6.9.3.tar.xz";
+      sha256 = "1j1cqj2hq0c8r9lxb1h6mdhnf9clqb95jw2p0nn81jzin701ypn6";
+      name = "qtwebview-everywhere-src-6.9.3.tar.xz";
     };
   };
 }

From 631c6a2ff2f69bdeb5fad7f33f90d8a02374bb1d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 4 Oct 2025 10:57:17 +0300
Subject: [PATCH 204/306] qt6.qtwebengine: replace revert with better patch
 from upstream

---
 .../libraries/qt-6/modules/qtwebengine/default.nix     | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
index 43c7aea86f15d..332240e50b146 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
@@ -113,13 +113,11 @@ qtModule {
     # Reproducibility QTBUG-136068
     ./gn-object-sorted.patch
 
-    # Revert "Create EGLImage with eglCreateDRMImageMESA() for exporting dma_buf"
-    # Mesa 25.2 dropped eglCreateDRMImageMESA, so this no longer works.
-    # There are better ways to do this, but this is the easy fix for now.
+    # Fix GPU rendering with Mesa 25.2
+    # https://bugreports.qt.io/browse/QTBUG-139424
     (fetchpatch {
-      url = "https://invent.kde.org/qt/qt/qtwebengine/-/commit/ddcd30454aa6338d898c9d20c8feb48f36632e16.diff";
-      revert = true;
-      hash = "sha256-ht7C3GIEaPtmMGLzQKOtMqE9sLKdqqYCgi/W6b430YU=";
+      url = "https://invent.kde.org/qt/qt/qtwebengine/-/commit/3cc88e0f85113e38ccb1bfdadb7d150c2389b1bc.diff";
+      hash = "sha256-5tKZ6b93VP4mKVc7jctrbW5Ktl+4Mjxw6bK1ajY62zQ=";
     })
   ];
 

From cd7c4411238fe52f06b397a15c7ae8710a73968a Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 4 Oct 2025 10:57:37 +0300
Subject: [PATCH 205/306] qt6.qtdeclarative: backport fix for common crash in
 Plasma

---
 .../qt-6/modules/qtdeclarative/default.nix    |   5 +
 .../qtdeclarative/stackview-crash.patch       | 473 ++++++++++++++++++
 2 files changed, 478 insertions(+)
 create mode 100644 pkgs/development/libraries/qt-6/modules/qtdeclarative/stackview-crash.patch

diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 4cdc80a4090a5..97f306afb3e0a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -37,6 +37,11 @@ qtModule {
     })
     # add version specific QML import path
     ./use-versioned-import-path.patch
+
+    # Fix common crash
+    # Manual backport of https://invent.kde.org/qt/qt/qtdeclarative/-/commit/b1ee7061ba77a7f5dc4148129bb2083f5c28e039
+    # https://bugreports.qt.io/browse/QTBUG-140018
+    ./stackview-crash.patch
   ];
 
   preConfigure =
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/stackview-crash.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/stackview-crash.patch
new file mode 100644
index 0000000000000..19c7c06486346
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/stackview-crash.patch
@@ -0,0 +1,473 @@
+diff --git a/src/quicktemplates/qquickstackelement.cpp b/src/quicktemplates/qquickstackelement.cpp
+index f6a5ffdd74..304bafe4ef 100644
+--- a/src/quicktemplates/qquickstackelement.cpp
++++ b/src/quicktemplates/qquickstackelement.cpp
+@@ -39,7 +39,10 @@ protected:
+     void setInitialState(QObject *object) override
+     {
+         auto privIncubator = QQmlIncubatorPrivate::get(this);
+-        element->incubate(object, privIncubator->requiredProperties());
++        if (QQmlEnginePrivate *enginePriv = privIncubator->enginePriv) {
++            element->incubate(enginePriv->v4engine(), object,
++                              privIncubator->requiredProperties());
++        }
+     }
+ 
+ private:
+@@ -90,7 +93,8 @@ QQuickStackElement::~QQuickStackElement()
+ #endif
+ }
+ 
+-QQuickStackElement *QQuickStackElement::fromString(const QString &str, QQuickStackView *view, QString *error)
++QQuickStackElement *QQuickStackElement::fromString(
++        QQmlEngine *engine, const QString &str, QQuickStackView *view, QString *error)
+ {
+     QUrl url(str);
+     if (!url.isValid()) {
+@@ -102,7 +106,7 @@ QQuickStackElement *QQuickStackElement::fromString(const QString &str, QQuickSta
+         url = qmlContext(view)->resolvedUrl(url);
+ 
+     QQuickStackElement *element = new QQuickStackElement;
+-    element->component = new QQmlComponent(qmlEngine(view), url, view);
++    element->component = new QQmlComponent(engine, url, view);
+     element->ownComponent = true;
+     return element;
+ }
+@@ -127,7 +131,8 @@ QQuickStackElement *QQuickStackElement::fromObject(QObject *object, QQuickStackV
+     return element;
+ }
+ 
+-QQuickStackElement *QQuickStackElement::fromStackViewArg(QQuickStackView *view, QQuickStackViewArg arg)
++QQuickStackElement *QQuickStackElement::fromStackViewArg(
++        QQmlEngine *engine, QQuickStackView *view, QQuickStackViewArg arg)
+ {
+     QQuickStackElement *element = new QQuickStackElement;
+ #if QT_CONFIG(quick_viewtransitions)
+@@ -144,7 +149,7 @@ QQuickStackElement *QQuickStackElement::fromStackViewArg(QQuickStackView *view,
+ 
+         Q_ASSERT(!arg.mUrl.isValid());
+     } else if (arg.mUrl.isValid()) {
+-        element->component = new QQmlComponent(qmlEngine(view), arg.mUrl, view);
++        element->component = new QQmlComponent(engine, arg.mUrl, view);
+         element->ownComponent = true;
+     } else {
+         qFatal("No Item, Component or URL set on arg passed to fromStrictArg");
+@@ -152,7 +157,7 @@ QQuickStackElement *QQuickStackElement::fromStackViewArg(QQuickStackView *view,
+     return element;
+ }
+ 
+-bool QQuickStackElement::load(QQuickStackView *parent)
++bool QQuickStackElement::load(QV4::ExecutionEngine *v4, QQuickStackView *parent)
+ {
+     setView(parent);
+     if (!item) {
+@@ -161,7 +166,7 @@ bool QQuickStackElement::load(QQuickStackView *parent)
+         if (component->isLoading()) {
+             QObject::connect(component, &QQmlComponent::statusChanged, [this](QQmlComponent::Status status) {
+                 if (status == QQmlComponent::Ready)
+-                    load(view);
++                    load(component->engine()->handle(), view);
+                 else if (status == QQmlComponent::Error)
+                     QQuickStackViewPrivate::get(view)->warn(component->errorString().trimmed());
+             });
+@@ -177,22 +182,24 @@ bool QQuickStackElement::load(QQuickStackView *parent)
+         if (component->isError())
+             QQuickStackViewPrivate::get(parent)->warn(component->errorString().trimmed());
+     } else {
+-        initialize(/*required properties=*/nullptr);
++        initialize(v4, /*required properties=*/nullptr);
+     }
+     return item;
+ }
+ 
+-void QQuickStackElement::incubate(QObject *object, RequiredProperties *requiredProperties)
++void QQuickStackElement::incubate(
++        QV4::ExecutionEngine *v4, QObject *object, RequiredProperties *requiredProperties)
+ {
+     item = qmlobject_cast<QQuickItem *>(object);
+     if (item) {
+         QQmlEngine::setObjectOwnership(item, QQmlEngine::CppOwnership);
+         item->setParent(view);
+-        initialize(requiredProperties);
++        initialize(v4, requiredProperties);
+     }
+ }
+ 
+-void QQuickStackElement::initialize(RequiredProperties *requiredProperties)
++void QQuickStackElement::initialize(
++        QV4::ExecutionEngine *v4, RequiredProperties *requiredProperties)
+ {
+     if (!item || init)
+         return;
+@@ -205,11 +212,8 @@ void QQuickStackElement::initialize(RequiredProperties *requiredProperties)
+     item->setParentItem(view);
+ 
+     if (!properties.isUndefined()) {
+-        QQmlEngine *engine = qmlEngine(view);
+-        Q_ASSERT(engine);
+-        QV4::ExecutionEngine *v4 = QQmlEnginePrivate::getV4Engine(engine);
+-        Q_ASSERT(v4);
+         QV4::Scope scope(v4);
++        Q_ASSERT(scope.engine);
+         QV4::ScopedValue ipv(scope, properties.value());
+         QV4::Scoped<QV4::QmlContext> qmlContext(scope, qmlCallingContext.value());
+         QV4::ScopedValue qmlObject(scope, QV4::QObjectWrapper::wrap(v4, item));
+diff --git a/src/quicktemplates/qquickstackelement_p_p.h b/src/quicktemplates/qquickstackelement_p_p.h
+index 5af8149d91..2986a78569 100644
+--- a/src/quicktemplates/qquickstackelement_p_p.h
++++ b/src/quicktemplates/qquickstackelement_p_p.h
+@@ -43,13 +43,14 @@ class QQuickStackElement :
+ public:
+     ~QQuickStackElement();
+ 
+-    static QQuickStackElement *fromString(const QString &str, QQuickStackView *view, QString *error);
++    static QQuickStackElement *fromString(QQmlEngine *engine, const QString &str, QQuickStackView *view, QString *error);
+     static QQuickStackElement *fromObject(QObject *object, QQuickStackView *view, QString *error);
+-    static QQuickStackElement *fromStackViewArg(QQuickStackView *view, QQuickStackViewArg arg);
++    static QQuickStackElement *fromStackViewArg(QQmlEngine *engine, QQuickStackView *view, QQuickStackViewArg arg);
+ 
+-    bool load(QQuickStackView *parent);
+-    void incubate(QObject *object, RequiredProperties *requiredProperties);
+-    void initialize(RequiredProperties *requiredProperties);
++    bool load(QV4::ExecutionEngine *v4, QQuickStackView *parent);
++    void incubate(
++            QV4::ExecutionEngine *v4, QObject *object, RequiredProperties *requiredProperties);
++    void initialize(QV4::ExecutionEngine *v4, RequiredProperties *requiredProperties);
+ 
+     void setIndex(int index);
+     void setView(QQuickStackView *view);
+diff --git a/src/quicktemplates/qquickstackview.cpp b/src/quicktemplates/qquickstackview.cpp
+index cb8854dca8..a0909b7fcb 100644
+--- a/src/quicktemplates/qquickstackview.cpp
++++ b/src/quicktemplates/qquickstackview.cpp
+@@ -457,8 +457,12 @@ QQuickItem *QQuickStackView::get(int index, LoadBehavior behavior)
+     Q_D(QQuickStackView);
+     QQuickStackElement *element = d->elements.value(index);
+     if (element) {
+-        if (behavior == ForceLoad)
+-            element->load(this);
++        if (behavior == ForceLoad) {
++            // It's possible for a slot to still be connected during destruction of the receiver's
++            // parent (QTBUG-140018), so only try to load new things if our engine is alive.
++            if (QQmlEngine *engine = qmlEngine(this))
++                element->load(engine->handle(), this);
++        }
+         return element->item;
+     }
+     return nullptr;
+@@ -492,7 +496,7 @@ QQuickItem *QQuickStackView::find(const QJSValue &callback, LoadBehavior behavio
+     for (int i = d->elements.size() - 1; i >= 0; --i) {
+         QQuickStackElement *element = d->elements.at(i);
+         if (behavior == ForceLoad)
+-            element->load(this);
++            element->load(engine->handle(), this);
+         if (element->item) {
+             QJSValue rv = func.call(QJSValueList() << engine->newQObject(element->item) << i);
+             if (rv.toBool())
+@@ -624,7 +628,7 @@ void QQuickStackView::push(QQmlV4FunctionPtr args)
+ #endif
+ 
+     int oldDepth = d->elements.size();
+-    if (d->pushElements(elements)) {
++    if (d->pushElements(v4, elements)) {
+         d->depthChange(d->elements.size(), oldDepth);
+         QQuickStackElement *enter = d->elements.top();
+ #if QT_CONFIG(quick_viewtransitions)
+@@ -737,7 +741,7 @@ void QQuickStackView::pop(QQmlV4FunctionPtr args)
+ 
+     QPointer<QQuickItem> previousItem;
+ 
+-    if (d->popElements(enter)) {
++    if (d->popElements(v4, enter)) {
+         if (exit) {
+             exit->removal = true;
+             d->removing.insert(exit);
+@@ -907,7 +911,7 @@ void QQuickStackView::replace(QQmlV4FunctionPtr args)
+     if (!d->elements.isEmpty())
+         exit = d->elements.pop();
+ 
+-    if (exit != target ? d->replaceElements(target, elements) : d->pushElements(elements)) {
++    if (exit != target ? d->replaceElements(v4, target, elements) : d->pushElements(v4, elements)) {
+         d->depthChange(d->elements.size(), oldDepth);
+         if (exit) {
+             exit->removal = true;
+@@ -991,10 +995,14 @@ QQuickItem *QQuickStackView::pushItems(QList<QQuickStackViewArg> args, Operation
+         return nullptr;
+     }
+ 
++    QQmlEngine *engine = qmlEngine(this);
++    if (!engine)
++        return nullptr;
++
+     QScopedValueRollback<bool> modifyingElements(d->modifyingElements, true);
+     QScopedValueRollback<QString> operationNameRollback(d->operation, operationName);
+ 
+-    const QList<QQuickStackElement *> stackElements = d->parseElements(args);
++    const QList<QQuickStackElement *> stackElements = d->parseElements(engine, args);
+ 
+ #if QT_CONFIG(quick_viewtransitions)
+     QQuickStackElement *exit = nullptr;
+@@ -1003,7 +1011,7 @@ QQuickItem *QQuickStackView::pushItems(QList<QQuickStackViewArg> args, Operation
+ #endif
+ 
+     const int oldDepth = d->elements.size();
+-    if (d->pushElements(stackElements)) {
++    if (d->pushElements(engine->handle(), stackElements)) {
+         d->depthChange(d->elements.size(), oldDepth);
+         QQuickStackElement *enter = d->elements.top();
+ #if QT_CONFIG(quick_viewtransitions)
+@@ -1109,7 +1117,11 @@ QQuickItem *QQuickStackView::pushItem(const QUrl &url, const QVariantMap &proper
+ QQuickItem *QQuickStackView::popToItem(QQuickItem *item, Operation operation)
+ {
+     Q_D(QQuickStackView);
+-    return d->popToItem(item, operation, QQuickStackViewPrivate::CurrentItemPolicy::DoNotPop);
++    QQmlEngine *engine = qmlEngine(this);
++    if (!engine)
++        return nullptr;
++    return d->popToItem(
++            engine->handle(), item, operation, QQuickStackViewPrivate::CurrentItemPolicy::DoNotPop);
+ }
+ 
+ /*!
+@@ -1149,8 +1161,13 @@ QQuickItem *QQuickStackView::popToIndex(int index, Operation operation)
+     }
+ 
+     QQuickStackElement *element = d->elements.at(index);
+-    element->load(this);
+-    return d->popToItem(element->item, operation, QQuickStackViewPrivate::CurrentItemPolicy::Pop);
++    QQmlEngine *engine = qmlEngine(this);
++    if (!engine)
++        return nullptr;
++    QV4::ExecutionEngine *v4 = engine->handle();
++    element->load(v4, this);
++    return d->popToItem(
++            v4, element->item, operation, QQuickStackViewPrivate::CurrentItemPolicy::Pop);
+ }
+ 
+ /*!
+@@ -1178,7 +1195,13 @@ QQuickItem *QQuickStackView::popCurrentItem(Operation operation)
+         clear(operation);
+         return lastItemRemoved;
+     }
+-    return d->popToItem(d->currentItem, operation, QQuickStackViewPrivate::CurrentItemPolicy::Pop);
++
++    QQmlEngine *engine = qmlEngine(this);
++    if (!engine)
++        return nullptr;
++    return d->popToItem(
++            engine->handle(), d->currentItem, operation,
++            QQuickStackViewPrivate::CurrentItemPolicy::Pop);
+ }
+ 
+ /*!
+@@ -1232,12 +1255,16 @@ QQuickItem *QQuickStackView::replaceCurrentItem(const QList<QQuickStackViewArg>
+         return nullptr;
+     }
+ 
++    QQmlEngine *engine = qmlEngine(this);
++    if (!engine)
++        return nullptr;
++
+     QScopedValueRollback<bool> modifyingElements(d->modifyingElements, true);
+     QScopedValueRollback<QString> operationNameRollback(d->operation, operationName);
+ 
+     QQuickStackElement *currentElement = !d->elements.isEmpty() ? d->elements.top() : nullptr;
+ 
+-    const QList<QQuickStackElement *> stackElements = d->parseElements(args);
++    const QList<QQuickStackElement *> stackElements = d->parseElements(engine, args);
+ 
+     int oldDepth = d->elements.size();
+     QQuickStackElement* exit = nullptr;
+@@ -1245,8 +1272,8 @@ QQuickItem *QQuickStackView::replaceCurrentItem(const QList<QQuickStackViewArg>
+         exit = d->elements.pop();
+ 
+     const bool successfullyReplaced = exit != currentElement
+-        ? d->replaceElements(currentElement, stackElements)
+-        : d->pushElements(stackElements);
++        ? d->replaceElements(engine->handle(), currentElement, stackElements)
++        : d->pushElements(engine->handle(), stackElements);
+     if (successfullyReplaced) {
+         d->depthChange(d->elements.size(), oldDepth);
+         if (exit) {
+@@ -1607,14 +1634,19 @@ void QQuickStackView::componentComplete()
+     QQuickStackElement *element = nullptr;
+     QString error;
+     int oldDepth = d->elements.size();
++
++    QQmlEngine *engine = qmlEngine(this);
++    if (!engine)
++        return;
++
+     if (QObject *o = d->initialItem.toQObject())
+         element = QQuickStackElement::fromObject(o, this, &error);
+     else if (d->initialItem.isString())
+-        element = QQuickStackElement::fromString(d->initialItem.toString(), this, &error);
++        element = QQuickStackElement::fromString(engine, d->initialItem.toString(), this, &error);
+     if (!error.isEmpty()) {
+         d->warn(error);
+         delete element;
+-    } else if (d->pushElement(element)) {
++    } else if (d->pushElement(engine->handle(), element)) {
+         d->depthChange(d->elements.size(), oldDepth);
+         d->setCurrentItem(element);
+         element->setStatus(QQuickStackView::Active);
+diff --git a/src/quicktemplates/qquickstackview_p.cpp b/src/quicktemplates/qquickstackview_p.cpp
+index 0288ff1f4b..8f08f29168 100644
+--- a/src/quicktemplates/qquickstackview_p.cpp
++++ b/src/quicktemplates/qquickstackview_p.cpp
+@@ -109,7 +109,8 @@ QList<QQuickStackElement *> QQuickStackViewPrivate::parseElements(int from, QQml
+     return elements;
+ }
+ 
+-QList<QQuickStackElement *> QQuickStackViewPrivate::parseElements(const QList<QQuickStackViewArg> &args)
++QList<QQuickStackElement *> QQuickStackViewPrivate::parseElements(
++        QQmlEngine *engine, const QList<QQuickStackViewArg> &args)
+ {
+     Q_Q(QQuickStackView);
+     QList<QQuickStackElement *> stackElements;
+@@ -141,8 +142,8 @@ QList<QQuickStackElement *> QQuickStackViewPrivate::parseElements(const QList<QQ
+             return {};
+         }
+ 
+-        QQuickStackElement *element = QQuickStackElement::fromStackViewArg(q, arg);
+-        QV4::ExecutionEngine *v4Engine = qmlEngine(q)->handle();
++        QQuickStackElement *element = QQuickStackElement::fromStackViewArg(engine, q, arg);
++        QV4::ExecutionEngine *v4Engine = engine->handle();
+         element->properties.set(v4Engine, v4Engine->fromVariant(properties));
+         element->qmlCallingContext.set(v4Engine, v4Engine->qmlContext());
+         stackElements.append(element);
+@@ -183,28 +184,33 @@ static QString resolvedUrl(const QString &str, const QQmlRefPointer<QQmlContextD
+     return str;
+ }
+ 
+-QQuickStackElement *QQuickStackViewPrivate::createElement(const QV4::Value &value, const QQmlRefPointer<QQmlContextData> &context, QString *error)
++QQuickStackElement *QQuickStackViewPrivate::createElement(
++        const QV4::Value &value, const QQmlRefPointer<QQmlContextData> &context, QString *error)
+ {
+     Q_Q(QQuickStackView);
+     if (const QV4::String *s = value.as<QV4::String>())
+-        return QQuickStackElement::fromString(resolvedUrl(s->toQString(), context), q, error);
++        return QQuickStackElement::fromString(
++                s->engine()->qmlEngine(), resolvedUrl(s->toQString(), context), q, error);
+     if (const QV4::QObjectWrapper *o = value.as<QV4::QObjectWrapper>())
+         return QQuickStackElement::fromObject(o->object(), q, error);
+     if (const QV4::UrlObject *u = value.as<QV4::UrlObject>())
+-        return QQuickStackElement::fromString(resolvedUrl(u->href(), context), q, error);
++        return QQuickStackElement::fromString(
++                u->engine()->qmlEngine(), resolvedUrl(u->href(), context), q, error);
+ 
+-    if (value.as<QV4::Object>()) {
++    if (const QV4::Object *o = value.as<QV4::Object>()) {
+         const QVariant data = QV4::ExecutionEngine::toVariant(value, QMetaType::fromType<QUrl>());
+         if (data.typeId() == QMetaType::QUrl) {
+-            return QQuickStackElement::fromString(resolvedUrl(data.toUrl(), context).toString(), q,
+-                                                  error);
++            return QQuickStackElement::fromString(
++                    o->engine()->qmlEngine(), resolvedUrl(data.toUrl(), context).toString(), q,
++                    error);
+         }
+     }
+ 
+     return nullptr;
+ }
+ 
+-bool QQuickStackViewPrivate::pushElements(const QList<QQuickStackElement *> &elems)
++bool QQuickStackViewPrivate::pushElements(
++        QV4::ExecutionEngine *v4, const QList<QQuickStackElement *> &elems)
+ {
+     Q_Q(QQuickStackView);
+     if (!elems.isEmpty()) {
+@@ -212,19 +218,19 @@ bool QQuickStackViewPrivate::pushElements(const QList<QQuickStackElement *> &ele
+             e->setIndex(elements.size());
+             elements += e;
+         }
+-        return elements.top()->load(q);
++        return elements.top()->load(v4, q);
+     }
+     return false;
+ }
+ 
+-bool QQuickStackViewPrivate::pushElement(QQuickStackElement *element)
++bool QQuickStackViewPrivate::pushElement(QV4::ExecutionEngine *v4, QQuickStackElement *element)
+ {
+     if (element)
+-        return pushElements(QList<QQuickStackElement *>() << element);
++        return pushElements(v4, QList<QQuickStackElement *>() << element);
+     return false;
+ }
+ 
+-bool QQuickStackViewPrivate::popElements(QQuickStackElement *element)
++bool QQuickStackViewPrivate::popElements(QV4::ExecutionEngine *v4, QQuickStackElement *element)
+ {
+     Q_Q(QQuickStackView);
+     while (elements.size() > 1 && elements.top() != element) {
+@@ -232,10 +238,12 @@ bool QQuickStackViewPrivate::popElements(QQuickStackElement *element)
+         if (!element)
+             break;
+     }
+-    return elements.top()->load(q);
++    return elements.top()->load(v4, q);
+ }
+ 
+-bool QQuickStackViewPrivate::replaceElements(QQuickStackElement *target, const QList<QQuickStackElement *> &elems)
++bool QQuickStackViewPrivate::replaceElements(
++        QV4::ExecutionEngine *v4, QQuickStackElement *target,
++        const QList<QQuickStackElement *> &elems)
+ {
+     if (target) {
+         while (!elements.isEmpty()) {
+@@ -245,10 +253,12 @@ bool QQuickStackViewPrivate::replaceElements(QQuickStackElement *target, const Q
+                 break;
+         }
+     }
+-    return pushElements(elems);
++    return pushElements(v4, elems);
+ }
+ 
+-QQuickItem *QQuickStackViewPrivate::popToItem(QQuickItem *item, QQuickStackView::Operation operation, CurrentItemPolicy currentItemPolicy)
++QQuickItem *QQuickStackViewPrivate::popToItem(
++        QV4::ExecutionEngine *v4, QQuickItem *item, QQuickStackView::Operation operation,
++        CurrentItemPolicy currentItemPolicy)
+ {
+     const QString operationName = QStringLiteral("pop");
+     if (modifyingElements) {
+@@ -301,7 +311,7 @@ QQuickItem *QQuickStackViewPrivate::popToItem(QQuickItem *item, QQuickStackView:
+     }
+ 
+     QQuickItem *previousItem = nullptr;
+-    if (popElements(enter)) {
++    if (popElements(v4, enter)) {
+         if (exit) {
+             exit->removal = true;
+             removing.insert(exit);
+diff --git a/src/quicktemplates/qquickstackview_p_p.h b/src/quicktemplates/qquickstackview_p_p.h
+index 4ae849aa20..8bb95760a4 100644
+--- a/src/quicktemplates/qquickstackview_p_p.h
++++ b/src/quicktemplates/qquickstackview_p_p.h
+@@ -50,20 +50,20 @@ public:
+     void setCurrentItem(QQuickStackElement *element);
+ 
+     QList<QQuickStackElement *> parseElements(int from, QQmlV4FunctionPtr args, QStringList *errors);
+-    QList<QQuickStackElement *> parseElements(const QList<QQuickStackViewArg> &args);
++    QList<QQuickStackElement *> parseElements(QQmlEngine *engine, const QList<QQuickStackViewArg> &args);
+     QQuickStackElement *findElement(QQuickItem *item) const;
+     QQuickStackElement *findElement(const QV4::Value &value) const;
+     QQuickStackElement *createElement(const QV4::Value &value, const QQmlRefPointer<QQmlContextData> &context, QString *error);
+-    bool pushElements(const QList<QQuickStackElement *> &elements);
+-    bool pushElement(QQuickStackElement *element);
+-    bool popElements(QQuickStackElement *element);
+-    bool replaceElements(QQuickStackElement *element, const QList<QQuickStackElement *> &elements);
++    bool pushElements(QV4::ExecutionEngine *v4, const QList<QQuickStackElement *> &elements);
++    bool pushElement(QV4::ExecutionEngine *v4, QQuickStackElement *element);
++    bool popElements(QV4::ExecutionEngine *v4, QQuickStackElement *element);
++    bool replaceElements(QV4::ExecutionEngine *v4, QQuickStackElement *element, const QList<QQuickStackElement *> &elements);
+ 
+     enum class CurrentItemPolicy {
+         DoNotPop,
+         Pop
+     };
+-    QQuickItem *popToItem(QQuickItem *item, QQuickStackView::Operation operation, CurrentItemPolicy currentItemPolicy);
++    QQuickItem *popToItem(QV4::ExecutionEngine *v4, QQuickItem *item, QQuickStackView::Operation operation, CurrentItemPolicy currentItemPolicy);
+ 
+ #if QT_CONFIG(quick_viewtransitions)
+     void ensureTransitioner();

From cb4a36487c8bfb7a0ac51117cb821f16b2f3c787 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 4 Oct 2025 10:57:57 +0300
Subject: [PATCH 206/306] kdePackages.plasma-workspace: drop workaround for Qt
 crash

---
 pkgs/kde/plasma/plasma-workspace/default.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/kde/plasma/plasma-workspace/default.nix b/pkgs/kde/plasma/plasma-workspace/default.nix
index a7cd8fc5388fc..90b76badce643 100644
--- a/pkgs/kde/plasma/plasma-workspace/default.nix
+++ b/pkgs/kde/plasma/plasma-workspace/default.nix
@@ -2,7 +2,6 @@
   lib,
   mkKdeDerivation,
   replaceVars,
-  fetchpatch,
   dbus,
   fontconfig,
   xorg,
@@ -34,12 +33,6 @@ mkKdeDerivation {
       # @QtBinariesDir@ only appears in the *removed* lines of the diff
       QtBinariesDir = null;
     })
-    # Fixes https://github.com/NixOS/nixpkgs/issues/442630, next upstream release should already contain this patch
-    (fetchpatch {
-      name = "fix-media-applet-crash.diff";
-      url = "https://invent.kde.org/plasma/plasma-workspace/-/commit/30273fb2afcc6e304951c8895bb17d38255fed39.diff";
-      sha256 = "sha256-1p1CjxRioCDm5ugoI8l6kDlOse5FbDJ71tTAY9LPvRc=";
-    })
   ];
 
   postInstall = ''

From 3480dcebd5e0788be8ad50dd71f5b916987751d3 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 4 Oct 2025 13:20:36 +0300
Subject: [PATCH 207/306] python313Packages.pyside6: 6.9.2 -> 6.9.3

---
 pkgs/development/python-modules/shiboken6/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/shiboken6/default.nix b/pkgs/development/python-modules/shiboken6/default.nix
index 778a88a397b46..6fece11bb0dbf 100644
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@@ -13,11 +13,11 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "shiboken6";
-  version = "6.9.2";
+  version = "6.9.3";
 
   src = fetchurl {
     url = "mirror://qt/official_releases/QtForPython/pyside6/PySide6-${finalAttrs.version}-src/pyside-setup-everywhere-src-${finalAttrs.version}.tar.xz";
-    hash = "sha256-nsCHRlNCvcnb5JKjDlj9u8VEhlXerPWYKg/nEj9ZIi0=";
+    hash = "sha256-fNLVq7mPLm9EKw5B9fz5MOcxKuSxf2gTFrGtx7Y7sXI=";
   };
 
   sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/shiboken6";

From 3e4b64a501f421b30ed8e6dbc5a6af7d5f62bbd6 Mon Sep 17 00:00:00 2001
From: EarthenGarland <>
Date: Wed, 24 Sep 2025 11:38:22 +0300
Subject: [PATCH 208/306] python3Packages.cffi: 1.17.1 -> 2.0.0

---
 .../python-modules/cffi/default.nix           | 91 +++++++------------
 pkgs/top-level/python-packages.nix            |  2 +-
 2 files changed, 32 insertions(+), 61 deletions(-)

diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index b7a5c901435a7..0c837d51ffce8 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -1,75 +1,46 @@
 {
-  lib,
-  stdenv,
   buildPythonPackage,
-  isPyPy,
-  fetchPypi,
-  setuptools,
-  pytestCheckHook,
+  fetchFromGitHub,
+  lib,
   libffi,
   pkg-config,
   pycparser,
+  pytestCheckHook,
+  setuptools,
+  stdenv,
 }:
 
-let
-  version = "1.17.1";
-in
-if isPyPy then
-  buildPythonPackage {
-    pname = "cffi";
-    inherit version;
-    pyproject = false;
-
-    # cffi is bundled with PyPy.
-    dontUnpack = true;
-
-    # Some dependent packages expect to have pycparser available when using cffi.
-    dependencies = [ pycparser ];
-
-    meta = {
-      description = "Foreign Function Interface for Python calling C code (bundled with PyPy, placeholder package)";
-      homepage = "https://cffi.readthedocs.org/";
-      license = lib.licenses.mit;
-      teams = [ lib.teams.python ];
-    };
-  }
-else
-  buildPythonPackage rec {
-    pname = "cffi";
-    inherit version;
-    pyproject = true;
-
-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-HDnGAWwyvEjdVFYZUOvWg24WcPKuRhKPZ89J54nFKCQ=";
-    };
-
-    nativeBuildInputs = [ pkg-config ];
+buildPythonPackage rec {
+  pname = "cffi";
+  version = "2.0.0";
+  pyproject = true;
 
-    build-system = [ setuptools ];
+  src = fetchFromGitHub {
+    owner = "python-cffi";
+    repo = "cffi";
+    tag = "v${version}";
+    hash = "sha256-7Mzz3KmmmE2xQru1GA4aY0DZqn6vxykWiExQvnA1bjM=";
+  };
 
-    buildInputs = [ libffi ];
+  nativeBuildInputs = [ pkg-config ];
 
-    dependencies = [ pycparser ];
+  build-system = [ setuptools ];
 
-    # The tests use -Werror but with python3.6 clang detects some unreachable code.
-    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument -Wno-unreachable-code -Wno-c++11-narrowing";
+  buildInputs = [ libffi ];
 
-    doCheck = !(stdenv.hostPlatform.isMusl || stdenv.hostPlatform.useLLVM or false);
+  # Some dependent packages expect to have pycparser available when using cffi.
+  dependencies = [ pycparser ];
 
-    nativeCheckInputs = [ pytestCheckHook ];
+  doCheck = !(stdenv.hostPlatform.isMusl || stdenv.hostPlatform.useLLVM or false);
 
-    disabledTests = lib.optionals stdenv.hostPlatform.isFreeBSD [
-      # https://github.com/python-cffi/cffi/pull/144
-      "test_dlopen_handle"
-    ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-    meta = with lib; {
-      changelog = "https://github.com/python-cffi/cffi/releases/tag/v${version}";
-      description = "Foreign Function Interface for Python calling C code";
-      downloadPage = "https://github.com/python-cffi/cffi";
-      homepage = "https://cffi.readthedocs.org/";
-      license = licenses.mit;
-      teams = [ teams.python ];
-    };
-  }
+  meta = {
+    changelog = "https://github.com/python-cffi/cffi/releases/tag/v${version}";
+    description = "Foreign Function Interface for Python calling C code";
+    downloadPage = "https://github.com/python-cffi/cffi";
+    homepage = "https://cffi.readthedocs.org/";
+    license = lib.licenses.mit0;
+    teams = [ lib.teams.python ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index db7b4e2206922..c03ec4824a11f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2474,7 +2474,7 @@ self: super: with self; {
 
   cffconvert = callPackage ../development/python-modules/cffconvert { };
 
-  cffi = callPackage ../development/python-modules/cffi { };
+  cffi = if isPyPy then null else callPackage ../development/python-modules/cffi { };
 
   cffsubr = callPackage ../development/python-modules/cffsubr { };
 

From 5c2b3c07b3e80096bed19f4c9122db1ad80415b9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 Sep 2025 21:37:53 +0200
Subject: [PATCH 209/306] python3Packages.isal: 1.7.2 -> 1.8.0

https://github.com/pycompression/python-isal/blob/v1.8.0/CHANGELOG.rst
---
 .../development/python-modules/isal/default.nix | 17 +++++------------
 .../python-modules/isal/version.patch           | 16 ----------------
 2 files changed, 5 insertions(+), 28 deletions(-)
 delete mode 100644 pkgs/development/python-modules/isal/version.patch

diff --git a/pkgs/development/python-modules/isal/default.nix b/pkgs/development/python-modules/isal/default.nix
index bd3f11ac014b4..d1344d106f547 100644
--- a/pkgs/development/python-modules/isal/default.nix
+++ b/pkgs/development/python-modules/isal/default.nix
@@ -2,11 +2,10 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  replaceVars,
 
   # build-system
   setuptools,
-  versioningit,
+  setuptools-scm,
 
   # native dependencies
   isa-l,
@@ -18,25 +17,19 @@
 
 buildPythonPackage rec {
   pname = "isal";
-  version = "1.7.2";
+  version = "1.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pycompression";
     repo = "python-isal";
-    rev = "v${version}";
-    hash = "sha256-gvUVSGarPA4KupQTd61x75CfqNVqZfFC1zq0R21Clf8=";
+    tag = "v${version}";
+    hash = "sha256-703uXty3a0N+yXfv/7nVIAnU7PaqMtNO0ScltNLJq3g=";
   };
 
-  patches = [
-    (replaceVars ./version.patch {
-      inherit version;
-    })
-  ];
-
   build-system = [
     setuptools
-    versioningit
+    setuptools-scm
   ];
 
   buildInputs = [ isa-l ];
diff --git a/pkgs/development/python-modules/isal/version.patch b/pkgs/development/python-modules/isal/version.patch
deleted file mode 100644
index 9a8500a12d469..0000000000000
--- a/pkgs/development/python-modules/isal/version.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index bf5fe99..b559255 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -2,9 +2,8 @@
- requires = ["setuptools>=64", "versioningit>=1.1.0"]
- build-backend = "setuptools.build_meta"
- 
--[tool.versioningit.vcs]
--method="git"
--default-tag = "v0.0.0"
-+[tool.versioningit]
-+default-version = "@version@"
- 
- [tool.versioningit.write]
- file = "src/isal/_version.py"

From d856e74723c9162028ed5b498c0d6eee9ef4479b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 4 Oct 2025 21:55:59 +0100
Subject: [PATCH 210/306] hwdata: 0.398 -> 0.400

Changes: https://github.com/vcrhonek/hwdata/compare/v0.399...v0.400
---
 pkgs/by-name/hw/hwdata/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index b0a26d17b0919..28440ad5a0be7 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.399";
+  version = "0.400";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7IhOMl0o5dyevklvOSZrTbNMkMy/Sp/MtxaPdeqpHJg=";
+    hash = "sha256-X3LL3PZjEiGrkntegcSWNW2Wsx/IpdTowSVp/F4ov+E=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)

From 4eb4a0d387408d9096ac500c3a5654fcfafef152 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 5 Oct 2025 06:25:39 +0100
Subject: [PATCH 211/306] maturin: 1.9.4 -> 1.9.5

Changes: https://github.com/PyO3/maturin/releases/tag/v1.9.5
---
 pkgs/by-name/ma/maturin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 7defb66efee73..abb2695d21a1b 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-dZIcUaHPdXNgzUhSUld2TAKJVfktRahc7OtOwYRlKSQ=";
+    hash = "sha256-2WiQtNuhuCJfKIoRKNFaX50Jah4nn2aqlAGrRq/+kww=";
   };
 
-  cargoHash = "sha256-tmImZOGERNvAI4I8H4nuJAdrMrMyOYza43+SVdyjFNc=";
+  cargoHash = "sha256-lLWQy9f7vQ+8K0gOCcantAf5644v6Y6MDRvaBvJZJKA=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv

From 0778597c69efdd5ce54853993094ba8f163553c0 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Sun, 5 Oct 2025 15:18:28 +0800
Subject: [PATCH 212/306] uv: 0.8.22 -> 0.8.23

---
 pkgs/by-name/uv/uv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 41edda5835afb..8122b1afea866 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.8.22";
+  version = "0.8.23";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-7/WOjsyfkDTZLNJY0+rNdRUmMabJsSFvKi2yh/WqViQ=";
+    hash = "sha256-5L/FipR5MPsscpWfpDURbC5qwn6XB5KoOrjedk1HzDo=";
   };
 
-  cargoHash = "sha256-RubSyxQjWlkoHMItYLjiyJ5Whz3oMXgioqbuewi1fcM=";
+  cargoHash = "sha256-JHfqsT/W7RvoHx9WbA4fdQZw2/+BOSRuGV3mcMx1FN4=";
 
   buildInputs = [
     rust-jemalloc-sys

From c5cdad7dd4ccc09f3cd42814ec973faa0da2f21a Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Thu, 9 Jan 2025 00:43:42 +0100
Subject: [PATCH 213/306] pkgs-lib.formats: add mkStructuredType

---
 pkgs/pkgs-lib/formats.nix | 161 ++++++++++----------------------------
 1 file changed, 41 insertions(+), 120 deletions(-)

diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index f83a00b9e610a..bbafa42f8ae6e 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -126,27 +126,42 @@ optionalAttrs allowAliases aliases
 
   php = (import ./formats/php/default.nix { inherit lib pkgs; }).format;
 
+  /*
+    Creates a structured value type suitable for serialization formats.
+
+    Parameters:
+    - typeName: String describing the format (e.g. "JSON", "YAML", "XML")
+
+    Returns a type suitable for structured data formats that supports:
+    - Basic types: boolean, integer, float, string, path
+    - Complex types: attribute sets and lists
+  */
+  mkStructuredType =
+    {
+      typeName,
+      nullable ? true,
+    }:
+    let
+      baseType = oneOf [
+        bool
+        int
+        float
+        str
+        path
+        (attrsOf valueType)
+        (listOf valueType)
+      ];
+      valueType = (if nullable then nullOr baseType else baseType) // {
+        description = "${typeName} value";
+      };
+    in
+    valueType;
+
   json =
     { }:
     {
 
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "JSON value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "JSON"; };
 
       generate =
         name: value:
@@ -160,7 +175,7 @@ optionalAttrs allowAliases aliases
               preferLocalBuild = true;
             }
             ''
-              jq . "$valuePath"> $out
+              jq . "$valuePath" > $out
             ''
         ) { };
 
@@ -187,23 +202,7 @@ optionalAttrs allowAliases aliases
             ''
         ) { };
 
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "YAML 1.1 value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "YAML 1.1"; };
 
     };
 
@@ -226,23 +225,7 @@ optionalAttrs allowAliases aliases
             ''
         ) { };
 
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "YAML 1.2 value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "YAML 1.2"; };
 
     };
 
@@ -491,23 +474,7 @@ optionalAttrs allowAliases aliases
     { }:
     json { }
     // {
-      type =
-        let
-          valueType =
-            oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ]
-            // {
-              description = "TOML value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "TOML"; };
 
       generate =
         name: value:
@@ -540,23 +507,7 @@ optionalAttrs allowAliases aliases
     { }:
     json { }
     // {
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "CDN value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "CDN"; };
 
       generate =
         name: value:
@@ -971,23 +922,9 @@ optionalAttrs allowAliases aliases
   pythonVars =
     { }:
     {
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              float
-              int
-              path
-              str
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "Python value";
-            };
-        in
-        attrsOf valueType;
+      type = attrsOf (mkStructuredType {
+        typeName = "Python";
+      });
 
       lib = {
         mkRaw = value: {
@@ -1067,23 +1004,7 @@ optionalAttrs allowAliases aliases
     }:
     if format == "badgerfish" then
       {
-        type =
-          let
-            valueType =
-              nullOr (oneOf [
-                bool
-                int
-                float
-                str
-                path
-                (attrsOf valueType)
-                (listOf valueType)
-              ])
-              // {
-                description = "XML value";
-              };
-          in
-          valueType;
+        type = mkStructuredType { typeName = "XML"; };
 
         generate =
           name: value:

From bbe152dcfe1c45585a312cf597fc10e6dd3c82fe Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 5 Oct 2025 13:07:29 +0200
Subject: [PATCH 214/306] glibcLocales: use substituteInPlace for Makefile fix

That way we'll notice if the code changes to examine if this either
needs to be updated or removed.
---
 pkgs/development/libraries/glibc/locales.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index bd61f72fc28ec..8b1a4df4838f8 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -54,7 +54,8 @@
           echo 'C.UTF-8/UTF-8 \' >> ../glibc-2*/localedata/SUPPORTED
 
           # Hack to allow building of the locales (needed since glibc-2.12)
-          sed -i -e 's,^$(rtld-prefix) $(common-objpfx)locale/localedef,localedef $(LOCALEDEF_FLAGS),' ../glibc-2*/localedata/Makefile
+          substituteInPlace ../glibc-2*/localedata/Makefile \
+            --replace-fail '$(rtld-prefix) $(common-objpfx)locale/localedef' 'localedef $(LOCALEDEF_FLAGS)'
         ''
         + lib.optionalString (!allLocales) ''
           # Check that all locales to be built are supported

From 9da1bc57fd287a5aa54c39eccb247fded4c6b4f3 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 5 Oct 2025 13:08:33 +0200
Subject: [PATCH 215/306] postgresql_{17,18}: fix build

After a recent update of libxml2 the build fails with

    /nix/store/casz7al9kpkg52sn156h6slqijwkybqj-libxml2-2.15.0-bin/bin/xmllint --nonet --path . --path . --output postgres-full.xml --noent --valid postgres.sgml
    ref/pg_combinebackup.sgml:287: validity error : standalone: normalization of attribute linkend on xref by external subset declaration
   state of the cluster using <xref linkend="app-pgchecksums "/> is

Reported in #448752 (not closing on purpose since the issue is actually
about another problem).
---
 pkgs/servers/sql/postgresql/generic.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index d07f97e9840c3..836b48664aa58 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -6,6 +6,7 @@ let
       stdenv,
       fetchFromGitHub,
       fetchurl,
+      fetchpatch2,
       lib,
       replaceVars,
       writeShellScriptBin,
@@ -424,6 +425,12 @@ let
       ]
       ++ lib.optionals (stdenv'.hostPlatform.isDarwin && olderThan "16") [
         ./patches/export-dynamic-darwin-15-.patch
+      ]
+      ++ lib.optionals (atLeast "17") [
+        (fetchpatch2 {
+          url = "https://github.com/postgres/postgres/commit/a48d1ef58652229521ba4b5070e19f857608b22e.patch";
+          hash = "sha256-3FKQS1Vpu+p6z6c1GWs6GlrLl2Bgm9paEU/z81LrEus=";
+        })
       ];
 
       installTargets = [ "install-world" ];

From 8fd62521538d361ed5a3c43a4bc152e8091e03ee Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Sun, 5 Oct 2025 23:27:20 +0900
Subject: [PATCH 216/306] pkgs-lib.formats: move `mkStructuredType` to
 let-block

---
 pkgs/pkgs-lib/formats.nix | 62 +++++++++++++++++++--------------------
 1 file changed, 31 insertions(+), 31 deletions(-)

diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index bbafa42f8ae6e..25d13d367d99a 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -58,6 +58,37 @@ let
     submodule
     ;
 
+  /*
+    Creates a structured value type suitable for serialization formats.
+
+    Parameters:
+    - typeName: String describing the format (e.g. "JSON", "YAML", "XML")
+
+    Returns a type suitable for structured data formats that supports:
+    - Basic types: boolean, integer, float, string, path
+    - Complex types: attribute sets and lists
+  */
+  mkStructuredType =
+    {
+      typeName,
+      nullable ? true,
+    }:
+    let
+      baseType = oneOf [
+        bool
+        int
+        float
+        str
+        path
+        (attrsOf valueType)
+        (listOf valueType)
+      ];
+      valueType = (if nullable then nullOr baseType else baseType) // {
+        description = "${typeName} value";
+      };
+    in
+    valueType;
+
   # Attributes added accidentally in https://github.com/NixOS/nixpkgs/pull/335232 (2024-08-18)
   # Deprecated in https://github.com/NixOS/nixpkgs/pull/415666 (2025-06)
   allowAliases = pkgs.config.allowAliases or false;
@@ -126,37 +157,6 @@ optionalAttrs allowAliases aliases
 
   php = (import ./formats/php/default.nix { inherit lib pkgs; }).format;
 
-  /*
-    Creates a structured value type suitable for serialization formats.
-
-    Parameters:
-    - typeName: String describing the format (e.g. "JSON", "YAML", "XML")
-
-    Returns a type suitable for structured data formats that supports:
-    - Basic types: boolean, integer, float, string, path
-    - Complex types: attribute sets and lists
-  */
-  mkStructuredType =
-    {
-      typeName,
-      nullable ? true,
-    }:
-    let
-      baseType = oneOf [
-        bool
-        int
-        float
-        str
-        path
-        (attrsOf valueType)
-        (listOf valueType)
-      ];
-      valueType = (if nullable then nullOr baseType else baseType) // {
-        description = "${typeName} value";
-      };
-    in
-    valueType;
-
   json =
     { }:
     {

From f2636ab9403a72c98264ffd2f550b5a6e17b95e0 Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Sun, 5 Oct 2025 23:27:36 +0900
Subject: [PATCH 217/306] pkgs-lib.formats: add missing parameter comment for
 `mkStructuredType`

---
 pkgs/pkgs-lib/formats.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 25d13d367d99a..740d3f783834e 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -63,6 +63,7 @@ let
 
     Parameters:
     - typeName: String describing the format (e.g. "JSON", "YAML", "XML")
+    - nullable: Whether the structured value type allows `null` values.
 
     Returns a type suitable for structured data formats that supports:
     - Basic types: boolean, integer, float, string, path

From d493d7ecb74eae048d90268b1904e5b1045623a9 Mon Sep 17 00:00:00 2001
From: dramforever <dramforever@live.com>
Date: Sun, 5 Oct 2025 22:21:04 +0800
Subject: [PATCH 218/306] qt5.qtdeclarative: Make "RegisterID" patch
 unconditional

The patch was conditional to x86_64-darwin to fix staging-next without
rebuilding too much. Now that the cycle is done, make it unconditional.
---
 pkgs/development/libraries/qt-5/5.15/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 9c34451b9e842..fae48eeea230d 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -65,9 +65,6 @@ let
       ./qtdeclarative-default-disable-qmlcache.patch
       # add version specific QML import path
       ./qtdeclarative-qml-paths.patch
-    ]
-    # FIXME: Make unconditional on next staging cycle
-    ++ lib.optionals (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isDarwin) [
       # Fix an undefined behavior, and fix random-seeming build error with Clang. See:
       # - https://codereview.qt-project.org/c/qt/qtdeclarative/+/354847
       # - https://github.com/llvm/llvm-project/issues/74070

From cfb771c8a5a7b13e3d4f0ea48ca155d100c3e687 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 5 Oct 2025 13:14:36 +0200
Subject: [PATCH 219/306] glibcLocales: remove builder

There's no particular reason to have a special builder. Fold all the
changes it made into the derivation.
---
 .../libraries/glibc/locales-builder.sh        | 15 -------------
 pkgs/development/libraries/glibc/locales.nix  | 22 ++++++++++++++-----
 2 files changed, 17 insertions(+), 20 deletions(-)
 delete mode 100644 pkgs/development/libraries/glibc/locales-builder.sh

diff --git a/pkgs/development/libraries/glibc/locales-builder.sh b/pkgs/development/libraries/glibc/locales-builder.sh
deleted file mode 100644
index 6f10476f10898..0000000000000
--- a/pkgs/development/libraries/glibc/locales-builder.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-# Glibc cannot have itself in its RPATH.
-export NIX_NO_SELF_RPATH=1
-
-postConfigure() {
-    # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
-    # This has to be done *after* `configure' because it builds some
-    # test binaries.
-    export NIX_CFLAGS_LINK=
-    export NIX_LDFLAGS_BEFORE=
-
-    export NIX_DONT_SET_RPATH=1
-    unset CFLAGS
-}
-
-genericBuild
diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index 8b1a4df4838f8..e8c5565ab30a7 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -31,13 +31,25 @@
   (
     finalAttrs: previousAttrs: {
 
-      builder = ./locales-builder.sh;
-
       outputs = [ "out" ];
 
-      LOCALEDEF_FLAGS = [
-        (if stdenv.hostPlatform.isLittleEndian then "--little-endian" else "--big-endian")
-      ];
+      env = (previousAttrs.env or { }) // {
+        LOCALEDEF_FLAGS = if stdenv.hostPlatform.isLittleEndian then "--little-endian" else "--big-endian";
+
+        # Glibc cannot have itself in its RPATH.
+        NIX_NO_SELF_RPATH = 1;
+      };
+
+      postConfigure = (previousAttrs.postConfigure or "") + ''
+        # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
+        # This has to be done *after* `configure' because it builds some
+        # test binaries.
+        export NIX_CFLAGS_LINK=
+        export NIX_LDFLAGS_BEFORE=
+
+        export NIX_DONT_SET_RPATH=1
+        unset CFLAGS
+      '';
 
       preBuild =
         (previousAttrs.preBuild or "")

From 700d7ec879f4bce893aa14e0ba880ed99fe1fb29 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 5 Oct 2025 13:17:27 +0200
Subject: [PATCH 220/306] glibcLocales: re-enable parallel build

This was originally turned off in #245360 because the approach was
non-reproducible, i.e. all N concurrent jobs were racing to update
`locale-archive`.

glibc's localedef allows to separate the build from the install, i.e.
`localedef --no-archive` allows to only perform the build of the locale
which can be parallelized again. After that, a single process adds all
newly built locales into the archive.

This isn't supported by the Makefiles in upstream glibc yet[1], hence
the additional patches.

For me, this reduces the build-time of `pkgs.glibcLocales` from ~7min to
slightly under 1min.

[1] https://sourceware.org/pipermail/libc-alpha/2025-October/170803.html
---
 ...-reproducible-parallel-install-of-lo.patch | 50 +++++++++++++++++++
 ...-make-inst_complocaledir-overridable.patch | 42 ++++++++++++++++
 pkgs/development/libraries/glibc/common.nix   |  4 ++
 pkgs/development/libraries/glibc/locales.nix  |  9 +---
 4 files changed, 98 insertions(+), 7 deletions(-)
 create mode 100644 pkgs/development/libraries/glibc/0001-localedata-allow-reproducible-parallel-install-of-lo.patch
 create mode 100644 pkgs/development/libraries/glibc/0002-Makeconfig-make-inst_complocaledir-overridable.patch

diff --git a/pkgs/development/libraries/glibc/0001-localedata-allow-reproducible-parallel-install-of-lo.patch b/pkgs/development/libraries/glibc/0001-localedata-allow-reproducible-parallel-install-of-lo.patch
new file mode 100644
index 0000000000000..276e9cc0bf32d
--- /dev/null
+++ b/pkgs/development/libraries/glibc/0001-localedata-allow-reproducible-parallel-install-of-lo.patch
@@ -0,0 +1,50 @@
+From 38e9742ed794febbc8caa4177df14d097607a2d9 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Sun, 5 Oct 2025 12:45:25 +0200
+Subject: [PATCH 1/2] localedata: allow reproducible & parallel install of
+ locale-archive
+
+The problem with the current approach is that N processes are compiling
+a locale and updating the locale-archive at the same time. Hence,
+there's a race which process gets to update the archive first and thus
+the build is not reproducible[1].
+
+This patch changes that by adding the `--no-archive` flag to the
+`$(LOCALEDEF)` invocation in `build-one-locale` to parallelize the build
+process in a race-free manner. A single `localedef --add-to-archive`
+then adds all previously built locales to the archive.
+
+[1] https://github.com/NixOS/nixpkgs/issues/245360
+---
+ localedata/Makefile | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/localedata/Makefile b/localedata/Makefile
+index 01b32348d4..13f7d3a2c4 100644
+--- a/localedata/Makefile
++++ b/localedata/Makefile
+@@ -538,8 +538,13 @@ LOCALEDEF=I18NPATH=. GCONV_PATH=$(common-objpfx)iconvdata LC_ALL=C \
+ $(rtld-prefix) $(common-objpfx)locale/localedef
+ install-locales: install-locale-archive
+ 
++define install-all-locales
++  $(LOCALEDEF) $$flags --add-to-archive `find $(inst_complocaledir) -maxdepth 1 -mindepth 1 -type d | sort`
++endef
++
+ # Create and install the locale-archive file.
+ install-locale-archive: $(INSTALL-SUPPORTED-LOCALE-ARCHIVE)
++	$(install-all-locales)
+ # Create and install the locales individually (no archive).
+ install-locale-files: $(INSTALL-SUPPORTED-LOCALE-FILES)
+ 
+@@ -565,6 +570,7 @@ define build-one-locale
+ 	$(LOCALEDEF) $$flags --alias-file=../intl/locale.alias \
+ 		     -i locales/$$input -f charmaps/$$charset \
+ 		     $(addprefix --prefix=,$(install_root)) $$locale \
++		     --no-archive \
+ 	&& echo ' done';
+ endef
+ 
+-- 
+2.50.1
+
diff --git a/pkgs/development/libraries/glibc/0002-Makeconfig-make-inst_complocaledir-overridable.patch b/pkgs/development/libraries/glibc/0002-Makeconfig-make-inst_complocaledir-overridable.patch
new file mode 100644
index 0000000000000..c727912a6d84f
--- /dev/null
+++ b/pkgs/development/libraries/glibc/0002-Makeconfig-make-inst_complocaledir-overridable.patch
@@ -0,0 +1,42 @@
+From 887cb6906afa2b2d8abf35ccfc33ce7b8dc902f8 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Sun, 5 Oct 2025 12:48:43 +0200
+Subject: [PATCH 2/2] Makeconfig: make inst_complocaledir overridable
+
+On NixOS, we build the locales in a separate package from glibc itself.
+Also, packages aren't installed into a common location such as `/usr`,
+but each package has its own unique prefix below `/nix/store`.
+
+For us, the current state is a problem because `localedef` is built
+in a different package and expects DESTDIR to be the unique
+package-prefix of `glibc` itself. Our current workaround is to
+invoke `localedef` with `--prefix=$TMPDIR` and copy the contents
+to the correct prefix. This was doable without patching when
+`localedef` was doing build & locale-archive creation at the
+same time.
+
+With the previous patch, the Makefile uses `$(inst_complocaledir)` to
+tell localedef where the previously built locales are. In NixOS, we now
+need to override `$(inst_complocaledir)` to point to
+`$TMPDIR/$(glibc.out)`. Hence, this patch makes the variable overridable
+from env.
+---
+ Makeconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makeconfig b/Makeconfig
+index 9eda4fa528..43d88325bc 100644
+--- a/Makeconfig
++++ b/Makeconfig
+@@ -197,7 +197,7 @@ inst_zonedir = $(install_root)$(zonedir)
+ ifndef complocaledir
+ complocaledir = $(libdir)/locale
+ endif
+-inst_complocaledir = $(install_root)$(complocaledir)
++inst_complocaledir ?= $(install_root)$(complocaledir)
+ 
+ # Where to install the message catalog data files (which are
+ # machine-independent).
+-- 
+2.50.1
+
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index a35e5085f87c9..5293c6579c5d3 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -111,6 +111,10 @@ stdenv.mkDerivation (
         & https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991
       */
       ./reenable_DT_HASH.patch
+
+      # enable parallel & reproducible build of glibcLocales
+      ./0001-localedata-allow-reproducible-parallel-install-of-lo.patch
+      ./0002-Makeconfig-make-inst_complocaledir-overridable.patch
     ]
     /*
       NVCC does not support ARM intrinsics. Since <math.h> is pulled in by almost
diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index e8c5565ab30a7..98f04f22dbcd3 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -61,7 +61,8 @@
           # $TMPDIR/nix/store/...-glibc-.../lib/locale/locale-archive.
           LOCALEDEF_FLAGS+=" --prefix=$TMPDIR"
 
-          mkdir -p $TMPDIR/"${buildPackages.glibc.out}/lib/locale"
+          export inst_complocaledir="$TMPDIR/"${buildPackages.glibc.out}/lib/locale
+          mkdir -p "$inst_complocaledir"
 
           echo 'C.UTF-8/UTF-8 \' >> ../glibc-2*/localedata/SUPPORTED
 
@@ -88,12 +89,6 @@
           echo SUPPORTED-LOCALES='${toString locales}' > ../glibc-2*/localedata/SUPPORTED
         '';
 
-      # Current `nixpkgs` way of building locales is not compatible with
-      # parallel install. `locale-archive` is updated in parallel with
-      # multiple `localedef` processes and causes non-deterministic result:
-      #   https://github.com/NixOS/nixpkgs/issues/245360
-      enableParallelBuilding = false;
-
       makeFlags = (previousAttrs.makeFlags or [ ]) ++ [
         "localedata/install-locales"
         "localedir=${placeholder "out"}/lib/locale"

From f65d25cd1cc4bef52855259abb3c1a3a2b3ab2b4 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Fri, 26 Sep 2025 22:26:16 -0400
Subject: [PATCH 221/306] python3Packages.cryptography: 45.0.4 -> 46.0.1; adopt

Diff: https://github.com/pyca/cryptography/compare/refs/tags/45.0.4...refs/tags/46.0.1

Changelog: https://cryptography.io/en/latest/changelog/#v46-0-1
---
 .../python-modules/cryptography/default.nix           | 11 +++++++----
 .../python-modules/cryptography/vectors.nix           | 11 +++++++----
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 074a185269020..ff97aec223adc 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "45.0.4"; # Also update the hash in vectors.nix
+  version = "46.0.1"; # Also update the hash in vectors.nix
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -31,12 +31,12 @@ buildPythonPackage rec {
     owner = "pyca";
     repo = "cryptography";
     tag = version;
-    hash = "sha256-rKgMUVj5IdeWIdLWQ4E6zhC6dwJMi+BRHCh2JG73Zgc=";
+    hash = "sha256-saTHFKSJa9gjtEp6uGAHsvzFE3yPeck1WGdIE1+9kgs=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-dKwNnWBzBM9QEcRbbvkNhFJnFxFakqZ/MS7rqE8/tNQ=";
+    hash = "sha256-aCQzY2gBjVVwiqlqAxkH4y6yf4lqdQuSEnQSIjLPRJg=";
   };
 
   postPatch = ''
@@ -98,6 +98,9 @@ buildPythonPackage rec {
       bsd3
       psfl
     ];
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [
+      SuperSandro2000
+      mdaniels5757
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 73e4f2c75f706..9b962a886784c 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   cryptography,
-  flit-core,
+  uv-build,
 }:
 
 buildPythonPackage rec {
@@ -15,10 +15,10 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "cryptography_vectors";
     inherit version;
-    hash = "sha256-+7BAjfj/LSs9vSkovFt/7r/dNvsJL6h5DVd4qbmh+e8=";
+    hash = "sha256-B40Sh84rRdJGtCxs+545Dh96+hdsGZsL1t6p1s6Jou4=";
   };
 
-  build-system = [ flit-core ];
+  build-system = [ uv-build ];
 
   # No tests included
   doCheck = false;
@@ -33,6 +33,9 @@ buildPythonPackage rec {
       asl20
       bsd3
     ];
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [
+      SuperSandro2000
+      mdaniels5757
+    ];
   };
 }

From 0c6b081e66c17c90b65369c099073f47b22a4714 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 28 Sep 2025 09:41:43 -0400
Subject: [PATCH 222/306] python3Packages.cryptography: remove SuperSandro2000
 as maintainer

Per their request: https://github.com/NixOS/nixpkgs/pull/446515#discussion_r2385813367
---
 pkgs/development/python-modules/cryptography/default.nix | 5 +----
 pkgs/development/python-modules/cryptography/vectors.nix | 5 +----
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index ff97aec223adc..11f6406d42386 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -98,9 +98,6 @@ buildPythonPackage rec {
       bsd3
       psfl
     ];
-    maintainers = with maintainers; [
-      SuperSandro2000
-      mdaniels5757
-    ];
+    maintainers = with maintainers; [ mdaniels5757 ];
   };
 }
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 9b962a886784c..0a9a1a5d58946 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -33,9 +33,6 @@ buildPythonPackage rec {
       asl20
       bsd3
     ];
-    maintainers = with maintainers; [
-      SuperSandro2000
-      mdaniels5757
-    ];
+    maintainers = with maintainers; [ mdaniels5757 ];
   };
 }

From 6fe0bb189ff708e5bff9c3d7964d8dcebbe119c7 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sun, 5 Oct 2025 22:36:28 -0700
Subject: [PATCH 223/306] util-linux: 2.41.1 -> 2.41.2

---
 pkgs/by-name/ut/util-linux/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index 70303a99050ea..ac034405d5006 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -41,11 +41,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "util-linux" + lib.optionalString isMinimal "-minimal";
-  version = "2.41.1";
+  version = "2.41.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor finalAttrs.version}/util-linux-${finalAttrs.version}.tar.xz";
-    hash = "sha256-vprZonb0MFq33S9SJci+H/VDUvVl/03t6WKMGqp97Fc=";
+    hash = "sha256-YGKh2JtXGmGTLm/AIR82BgxBg1aLge6GbPNjvOn2WD4=";
   };
 
   patches = [

From 1e3e005a5f9ec6591010901082a78d889ca13908 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 30 Sep 2025 08:05:43 -0700
Subject: [PATCH 224/306] python3Packages.pycparser: 2.22 -> 2.23

Diff: https://github.com/eliben/pycparser/compare/release_v2.22...release_v2.23

Changelog: https://github.com/eliben/pycparser/releases/tag/release_v2.23
---
 .../python-modules/pycparser/default.nix      | 26 ++++++++++++-------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/pycparser/default.nix b/pkgs/development/python-modules/pycparser/default.nix
index fb2e5cbda0e0e..ee58976384d76 100644
--- a/pkgs/development/python-modules/pycparser/default.nix
+++ b/pkgs/development/python-modules/pycparser/default.nix
@@ -1,36 +1,44 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  gitUpdater,
   setuptools,
   unittestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "pycparser";
-  version = "2.22";
+  version = "2.23";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-SRyL6cBA9TkPW/RKWwd1K9B/Vu35kjgbBccBQ57sEPY=";
+  src = fetchFromGitHub {
+    owner = "eliben";
+    repo = "pycparser";
+    tag = "release_v${version}";
+    hash = "sha256-dkteM8VizYf9ZLPOe8od5CZgg7a3fs4Hy+t8bGLV/GI=";
   };
 
   build-system = [ setuptools ];
 
+  pythonImportsCheck = [ "pycparser" ];
+
   nativeCheckInputs = [ unittestCheckHook ];
-  disabled = pythonOlder "3.8";
 
   unittestFlagsArray = [
     "-s"
     "tests"
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "release_v";
+  };
+
+  meta = {
+    changelog = "https://github.com/eliben/pycparser/releases/tag/${src.tag}";
     description = "C parser in Python";
     homepage = "https://github.com/eliben/pycparser";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     maintainers = [ ];
   };
 }

From 8a7d22e0c4622763d83d0be0484944df2fb4dd23 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 30 Sep 2025 08:12:23 -0700
Subject: [PATCH 225/306] python3Packages.pycparser: add dotlambda to
 maintainers

---
 pkgs/development/python-modules/pycparser/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pycparser/default.nix b/pkgs/development/python-modules/pycparser/default.nix
index ee58976384d76..9f2068a0e72f3 100644
--- a/pkgs/development/python-modules/pycparser/default.nix
+++ b/pkgs/development/python-modules/pycparser/default.nix
@@ -39,6 +39,6 @@ buildPythonPackage rec {
     description = "C parser in Python";
     homepage = "https://github.com/eliben/pycparser";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.dotlambda ];
   };
 }

From 70b13187027011175bda58c8c57e37810da57aad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
Date: Mon, 6 Oct 2025 12:10:23 +0200
Subject: [PATCH 226/306] openssh: 10.0p2 -> 10.1p1

---
 pkgs/tools/networking/openssh/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index c1e78916e3d93..47f215c6e7f9c 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -25,11 +25,11 @@ in
 {
   openssh = common rec {
     pname = "openssh";
-    version = "10.0p2";
+    version = "10.1p1";
 
     src = fetchurl {
       url = urlFor version;
-      hash = "sha256-AhoucJoO30JQsSVr1anlAEEakN3avqgw7VnO+Q652Fw=";
+      hash = "sha256-ufx6K4JXlGem8vQ+SoHI4d/aYU3bT5slWq/XAgu/B1g=";
     };
 
     extraPatches = [

From 59011787de6d841fcc5e3c0fd7f5d3247ff37a18 Mon Sep 17 00:00:00 2001
From: Cobalt <cobalt@cobalt.rocks>
Date: Mon, 6 Oct 2025 18:39:18 +0200
Subject: [PATCH 227/306] cmake: 4.1.1 -> 4.1.2

---
 pkgs/by-name/cm/cmake/package.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index 7e3b689f45678..3f099d56c7f9f 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -50,11 +50,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "4.1.1";
+  version = "4.1.2";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-sp9vGXM6oiS3djUHoQikJ+1Ixojh+vIrKcROHDBUkoI=";
+    hash = "sha256-ZD8EGCt7oyOrMfUm94UTT7ecujGIqFIgbvBHP+4oKhU=";
   };
 
   patches = [
@@ -80,9 +80,6 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ]
   ++ [
-    # Backport of https://gitlab.kitware.com/cmake/cmake/-/merge_requests/11134
-    ./fix-curl-8.16.patch
-
     # Remove references to non‐Nix search paths.
     ./remove-impure-search-paths.patch
   ];

From 25e606dd64db47e01d80544285e352522dbed02d Mon Sep 17 00:00:00 2001
From: Tyler Langlois <tjl@byu.net>
Date: Mon, 6 Oct 2025 10:16:46 -0600
Subject: [PATCH 228/306] binutils: fix CVE-2025-5244

---
 .../tools/misc/binutils/CVE-2025-5244.diff          | 13 +++++++++++++
 pkgs/development/tools/misc/binutils/default.nix    |  4 ++++
 2 files changed, 17 insertions(+)
 create mode 100644 pkgs/development/tools/misc/binutils/CVE-2025-5244.diff

diff --git a/pkgs/development/tools/misc/binutils/CVE-2025-5244.diff b/pkgs/development/tools/misc/binutils/CVE-2025-5244.diff
new file mode 100644
index 0000000000000..947172f2866a4
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2025-5244.diff
@@ -0,0 +1,13 @@
+Backported patch originally targeted against 2.45.
+--- a/bfd/elflink.c
++++ b/bfd/elflink.c
+@@ -14356,5 +14356,6 @@ elf_gc_sweep (bfd *abfd, struct bfd_link_info *info)
+	  if (o->flags & SEC_GROUP)
+	    {
+	      asection *first = elf_next_in_group (o);
+-	      o->gc_mark = first->gc_mark;
++	      if (first != NULL)
++	        o->gc_mark = first->gc_mark;
+	    }
+
+	  if (o->gc_mark)
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 04e311bf38a12..2e3941d17f511 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -118,6 +118,10 @@ stdenv.mkDerivation (finalAttrs: {
     ./avr-size.patch
 
     ./windres-locate-gcc.patch
+
+    # Backported against CVE patched in the 2.45 series. See:
+    # https://nvd.nist.gov/vuln/detail/CVE-2025-5244
+    ./CVE-2025-5244.diff
   ];
 
   outputs = [

From 88ceb91bdfeab0552e6a57c578a4d286a7c49ecd Mon Sep 17 00:00:00 2001
From: Tyler Langlois <tjl@byu.net>
Date: Mon, 6 Oct 2025 14:35:12 -0600
Subject: [PATCH 229/306] binutils: fix CVE-2025-5245

Backport derived from upstream commit; see:
https://nvd.nist.gov/vuln/detail/CVE-2025-5245
---
 .../tools/misc/binutils/CVE-2025-5245.diff    | 26 +++++++++++++++++++
 .../tools/misc/binutils/default.nix           |  4 +++
 2 files changed, 30 insertions(+)
 create mode 100644 pkgs/development/tools/misc/binutils/CVE-2025-5245.diff

diff --git a/pkgs/development/tools/misc/binutils/CVE-2025-5245.diff b/pkgs/development/tools/misc/binutils/CVE-2025-5245.diff
new file mode 100644
index 0000000000000..27592a8d0e87f
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2025-5245.diff
@@ -0,0 +1,26 @@
+Backported patch originally targeted against 2.45.
+--- a/binutils/debug.c
++++ b/binutils/debug.c
+@@ -2554,9 +2554,6 @@ debug_write_type (struct debug_handle *info,
+     case DEBUG_KIND_UNION_CLASS:
+       return debug_write_class_type (info, fns, fhandle, type, tag);
+     case DEBUG_KIND_ENUM:
+-      if (type->u.kenum == NULL)
+-	return (*fns->enum_type) (fhandle, tag, (const char **) NULL,
+-				  (bfd_signed_vma *) NULL);
+       return (*fns->enum_type) (fhandle, tag, type->u.kenum->names,
+ 				type->u.kenum->values);
+     case DEBUG_KIND_POINTER:
+@@ -3097,9 +3094,9 @@ debug_type_samep (struct debug_handle *info, struct debug_type_s *t1,
+       break;
+
+     case DEBUG_KIND_ENUM:
+-      if (t1->u.kenum == NULL)
+-	ret = t2->u.kenum == NULL;
+-      else if (t2->u.kenum == NULL)
++      if (t1->u.kenum->names == NULL)
++	ret = t2->u.kenum->names == NULL;
++      else if (t2->u.kenum->names == NULL)
+ 	ret = false;
+       else
+ 	{
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 2e3941d17f511..2dee9eb4f5724 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -122,6 +122,10 @@ stdenv.mkDerivation (finalAttrs: {
     # Backported against CVE patched in the 2.45 series. See:
     # https://nvd.nist.gov/vuln/detail/CVE-2025-5244
     ./CVE-2025-5244.diff
+
+    # Backported against CVE patched in the 2.45 series. See:
+    # https://nvd.nist.gov/vuln/detail/CVE-2025-5245
+    ./CVE-2025-5245.diff
   ];
 
   outputs = [

From 2ed2d2860dcb709ac844d284ac717a09200f4a67 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 7 Oct 2025 06:10:56 +0100
Subject: [PATCH 230/306] mpg123: 1.33.2 -> 1.33.3

Changes: https://www.mpg123.de/#2025-10-05
---
 pkgs/applications/audio/mpg123/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 8403a57e5fb57..20175c813f8ab 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.2";
+  version = "1.33.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-LFT6u/ppbc6PmxN8jvekKaBh+P5jPNfQpRGAmFXywhk=";
+    hash = "sha256-agxkct0VbiE8IGj0ARXru3OXjC2HPma64qJQ4tIZjSY=";
   };
 
   outputs = [

From 7fc750a3752bfb06f5544e2b1e8389a0ea10a3b7 Mon Sep 17 00:00:00 2001
From: Cobalt <cobalt@cobalt.rocks>
Date: Tue, 7 Oct 2025 09:10:35 +0200
Subject: [PATCH 231/306] harfbuzz: 11.5.0 -> 12.1.0

---
 pkgs/by-name/ha/harfbuzz/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ha/harfbuzz/package.nix b/pkgs/by-name/ha/harfbuzz/package.nix
index cf7198d791327..3742ae1313127 100644
--- a/pkgs/by-name/ha/harfbuzz/package.nix
+++ b/pkgs/by-name/ha/harfbuzz/package.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "11.5.0";
+  version = "12.1.0";
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${finalAttrs.version}/harfbuzz-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LTC6RcTI7E3mYaEAK0+I0IQf8aMIfzRiknX1Q21yIQk=";
+    hash = "sha256-5cgbf24LEC37AAz6QkU4uOiWq3ii9Lil7IyuYqtDNp4=";
   };
 
   postPatch = ''

From 875a8088a14f11cfab94ba961e36270d471ed172 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Oct 2025 07:16:31 +0000
Subject: [PATCH 232/306] nss: 3.112.1 -> 3.112.2

---
 pkgs/development/libraries/nss/esr.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index 88b97a28d5458..c7e53ae11ab65 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "3.112.1";
-  hash = "sha256-NpvE/WH+oY231uDKxXJptDojfU4rNsXySpOduWszzjQ=";
+  version = "3.112.2";
+  hash = "sha256-hK0TovR0LrVkB96BwCnhwaljDSElR85fnobzCa9+uKo=";
   filename = "esr.nix";
   versionRegex = "NSS_(3)_(112)(?:_(\\d+))?_RTM";
 }

From 4b368ec103b776448c42a6eb34e22242916f3e7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 7 Oct 2025 09:38:33 +0200
Subject: [PATCH 233/306] diffutils: unconditionalize a patch

---
 pkgs/tools/text/diffutils/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/tools/text/diffutils/default.nix b/pkgs/tools/text/diffutils/default.nix
index d82686d98c3e8..aa42eeaf0b9f0 100644
--- a/pkgs/tools/text/diffutils/default.nix
+++ b/pkgs/tools/text/diffutils/default.nix
@@ -31,8 +31,7 @@ stdenv.mkDerivation rec {
     # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html
     # Multiple upstream commits squashed with adjustments, see header
     ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.useLLVM [
+
     ./musl-llvm.patch
   ];
 

From 8d0a521e5100abaa4dcd0b77a05a15ea10ba67b3 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 7 Oct 2025 12:24:13 +0200
Subject: [PATCH 234/306] libxml2: fix attribute normalization regression

---
 pkgs/development/libraries/libxml2/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index bcd56ff6e54d7..3c1632ea82731 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -58,6 +58,15 @@ let
         tag = "v${packages.libxml2.version}";
         hash = "sha256-jumHSiIMDzqG2hvPUdcBP8LsszcU+loOY+vqEh/0Yqo=";
       };
+      extraPatches = [
+        # Fixes a regression in attribute normalization.
+        # Also see https://www.postgresql.org/message-id/flat/0756AC61-FBA3-46E2-B3C2-19B58B65EBDC%2540yesql.se
+        # To be removed with 2.15.1.
+        (fetchpatch2 {
+          url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/da45a190f718e8e2f0e3d2a6325ffa23abc8b90c.patch";
+          hash = "sha256-dE5DxkP+LBZ8N5V3x02Q1xOU9IXDvvr64xzcln0QH0E=";
+        })
+      ];
       extraMeta = {
         maintainers = with lib.maintainers; [
           jtojnar

From fdf2edc77549330268724e89497f0512df075fff Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 7 Oct 2025 13:02:04 +0200
Subject: [PATCH 235/306] coreutils: ignore format-security warnings on clang

As raised by https://lists.gnu.org/r/bug-gnulib/2025-06/msg00325.html
and https://lists.gnu.org/r/bug-gnulib/2025-06/msg00327.html on the
upstream mailing list, gnulib does not consider clang-specific warnings
to be bugs.
GCC itself works around present instances of this warning by treating
gettext as a built-in.
---
 pkgs/tools/misc/coreutils/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 4f6b61521dec0..4f94c41dcf42a 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -207,6 +207,9 @@ stdenv.mkDerivation rec {
     # Work around a bogus warning in conjunction with musl.
     ++ optional stdenv.hostPlatform.isMusl "-Wno-error"
     ++ optional stdenv.hostPlatform.isAndroid "-D__USE_FORTIFY_LEVEL=0"
+    # gnulib does not consider Clang-specific warnings to be bugs:
+    # https://lists.gnu.org/r/bug-gnulib/2025-06/msg00325.html
+    ++ optional stdenv.cc.isClang "-Wno-error=format-security"
   );
 
   # Works around a bug with 8.26:

From 5f9ce80281be5de3947a74889e08959a3adca4cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 2 Oct 2025 08:34:45 -0700
Subject: [PATCH 236/306] python3Packages.click: 8.1.8 -> 8.2.1

Diff: https://github.com/pallets/click/compare/8.1.8...8.2.1

Changelog: https://github.com/pallets/click/blob/8.2.1/CHANGES.rst
---
 .../python-modules/click/default.nix           | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index ec105f1ef7d5e..e028343fbb656 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   importlib-metadata,
   pytestCheckHook,
@@ -17,24 +16,24 @@
 
 buildPythonPackage rec {
   pname = "click";
-  version = "8.1.8";
+  version = "8.2.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "pallets";
     repo = "click";
     tag = version;
-    hash = "sha256-pAAqf8jZbDfVZUoltwIFpov/1ys6HSYMyw3WV2qcE/M=";
+    hash = "sha256-3FfLKwpfkiGfY2+H2fQoZwLBqfPlV46xw2Bc4YEsyps=";
   };
 
   build-system = [ flit-core ];
-  dependencies = lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
+    # for some reason the tests fail to execute cat, even though they run with less just fine,
+    # even adding coreutils to nativeCheckInputs explicitly does not change anything
+    "test_echo_via_pager"
     # test fails with filename normalization on zfs
     "test_file_surrogates"
   ];
@@ -49,14 +48,15 @@ buildPythonPackage rec {
       ;
   };
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/pallets/click/blob/${src.tag}/CHANGES.rst";
     homepage = "https://click.palletsprojects.com/";
     description = "Create beautiful command line interfaces in Python";
     longDescription = ''
       A Python package for creating beautiful command line interfaces in a
       composable way, with as little code as necessary.
     '';
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ nickcao ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nickcao ];
   };
 }

From cb4b56a03343852027f9c52a14589e892076aaf8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 3 Oct 2025 02:02:41 -0700
Subject: [PATCH 237/306] python3Packages.click-repl: mark broken

---
 pkgs/development/python-modules/click-repl/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/click-repl/default.nix b/pkgs/development/python-modules/click-repl/default.nix
index 201e0d8d4253d..00b8221e3bc98 100644
--- a/pkgs/development/python-modules/click-repl/default.nix
+++ b/pkgs/development/python-modules/click-repl/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    # https://github.com/click-contrib/click-repl/issues/128
+    broken = lib.versionAtLeast click.version "8.2.0";
     homepage = "https://github.com/click-contrib/click-repl";
     description = "Subcommand REPL for click apps";
     license = licenses.mit;

From f5445b5bb5e6102ba535f0f1f94a05e9a58acdf1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 3 Oct 2025 02:33:57 -0700
Subject: [PATCH 238/306] python3Packages.celery: don't include AMQP REPL by
 default

The REPL depends on click-repl, which doesn't support click >= 8.2.0.
---
 .../python-modules/celery/default.nix         | 11 ++++++-
 .../celery/remove-amqp-repl.patch             | 32 +++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/python-modules/celery/remove-amqp-repl.patch

diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index 99ff9c25fb95d..17c6e9c0f84dc 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -29,6 +29,9 @@
   pyyaml,
   setuptools,
   vine,
+  # The AMQP REPL depends on click-repl, which is incompatible with our version
+  # of click.
+  withAmqpRepl ? false,
 }:
 
 buildPythonPackage rec {
@@ -43,6 +46,10 @@ buildPythonPackage rec {
     hash = "sha256-+sickqRfSkBxhcO0W9na6Uov4kZ7S5oqpXXKX0iRQ0w=";
   };
 
+  patches = lib.optionals (!withAmqpRepl) [
+    ./remove-amqp-repl.patch
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -50,10 +57,12 @@ buildPythonPackage rec {
     click
     click-didyoumean
     click-plugins
-    click-repl
     kombu
     python-dateutil
     vine
+  ]
+  ++ lib.optionals withAmqpRepl [
+    click-repl
   ];
 
   optional-dependencies = {
diff --git a/pkgs/development/python-modules/celery/remove-amqp-repl.patch b/pkgs/development/python-modules/celery/remove-amqp-repl.patch
new file mode 100644
index 0000000000000..6a9dcd641bf4e
--- /dev/null
+++ b/pkgs/development/python-modules/celery/remove-amqp-repl.patch
@@ -0,0 +1,32 @@
+diff --git a/celery/bin/celery.py b/celery/bin/celery.py
+index e1fae1a77..cf05a927a 100644
+--- a/celery/bin/celery.py
++++ b/celery/bin/celery.py
+@@ -12,7 +12,6 @@ from click_plugins import with_plugins
+ 
+ from celery import VERSION_BANNER
+ from celery.app.utils import find_app
+-from celery.bin.amqp import amqp
+ from celery.bin.base import CeleryCommand, CeleryOption, CLIContext
+ from celery.bin.beat import beat
+ from celery.bin.call import call
+@@ -186,7 +185,6 @@ celery.add_command(control)
+ celery.add_command(graph)
+ celery.add_command(upgrade)
+ celery.add_command(logtool)
+-celery.add_command(amqp)
+ celery.add_command(shell)
+ celery.add_command(multi)
+ 
+diff --git a/requirements/default.txt b/requirements/default.txt
+index 185b6eddd..fbfc59fd7 100644
+--- a/requirements/default.txt
++++ b/requirements/default.txt
+@@ -3,7 +3,6 @@ kombu>=5.6.0rc1,<5.7
+ vine>=5.1.0,<6.0
+ click>=8.1.2,<9.0
+ click-didyoumean>=0.3.0
+-click-repl>=0.2.0
+ click-plugins>=1.1.1
+ backports.zoneinfo[tzdata]>=0.2.1; python_version < '3.9'
+ python-dateutil>=2.8.2

From c4bfb3f7d7f46a15daf50c44ce8bb01d82954656 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 3 Oct 2025 03:12:00 -0700
Subject: [PATCH 239/306] todoman: make click-repl an optional dependency

---
 pkgs/by-name/to/todoman/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/todoman/package.nix b/pkgs/by-name/to/todoman/package.nix
index 49c38c8b92104..6460fdd606a8c 100644
--- a/pkgs/by-name/to/todoman/package.nix
+++ b/pkgs/by-name/to/todoman/package.nix
@@ -32,18 +32,20 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   dependencies = with python3.pkgs; [
-    atomicwrites
     click
     click-log
-    click-repl
     humanize
     icalendar
     parsedatetime
+    python-dateutil
     pyxdg
-    tabulate
     urwid
   ];
 
+  optional-dependencies = with python3.pkgs; {
+    repl = [ click-repl ];
+  };
+
   nativeCheckInputs = with python3.pkgs; [
     freezegun
     hypothesis

From 86b774ab394d71f066f7245154ece57fffa38a2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 3 Oct 2025 03:51:17 -0700
Subject: [PATCH 240/306] python3Packages.pytest-celery: fix typo

---
 pkgs/development/python-modules/pytest-celery/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pytest-celery/default.nix b/pkgs/development/python-modules/pytest-celery/default.nix
index 568159010c9d6..0249bc8dbfe81 100644
--- a/pkgs/development/python-modules/pytest-celery/default.nix
+++ b/pkgs/development/python-modules/pytest-celery/default.nix
@@ -42,7 +42,7 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  buildInput = [ pytest ];
+  buildInputs = [ pytest ];
 
   dependencies = [
     (celery.overridePythonAttrs { doCheck = false; })

From e801416c3e0b0d2f6f2c23b46b7f00f87e263d83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 3 Oct 2025 04:00:08 -0700
Subject: [PATCH 241/306] python3Packages.pytest-celery: don't depend on celery
 and setuptools

---
 .../development/python-modules/pytest-celery/default.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-celery/default.nix b/pkgs/development/python-modules/pytest-celery/default.nix
index 0249bc8dbfe81..5243889073014 100644
--- a/pkgs/development/python-modules/pytest-celery/default.nix
+++ b/pkgs/development/python-modules/pytest-celery/default.nix
@@ -11,7 +11,6 @@
   pytest-docker-tools,
   pytest,
   pythonOlder,
-  setuptools,
   tenacity,
 }:
 
@@ -37,7 +36,11 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "debugpy"
-    "setuptools"
+  ];
+
+  pythonRemoveDeps = [
+    "celery" # cyclic dependency
+    "setuptools" # https://github.com/celery/pytest-celery/pull/464
   ];
 
   build-system = [ poetry-core ];
@@ -45,13 +48,11 @@ buildPythonPackage rec {
   buildInputs = [ pytest ];
 
   dependencies = [
-    (celery.overridePythonAttrs { doCheck = false; })
     debugpy
     docker
     kombu
     psutil
     pytest-docker-tools
-    setuptools
     tenacity
   ];
 

From 669813e0d27fd1e8dfccd9d60fa64a91b743d61c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 3 Oct 2025 04:03:52 -0700
Subject: [PATCH 242/306] python3Packages.celery: add
 optional-dependencies.auth

---
 pkgs/development/python-modules/celery/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index 17c6e9c0f84dc..afd13b3844d2e 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -9,6 +9,7 @@
   click-plugins,
   click-repl,
   click,
+  cryptography,
   fetchFromGitHub,
   gevent,
   google-cloud-firestore,
@@ -66,6 +67,7 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = {
+    auth = [ cryptography ];
     azureblockblob = [
       azure-identity
       azure-storage-blob

From 8bb2e841bd04d2bf6d09202c768402b1dd3adb49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 6 Oct 2025 07:48:49 -0700
Subject: [PATCH 243/306] python3Packages.greynoise: don't include REPL by
 default

The REPL depends on click-repl, which doesn't support click >= 8.2.0.
---
 .../python-modules/greynoise/default.nix      | 15 +++++++-
 .../greynoise/remove-repl.patch               | 37 +++++++++++++++++++
 2 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/python-modules/greynoise/remove-repl.patch

diff --git a/pkgs/development/python-modules/greynoise/default.nix b/pkgs/development/python-modules/greynoise/default.nix
index 0b9631179569b..2ffdbcc4c8de4 100644
--- a/pkgs/development/python-modules/greynoise/default.nix
+++ b/pkgs/development/python-modules/greynoise/default.nix
@@ -17,6 +17,9 @@
   pytestCheckHook,
   mock,
   pythonOlder,
+  # The REPL depends on click-repl, which is incompatible with our version of
+  # click.
+  withRepl ? false,
 }:
 
 buildPythonPackage rec {
@@ -33,22 +36,32 @@ buildPythonPackage rec {
     hash = "sha256-wJDO666HC3EohfR+LbG5F0Cp/eL7q4kXniWhJfc7C3s=";
   };
 
+  patches = lib.optionals (!withRepl) [
+    ./remove-repl.patch
+  ];
+
   build-system = [
     hatchling
   ];
 
+  pythonRelaxDeps = [
+    "click"
+  ];
+
   dependencies = [
     click
     ansimarkup
     cachetools
     colorama
     click-default-group
-    click-repl
     dict2xml
     jinja2
     more-itertools
     requests
     six
+  ]
+  ++ lib.optionals withRepl [
+    click-repl
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/greynoise/remove-repl.patch b/pkgs/development/python-modules/greynoise/remove-repl.patch
new file mode 100644
index 0000000000000..88f46af3bdc33
--- /dev/null
+++ b/pkgs/development/python-modules/greynoise/remove-repl.patch
@@ -0,0 +1,37 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index 9c5950e..f19a5db 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -33,7 +33,6 @@ dependencies = [
+     "cachetools",
+     "colorama",
+     "click-default-group",
+-    "click-repl",
+     "dict2xml",
+     "jinja2",
+     "more-itertools>=8.14.0",
+@@ -53,4 +52,4 @@ greynoise = "greynoise.cli:main"
+ packages = ["src/greynoise"]
+ 
+ [tool.hatch.build.targets.wheel.shared-data]
+-"src/greynoise/cli/templates/*.j2" = "greynoise/cli/templates" 
+\ No newline at end of file
++"src/greynoise/cli/templates/*.j2" = "greynoise/cli/templates"
+diff --git a/src/greynoise/cli/__init__.py b/src/greynoise/cli/__init__.py
+index a7c22ea..9d26d3e 100644
+--- a/src/greynoise/cli/__init__.py
++++ b/src/greynoise/cli/__init__.py
+@@ -2,7 +2,6 @@
+ 
+ import click
+ from click_default_group import DefaultGroup
+-from click_repl import register_repl
+ 
+ from greynoise.cli import subcommand
+ 
+@@ -24,5 +23,3 @@ SUBCOMMAND_FUNCTIONS = [
+ 
+ for subcommand_function in SUBCOMMAND_FUNCTIONS:
+     main.add_command(subcommand_function)
+-
+-register_repl(main)

From dbef4cf7a096e9db7540778a94a1040d242a4a20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 7 Oct 2025 05:46:11 -0700
Subject: [PATCH 244/306] python3Packages.flasgger: fix tests with Click 8.2

---
 pkgs/development/python-modules/flasgger/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/python-modules/flasgger/default.nix b/pkgs/development/python-modules/flasgger/default.nix
index 1cc0d1fb7648e..7cd1174589c99 100644
--- a/pkgs/development/python-modules/flasgger/default.nix
+++ b/pkgs/development/python-modules/flasgger/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -31,6 +32,15 @@ buildPythonPackage rec {
     hash = "sha256-ULEf9DJiz/S2wKlb/vjGto8VCI0QDcm0pkU5rlOwtiE=";
   };
 
+  patches = [
+    # https://github.com/flasgger/flasgger/pull/633
+    (fetchpatch {
+      name = "fix-tests-with-click-8.2.patch";
+      url = "https://github.com/flasgger/flasgger/commit/08591b60e988c0002fcf1b1e9f98b78e041d2732.patch";
+      hash = "sha256-DHaaY9W+cta3M2VA8S+ZQWacmgSpeyP03SKTiIlfBRM=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [

From 349bee348ece8acf571603f6cd3d0432cbd3bcbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 7 Oct 2025 06:00:16 -0700
Subject: [PATCH 245/306] python3Packages.typer: 0.17.4 -> 0.19.2

Diff: https://github.com/fastapi/typer/compare/0.17.4...0.19.2

Changelog: https://github.com/tiangolo/typer/releases/tag/0.19.2
---
 pkgs/development/python-modules/typer/default.nix | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/typer/default.nix b/pkgs/development/python-modules/typer/default.nix
index 7b8d2a1b2289b..c8ee4e01a9ef3 100644
--- a/pkgs/development/python-modules/typer/default.nix
+++ b/pkgs/development/python-modules/typer/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = package;
-  version = "0.17.4";
+  version = "0.19.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastapi";
     repo = "typer";
     tag = version;
-    hash = "sha256-gd4GgoRnQVVmwmW5DprmNRxgjFiRRa8HB6xO9U9wHI8=";
+    hash = "sha256-mMsOEI4FpLkLkpjxjnUdmKdWD65Zx3Z1+L+XsS79k44=";
   };
 
   env.TIANGOLO_BUILD_PACKAGE = package;
@@ -80,12 +80,6 @@ buildPythonPackage rec {
     "test_install_completion"
   ];
 
-  disabledTestPaths = [
-    # likely click 8.2 compat issue
-    "tests/test_tutorial/test_parameter_types/test_bool/test_tutorial002_an.py"
-    "tests/test_tutorial/test_parameter_types/test_bool/test_tutorial002.py"
-  ];
-
   pythonImportsCheck = [ "typer" ];
 
   meta = {

From dedd3c3f5344c6659eb85dc79a0588765950cd9b Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 7 Oct 2025 15:08:14 +0200
Subject: [PATCH 246/306] libxml2: use fetchpatch instead of fetchpatch2

---
 pkgs/development/libraries/libxml2/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 3c1632ea82731..8c4c1c6530922 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -2,7 +2,7 @@
   lib,
   callPackage,
   fetchFromGitLab,
-  fetchpatch2,
+  fetchpatch,
 }:
 
 let
@@ -20,15 +20,15 @@ let
         # same as upstream patch but fixed conflict and added required import:
         # https://gitlab.gnome.org/GNOME/libxml2/-/commit/acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0.diff
         ./CVE-2025-6021.patch
-        (fetchpatch2 {
+        (fetchpatch {
           name = "CVE-2025-49794-49796.patch";
           url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/f7ebc65f05bffded58d1e1b2138eb124c2e44f21.patch";
-          hash = "sha256-k+IGq6pbv9EA7o+uDocEAUqIammEjLj27Z+2RF5EMrs=";
+          hash = "sha256-p5Vc/lkakHKsxuFNnCQtFczjqFJBeLnCwIwv2GnrQco=";
         })
-        (fetchpatch2 {
+        (fetchpatch {
           name = "CVE-2025-49795.patch";
           url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c24909ba2601848825b49a60f988222da3019667.patch";
-          hash = "sha256-r7PYKr5cDDNNMtM3ogNLsucPFTwP/uoC7McijyLl4kU=";
+          hash = "sha256-vICVSb+X89TTE4QY92/v/6fRk77Hy9vzEWWsADHqMlk=";
           excludes = [ "runtest.c" ]; # tests were rewritten in C and are on schematron for 2.13.x, meaning this does not apply
         })
         # same as upstream, fixed conflicts
@@ -62,9 +62,9 @@ let
         # Fixes a regression in attribute normalization.
         # Also see https://www.postgresql.org/message-id/flat/0756AC61-FBA3-46E2-B3C2-19B58B65EBDC%2540yesql.se
         # To be removed with 2.15.1.
-        (fetchpatch2 {
+        (fetchpatch {
           url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/da45a190f718e8e2f0e3d2a6325ffa23abc8b90c.patch";
-          hash = "sha256-dE5DxkP+LBZ8N5V3x02Q1xOU9IXDvvr64xzcln0QH0E=";
+          hash = "sha256-wqmFszr7w1Lte12YR6Ug7Ng7fXABzizwUsJU1EhylgU=";
         })
       ];
       extraMeta = {

From 8e4e42d0a0a36db5a5ae11e0afdc5e88130524e2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Oct 2025 14:11:27 +0000
Subject: [PATCH 247/306] vim: 9.1.1765 -> 9.1.1833

---
 pkgs/applications/editors/vim/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 11875eaac7e11..de4362946baae 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1765";
+  version = "9.1.1833";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-bL6mqnke0uE0Bk7oYjJPiPtl/9Qk8fvCXrQVqAb7pPM=";
+    hash = "sha256-bcHTwrJt7ERsIYydCj+Um4AY7sREtkdkqlEA0OdgnuM=";
   };
 
   enableParallelBuilding = true;

From eb590fd24136f81d40385813e021c4740438d654 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Tue, 7 Oct 2025 11:38:26 -0400
Subject: [PATCH 248/306] python313: 3.13.7 -> 3.13.8

https://docs.python.org/release/3.13.8/whatsnew/changelog.html#python-3-13-8
---
 pkgs/development/interpreters/python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index ae70e475b7391..926c90db82614 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -20,10 +20,10 @@
         sourceVersion = {
           major = "3";
           minor = "13";
-          patch = "7";
+          patch = "8";
           suffix = "";
         };
-        hash = "sha256-VGL5CZ39MOI43vg8cdkYl9jKpf9uvHpQ8U1IAs2qp5o=";
+        hash = "sha256-uZEHMFJrKYKZtGs1WVztkFVyLfYMBq1jAfak4scoolI=";
       };
     };
 

From 1f6865500b9876d387029efbfdf422ee3174f495 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:16:03 +0300
Subject: [PATCH 249/306] vulkan-headers: 1.4.321.0 -> 1.4.328.0

Diff: https://github.com/KhronosGroup/Vulkan-Headers/compare/vulkan-sdk-1.4.321.0...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/vu/vulkan-headers/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-headers/package.nix b/pkgs/by-name/vu/vulkan-headers/package.nix
index c1b118fc6cef4..cd719a2021ced 100644
--- a/pkgs/by-name/vu/vulkan-headers/package.nix
+++ b/pkgs/by-name/vu/vulkan-headers/package.nix
@@ -7,7 +7,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   # Adding `ninja` here to enable Ninja backend. Otherwise on gcc-14 or
   # later the build fails as:
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-Yznjiiu/EEW7B37hbO0aw8Lvc6aVxOy7J/zSwmGxVc0=";
+    hash = "sha256-Sg/zp6UhRC5wqBS3vdfs0sQL8cBgLiwvfG0oY0v9MWU=";
   };
 
   passthru.updateScript = ./update.sh;

From b526de4b89f3d252c39a983c2508130490c729cc Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:16:07 +0300
Subject: [PATCH 250/306] vulkan-loader: 1.4.321.0 -> 1.4.328.0

Diff: https://github.com/KhronosGroup/Vulkan-Loader/compare/vulkan-sdk-1.4.321.0...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/vu/vulkan-loader/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-loader/package.nix b/pkgs/by-name/vu/vulkan-loader/package.nix
index 323dbd95dcbe2..97cfc1168acf4 100644
--- a/pkgs/by-name/vu/vulkan-loader/package.nix
+++ b/pkgs/by-name/vu/vulkan-loader/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-loader";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-i06il1GRkjSlhY36XpIUCcd1Wy+If+Eennzbb//1dzk=";
+    hash = "sha256-+cuKdhdCMIL4b+GzIpCNrDBmC7cVX0iX2QW7BQIj9Tc=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];

From 522da385565e73731e67b1f35dfc1dab05b9ca29 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:16:22 +0300
Subject: [PATCH 251/306] vulkan-validation-layers: 1.4.321.0 -> 1.4.328.0

Diff: https://github.com/KhronosGroup/Vulkan-ValidationLayers/compare/vulkan-sdk-1.4.321.0...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/vu/vulkan-validation-layers/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-validation-layers/package.nix b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
index 5ec68fa4c0b1a..9a363aacc58d8 100644
--- a/pkgs/by-name/vu/vulkan-validation-layers/package.nix
+++ b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-aTO8AIwN6/oOcxu6AgYBoOQiUHQkT6MJGAYNgP5js9I=";
+    hash = "sha256-iz6kWvnfVnznn78XNHJqSvIW4TYkp2KgEFT302VAiaY=";
   };
 
   strictDeps = true;

From 8d94d383c7006e49c9274f09a9e5fb3527360209 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:16:28 +0300
Subject: [PATCH 252/306] vulkan-tools: 1.4.321.0 -> 1.4.328.0

Diff: https://github.com/KhronosGroup/Vulkan-Tools/compare/vulkan-sdk-1.4.321.0...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/vu/vulkan-tools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-tools/package.nix b/pkgs/by-name/vu/vulkan-tools/package.nix
index dfd2fc5236976..ee60fd4441740 100644
--- a/pkgs/by-name/vu/vulkan-tools/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-cd7aLDhXiZ4Wlnrx2dfCQG3j+9vosM3SeohhCNvVN48=";
+    hash = "sha256-QoqlHrhgaV1SRLAxmYUXaKxH1IdbnxqkcJklDy20ORg=";
   };
 
   patches = [ ./wayland-scanner.patch ];

From 5a4d09406ba385bcf81decb42bffc0f63e382423 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:16:47 +0300
Subject: [PATCH 253/306] vulkan-tools-lunarg: 1.4.321.0 -> 1.4.328.0

Diff: https://github.com/LunarG/VulkanTools/compare/vulkan-sdk-1.4.321.0...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/vu/vulkan-tools-lunarg/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
index 47bd85ab67b86..b4ec722ca336d 100644
--- a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "LunarG";
     repo = "VulkanTools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-Wd37AYfZ8Ia5kXS9Nvxyj7s+W2DPHUONtqD+tX45XGk=";
+    hash = "sha256-kywAcpBYLSlhEbgssXGwMoXQC03QUEz4dwsvI0I8Nh4=";
   };
 
   nativeBuildInputs = [

From cd6f521e0031bc17c017c666a0db27d1dc530686 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:16:56 +0300
Subject: [PATCH 254/306] vulkan-extension-layer: 1.4.321.0 -> 1.4.328.0

Diff: https://github.com/KhronosGroup/Vulkan-ExtensionLayer/compare/vulkan-sdk-1.4.321.0...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/vu/vulkan-extension-layer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-extension-layer/package.nix b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
index b64bfb519150f..057589a9a18cf 100644
--- a/pkgs/by-name/vu/vulkan-extension-layer/package.nix
+++ b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-tWUi+yCI7wNLVeGg/h5a+yvKWAu8KZqtgEujfCUtYQ4=";
+    hash = "sha256-J9l20abn7meSF0WnCh3cepYKQh10ezb0mAKzc0HAo1w=";
   };
 
   nativeBuildInputs = [

From 7d5c22627991ac40c61ec8ec33f3001420e49e54 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:17:03 +0300
Subject: [PATCH 255/306] vulkan-utility-libraries: 1.4.321.0 -> 1.4.328.0

Diff: https://github.com/KhronosGroup/Vulkan-Utility-Libraries/compare/vulkan-sdk-1.4.321.0...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/vu/vulkan-utility-libraries/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
index 71601060ee97c..03066b567ef5a 100644
--- a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
+++ b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-MaEn0qVTnhp5kKCbyMhFXysIcAnZF+ba4+KaVD4wSPY=";
+    hash = "sha256-qcCATZWM0YJ02Dl5VxjvbFYoE2b0r7Ku+ELr2is2VIg=";
   };
 
   nativeBuildInputs = [

From dd0412bdf34094dae5b06a0398401e7a844fc3e8 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:17:09 +0300
Subject: [PATCH 256/306] vulkan-volk: 1.4.321.0 -> 1.4.328.0

Diff: https://github.com/zeux/volk/compare/vulkan-sdk-1.4.321.0...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/vu/vulkan-volk/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-volk/package.nix b/pkgs/by-name/vu/vulkan-volk/package.nix
index 22be9032106eb..5168ba77f4529 100644
--- a/pkgs/by-name/vu/vulkan-volk/package.nix
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "volk";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-Revi0OVvLI23yh1R6mNfcUCo1DXlACLjIw+k6EZQb/U=";
+    hash = "sha256-7JhTLhCqdn/zDIYdIb2xJnjJVk57i+6M5OXk0KvfpDk=";
   };
 
   nativeBuildInputs = [ cmake ];

From 742f250090206c3a553011e869509606cc3aee19 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:17:13 +0300
Subject: [PATCH 257/306] spirv-headers: 1.4.321.0-unstable-2025-06-24 ->
 1.4.328.0

Diff: https://github.com/KhronosGroup/SPIRV-Headers/compare/9e3836d7d6023843a72ecd3fbf3f09b1b6747a9e...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/sp/spirv-headers/package.nix | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/sp/spirv-headers/package.nix b/pkgs/by-name/sp/spirv-headers/package.nix
index 8a4f92e9dfb29..400c8244a344b 100644
--- a/pkgs/by-name/sp/spirv-headers/package.nix
+++ b/pkgs/by-name/sp/spirv-headers/package.nix
@@ -5,18 +5,15 @@
   cmake,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-headers";
-  version = "1.4.321.0-unstable-2025-06-24";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
-    # The release for Vulkan SDK 1.4.321.0 is missing a PR required for
-    # LLVM 21 support in SPIRV-LLVM-Translator; return to the
-    # `vulkan-sdk-*` tags on the next stable release.
-    rev = "9e3836d7d6023843a72ecd3fbf3f09b1b6747a9e";
-    hash = "sha256-N8NBAkkpOcbgap4loPJJW6E5bjG+TixCh/HN259RyjI=";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-gewCQvcVRw+qdWPWRlYUMTt/aXrZ7Lea058WyqL5c08=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -27,4 +24,4 @@ stdenv.mkDerivation {
     license = licenses.mit;
     maintainers = [ maintainers.ralith ];
   };
-}
+})

From b71e1949d5b016ab222a072b7bf002ab3465079a Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:17:28 +0300
Subject: [PATCH 258/306] spirv-cross: 1.4.321.0 -> 1.4.328.0

Diff: https://github.com/KhronosGroup/SPIRV-Cross/compare/vulkan-sdk-1.4.321.0...vulkan-sdk-1.4.328.0

Changelog: https://github.com/KhronosGroup/SPIRV-Cross/releases/tag/1.4.328.0
---
 pkgs/by-name/sp/spirv-cross/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sp/spirv-cross/package.nix b/pkgs/by-name/sp/spirv-cross/package.nix
index 20b464dd5ea0e..738ebfc4dcadc 100644
--- a/pkgs/by-name/sp/spirv-cross/package.nix
+++ b/pkgs/by-name/sp/spirv-cross/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-qmJK29PtjDE4+6uF8Mj6noAcRoeM3rHWRbUvcr6JzI0=";
+    hash = "sha256-Fq2Kw8KOlh35hRZy5EnPtWAjazun4vdTk/HyhY76GRM=";
   };
 
   nativeBuildInputs = [

From ebe9c88c7bc9ea47dd9bb998fb1fd16c28e1d3e7 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:17:37 +0300
Subject: [PATCH 259/306] spirv-tools: 1.4.321.0-unstable-2025-06-25 ->
 1.4.328.0

Diff: https://github.com/KhronosGroup/SPIRV-Tools/compare/28a883ba4c67f58a9540fb0651c647bb02883622...vulkan-sdk-1.4.328.0
---
 pkgs/by-name/sp/spirv-tools/package.nix | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/sp/spirv-tools/package.nix b/pkgs/by-name/sp/spirv-tools/package.nix
index afd55c4dc7421..03b10d0abcd98 100644
--- a/pkgs/by-name/sp/spirv-tools/package.nix
+++ b/pkgs/by-name/sp/spirv-tools/package.nix
@@ -7,18 +7,15 @@
   spirv-headers,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-tools";
-  version = "1.4.321.0-unstable-2025-06-25";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    # The SPIRV-Headers release for Vulkan SDK 1.4.321.0 is missing
-    # a PR required for LLVM 21 support in SPIRV-LLVM-Translator;
-    # return to the `vulkan-sdk-*` tags on the next stable release.
-    rev = "28a883ba4c67f58a9540fb0651c647bb02883622";
-    hash = "sha256-yRzpEBGyTr9oovsh3TUnJsR/luHNAPkotcJFWh7R1Fc=";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-NXxC5XLvEEIAlA0sym6l7vWj+g8pJ4trsJI3pmZwRxU=";
   };
 
   # The cmake options are sufficient for turning on static building, but not
@@ -60,4 +57,4 @@ stdenv.mkDerivation {
     platforms = with platforms; unix ++ windows;
     maintainers = [ maintainers.ralith ];
   };
-}
+})

From d5a9b6b70c53ee2e7ecb236d3273745021964fdf Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 20:25:57 +0300
Subject: [PATCH 260/306] vulkan-tools: bring back the cube

Praise the cube.
---
 pkgs/by-name/vu/vulkan-tools/package.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-tools/package.nix b/pkgs/by-name/vu/vulkan-tools/package.nix
index ee60fd4441740..122e75d0e40bb 100644
--- a/pkgs/by-name/vu/vulkan-tools/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools/package.nix
@@ -70,9 +70,6 @@ stdenv.mkDerivation rec {
   env.PKG_CONFIG_WAYLAND_SCANNER_WAYLAND_SCANNER = lib.getExe buildPackages.wayland-scanner;
 
   cmakeFlags = [
-    # Temporarily disabled, see https://github.com/KhronosGroup/Vulkan-Tools/issues/1130
-    # FIXME: remove when fixed upstream
-    "-DBUILD_CUBE=OFF"
     # Don't build the mock ICD as it may get used instead of other drivers, if installed
     "-DBUILD_ICD=OFF"
     # vulkaninfo loads libvulkan using dlopen, so we have to add it manually to RPATH

From 33c5fd0a77fd32b7801ac33d609390ee1526e0d9 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 14:21:23 +0300
Subject: [PATCH 261/306] qt6.qtbase: be more verbose when configuring

---
 pkgs/development/libraries/qt-6/modules/qtbase/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index df8286ee8f461..5b5e987d9ef7a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -251,6 +251,9 @@ stdenv.mkDerivation rec {
   qtQmlPrefix = "lib/qt-6/qml";
 
   cmakeFlags = [
+    # makes Qt print the configure summary
+    "--log-level=STATUS"
+
     "-DQT_EMBED_TOOLCHAIN_COMPILER=OFF"
     "-DINSTALL_PLUGINSDIR=${qtPluginPrefix}"
     "-DINSTALL_QMLDIR=${qtQmlPrefix}"

From 745d05cff5a8e51c7fdeae39de24478aab093e3d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 14:22:09 +0300
Subject: [PATCH 262/306] qt6.qtModule: be more verbose everywhere else too

---
 pkgs/development/libraries/qt-6/qtModule.nix | 23 +++++++++++---------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/libraries/qt-6/qtModule.nix b/pkgs/development/libraries/qt-6/qtModule.nix
index ac37bfd4f96e7..07aa27e13abf0 100644
--- a/pkgs/development/libraries/qt-6/qtModule.nix
+++ b/pkgs/development/libraries/qt-6/qtModule.nix
@@ -37,18 +37,21 @@ stdenv.mkDerivation (
       (lib.warnIf (args ? qtInputs) "qt6.qtModule's qtInputs argument is deprecated" args.qtInputs or [ ])
       ++ (args.propagatedBuildInputs or [ ]);
 
-    cmakeFlags =
+    cmakeFlags = [
+      # be more verbose
+      "--log-level=STATUS"
       # don't leak OS version into the final output
       # https://bugreports.qt.io/browse/QTBUG-136060
-      [ "-DCMAKE_SYSTEM_VERSION=" ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        "-DQT_NO_XCODE_MIN_VERSION_CHECK=ON"
-        # This is only used for the min version check, which we disabled above.
-        # When this variable is not set, cmake tries to execute xcodebuild
-        # to query the version.
-        "-DQT_INTERNAL_XCODE_VERSION=0.1"
-      ]
-      ++ args.cmakeFlags or [ ];
+      "-DCMAKE_SYSTEM_VERSION="
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-DQT_NO_XCODE_MIN_VERSION_CHECK=ON"
+      # This is only used for the min version check, which we disabled above.
+      # When this variable is not set, cmake tries to execute xcodebuild
+      # to query the version.
+      "-DQT_INTERNAL_XCODE_VERSION=0.1"
+    ]
+    ++ args.cmakeFlags or [ ];
 
     moveToDev = false;
 

From 60e9798ba5e36c7c7e6baafc8dad7b146bc06639 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 14:20:56 +0300
Subject: [PATCH 263/306] qt6.qtbase: add libgbm dependency

Used for EGLFS GBM backend.
---
 pkgs/development/libraries/qt-6/modules/qtbase/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index 5b5e987d9ef7a..41884d523fc31 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -29,6 +29,7 @@
   vulkan-loader,
   libthai,
   libdrm,
+  libgbm,
   libdatrie,
   lttng-ust,
   libepoxy,
@@ -133,6 +134,7 @@ stdenv.mkDerivation rec {
     lttng-ust
     libthai
     libdrm
+    libgbm
     libdatrie
     udev
     # Text rendering

From 2c70074deffafb7a7ad4f1c3318679d5d6bd0389 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 16:19:17 +0300
Subject: [PATCH 264/306] qt6.qtconnectivity: enable pcsclite, fix silly typo

---
 pkgs/development/libraries/qt-6/modules/qtconnectivity.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix b/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix
index 627454f85a517..7fc3c4ca3c5d8 100644
--- a/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix
@@ -5,15 +5,20 @@
   qtbase,
   qtdeclarative,
   bluez,
+  pcsclite,
   pkg-config,
 }:
 
 qtModule {
   pname = "qtconnectivity";
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ bluez ];
+  buildInputs = [ pcsclite ] ++ lib.optionals stdenv.hostPlatform.isLinux [ bluez ];
   propagatedBuildInputs = [
     qtbase
     qtdeclarative
   ];
+
+  postPatch = ''
+    substituteInPlace src/nfc/configure.cmake --replace-fail "qt_configure_add_summary_entry(ARGS pcslite)" "qt_configure_add_summary_entry(ARGS pcsclite)"
+  '';
 }

From 5c43e78b605be1338e8de2c30770d5ce268064fd Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 16:44:40 +0300
Subject: [PATCH 265/306] qt6.qtwebengine: enable VA-API support

Requires vendored libvpx, but the end user experience is much better for it.
---
 .../libraries/qt-6/modules/qtwebengine/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
index c2bcba370bb3e..7278281774d5a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
@@ -37,7 +37,6 @@
   libopus,
   jsoncpp,
   protobuf,
-  libvpx,
   srtp,
   snappy,
   nss,
@@ -59,6 +58,7 @@
   lcms2,
   libkrb5,
   libgbm,
+  libva,
   enableProprietaryCodecs ? true,
   # darwin
   bootstrap_cmds,
@@ -208,7 +208,6 @@ qtModule {
 
     # Video formats
     srtp
-    libvpx
 
     # Audio formats
     libopus
@@ -267,6 +266,7 @@ qtModule {
 
     libkrb5
     libgbm
+    libva
   ];
 
   buildInputs = [

From 13fda0b4b2bf5f672b96d5409a588a4f918127bf Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 14:33:53 +0300
Subject: [PATCH 266/306] qt6: 6.9.3 -> 6.10.0

---
 pkgs/development/libraries/qt-6/fetch.sh      |   2 +-
 .../libraries/qt-6/modules/qtbase/default.nix |  18 +-
 .../qt-6/modules/qtdeclarative/default.nix    |  25 +-
 .../dont-cache-nix-store-paths.patch          |  17 +
 ...e-caches-from-mismatched-store-paths.patch | 112 -----
 .../qtdeclarative/stackview-crash.patch       | 473 ------------------
 .../use-versioned-import-path.patch           |  12 +-
 .../libraries/qt-6/modules/qtmqtt.nix         |   4 +-
 .../qt-6/modules/qttools/default.nix          |   7 +-
 .../qt-6/modules/qttools/paths.patch          |   4 +-
 .../libraries/qt-6/modules/qtwayland.nix      |  13 +-
 .../qt-6/modules/qtwebengine/default.nix      |   9 -
 pkgs/development/libraries/qt-6/srcs.nix      | 312 ++++++------
 13 files changed, 213 insertions(+), 795 deletions(-)
 create mode 100644 pkgs/development/libraries/qt-6/modules/qtdeclarative/dont-cache-nix-store-paths.patch
 delete mode 100644 pkgs/development/libraries/qt-6/modules/qtdeclarative/invalidate-caches-from-mismatched-store-paths.patch
 delete mode 100644 pkgs/development/libraries/qt-6/modules/qtdeclarative/stackview-crash.patch

diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index b5a099e317550..9c161baa005d6 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.9/6.9.3/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.10/6.10.0/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index 41884d523fc31..ab35d1906f733 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -79,6 +79,9 @@
   gtk3,
   withLibinput ? false,
   libinput,
+  withWayland ? lib.meta.availableOn stdenv.hostPlatform wayland,
+  wayland,
+  wayland-scanner,
   # options
   qttranslations ? null,
 }:
@@ -158,7 +161,11 @@ stdenv.mkDerivation rec {
     xorg.xcbutilcursor
     libepoxy
   ]
-  ++ lib.optional (cups != null && lib.meta.availableOn stdenv.hostPlatform cups) cups;
+  ++ lib.optional (cups != null && lib.meta.availableOn stdenv.hostPlatform cups) cups
+  ++ lib.optionals withWayland [
+    wayland
+    wayland-scanner
+  ];
 
   buildInputs =
     lib.optionals (lib.meta.availableOn stdenv.hostPlatform at-spi2-core) [
@@ -188,7 +195,14 @@ stdenv.mkDerivation rec {
   ]
   # I’m not sure if this is necessary, but the macOS mkspecs stuff
   # tries to call `xcrun xcodebuild`, so better safe than sorry.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ]
+  # wayland-scanner needs to be propagated as both build
+  # (for the wayland-scanner binary) and host (for the
+  # actual wayland.xml protocol definition)
+  ++ lib.optionals withWayland [
+    wayland
+    wayland-scanner
+  ];
 
   strictDeps = true;
 
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 22ce9f733cf6a..5578dc8a82364 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -1,4 +1,5 @@
 {
+  fetchpatch,
   qtModule,
   qtbase,
   qtlanguageserver,
@@ -29,32 +30,20 @@ qtModule {
   ];
 
   patches = [
-    # invalidates qml caches created from nix applications at different
-    # store paths and disallows saving caches of bare qml files in the store.
-    (replaceVars ./invalidate-caches-from-mismatched-store-paths.patch {
+    # don't cache bytecode of bare qml files in the store, as that never gets cleaned up
+    (replaceVars ./dont-cache-nix-store-paths.patch {
       nixStore = builtins.storeDir;
-      nixStoreLength = toString ((builtins.stringLength builtins.storeDir) + 1); # trailing /
     })
     # add version specific QML import path
     ./use-versioned-import-path.patch
-
     # Fix common crash
-    # Manual backport of https://invent.kde.org/qt/qt/qtdeclarative/-/commit/b1ee7061ba77a7f5dc4148129bb2083f5c28e039
     # https://bugreports.qt.io/browse/QTBUG-140018
-    ./stackview-crash.patch
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtdeclarative/-/commit/2b7f93da38d41ffaeb5322a7dca40ec26fc091a1.diff";
+      hash = "sha256-AOXey18lJlswpZ8tpTTZeFb0VE9k1louXy8TPPGNiA4=";
+    })
   ];
 
-  preConfigure =
-    let
-      storePrefixLen = toString ((builtins.stringLength builtins.storeDir) + 1);
-    in
-    ''
-      # "NIX:" is reserved for saved qmlc files in patch 0001, "QTDHASH:" takes the place
-      # of the old tag, which is otherwise the qt version, invalidating caches from other
-      # qtdeclarative store paths.
-      echo "QTDHASH:''${out:${storePrefixLen}:32}" > .tag
-    '';
-
   cmakeFlags = [
     "-DQt6ShaderToolsTools_DIR=${pkgsBuildBuild.qt6.qtshadertools}/lib/cmake/Qt6ShaderTools"
     # for some reason doesn't get found automatically on Darwin
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/dont-cache-nix-store-paths.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/dont-cache-nix-store-paths.patch
new file mode 100644
index 0000000000000..ef5d108db10cd
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/dont-cache-nix-store-paths.patch
@@ -0,0 +1,17 @@
+--- a/src/qml/common/qv4compileddata.cpp
++++ b/src/qml/common/qv4compileddata.cpp
+@@ -178,6 +178,14 @@ bool CompilationUnit::saveToDisk(const QUrl &unitUrl, QString *errorString)
+         return false;
+     }
+ 
++    if (unitUrl.path().startsWith(QStringLiteral("@nixStore@"))) {
++        // We don't store bytecode for bare QML files in the nix store as the
++        // paths will change every time the application updates, filling caches
++        // endlessly with junk.
++        *errorString = QStringLiteral("Refusing to save bytecode for bare @nixStore@ path.");
++        return false;
++    }
++
+     return SaveableUnitPointer(unitData()).saveToDisk<char>(
+             [&unitUrl, errorString](const char *data, quint32 size) {
+                 const QString cachePath = localCacheFilePath(unitUrl);
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/invalidate-caches-from-mismatched-store-paths.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/invalidate-caches-from-mismatched-store-paths.patch
deleted file mode 100644
index 364c3ed838e68..0000000000000
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/invalidate-caches-from-mismatched-store-paths.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-diff --git a/src/qml/common/qv4compileddata.cpp b/src/qml/common/qv4compileddata.cpp
-index 9dee91f713..9dec5cae67 100644
---- a/src/qml/common/qv4compileddata.cpp
-+++ b/src/qml/common/qv4compileddata.cpp
-@@ -15,6 +15,8 @@
- #include <QtCore/qscopeguard.h>
- #include <QtCore/qstandardpaths.h>
- 
-+#include <QtCore/qcoreapplication.h>
-+
- static_assert(QV4::CompiledData::QmlCompileHashSpace > QML_COMPILE_HASH_LENGTH);
- 
- #if defined(QML_COMPILE_HASH) && defined(QML_COMPILE_HASH_LENGTH) && QML_COMPILE_HASH_LENGTH > 0
-@@ -26,6 +28,35 @@ __attribute__((section(".qml_compile_hash")))
- const char qml_compile_hash[QV4::CompiledData::QmlCompileHashSpace] = QML_COMPILE_HASH;
- static_assert(sizeof(QV4::CompiledData::Unit::libraryVersionHash) > QML_COMPILE_HASH_LENGTH,
-               "Compile hash length exceeds reserved size in data structure. Please adjust and bump the format version");
-+
-+bool nix__isNixApplication() {
-+    static const bool value = QCoreApplication::applicationFilePath().startsWith(QStringLiteral("@nixStore@"));
-+    return value;
-+}
-+
-+static_assert(sizeof(QV4::CompiledData::Unit::libraryVersionHash) >
-+                  /*sha1*/ 20 + /*NIX:*/ 4,
-+              "Nix compile hash length exceeds the reserved space in data "
-+              "structure. Please review the patch.");
-+
-+const QByteArray &nix__applicationHash() {
-+    static const QByteArray value = [](){
-+        QCryptographicHash applicationHash(QCryptographicHash::Sha1);
-+        applicationHash.addData(QByteArrayView(qml_compile_hash, QML_COMPILE_HASH_LENGTH));
-+
-+        // We only care about the package, not the specific file path.
-+        auto view = QCoreApplication::applicationFilePath().sliced(@nixStoreLength@);
-+        auto pkgEndIdx = view.indexOf(QStringLiteral("/"));
-+        if (pkgEndIdx != -1) view = view.sliced(0, pkgEndIdx);
-+
-+        applicationHash.addData(view.toUtf8());
-+
-+        return QByteArray("NIX:") + applicationHash.result();
-+    }();
-+
-+    return value;
-+}
-+
- #else
- #  error "QML_COMPILE_HASH must be defined for the build of QtDeclarative to ensure version checking for cache files"
- #endif
-@@ -69,13 +100,29 @@ bool Unit::verifyHeader(QDateTime expectedSourceTimeStamp, QString *errorString)
-     }
- 
- #if defined(QML_COMPILE_HASH) && defined(QML_COMPILE_HASH_LENGTH) && QML_COMPILE_HASH_LENGTH > 0
--    if (qstrncmp(qml_compile_hash, libraryVersionHash, QML_COMPILE_HASH_LENGTH) != 0) {
-+    const bool nixUnit = qstrncmp("NIX:", this->libraryVersionHash, 4) == 0;
-+
-+    if (nixUnit && !nix__isNixApplication()) {
-+        *errorString = QStringLiteral("QML compile hash is for a nix store application.");
-+        return false;
-+    }
-+
-+    const char *targetHash = qml_compile_hash;
-+    size_t targetHashLength = QML_COMPILE_HASH_LENGTH;
-+
-+    if (nixUnit) {
-+        const auto &applicationHash = nix__applicationHash();
-+        targetHash = applicationHash.constData();
-+        targetHashLength = applicationHash.length();
-+    }
-+
-+    if (qstrncmp(targetHash, this->libraryVersionHash, targetHashLength) != 0) {
-         *errorString = QStringLiteral("QML compile hashes don't match. Found %1 expected %2")
-                                .arg(QString::fromLatin1(
--                                            QByteArray(libraryVersionHash, QML_COMPILE_HASH_LENGTH)
-+                                            QByteArray(this->libraryVersionHash, targetHashLength)
-                                                     .toPercentEncoding()),
-                                     QString::fromLatin1(
--                                            QByteArray(qml_compile_hash, QML_COMPILE_HASH_LENGTH)
-+                                            QByteArray(targetHash, targetHashLength)
-                                                     .toPercentEncoding()));
-         return false;
-     }
-@@ -213,6 +260,29 @@ bool CompilationUnit::saveToDisk(const QUrl &unitUrl, QString *errorString)
-         return false;
-     }
- 
-+#if defined(QML_COMPILE_HASH) && defined(QML_COMPILE_HASH_LENGTH) && QML_COMPILE_HASH_LENGTH > 0
-+    if (nix__isNixApplication() && unitUrl.scheme() == QStringLiteral("qrc")) {
-+        // If the application is running from the nix store, we can safely save
-+        // bytecode for its embedded QML files as long as we hash the
-+        // application path into the version. This will invalidate the caches
-+        // when the store path changes.
-+        const auto &applicationHash = nix__applicationHash();
-+
-+        memcpy(const_cast<char *>(unitData()->libraryVersionHash),
-+               applicationHash.constData(), applicationHash.length());
-+    } else if (unitUrl.path().startsWith(QStringLiteral("@nixStore@"))) {
-+        // We don't store bytecode for bare QML files in the nix store as the
-+        // paths will change every time the application updates, filling caches
-+        // endlessly with junk.
-+        *errorString = QStringLiteral("Refusing to save bytecode for bare @nixStore@ path.");
-+        return false;
-+    } else {
-+        // If the QML file is loaded from a normal file path it doesn't matter
-+        // if the application itself is running from a nix path, so we fall back
-+        // to the default Qt behavior.
-+    }
-+#endif
-+
-     return SaveableUnitPointer(unitData()).saveToDisk<char>(
-             [&unitUrl, errorString](const char *data, quint32 size) {
-                 const QString cachePath = localCacheFilePath(unitUrl);
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/stackview-crash.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/stackview-crash.patch
deleted file mode 100644
index 19c7c06486346..0000000000000
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/stackview-crash.patch
+++ /dev/null
@@ -1,473 +0,0 @@
-diff --git a/src/quicktemplates/qquickstackelement.cpp b/src/quicktemplates/qquickstackelement.cpp
-index f6a5ffdd74..304bafe4ef 100644
---- a/src/quicktemplates/qquickstackelement.cpp
-+++ b/src/quicktemplates/qquickstackelement.cpp
-@@ -39,7 +39,10 @@ protected:
-     void setInitialState(QObject *object) override
-     {
-         auto privIncubator = QQmlIncubatorPrivate::get(this);
--        element->incubate(object, privIncubator->requiredProperties());
-+        if (QQmlEnginePrivate *enginePriv = privIncubator->enginePriv) {
-+            element->incubate(enginePriv->v4engine(), object,
-+                              privIncubator->requiredProperties());
-+        }
-     }
- 
- private:
-@@ -90,7 +93,8 @@ QQuickStackElement::~QQuickStackElement()
- #endif
- }
- 
--QQuickStackElement *QQuickStackElement::fromString(const QString &str, QQuickStackView *view, QString *error)
-+QQuickStackElement *QQuickStackElement::fromString(
-+        QQmlEngine *engine, const QString &str, QQuickStackView *view, QString *error)
- {
-     QUrl url(str);
-     if (!url.isValid()) {
-@@ -102,7 +106,7 @@ QQuickStackElement *QQuickStackElement::fromString(const QString &str, QQuickSta
-         url = qmlContext(view)->resolvedUrl(url);
- 
-     QQuickStackElement *element = new QQuickStackElement;
--    element->component = new QQmlComponent(qmlEngine(view), url, view);
-+    element->component = new QQmlComponent(engine, url, view);
-     element->ownComponent = true;
-     return element;
- }
-@@ -127,7 +131,8 @@ QQuickStackElement *QQuickStackElement::fromObject(QObject *object, QQuickStackV
-     return element;
- }
- 
--QQuickStackElement *QQuickStackElement::fromStackViewArg(QQuickStackView *view, QQuickStackViewArg arg)
-+QQuickStackElement *QQuickStackElement::fromStackViewArg(
-+        QQmlEngine *engine, QQuickStackView *view, QQuickStackViewArg arg)
- {
-     QQuickStackElement *element = new QQuickStackElement;
- #if QT_CONFIG(quick_viewtransitions)
-@@ -144,7 +149,7 @@ QQuickStackElement *QQuickStackElement::fromStackViewArg(QQuickStackView *view,
- 
-         Q_ASSERT(!arg.mUrl.isValid());
-     } else if (arg.mUrl.isValid()) {
--        element->component = new QQmlComponent(qmlEngine(view), arg.mUrl, view);
-+        element->component = new QQmlComponent(engine, arg.mUrl, view);
-         element->ownComponent = true;
-     } else {
-         qFatal("No Item, Component or URL set on arg passed to fromStrictArg");
-@@ -152,7 +157,7 @@ QQuickStackElement *QQuickStackElement::fromStackViewArg(QQuickStackView *view,
-     return element;
- }
- 
--bool QQuickStackElement::load(QQuickStackView *parent)
-+bool QQuickStackElement::load(QV4::ExecutionEngine *v4, QQuickStackView *parent)
- {
-     setView(parent);
-     if (!item) {
-@@ -161,7 +166,7 @@ bool QQuickStackElement::load(QQuickStackView *parent)
-         if (component->isLoading()) {
-             QObject::connect(component, &QQmlComponent::statusChanged, [this](QQmlComponent::Status status) {
-                 if (status == QQmlComponent::Ready)
--                    load(view);
-+                    load(component->engine()->handle(), view);
-                 else if (status == QQmlComponent::Error)
-                     QQuickStackViewPrivate::get(view)->warn(component->errorString().trimmed());
-             });
-@@ -177,22 +182,24 @@ bool QQuickStackElement::load(QQuickStackView *parent)
-         if (component->isError())
-             QQuickStackViewPrivate::get(parent)->warn(component->errorString().trimmed());
-     } else {
--        initialize(/*required properties=*/nullptr);
-+        initialize(v4, /*required properties=*/nullptr);
-     }
-     return item;
- }
- 
--void QQuickStackElement::incubate(QObject *object, RequiredProperties *requiredProperties)
-+void QQuickStackElement::incubate(
-+        QV4::ExecutionEngine *v4, QObject *object, RequiredProperties *requiredProperties)
- {
-     item = qmlobject_cast<QQuickItem *>(object);
-     if (item) {
-         QQmlEngine::setObjectOwnership(item, QQmlEngine::CppOwnership);
-         item->setParent(view);
--        initialize(requiredProperties);
-+        initialize(v4, requiredProperties);
-     }
- }
- 
--void QQuickStackElement::initialize(RequiredProperties *requiredProperties)
-+void QQuickStackElement::initialize(
-+        QV4::ExecutionEngine *v4, RequiredProperties *requiredProperties)
- {
-     if (!item || init)
-         return;
-@@ -205,11 +212,8 @@ void QQuickStackElement::initialize(RequiredProperties *requiredProperties)
-     item->setParentItem(view);
- 
-     if (!properties.isUndefined()) {
--        QQmlEngine *engine = qmlEngine(view);
--        Q_ASSERT(engine);
--        QV4::ExecutionEngine *v4 = QQmlEnginePrivate::getV4Engine(engine);
--        Q_ASSERT(v4);
-         QV4::Scope scope(v4);
-+        Q_ASSERT(scope.engine);
-         QV4::ScopedValue ipv(scope, properties.value());
-         QV4::Scoped<QV4::QmlContext> qmlContext(scope, qmlCallingContext.value());
-         QV4::ScopedValue qmlObject(scope, QV4::QObjectWrapper::wrap(v4, item));
-diff --git a/src/quicktemplates/qquickstackelement_p_p.h b/src/quicktemplates/qquickstackelement_p_p.h
-index 5af8149d91..2986a78569 100644
---- a/src/quicktemplates/qquickstackelement_p_p.h
-+++ b/src/quicktemplates/qquickstackelement_p_p.h
-@@ -43,13 +43,14 @@ class QQuickStackElement :
- public:
-     ~QQuickStackElement();
- 
--    static QQuickStackElement *fromString(const QString &str, QQuickStackView *view, QString *error);
-+    static QQuickStackElement *fromString(QQmlEngine *engine, const QString &str, QQuickStackView *view, QString *error);
-     static QQuickStackElement *fromObject(QObject *object, QQuickStackView *view, QString *error);
--    static QQuickStackElement *fromStackViewArg(QQuickStackView *view, QQuickStackViewArg arg);
-+    static QQuickStackElement *fromStackViewArg(QQmlEngine *engine, QQuickStackView *view, QQuickStackViewArg arg);
- 
--    bool load(QQuickStackView *parent);
--    void incubate(QObject *object, RequiredProperties *requiredProperties);
--    void initialize(RequiredProperties *requiredProperties);
-+    bool load(QV4::ExecutionEngine *v4, QQuickStackView *parent);
-+    void incubate(
-+            QV4::ExecutionEngine *v4, QObject *object, RequiredProperties *requiredProperties);
-+    void initialize(QV4::ExecutionEngine *v4, RequiredProperties *requiredProperties);
- 
-     void setIndex(int index);
-     void setView(QQuickStackView *view);
-diff --git a/src/quicktemplates/qquickstackview.cpp b/src/quicktemplates/qquickstackview.cpp
-index cb8854dca8..a0909b7fcb 100644
---- a/src/quicktemplates/qquickstackview.cpp
-+++ b/src/quicktemplates/qquickstackview.cpp
-@@ -457,8 +457,12 @@ QQuickItem *QQuickStackView::get(int index, LoadBehavior behavior)
-     Q_D(QQuickStackView);
-     QQuickStackElement *element = d->elements.value(index);
-     if (element) {
--        if (behavior == ForceLoad)
--            element->load(this);
-+        if (behavior == ForceLoad) {
-+            // It's possible for a slot to still be connected during destruction of the receiver's
-+            // parent (QTBUG-140018), so only try to load new things if our engine is alive.
-+            if (QQmlEngine *engine = qmlEngine(this))
-+                element->load(engine->handle(), this);
-+        }
-         return element->item;
-     }
-     return nullptr;
-@@ -492,7 +496,7 @@ QQuickItem *QQuickStackView::find(const QJSValue &callback, LoadBehavior behavio
-     for (int i = d->elements.size() - 1; i >= 0; --i) {
-         QQuickStackElement *element = d->elements.at(i);
-         if (behavior == ForceLoad)
--            element->load(this);
-+            element->load(engine->handle(), this);
-         if (element->item) {
-             QJSValue rv = func.call(QJSValueList() << engine->newQObject(element->item) << i);
-             if (rv.toBool())
-@@ -624,7 +628,7 @@ void QQuickStackView::push(QQmlV4FunctionPtr args)
- #endif
- 
-     int oldDepth = d->elements.size();
--    if (d->pushElements(elements)) {
-+    if (d->pushElements(v4, elements)) {
-         d->depthChange(d->elements.size(), oldDepth);
-         QQuickStackElement *enter = d->elements.top();
- #if QT_CONFIG(quick_viewtransitions)
-@@ -737,7 +741,7 @@ void QQuickStackView::pop(QQmlV4FunctionPtr args)
- 
-     QPointer<QQuickItem> previousItem;
- 
--    if (d->popElements(enter)) {
-+    if (d->popElements(v4, enter)) {
-         if (exit) {
-             exit->removal = true;
-             d->removing.insert(exit);
-@@ -907,7 +911,7 @@ void QQuickStackView::replace(QQmlV4FunctionPtr args)
-     if (!d->elements.isEmpty())
-         exit = d->elements.pop();
- 
--    if (exit != target ? d->replaceElements(target, elements) : d->pushElements(elements)) {
-+    if (exit != target ? d->replaceElements(v4, target, elements) : d->pushElements(v4, elements)) {
-         d->depthChange(d->elements.size(), oldDepth);
-         if (exit) {
-             exit->removal = true;
-@@ -991,10 +995,14 @@ QQuickItem *QQuickStackView::pushItems(QList<QQuickStackViewArg> args, Operation
-         return nullptr;
-     }
- 
-+    QQmlEngine *engine = qmlEngine(this);
-+    if (!engine)
-+        return nullptr;
-+
-     QScopedValueRollback<bool> modifyingElements(d->modifyingElements, true);
-     QScopedValueRollback<QString> operationNameRollback(d->operation, operationName);
- 
--    const QList<QQuickStackElement *> stackElements = d->parseElements(args);
-+    const QList<QQuickStackElement *> stackElements = d->parseElements(engine, args);
- 
- #if QT_CONFIG(quick_viewtransitions)
-     QQuickStackElement *exit = nullptr;
-@@ -1003,7 +1011,7 @@ QQuickItem *QQuickStackView::pushItems(QList<QQuickStackViewArg> args, Operation
- #endif
- 
-     const int oldDepth = d->elements.size();
--    if (d->pushElements(stackElements)) {
-+    if (d->pushElements(engine->handle(), stackElements)) {
-         d->depthChange(d->elements.size(), oldDepth);
-         QQuickStackElement *enter = d->elements.top();
- #if QT_CONFIG(quick_viewtransitions)
-@@ -1109,7 +1117,11 @@ QQuickItem *QQuickStackView::pushItem(const QUrl &url, const QVariantMap &proper
- QQuickItem *QQuickStackView::popToItem(QQuickItem *item, Operation operation)
- {
-     Q_D(QQuickStackView);
--    return d->popToItem(item, operation, QQuickStackViewPrivate::CurrentItemPolicy::DoNotPop);
-+    QQmlEngine *engine = qmlEngine(this);
-+    if (!engine)
-+        return nullptr;
-+    return d->popToItem(
-+            engine->handle(), item, operation, QQuickStackViewPrivate::CurrentItemPolicy::DoNotPop);
- }
- 
- /*!
-@@ -1149,8 +1161,13 @@ QQuickItem *QQuickStackView::popToIndex(int index, Operation operation)
-     }
- 
-     QQuickStackElement *element = d->elements.at(index);
--    element->load(this);
--    return d->popToItem(element->item, operation, QQuickStackViewPrivate::CurrentItemPolicy::Pop);
-+    QQmlEngine *engine = qmlEngine(this);
-+    if (!engine)
-+        return nullptr;
-+    QV4::ExecutionEngine *v4 = engine->handle();
-+    element->load(v4, this);
-+    return d->popToItem(
-+            v4, element->item, operation, QQuickStackViewPrivate::CurrentItemPolicy::Pop);
- }
- 
- /*!
-@@ -1178,7 +1195,13 @@ QQuickItem *QQuickStackView::popCurrentItem(Operation operation)
-         clear(operation);
-         return lastItemRemoved;
-     }
--    return d->popToItem(d->currentItem, operation, QQuickStackViewPrivate::CurrentItemPolicy::Pop);
-+
-+    QQmlEngine *engine = qmlEngine(this);
-+    if (!engine)
-+        return nullptr;
-+    return d->popToItem(
-+            engine->handle(), d->currentItem, operation,
-+            QQuickStackViewPrivate::CurrentItemPolicy::Pop);
- }
- 
- /*!
-@@ -1232,12 +1255,16 @@ QQuickItem *QQuickStackView::replaceCurrentItem(const QList<QQuickStackViewArg>
-         return nullptr;
-     }
- 
-+    QQmlEngine *engine = qmlEngine(this);
-+    if (!engine)
-+        return nullptr;
-+
-     QScopedValueRollback<bool> modifyingElements(d->modifyingElements, true);
-     QScopedValueRollback<QString> operationNameRollback(d->operation, operationName);
- 
-     QQuickStackElement *currentElement = !d->elements.isEmpty() ? d->elements.top() : nullptr;
- 
--    const QList<QQuickStackElement *> stackElements = d->parseElements(args);
-+    const QList<QQuickStackElement *> stackElements = d->parseElements(engine, args);
- 
-     int oldDepth = d->elements.size();
-     QQuickStackElement* exit = nullptr;
-@@ -1245,8 +1272,8 @@ QQuickItem *QQuickStackView::replaceCurrentItem(const QList<QQuickStackViewArg>
-         exit = d->elements.pop();
- 
-     const bool successfullyReplaced = exit != currentElement
--        ? d->replaceElements(currentElement, stackElements)
--        : d->pushElements(stackElements);
-+        ? d->replaceElements(engine->handle(), currentElement, stackElements)
-+        : d->pushElements(engine->handle(), stackElements);
-     if (successfullyReplaced) {
-         d->depthChange(d->elements.size(), oldDepth);
-         if (exit) {
-@@ -1607,14 +1634,19 @@ void QQuickStackView::componentComplete()
-     QQuickStackElement *element = nullptr;
-     QString error;
-     int oldDepth = d->elements.size();
-+
-+    QQmlEngine *engine = qmlEngine(this);
-+    if (!engine)
-+        return;
-+
-     if (QObject *o = d->initialItem.toQObject())
-         element = QQuickStackElement::fromObject(o, this, &error);
-     else if (d->initialItem.isString())
--        element = QQuickStackElement::fromString(d->initialItem.toString(), this, &error);
-+        element = QQuickStackElement::fromString(engine, d->initialItem.toString(), this, &error);
-     if (!error.isEmpty()) {
-         d->warn(error);
-         delete element;
--    } else if (d->pushElement(element)) {
-+    } else if (d->pushElement(engine->handle(), element)) {
-         d->depthChange(d->elements.size(), oldDepth);
-         d->setCurrentItem(element);
-         element->setStatus(QQuickStackView::Active);
-diff --git a/src/quicktemplates/qquickstackview_p.cpp b/src/quicktemplates/qquickstackview_p.cpp
-index 0288ff1f4b..8f08f29168 100644
---- a/src/quicktemplates/qquickstackview_p.cpp
-+++ b/src/quicktemplates/qquickstackview_p.cpp
-@@ -109,7 +109,8 @@ QList<QQuickStackElement *> QQuickStackViewPrivate::parseElements(int from, QQml
-     return elements;
- }
- 
--QList<QQuickStackElement *> QQuickStackViewPrivate::parseElements(const QList<QQuickStackViewArg> &args)
-+QList<QQuickStackElement *> QQuickStackViewPrivate::parseElements(
-+        QQmlEngine *engine, const QList<QQuickStackViewArg> &args)
- {
-     Q_Q(QQuickStackView);
-     QList<QQuickStackElement *> stackElements;
-@@ -141,8 +142,8 @@ QList<QQuickStackElement *> QQuickStackViewPrivate::parseElements(const QList<QQ
-             return {};
-         }
- 
--        QQuickStackElement *element = QQuickStackElement::fromStackViewArg(q, arg);
--        QV4::ExecutionEngine *v4Engine = qmlEngine(q)->handle();
-+        QQuickStackElement *element = QQuickStackElement::fromStackViewArg(engine, q, arg);
-+        QV4::ExecutionEngine *v4Engine = engine->handle();
-         element->properties.set(v4Engine, v4Engine->fromVariant(properties));
-         element->qmlCallingContext.set(v4Engine, v4Engine->qmlContext());
-         stackElements.append(element);
-@@ -183,28 +184,33 @@ static QString resolvedUrl(const QString &str, const QQmlRefPointer<QQmlContextD
-     return str;
- }
- 
--QQuickStackElement *QQuickStackViewPrivate::createElement(const QV4::Value &value, const QQmlRefPointer<QQmlContextData> &context, QString *error)
-+QQuickStackElement *QQuickStackViewPrivate::createElement(
-+        const QV4::Value &value, const QQmlRefPointer<QQmlContextData> &context, QString *error)
- {
-     Q_Q(QQuickStackView);
-     if (const QV4::String *s = value.as<QV4::String>())
--        return QQuickStackElement::fromString(resolvedUrl(s->toQString(), context), q, error);
-+        return QQuickStackElement::fromString(
-+                s->engine()->qmlEngine(), resolvedUrl(s->toQString(), context), q, error);
-     if (const QV4::QObjectWrapper *o = value.as<QV4::QObjectWrapper>())
-         return QQuickStackElement::fromObject(o->object(), q, error);
-     if (const QV4::UrlObject *u = value.as<QV4::UrlObject>())
--        return QQuickStackElement::fromString(resolvedUrl(u->href(), context), q, error);
-+        return QQuickStackElement::fromString(
-+                u->engine()->qmlEngine(), resolvedUrl(u->href(), context), q, error);
- 
--    if (value.as<QV4::Object>()) {
-+    if (const QV4::Object *o = value.as<QV4::Object>()) {
-         const QVariant data = QV4::ExecutionEngine::toVariant(value, QMetaType::fromType<QUrl>());
-         if (data.typeId() == QMetaType::QUrl) {
--            return QQuickStackElement::fromString(resolvedUrl(data.toUrl(), context).toString(), q,
--                                                  error);
-+            return QQuickStackElement::fromString(
-+                    o->engine()->qmlEngine(), resolvedUrl(data.toUrl(), context).toString(), q,
-+                    error);
-         }
-     }
- 
-     return nullptr;
- }
- 
--bool QQuickStackViewPrivate::pushElements(const QList<QQuickStackElement *> &elems)
-+bool QQuickStackViewPrivate::pushElements(
-+        QV4::ExecutionEngine *v4, const QList<QQuickStackElement *> &elems)
- {
-     Q_Q(QQuickStackView);
-     if (!elems.isEmpty()) {
-@@ -212,19 +218,19 @@ bool QQuickStackViewPrivate::pushElements(const QList<QQuickStackElement *> &ele
-             e->setIndex(elements.size());
-             elements += e;
-         }
--        return elements.top()->load(q);
-+        return elements.top()->load(v4, q);
-     }
-     return false;
- }
- 
--bool QQuickStackViewPrivate::pushElement(QQuickStackElement *element)
-+bool QQuickStackViewPrivate::pushElement(QV4::ExecutionEngine *v4, QQuickStackElement *element)
- {
-     if (element)
--        return pushElements(QList<QQuickStackElement *>() << element);
-+        return pushElements(v4, QList<QQuickStackElement *>() << element);
-     return false;
- }
- 
--bool QQuickStackViewPrivate::popElements(QQuickStackElement *element)
-+bool QQuickStackViewPrivate::popElements(QV4::ExecutionEngine *v4, QQuickStackElement *element)
- {
-     Q_Q(QQuickStackView);
-     while (elements.size() > 1 && elements.top() != element) {
-@@ -232,10 +238,12 @@ bool QQuickStackViewPrivate::popElements(QQuickStackElement *element)
-         if (!element)
-             break;
-     }
--    return elements.top()->load(q);
-+    return elements.top()->load(v4, q);
- }
- 
--bool QQuickStackViewPrivate::replaceElements(QQuickStackElement *target, const QList<QQuickStackElement *> &elems)
-+bool QQuickStackViewPrivate::replaceElements(
-+        QV4::ExecutionEngine *v4, QQuickStackElement *target,
-+        const QList<QQuickStackElement *> &elems)
- {
-     if (target) {
-         while (!elements.isEmpty()) {
-@@ -245,10 +253,12 @@ bool QQuickStackViewPrivate::replaceElements(QQuickStackElement *target, const Q
-                 break;
-         }
-     }
--    return pushElements(elems);
-+    return pushElements(v4, elems);
- }
- 
--QQuickItem *QQuickStackViewPrivate::popToItem(QQuickItem *item, QQuickStackView::Operation operation, CurrentItemPolicy currentItemPolicy)
-+QQuickItem *QQuickStackViewPrivate::popToItem(
-+        QV4::ExecutionEngine *v4, QQuickItem *item, QQuickStackView::Operation operation,
-+        CurrentItemPolicy currentItemPolicy)
- {
-     const QString operationName = QStringLiteral("pop");
-     if (modifyingElements) {
-@@ -301,7 +311,7 @@ QQuickItem *QQuickStackViewPrivate::popToItem(QQuickItem *item, QQuickStackView:
-     }
- 
-     QQuickItem *previousItem = nullptr;
--    if (popElements(enter)) {
-+    if (popElements(v4, enter)) {
-         if (exit) {
-             exit->removal = true;
-             removing.insert(exit);
-diff --git a/src/quicktemplates/qquickstackview_p_p.h b/src/quicktemplates/qquickstackview_p_p.h
-index 4ae849aa20..8bb95760a4 100644
---- a/src/quicktemplates/qquickstackview_p_p.h
-+++ b/src/quicktemplates/qquickstackview_p_p.h
-@@ -50,20 +50,20 @@ public:
-     void setCurrentItem(QQuickStackElement *element);
- 
-     QList<QQuickStackElement *> parseElements(int from, QQmlV4FunctionPtr args, QStringList *errors);
--    QList<QQuickStackElement *> parseElements(const QList<QQuickStackViewArg> &args);
-+    QList<QQuickStackElement *> parseElements(QQmlEngine *engine, const QList<QQuickStackViewArg> &args);
-     QQuickStackElement *findElement(QQuickItem *item) const;
-     QQuickStackElement *findElement(const QV4::Value &value) const;
-     QQuickStackElement *createElement(const QV4::Value &value, const QQmlRefPointer<QQmlContextData> &context, QString *error);
--    bool pushElements(const QList<QQuickStackElement *> &elements);
--    bool pushElement(QQuickStackElement *element);
--    bool popElements(QQuickStackElement *element);
--    bool replaceElements(QQuickStackElement *element, const QList<QQuickStackElement *> &elements);
-+    bool pushElements(QV4::ExecutionEngine *v4, const QList<QQuickStackElement *> &elements);
-+    bool pushElement(QV4::ExecutionEngine *v4, QQuickStackElement *element);
-+    bool popElements(QV4::ExecutionEngine *v4, QQuickStackElement *element);
-+    bool replaceElements(QV4::ExecutionEngine *v4, QQuickStackElement *element, const QList<QQuickStackElement *> &elements);
- 
-     enum class CurrentItemPolicy {
-         DoNotPop,
-         Pop
-     };
--    QQuickItem *popToItem(QQuickItem *item, QQuickStackView::Operation operation, CurrentItemPolicy currentItemPolicy);
-+    QQuickItem *popToItem(QV4::ExecutionEngine *v4, QQuickItem *item, QQuickStackView::Operation operation, CurrentItemPolicy currentItemPolicy);
- 
- #if QT_CONFIG(quick_viewtransitions)
-     void ensureTransitioner();
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/use-versioned-import-path.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/use-versioned-import-path.patch
index 7efd9c9cdb70f..6de31fae7a77c 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/use-versioned-import-path.patch
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/use-versioned-import-path.patch
@@ -1,10 +1,14 @@
---- a/src/qml/qml/qqmlimport.cpp
-+++ b/src/qml/qml/qqmlimport.cpp
-@@ -1520,6 +1520,7 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+diff --git a/src/qml/qml/qqmltypeloader.cpp b/src/qml/qml/qqmltypeloader.cpp
+index 5d09bf21c6..eacc8ccaea 100644
+--- a/src/qml/qml/qqmltypeloader.cpp
++++ b/src/qml/qml/qqmltypeloader.cpp
+@@ -1235,7 +1235,8 @@ QQmlTypeLoader::QQmlTypeLoader(QQmlEngine *engine)
      // env import paths
      addEnvImportPath("QML_IMPORT_PATH");
      addEnvImportPath("QML2_IMPORT_PATH");
+-
 +    addEnvImportPath("NIXPKGS_QT6_QML_IMPORT_PATH");
- 
++ 
      addImportPath(QStringLiteral("qrc:/qt/qml"));
      addImportPath(QStringLiteral("qrc:/qt-project.org/imports"));
+ 
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index 1339e43f52bfc..eec3ee8f7a8d0 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.9.3";
+  version = "6.10.0";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-xzh2cNPlGe0VlCdNN1u8vBi+Uq+U2oa2bskAJQTt0ik=";
+    hash = "sha256-0o0zC8SUlug5xOV5AX9PiTim1td8NA4fq6WfBR5aSXA=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/modules/qttools/default.nix b/pkgs/development/libraries/qt-6/modules/qttools/default.nix
index 4fb69db29359d..58ef182fff2cc 100644
--- a/pkgs/development/libraries/qt-6/modules/qttools/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qttools/default.nix
@@ -6,7 +6,7 @@
   qtbase,
   qtdeclarative,
   cups,
-  llvmPackages_20,
+  llvmPackages,
   # clang-based c++ parser for qdoc and lupdate
   withClang ? false,
 }:
@@ -30,10 +30,9 @@ qtModule {
     "-DNIX_OUTPUT_OUT=\"${placeholder "out"}\""
   ];
 
-  # FIXME: update to LLVM 21 with Qt 6.10
   buildInputs = lib.optionals withClang [
-    llvmPackages_20.libclang
-    llvmPackages_20.llvm
+    llvmPackages.libclang
+    llvmPackages.llvm
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/qt-6/modules/qttools/paths.patch b/pkgs/development/libraries/qt-6/modules/qttools/paths.patch
index ec306ecc480ac..6b1eca682c593 100644
--- a/pkgs/development/libraries/qt-6/modules/qttools/paths.patch
+++ b/pkgs/development/libraries/qt-6/modules/qttools/paths.patch
@@ -18,8 +18,8 @@
 +
  static QString qtToolFilePath(const QString &toolName, QLibraryInfo::LibraryPath location)
  {
--    QString filePath = QLibraryInfo::path(location) + QLatin1Char('/') + toolName;
-+    QString filePath = qtBasePath(location) + QLatin1Char('/') + toolName;
+-    QString filePath = QLibraryInfo::path(location) + u'/' + toolName;
++    QString filePath = qtBasePath(location) + u'/' + toolName;
  #ifdef Q_OS_WIN
      filePath.append(QLatin1String(".exe"));
  #endif
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index ae34492453c55..54fc9cac7e3c6 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -5,8 +5,6 @@
   qtModule,
   qtbase,
   qtdeclarative,
-  wayland,
-  wayland-scanner,
   pkg-config,
   libdrm,
 }:
@@ -14,24 +12,15 @@
 qtModule {
   pname = "qtwayland";
 
-  # wayland-scanner needs to be propagated as both build
-  # (for the wayland-scanner binary) and host (for the
-  # actual wayland.xml protocol definition)
   propagatedBuildInputs = [
     qtbase
     qtdeclarative
-    wayland
-    wayland-scanner
-  ];
-  propagatedNativeBuildInputs = [
-    wayland
-    wayland-scanner
   ];
   buildInputs = [ libdrm ];
   nativeBuildInputs = [ pkg-config ];
 
   cmakeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-    "-DQt6WaylandScannerTools_DIR=${pkgsBuildBuild.qt6.qtwayland}/lib/cmake/Qt6WaylandScannerTools"
+    "-DQt6WaylandScannerTools_DIR=${pkgsBuildBuild.qt6.qtbase}/lib/cmake/Qt6WaylandScannerTools"
   ];
 
   meta = {
diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
index 7278281774d5a..d06abd2441b9a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
@@ -64,8 +64,6 @@
   bootstrap_cmds,
   cctools,
   xcbuild,
-
-  fetchpatch,
 }:
 
 qtModule {
@@ -112,13 +110,6 @@ qtModule {
 
     # Reproducibility QTBUG-136068
     ./gn-object-sorted.patch
-
-    # Fix GPU rendering with Mesa 25.2
-    # https://bugreports.qt.io/browse/QTBUG-139424
-    (fetchpatch {
-      url = "https://invent.kde.org/qt/qt/qtwebengine/-/commit/3cc88e0f85113e38ccb1bfdadb7d150c2389b1bc.diff";
-      hash = "sha256-5tKZ6b93VP4mKVc7jctrbW5Ktl+4Mjxw6bK1ajY62zQ=";
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 9cabeda268167..58d46a69ea562 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,315 +4,315 @@
 
 {
   qt3d = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qt3d-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1zvzc88gykbqmks5q06zl9113lvy07gxsxmzmvpd8y8sybfn91ky";
-      name = "qt3d-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qt3d-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1dz9g3nlwgwfycwl5a0c7h339s7azq2xvq99kd76wjqzfkrmz25x";
+      name = "qt3d-everywhere-src-6.10.0.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qt5compat-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0qa4s1m9f0qzs6msrilpi12wv5hpkgw211s0cqsiqaf24hhsq789";
-      name = "qt5compat-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qt5compat-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0zibn0kq8grlpkvfasjciz71bv6x4cgz02v5l5giyplbcnfwa9fh";
+      name = "qt5compat-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtactiveqt-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1kzc0pqwyi1h1s8qk8agplfkrib2s9cg7bwpl41z8icngwj76h6v";
-      name = "qtactiveqt-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtactiveqt-everywhere-src-6.10.0.tar.xz";
+      sha256 = "15m7g4h4aa3fk5q4an3apd0bdqkxdknnx64p72brrmah773mmlpm";
+      name = "qtactiveqt-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtbase = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtbase-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0vnwp12wvsab1vsn8zhi4mcvrpg5iacq59xzzs0w0vimc3va58f5";
-      name = "qtbase-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtbase-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0v84f9pw387m0ghd4n6s9ipwjvniqspabqxkqmbj58slrcxn5m7a";
+      name = "qtbase-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtcharts-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0lsckms5s0av6dy8mll7bnspsigz6hpvbddm79n2wshxnfywpmr9";
-      name = "qtcharts-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtcharts-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0svz8frryxv811xyg8cawn5icjcin6909mw4k6hlvgz7429m5zqv";
+      name = "qtcharts-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtconnectivity-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1xfp3p5xkypxfgzvq2a5zcnyc7ms5gav99z5qmb48k0pzdgbl6z2";
-      name = "qtconnectivity-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtconnectivity-everywhere-src-6.10.0.tar.xz";
+      sha256 = "16gs86zyaq8rvzd9jribgg51hanas15gpy8zh45n58004v7xa2jn";
+      name = "qtconnectivity-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtdatavis3d-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1v5zdwjpz8j7s1nrkg7sp452vmdmhq09kdxvbsya2ad6jsw4ajxa";
-      name = "qtdatavis3d-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtdatavis3d-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1qinrrk1j9qknwq2x7rl9aw8ajrp1h7kpfg29wcvaklbz9jj5xpx";
+      name = "qtdatavis3d-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtdeclarative-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0q52z2iiqdchsvvcs7w6mq38v0ahv2h5jyvbjxfbzbr9f8i1n1ss";
-      name = "qtdeclarative-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtdeclarative-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1c7nar7q92w8l7wkmwbl0f6j4g1c8kw8jbn1bf35sf821593bzbf";
+      name = "qtdeclarative-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtdoc-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0am13lnmfxqj8ayx9ml5sm2qagl5s6hrki3bvdxfmzfkl07ds694";
-      name = "qtdoc-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtdoc-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0fvx690kap3s2h9lg4d4w3nsiks6h2idggskisg1r1gpwks2brgc";
+      name = "qtdoc-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtgraphs-everywhere-src-6.9.3.tar.xz";
-      sha256 = "13041r244h3mgs95zcyw5x7lfginf4gxs59spz030p0jap867p2h";
-      name = "qtgraphs-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtgraphs-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1shllyk4f5lidw0hij9zhgapck3rf3hm6qw4m1nn79mynfrz3j3f";
+      name = "qtgraphs-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtgrpc-everywhere-src-6.9.3.tar.xz";
-      sha256 = "00py189v3ihpy9cj51sxapl2dp3ci7k04ikjl6zbxmbjrdwwhqvr";
-      name = "qtgrpc-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtgrpc-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0id4j4xgamx9wndc3cgnf5m42ax257xyfy2khq4aw0b10s4j4wpv";
+      name = "qtgrpc-everywhere-src-6.10.0.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qthttpserver-everywhere-src-6.9.3.tar.xz";
-      sha256 = "13rfvmh42h4zd2slb2d0xqdy7wgsy05q8jqy3ldbikx5vf9qg9vs";
-      name = "qthttpserver-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qthttpserver-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1i8z4l1is5xashh5lq9afj1syhvvz15zgcr5f27mwhjzvc0mfw74";
+      name = "qthttpserver-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtimageformats-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1zigaz2418sy6m3na91rddxvlfn3257535kq120f9f6lzgdnpcjg";
-      name = "qtimageformats-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtimageformats-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1shcghzjn3v9mbgms0ykk5d91q7hdm8mxv8n6vjhsm3wa190lib4";
+      name = "qtimageformats-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtlanguageserver-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0cwx6rlp9nm0qbzjamfcqhhylbmh2f5kk3z749ln49fbz32ads68";
-      name = "qtlanguageserver-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtlanguageserver-everywhere-src-6.10.0.tar.xz";
+      sha256 = "19i151qxh2fw2h5w6082bh0myk6skz3dihhs4mahhb1rkzh077jc";
+      name = "qtlanguageserver-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtlocation-everywhere-src-6.9.3.tar.xz";
-      sha256 = "018nwyr1idh3rfp22w86pw3i25xbj7mv49wir5s1akmgzp8jf4hl";
-      name = "qtlocation-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtlocation-everywhere-src-6.10.0.tar.xz";
+      sha256 = "007qbni20qajdq6villwp7bc7hqzjlppc30yw3ccqb2bzf3kxm6b";
+      name = "qtlocation-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtlottie-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0cyzj0xhdhlgkra1pqb4vdazxjfii05sc7r5h0ml9fzhfiai0vhi";
-      name = "qtlottie-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtlottie-everywhere-src-6.10.0.tar.xz";
+      sha256 = "09bvm3jr2s0hg14dq8b7604hfgxj3cm1i93lkkbjh2n2bfpi793h";
+      name = "qtlottie-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtmultimedia-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1xc6kgqm88rkzr8qzdi8yj8dm4dqfsfzkkba4d8iijb0xbkvwxd2";
-      name = "qtmultimedia-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtmultimedia-everywhere-src-6.10.0.tar.xz";
+      sha256 = "09hixwp8sq771rfp4c8bvmpzl6jd906k2rsrkxwij78drwhl0hh4";
+      name = "qtmultimedia-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtnetworkauth-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1ivyrha9ibc2iz4lvrz5309pdqxyccwzbpmyg2m24ghkxm3xrnb7";
-      name = "qtnetworkauth-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtnetworkauth-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1j5k6dn0zc5rq82k89nyz5w0ny89mg1pg5aw0h41ybg2f5fqaq04";
+      name = "qtnetworkauth-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtpositioning-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1d1mb1fni42vgfyj9ghk0g6602nx8lwa1y0bmynpmh84yy0ck1qc";
-      name = "qtpositioning-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtpositioning-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1q8yd9sjbm1vzcda1i21x0qf0n4md0k6wwbmr5jrvqbbcf8brgzc";
+      name = "qtpositioning-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtquick3d-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0wyfran9vwl6fm2i9nc149fpvv8r5k3yvrn2f1rjpb9qkw271cli";
-      name = "qtquick3d-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtquick3d-everywhere-src-6.10.0.tar.xz";
+      sha256 = "126lxiizd4pxxp43zzwv3k4i73806bgg329qsygz5qbnm0g8q9cq";
+      name = "qtquick3d-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtquick3dphysics-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0vjs7calgc0vc7fv6hnbghhi37cfiapxim650av9w92xfhnv5myw";
-      name = "qtquick3dphysics-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtquick3dphysics-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0hj90pdxh6x6zm1b4iflhr89sy13qrbwc79pv9z9m7gdwyzhid62";
+      name = "qtquick3dphysics-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtquickeffectmaker-everywhere-src-6.9.3.tar.xz";
-      sha256 = "04lrlp1fakn8kv160ln8j1fsqsfdcjf1dzwlknx5r1m04hfkdw3b";
-      name = "qtquickeffectmaker-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtquickeffectmaker-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0vmr5s6b4cqxpw5kl5shzydj3if89znm3izj5nrhzsgbic11vhk4";
+      name = "qtquickeffectmaker-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtquicktimeline-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1xqidk7njn1xiiz3i27ddzwd568caigq8p2ja4ks67x7bsk4nkr8";
-      name = "qtquicktimeline-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtquicktimeline-everywhere-src-6.10.0.tar.xz";
+      sha256 = "182bn72mifx8s867hsmramjfl9qr8szpla9fqw7bi3ywb1fiig6z";
+      name = "qtquicktimeline-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtremoteobjects-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0nyqmapypw0y745zg58rq9183vcrbm2c71dc3p9sdqflal07r64q";
-      name = "qtremoteobjects-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtremoteobjects-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1616dagpzs68rhi1wiq1dwl1kbgf2c1mmrb3c7ni204k0rcjsh5i";
+      name = "qtremoteobjects-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtscxml-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1drlbdgicqx76gyqi79ri1gy2vrya6l99gig76p8x46za70c12gk";
-      name = "qtscxml-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtscxml-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1r1ic7kr3xzrg0vyrj4smj2vzyidazwrb5jqn2l6irg1bx06r55m";
+      name = "qtscxml-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtsensors-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0s1gz66nar27c3l5cbqqdnza1pxbd7nylz88mnj32xpkwml53nx2";
-      name = "qtsensors-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtsensors-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0fc7cq067sddfwcn43j5v4h6xzjrvj5gvi08l9bfag43s4d5wlk7";
+      name = "qtsensors-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtserialbus-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1ksvfwfk0az47sgfcaqbac936y75lcaga5fip5lbgz0s0zd3k08a";
-      name = "qtserialbus-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtserialbus-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0c7cljc555vcs7jkm63mczxxpg085b161b6vpd9vnrz2zyzv49y6";
+      name = "qtserialbus-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtserialport-everywhere-src-6.9.3.tar.xz";
-      sha256 = "16427sa9qhk8hsyxjr69fhqmvzlg9n4pdizmqfc4cr7j1w1yq62b";
-      name = "qtserialport-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtserialport-everywhere-src-6.10.0.tar.xz";
+      sha256 = "01gqv6hc2ycd877jhq6ffnfgizh9pgnzc1gn6m6cfp8ximwa07jg";
+      name = "qtserialport-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtshadertools-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0rs553abb8sdla4cywfpgfh3vvyafm8spy8nnvj06md3hvp09632";
-      name = "qtshadertools-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtshadertools-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1xpvzmpisglbk3nnczqvj0n1dv6zd79phvczqwpqc9yq7y64gfl7";
+      name = "qtshadertools-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtspeech-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0gmbr65s4j2bka13iln3fmjrhl1i46lp5vlhdv66rf1gfi65lvzq";
-      name = "qtspeech-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtspeech-everywhere-src-6.10.0.tar.xz";
+      sha256 = "07m59akg31010khz82lvbrgjwwacavra5qsi17jqpk0chdk300qk";
+      name = "qtspeech-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtsvg-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1qi6f3lvp0r7n79m1iw80690366bd53gyxm5gp76zgnbb0rslxnv";
-      name = "qtsvg-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtsvg-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0cr5vaz485n23fvw4kvh1ykqny61bpdr5vd2q9szywsy9phc1ljy";
+      name = "qtsvg-everywhere-src-6.10.0.tar.xz";
     };
   };
   qttools = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qttools-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1sdla2blvk9r4g7v67dhwqjxx7kflyh7cm9pw5f7ziazjw7apxqc";
-      name = "qttools-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qttools-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0anhvd7yqs9l3dryl43f0f7zq22rwrvz93g16ygmjgiyryc50vfq";
+      name = "qttools-everywhere-src-6.10.0.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qttranslations-everywhere-src-6.9.3.tar.xz";
-      sha256 = "18chqjzy7ji76crfisl1rya8ds3my97bgsxkg7yldcc1crg58vgk";
-      name = "qttranslations-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qttranslations-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1pkc0a5kigcp0jcq3ny1ykl0rqw0vabz45w14d2mgjyhrx9q4vij";
+      name = "qttranslations-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtvirtualkeyboard-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0d2m87fvd11ckjjzy3lj1mbfisig4x9c263phq4fczwy3k4xb851";
-      name = "qtvirtualkeyboard-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtvirtualkeyboard-everywhere-src-6.10.0.tar.xz";
+      sha256 = "108klc6cr2ihaka9gnqaqv9i8r4lr8m39yviic3nviibd3r6gcmb";
+      name = "qtvirtualkeyboard-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwayland-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1pfsfdjqw985d8220jw13sqacyiip26bzpk1ax30ms33jayd84z4";
-      name = "qtwayland-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwayland-everywhere-src-6.10.0.tar.xz";
+      sha256 = "07vnfd0xmzg8vc68g9j2i88lilmic5vhv22gn47vs94v4l52ngv0";
+      name = "qtwayland-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwebchannel-everywhere-src-6.9.3.tar.xz";
-      sha256 = "01d3dy0fjz4vfy8s1yzpmd31b8mhvqf15z61fzr9qgd1wp0vnmwl";
-      name = "qtwebchannel-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwebchannel-everywhere-src-6.10.0.tar.xz";
+      sha256 = "02ahm7cz8wgvfcgyq85sc2v566x4ihymalmv5xi0wn5zz9j5h5kl";
+      name = "qtwebchannel-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwebengine-everywhere-src-6.9.3.tar.xz";
-      sha256 = "0rl9v936sq6spvb3sfkpmc51wwmljrn4ssy3ii0pdn0xsl8kn2ym";
-      name = "qtwebengine-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwebengine-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0765a5kfkxxi7rq58pivi32xwb17pvg3h2ix88dx3y9h3jqpfk64";
+      name = "qtwebengine-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwebsockets-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1i428awzws4x4cmv6zpdgb27c2m71cs8dqcjbwiwqcfbyf6dlzg2";
-      name = "qtwebsockets-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwebsockets-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0vl091wnzqjpnp0i0l2dqlbhlwcfzw2ry1p48aifxf63lmyjw2fi";
+      name = "qtwebsockets-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.9.3";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.3/submodules/qtwebview-everywhere-src-6.9.3.tar.xz";
-      sha256 = "1j1cqj2hq0c8r9lxb1h6mdhnf9clqb95jw2p0nn81jzin701ypn6";
-      name = "qtwebview-everywhere-src-6.9.3.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwebview-everywhere-src-6.10.0.tar.xz";
+      sha256 = "03rszbcr3lnf9cnk7hz99ibxx8na4l3i98q19fahj36ilpk68dd9";
+      name = "qtwebview-everywhere-src-6.10.0.tar.xz";
     };
   };
 }

From 292790f7c75d75d640c21abe0b02aa7afc901932 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 18:11:06 +0300
Subject: [PATCH 267/306] python313Packages.{shiboken6,pyside6}: 6.9.3 ->
 6.10.0

---
 .../python-modules/pyside6/default.nix        | 14 +++++++++-
 .../python-modules/shiboken6/default.nix      | 20 +++++++++-----
 .../shiboken6/fix-include-qt-headers.patch    | 26 ++++++++-----------
 3 files changed, 38 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/python-modules/pyside6/default.nix b/pkgs/development/python-modules/pyside6/default.nix
index bcd90f6b04758..0a9621aaa2d28 100644
--- a/pkgs/development/python-modules/pyside6/default.nix
+++ b/pkgs/development/python-modules/pyside6/default.nix
@@ -10,6 +10,7 @@
   shiboken6,
   llvmPackages,
   symlinkJoin,
+  fetchpatch,
 }:
 let
   packages = with python.pkgs.qt6; [
@@ -56,7 +57,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   inherit (shiboken6) version src;
 
-  sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/pyside6";
+  sourceRoot = "${finalAttrs.src.name}/sources/pyside6";
+
+  patches = [
+    # revert commit that breaks generated cmake files
+    (fetchpatch {
+      url = "https://code.qt.io/cgit/pyside/pyside-setup.git/patch/?id=05e328476f2d6ef8a0f3f44aca1e5b1cdb7499fc";
+      revert = true;
+      stripLen = 2;
+      hash = "sha256-PPLV5K+xp7ZdG0Tah1wpBdNWN7fsXvZh14eBzO0R55c=";
+    })
+  ];
 
   # Qt Designer plugin moved to a separate output to reduce closure size
   # for downstream things
@@ -115,6 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     cd ../../..
+    chmod +w .
     ${python.pythonOnBuildForHost.interpreter} setup.py egg_info --build-type=pyside6
     cp -r PySide6.egg-info $out/${python.sitePackages}/
 
diff --git a/pkgs/development/python-modules/shiboken6/default.nix b/pkgs/development/python-modules/shiboken6/default.nix
index 837daf16c7a7e..2ac75ab8a09df 100644
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  fetchurl,
+  fetchgit,
   llvmPackages,
   python,
   cmake,
@@ -13,14 +13,15 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "shiboken6";
-  version = "6.9.3";
+  version = "6.10.0";
 
-  src = fetchurl {
-    url = "mirror://qt/official_releases/QtForPython/pyside6/PySide6-${finalAttrs.version}-src/pyside-setup-everywhere-src-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fNLVq7mPLm9EKw5B9fz5MOcxKuSxf2gTFrGtx7Y7sXI=";
+  src = fetchgit {
+    url = "https://code.qt.io/pyside/pyside-setup.git";
+    rev = "97af685d5b777323690704fb9848f50aa2728ce9";
+    hash = "sha256-zJV4rrqr2bzWFEG1CWOI+y6wbfQDvWAst6T3aSssj6M=";
   };
 
-  sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/shiboken6";
+  sourceRoot = "${finalAttrs.src.name}/sources/shiboken6";
 
   patches = [ ./fix-include-qt-headers.patch ];
 
@@ -48,10 +49,17 @@ stdenv'.mkDerivation (finalAttrs: {
   # variable available in this file.
   postPatch = ''
     substituteInPlace cmake/ShibokenHelpers.cmake --replace-fail '#!/bin/bash' '#!''${BASH}'
+
+    # raise ValueError('ZIP does not support timestamps before 1980')
+    find \
+      shibokenmodule/files.dir/shibokensupport/ \
+      libshiboken/embed/signature_bootstrap.py \
+      -exec touch -d "1980-01-01T00:00Z" {} \;
   '';
 
   postInstall = ''
     cd ../../..
+    chmod +w .
     ${python.pythonOnBuildForHost.interpreter} setup.py egg_info --build-type=shiboken6
     cp -r shiboken6.egg-info $out/${python.sitePackages}/
   '';
diff --git a/pkgs/development/python-modules/shiboken6/fix-include-qt-headers.patch b/pkgs/development/python-modules/shiboken6/fix-include-qt-headers.patch
index bfa035b92b527..c9b2d51a94df0 100644
--- a/pkgs/development/python-modules/shiboken6/fix-include-qt-headers.patch
+++ b/pkgs/development/python-modules/shiboken6/fix-include-qt-headers.patch
@@ -1,14 +1,14 @@
 --- a/ApiExtractor/clangparser/compilersupport.cpp
 +++ b/ApiExtractor/clangparser/compilersupport.cpp
-@@ -16,6 +16,7 @@
+@@ -18,6 +18,7 @@
+ #include <QtCore/qprocess.h>
  #include <QtCore/qstandardpaths.h>
  #include <QtCore/qstringlist.h>
- #include <QtCore/qversionnumber.h>
 +#include <QtCore/qregularexpression.h>
  
  #include <clang-c/Index.h>
  
-@@ -341,6 +342,13 @@ QByteArrayList emulatedCompilerOptions()
+@@ -638,6 +639,13 @@ QByteArrayList emulatedCompilerOptions(LanguageLevel level)
  {
      QByteArrayList result;
      HeaderPaths headerPaths;
@@ -21,20 +21,18 @@
 +
      switch (compiler()) {
      case Compiler::Msvc:
-         result.append(QByteArrayLiteral("-fms-compatibility-version=19.26.28806"));
-@@ -352,9 +360,30 @@ QByteArrayList emulatedCompilerOptions()
+         result.append("-fms-compatibility-version="_ba + msvcCompatVersion());
+@@ -651,10 +659,27 @@ QByteArrayList emulatedCompilerOptions(LanguageLevel level)
              appendClangBuiltinIncludes(&headerPaths);
          break;
      case Compiler::Clang:
--        headerPaths.append(gppInternalIncludePaths(compilerFromCMake(u"clang++"_s)));
-+    // fix: error: cannot jump from switch statement to this case label: case Compiler::Gpp
-+    // note: jump bypasses variable initialization: const HeaderPaths clangPaths =
+-        headerPaths.append(gppInternalIncludePaths(compilerFromCMake(u"clang++"_s),
+-                                                   _compilerArguments));
 +    {
-+        //headerPaths.append(gppInternalIncludePaths(compilerFromCMake(u"clang++"_s)));
 +        // fix: qt.shiboken: x is specified in typesystem, but not defined. This could potentially lead to compilation errors.
 +        // PySide requires that Qt headers are not -isystem
 +        // https://bugreports.qt.io/browse/PYSIDE-787
-+        const HeaderPaths clangPaths = gppInternalIncludePaths(compilerFromCMake(u"clang++"_qs));
++        const HeaderPaths clangPaths = gppInternalIncludePaths(compilerFromCMake(u"clang++"_s), _compilerArguments);
 +        for (const HeaderPath &h : clangPaths) {
 +            auto match = qtHeaderRegex.match(QString::fromUtf8(h.path));
 +            if (!match.hasMatch()) {
@@ -54,9 +52,9 @@
      case Compiler::Gpp:
          if (needsClangBuiltinIncludes())
              appendClangBuiltinIncludes(&headerPaths);
-@@ -363,8 +392,20 @@ QByteArrayList emulatedCompilerOptions()
-         // <type_traits> etc (g++ 11.3).
-         const HeaderPaths gppPaths = gppInternalIncludePaths(compilerFromCMake(u"g++"_qs));
+@@ -664,8 +689,20 @@ QByteArrayList emulatedCompilerOptions(LanguageLevel level)
+         const HeaderPaths gppPaths = gppInternalIncludePaths(compilerFromCMake(u"g++"_s),
+                                                              _compilerArguments);
          for (const HeaderPath &h : gppPaths) {
 -            if (h.path.contains("c++") || h.path.contains("sysroot"))
 +            // fix: qt.shiboken: x is specified in typesystem, but not defined. This could potentially lead to compilation errors.
@@ -76,5 +74,3 @@
          }
          break;
      }
--- 
-2.39.0

From 13d9d908dbf8cfe8333d31eb67252fb5d2f17678 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 7 Oct 2025 21:22:48 +0300
Subject: [PATCH 268/306] telegram-desktop: 6.1.3 -> 6.1.4

---
 .../telegram/telegram-desktop/unwrapped.nix                   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
index 0c57e69091950..e592193e1f4ad 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
@@ -42,14 +42,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "6.1.3";
+  version = "6.1.4";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-ElbKzv+QMqH62BGAvNjDDNp7NSJYIEvoDzxKCbEdwqM=";
+    hash = "sha256-AmGYLRVkAmhpj22+ILAL7O2jQj6AzwdZdNaAESI9m5c=";
   };
 
   nativeBuildInputs = [

From 78a56791825f27d974e9f9f858d5a27283a56bea Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 08:28:41 +0300
Subject: [PATCH 269/306] nodejs: skip tests that fail on latest Ope

---
 pkgs/development/web/nodejs/nodejs.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 863be3a828f37..758f9314947ae 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -380,6 +380,10 @@ let
               "test-runner-run"
               "test-runner-watch-mode"
               "test-watch-mode-files_watcher"
+
+              # fail on openssl 3.6.0
+              "test-http2-server-unknown-protocol"
+              "test-tls-ocsp-callback"
             ]
             ++ lib.optionals (!lib.versionAtLeast version "22") [
               "test-tls-multi-key"

From b997b9093d8f8aa685a46b246242403d9e32f0ef Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 8 Oct 2025 09:52:47 +1000
Subject: [PATCH 270/306] go_1_25: 1.25.1 -> 1.25.2

Changelog: https://go.dev/doc/devel/release#go1.25
(cherry picked from commit c27d4b0b745774e5ee1d7f23201b430726c18d6a)
---
 pkgs/development/compilers/go/1.25.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index b25f60b3d5ae2..0908ef39dec9a 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.1";
+  version = "1.25.2";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-0BDBCc7pTYDv5oHqtGvepJGskGv0ZYPDLp8NuwvRpZQ=";
+    hash = "sha256-NxEUDPuH/Oj3oT982GDfBB5sEvdhD0DKxuxvorZeluQ=";
   };
 
   strictDeps = true;

From cb8b359b5fadbb54dd9186001c3e9c4f32b49ff7 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 13:14:21 +0300
Subject: [PATCH 271/306] python313Packages.pip-tools: 7.4.1 -> 7.5.1

- switch to github source (pypi artifacts are named weird now)
- update test skips
---
 .../python-modules/pip-tools/default.nix      | 37 ++++++-------------
 1 file changed, 11 insertions(+), 26 deletions(-)

diff --git a/pkgs/development/python-modules/pip-tools/default.nix b/pkgs/development/python-modules/pip-tools/default.nix
index a5a04a886480e..f73dbc4545503 100644
--- a/pkgs/development/python-modules/pip-tools/default.nix
+++ b/pkgs/development/python-modules/pip-tools/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   build,
   click,
-  fetchPypi,
+  fetchFromGitHub,
   pep517,
   pip,
   pytest-xdist,
@@ -19,14 +19,16 @@
 
 buildPythonPackage rec {
   pname = "pip-tools";
-  version = "7.4.1";
+  version = "7.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-hkgm9Qc4ZEUOJNvuuFzjkgzfsJhIo9aev1N7Uh8UvMk=";
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "pip-tools";
+    tag = "v${version}";
+    hash = "sha256-o2qpaiy+oL3QzfVaGaaRa+2drCjzc6YwNsJlK8NBICY=";
   };
 
   patches = [ ./fix-setup-py-bad-syntax-detection.patch ];
@@ -59,29 +61,12 @@ buildPythonPackage rec {
   disabledTests = [
     # Tests require network access
     "network"
-    "test_direct_reference_with_extras"
-    "test_local_duplicate_subdependency_combined"
     "test_bad_setup_file"
-    # Assertion error
-    "test_compile_recursive_extras"
-    "test_combine_different_extras_of_the_same_package"
-    "test_diff_should_not_uninstall"
-    "test_cli_compile_all_extras_with_multiple_packages"
-    # Deprecations
+    "test_compile_build_targets_setuptools_no_wheel_dep"
+    "test_compile_recursive_extras_build_targets"
+    "test_direct_reference_with_extras"
     "test_error_in_pyproject_toml"
-
-    # pip 25.0 compat issues
-    # https://github.com/jazzband/pip-tools/issues/2112
-    # requirement doesn't end with semicolon
-    "test_resolver"
-    "test_resolver__custom_unsafe_deps"
-    # constraints.txt is now in a tmpdir
-    "test_preserve_via_requirements_constrained_dependencies_when_run_twice"
-    "test_annotate_option"
-    # TypeError("'<' not supported between instances of 'InstallationCandidate' and 'InstallationCandidate'")>.exit_code
-    "test_no_candidates"
-    "test_no_candidates_pre"
-    "test_failure_of_legacy_resolver_prompts_for_backtracking"
+    "test_local_duplicate_subdependency_combined"
   ];
 
   pythonImportsCheck = [ "piptools" ];

From 697c16364fee72d3ccd81db2a6efe53e6b284c11 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 13:25:47 +0300
Subject: [PATCH 272/306] python313Packages.pyopenssl: skip test broken by
 openssl 3.6.0

---
 pkgs/development/python-modules/pyopenssl/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index ebbfcaff6c1f4..aab03cea1990a 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -64,6 +64,8 @@ buildPythonPackage rec {
     "test_wantWriteError"
     # https://github.com/pyca/pyopenssl/issues/1043
     "test_alpn_call_failure"
+    # https://github.com/pyca/pyopenssl/issues/1455
+    "test_client_receives_servers_data"
   ]
   ++ lib.optionals (lib.hasPrefix "libressl" openssl.meta.name) [
     # https://github.com/pyca/pyopenssl/issues/791

From 19d426681272b83a9c8c6215b6a80b7351d7cf6c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 13:54:34 +0300
Subject: [PATCH 273/306] python313Packages.py-vapid: pick patch to fix tests
 with latest cryptography

---
 .../py-vapid/cryptography.patch               | 270 ++++++++++++++++++
 .../python-modules/py-vapid/default.nix       |   6 +
 2 files changed, 276 insertions(+)
 create mode 100644 pkgs/development/python-modules/py-vapid/cryptography.patch

diff --git a/pkgs/development/python-modules/py-vapid/cryptography.patch b/pkgs/development/python-modules/py-vapid/cryptography.patch
new file mode 100644
index 0000000000000..d38088931b447
--- /dev/null
+++ b/pkgs/development/python-modules/py-vapid/cryptography.patch
@@ -0,0 +1,270 @@
+--- a/py_vapid/__init__.py
++++ b/py_vapid/__init__.py
+@@ -25,6 +25,7 @@
+ 
+ class VapidException(Exception):
+     """An exception wrapper for Vapid."""
++
+     pass
+ 
+ 
+@@ -34,6 +35,7 @@ class Vapid01(object):
+     https://tools.ietf.org/html/draft-ietf-webpush-vapid-01
+ 
+     """
++
+     _private_key = None
+     _public_key = None
+     _schema = "WebPush"
+@@ -65,14 +67,14 @@ def from_raw(cls, private_raw):
+         key = ec.derive_private_key(
+             int(binascii.hexlify(b64urldecode(private_raw)), 16),
+             curve=ec.SECP256R1(),
+-            backend=default_backend())
++            backend=default_backend(),
++        )
+         return cls(key)
+ 
+     @classmethod
+     def from_raw_public(cls, public_raw):
+         key = ec.EllipticCurvePublicKey.from_encoded_point(
+-            curve=ec.SECP256R1(),
+-            data=b64urldecode(public_raw)
++            curve=ec.SECP256R1(), data=b64urldecode(public_raw)
+         )
+         ss = cls()
+         ss._public_key = key
+@@ -87,8 +89,7 @@ def from_pem(cls, private_key):
+ 
+         """
+         # not sure why, but load_pem_private_key fails to deserialize
+-        return cls.from_der(
+-            b''.join(private_key.splitlines()[1:-1]))
++        return cls.from_der(b"".join(private_key.splitlines()[1:-1]))
+ 
+     @classmethod
+     def from_der(cls, private_key):
+@@ -98,9 +99,9 @@ def from_der(cls, private_key):
+         :type private_key: bytes
+ 
+         """
+-        key = serialization.load_der_private_key(b64urldecode(private_key),
+-                                                 password=None,
+-                                                 backend=default_backend())
++        key = serialization.load_der_private_key(
++            b64urldecode(private_key), password=None, backend=default_backend()
++        )
+         return cls(key)
+ 
+     @classmethod
+@@ -118,13 +119,13 @@ def from_file(cls, private_key_file=None):
+             vapid.generate_keys()
+             vapid.save_key(private_key_file)
+             return vapid
+-        with open(private_key_file, 'r') as file:
++        with open(private_key_file, "r") as file:
+             private_key = file.read()
+         try:
+             if "-----BEGIN" in private_key:
+-                vapid = cls.from_pem(private_key.encode('utf8'))
++                vapid = cls.from_pem(private_key.encode("utf8"))
+             else:
+-                vapid = cls.from_der(private_key.encode('utf8'))
++                vapid = cls.from_der(private_key.encode("utf8"))
+             return vapid
+         except Exception as exc:
+             logging.error("Could not open private key file: %s", repr(exc))
+@@ -156,11 +157,10 @@ def verify(cls, key, auth):
+         type key: str
+ 
+         """
+-        tokens = auth.rsplit(' ', 1)[1].rsplit('.', 1)
++        tokens = auth.rsplit(" ", 1)[1].rsplit(".", 1)
+         kp = cls().from_raw_public(key.encode())
+         return kp.verify_token(
+-            validation_token=tokens[0].encode(),
+-            verification_token=tokens[1]
++            validation_token=tokens[0].encode(), verification_token=tokens[1]
+         )
+ 
+     @property
+@@ -197,20 +197,19 @@ def public_key(self):
+ 
+     def generate_keys(self):
+         """Generate a valid ECDSA Key Pair."""
+-        self.private_key = ec.generate_private_key(ec.SECP256R1,
+-                                                   default_backend())
++        self.private_key = ec.generate_private_key(curve=ec.SECP256R1(), backend=default_backend())
+ 
+     def private_pem(self):
+         return self.private_key.private_bytes(
+             encoding=serialization.Encoding.PEM,
+             format=serialization.PrivateFormat.PKCS8,
+-            encryption_algorithm=serialization.NoEncryption()
++            encryption_algorithm=serialization.NoEncryption(),
+         )
+ 
+     def public_pem(self):
+         return self.public_key.public_bytes(
+             encoding=serialization.Encoding.PEM,
+-            format=serialization.PublicFormat.SubjectPublicKeyInfo
++            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+         )
+ 
+     def save_key(self, key_file):
+@@ -245,14 +244,14 @@ def verify_token(self, validation_token, verification_token):
+         :rtype: boolean
+ 
+         """
+-        hsig = b64urldecode(verification_token.encode('utf8'))
++        hsig = b64urldecode(verification_token.encode("utf8"))
+         r = int(binascii.hexlify(hsig[:32]), 16)
+         s = int(binascii.hexlify(hsig[32:]), 16)
+         try:
+             self.public_key.verify(
+                 ecutils.encode_dss_signature(r, s),
+                 validation_token,
+-                signature_algorithm=ec.ECDSA(hashes.SHA256())
++                signature_algorithm=ec.ECDSA(hashes.SHA256()),
+             )
+             return True
+         except InvalidSignature:
+@@ -260,23 +259,25 @@ def verify_token(self, validation_token, verification_token):
+ 
+     def _base_sign(self, claims):
+         cclaims = copy.deepcopy(claims)
+-        if not cclaims.get('exp'):
+-            cclaims['exp'] = int(time.time()) + 86400
+-        if not self.conf.get('no-strict', False):
+-            valid = _check_sub(cclaims.get('sub', ''))
++        if not cclaims.get("exp"):
++            cclaims["exp"] = int(time.time()) + 86400
++        if not self.conf.get("no-strict", False):
++            valid = _check_sub(cclaims.get("sub", ""))
+         else:
+-            valid = cclaims.get('sub') is not None
++            valid = cclaims.get("sub") is not None
+         if not valid:
+             raise VapidException(
+                 "Missing 'sub' from claims. "
+-                "'sub' is your admin email as a mailto: link.")
+-        if not re.match(r"^https?://[^/:]+(:\d+)?$",
+-                        cclaims.get("aud", ""),
+-                        re.IGNORECASE):
++                "'sub' is your admin email as a mailto: link."
++            )
++        if not re.match(
++            r"^https?://[^/:]+(:\d+)?$", cclaims.get("aud", ""), re.IGNORECASE
++        ):
+             raise VapidException(
+                 "Missing 'aud' from claims. "
+                 "'aud' is the scheme, host and optional port for this "
+-                "transaction e.g. https://example.com:8080")
++                "transaction e.g. https://example.com:8080"
++            )
+         return cclaims
+ 
+     def sign(self, claims, crypto_key=None):
+@@ -292,19 +293,22 @@ def sign(self, claims, crypto_key=None):
+ 
+         """
+         sig = sign(self._base_sign(claims), self.private_key)
+-        pkey = 'p256ecdsa='
++        pkey = "p256ecdsa="
+         pkey += b64urlencode(
+             self.public_key.public_bytes(
+                 serialization.Encoding.X962,
+-                serialization.PublicFormat.UncompressedPoint
+-            ))
++                serialization.PublicFormat.UncompressedPoint,
++            )
++        )
+         if crypto_key:
+-            crypto_key = crypto_key + ';' + pkey
++            crypto_key = crypto_key + ";" + pkey
+         else:
+             crypto_key = pkey
+ 
+-        return {"Authorization": "{} {}".format(self._schema, sig.strip('=')),
+-                "Crypto-Key": crypto_key}
++        return {
++            "Authorization": "{} {}".format(self._schema, sig.strip("=")),
++            "Crypto-Key": crypto_key,
++        }
+ 
+ 
+ class Vapid02(Vapid01):
+@@ -313,6 +317,7 @@ class Vapid02(Vapid01):
+     https://tools.ietf.org/html/rfc8292
+ 
+     """
++
+     _schema = "vapid"
+ 
+     def sign(self, claims, crypto_key=None):
+@@ -329,14 +334,11 @@ def sign(self, claims, crypto_key=None):
+         """
+         sig = sign(self._base_sign(claims), self.private_key)
+         pkey = self.public_key.public_bytes(
+-                serialization.Encoding.X962,
+-                serialization.PublicFormat.UncompressedPoint
+-            )
+-        return{
++            serialization.Encoding.X962, serialization.PublicFormat.UncompressedPoint
++        )
++        return {
+             "Authorization": "{schema} t={t},k={k}".format(
+-                schema=self._schema,
+-                t=sig,
+-                k=b64urlencode(pkey)
++                schema=self._schema, t=sig, k=b64urlencode(pkey)
+             )
+         }
+ 
+@@ -349,27 +351,23 @@ def verify(cls, auth):
+         :rtype: bool
+ 
+         """
+-        pref_tok = auth.rsplit(' ', 1)
+-        assert pref_tok[0].lower() == cls._schema, (
+-                "Incorrect schema specified")
++        pref_tok = auth.rsplit(" ", 1)
++        assert pref_tok[0].lower() == cls._schema, "Incorrect schema specified"
+         parts = {}
+-        for tok in pref_tok[1].split(','):
+-            kv = tok.split('=', 1)
++        for tok in pref_tok[1].split(","):
++            kv = tok.split("=", 1)
+             parts[kv[0]] = kv[1]
+-        assert 'k' in parts.keys(), (
+-                "Auth missing public key 'k' value")
+-        assert 't' in parts.keys(), (
+-                "Auth missing token set 't' value")
+-        kp = cls().from_raw_public(parts['k'].encode())
+-        tokens = parts['t'].rsplit('.', 1)
++        assert "k" in parts.keys(), "Auth missing public key 'k' value"
++        assert "t" in parts.keys(), "Auth missing token set 't' value"
++        kp = cls().from_raw_public(parts["k"].encode())
++        tokens = parts["t"].rsplit(".", 1)
+         return kp.verify_token(
+-            validation_token=tokens[0].encode(),
+-            verification_token=tokens[1]
++            validation_token=tokens[0].encode(), verification_token=tokens[1]
+         )
+ 
+ 
+ def _check_sub(sub):
+-    """ Check to see if the `sub` is a properly formatted `mailto:`
++    """Check to see if the `sub` is a properly formatted `mailto:`
+ 
+     a `mailto:` should be a SMTP mail address. Mind you, since I run
+     YouFailAtEmail.com, you have every right to yell about how terrible
+@@ -382,9 +380,7 @@ def _check_sub(sub):
+     :rtype: bool
+ 
+     """
+-    pattern = (
+-        r"^(mailto:.+@((localhost|[%\w-]+(\.[%\w-]+)+|([0-9a-f]{1,4}):+([0-9a-f]{1,4})?)))|https:\/\/(localhost|[\w-]+\.[\w\.-]+|([0-9a-f]{1,4}:+)+([0-9a-f]{1,4})?)$" # noqa
+-        )
++    pattern = r"^(mailto:.+@((localhost|[%\w-]+(\.[%\w-]+)+|([0-9a-f]{1,4}):+([0-9a-f]{1,4})?)))|https:\/\/(localhost|[\w-]+\.[\w\.-]+|([0-9a-f]{1,4}:+)+([0-9a-f]{1,4})?)$"  # noqa
+     return re.match(pattern, sub, re.IGNORECASE) is not None
diff --git a/pkgs/development/python-modules/py-vapid/default.nix b/pkgs/development/python-modules/py-vapid/default.nix
index 494afb7008d30..83042bf54525b 100644
--- a/pkgs/development/python-modules/py-vapid/default.nix
+++ b/pkgs/development/python-modules/py-vapid/default.nix
@@ -22,6 +22,12 @@ buildPythonPackage rec {
     hash = "sha256-PIlzts+DhK0MmuZNYnDMxIDguSxwLY9eoswD5rUSR/k=";
   };
 
+  patches = [
+    # Fix tests with latest cryptography
+    # Upstream PR: https://github.com/web-push-libs/vapid/pull/110
+    ./cryptography.patch
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [ cryptography ];

From 84b586af72066183d3be71aa04043e8ac7acda3d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 13:57:32 +0300
Subject: [PATCH 274/306] python313Packages.parsel: skip test broken by error
 message format change

---
 pkgs/development/python-modules/parsel/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/parsel/default.nix b/pkgs/development/python-modules/parsel/default.nix
index 750b61b13d487..e78c495f90c5b 100644
--- a/pkgs/development/python-modules/parsel/default.nix
+++ b/pkgs/development/python-modules/parsel/default.nix
@@ -42,6 +42,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "parsel" ];
 
+  disabledTests = [
+    # asserts on the exact output format of an error message
+    "test_set_xpathfunc"
+  ];
+
   meta = with lib; {
     description = "Python library to extract data from HTML and XML using XPath and CSS selectors";
     homepage = "https://github.com/scrapy/parsel";

From f49ca9070b8cf209d6b1c6f35b0c31a5e5ad7672 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 14:17:04 +0300
Subject: [PATCH 275/306] python313Packages.uvloop: skip test broken by error
 message wording change

---
 pkgs/development/python-modules/uvloop/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index bde90d49d2589..9c4be78c1c729 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -80,6 +80,8 @@ buildPythonPackage rec {
     "tests/test_base.py::TestBaseUV.test_call_at"
     # Pointless and flaky (at least on darwin, depending on the sandbox perhaps)
     "tests/test_dns.py"
+    # Asserts on exact wording of error message
+    "tests/test_tcp.py::Test_AIO_TCP::test_create_connection_open_con_addr"
   ]
   ++ lib.optionals (pythonOlder "3.11") [
     "tests/test_tcp.py::Test_UV_TCPSSL::test_create_connection_ssl_failed_certificat"

From 1d584e3a90dc2154eba1edbd57e1dfc754e31697 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 19:24:33 +0300
Subject: [PATCH 276/306] xwaylandvideobridge: drop

Unmaintained upstream, buggy, not really necessary anymore.
---
 .../services/desktop-managers/plasma6.nix     |  1 -
 .../wayland/xwaylandvideobridge/default.nix   | 62 -------------------
 pkgs/top-level/qt6-packages.nix               |  2 -
 3 files changed, 65 deletions(-)
 delete mode 100644 pkgs/tools/wayland/xwaylandvideobridge/default.nix

diff --git a/nixos/modules/services/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix
index 529734bd503fc..26507d2887f70 100644
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@@ -166,7 +166,6 @@ in
           spectacle
           ffmpegthumbs
           krdp
-          xwaylandvideobridge # exposes Wayland windows to X11 screen capture
         ]
         ++ lib.optionals config.hardware.sensor.iio.enable [
           # This is required for autorotation in Plasma 6
diff --git a/pkgs/tools/wayland/xwaylandvideobridge/default.nix b/pkgs/tools/wayland/xwaylandvideobridge/default.nix
deleted file mode 100644
index fcc46987c74a3..0000000000000
--- a/pkgs/tools/wayland/xwaylandvideobridge/default.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  cmake,
-  extra-cmake-modules,
-  pkg-config,
-  qtbase,
-  qtdeclarative,
-  qtx11extras ? null, # qt5 only
-  kcoreaddons,
-  ki18n,
-  knotifications,
-  kpipewire,
-  kstatusnotifieritem ? null, # qt6 only
-  kwindowsystem,
-  wrapQtAppsHook,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "xwaylandvideobridge";
-  version = "0.4.0";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/xwaylandvideobridge/xwaylandvideobridge-${finalAttrs.version}.tar.xz";
-    hash = "sha256-6nKseypnV46ZlNywYZYC6tMJekb7kzZmHaIA5jkn6+Y=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    extra-cmake-modules
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    qtbase
-    qtdeclarative
-    qtx11extras
-    kcoreaddons
-    ki18n
-    knotifications
-    kpipewire
-    kstatusnotifieritem
-    kwindowsystem
-  ];
-
-  cmakeFlags = [ "-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}" ];
-
-  meta = {
-    description = "Utility to allow streaming Wayland windows to X applications";
-    homepage = "https://invent.kde.org/system/xwaylandvideobridge";
-    license = with lib.licenses; [
-      bsd3
-      cc0
-      gpl2Plus
-    ];
-    maintainers = with lib.maintainers; [ stepbrobd ];
-    platforms = lib.platforms.linux;
-    mainProgram = "xwaylandvideobridge";
-  };
-})
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 6aae3abf5efd1..1f47e74579e3a 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -151,8 +151,6 @@ makeScopeWithSplicing' {
       waylib = callPackage ../development/libraries/waylib { };
 
       wayqt = callPackage ../development/libraries/wayqt { };
-
-      xwaylandvideobridge = kdePackages.callPackage ../tools/wayland/xwaylandvideobridge { };
     }
   );
 }

From ec56981b571018123ead90160a47d9595f529895 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 19:57:30 +0300
Subject: [PATCH 277/306] kdePackages: clean up outdated qtwaylandscanner
 references

---
 pkgs/kde/gear/kdeconnect-kde/default.nix  | 5 ++---
 pkgs/kde/gear/krfb/default.nix            | 5 ++---
 pkgs/kde/plasma/plasma-dialer/default.nix | 5 ++---
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/pkgs/kde/gear/kdeconnect-kde/default.nix b/pkgs/kde/gear/kdeconnect-kde/default.nix
index d81c487e452ff..a9c95f7b6fb57 100644
--- a/pkgs/kde/gear/kdeconnect-kde/default.nix
+++ b/pkgs/kde/gear/kdeconnect-kde/default.nix
@@ -3,9 +3,9 @@
   mkKdeDerivation,
   replaceVars,
   sshfs,
+  qtbase,
   qtconnectivity,
   qtmultimedia,
-  qtwayland,
   pkg-config,
   wayland,
   wayland-protocols,
@@ -30,13 +30,12 @@ mkKdeDerivation {
   extraBuildInputs = [
     qtconnectivity
     qtmultimedia
-    qtwayland
     wayland
     wayland-protocols
     libfakekey
   ];
 
   extraCmakeFlags = [
-    "-DQtWaylandScanner_EXECUTABLE=${qtwayland}/libexec/qtwaylandscanner"
+    "-DQtWaylandScanner_EXECUTABLE=${qtbase}/libexec/qtwaylandscanner"
   ];
 }
diff --git a/pkgs/kde/gear/krfb/default.nix b/pkgs/kde/gear/krfb/default.nix
index 808067fb00009..d2be348080823 100644
--- a/pkgs/kde/gear/krfb/default.nix
+++ b/pkgs/kde/gear/krfb/default.nix
@@ -1,7 +1,7 @@
 {
   mkKdeDerivation,
   pkg-config,
-  qtwayland,
+  qtbase,
   libvncserver,
   pipewire,
   xorg,
@@ -10,12 +10,11 @@ mkKdeDerivation {
   pname = "krfb";
 
   extraCmakeFlags = [
-    "-DQtWaylandScanner_EXECUTABLE=${qtwayland}/libexec/qtwaylandscanner"
+    "-DQtWaylandScanner_EXECUTABLE=${qtbase}/libexec/qtwaylandscanner"
   ];
 
   extraNativeBuildInputs = [ pkg-config ];
   extraBuildInputs = [
-    qtwayland
     libvncserver
     pipewire
     xorg.libXdamage
diff --git a/pkgs/kde/plasma/plasma-dialer/default.nix b/pkgs/kde/plasma/plasma-dialer/default.nix
index ca5a7cc221824..8a595c98a8f8b 100644
--- a/pkgs/kde/plasma/plasma-dialer/default.nix
+++ b/pkgs/kde/plasma/plasma-dialer/default.nix
@@ -1,7 +1,7 @@
 {
   mkKdeDerivation,
   pkg-config,
-  qtwayland,
+  qtbase,
   callaudiod,
   libphonenumber,
   protobuf,
@@ -11,13 +11,12 @@ mkKdeDerivation {
 
   extraNativeBuildInputs = [ pkg-config ];
   extraBuildInputs = [
-    qtwayland
     callaudiod
     libphonenumber
     protobuf
   ];
 
   extraCmakeFlags = [
-    "-DQtWaylandScanner_EXECUTABLE=${qtwayland}/libexec/qtwaylandscanner"
+    "-DQtWaylandScanner_EXECUTABLE=${qtbase}/libexec/qtwaylandscanner"
   ];
 }

From b158d3e44400fbc01cbb33dbc8014bb780c10779 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 21:08:46 +0300
Subject: [PATCH 278/306] python313Packages.mozilla-django-oidc: fix tests with
 latest cryptography

---
 .../mozilla-django-oidc/cryptography.patch          | 13 +++++++++++++
 .../python-modules/mozilla-django-oidc/default.nix  |  6 ++++++
 2 files changed, 19 insertions(+)
 create mode 100644 pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch

diff --git a/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch b/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch
new file mode 100644
index 0000000000000..a8f5de24f1045
--- /dev/null
+++ b/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch
@@ -0,0 +1,13 @@
+diff --git a/tests/test_auth.py b/tests/test_auth.py
+index 345de64..a78dab4 100644
+--- a/tests/test_auth.py
++++ b/tests/test_auth.py
+@@ -1219,7 +1219,7 @@ def test_es256_alg_verification(self, mock_requests):
+         self.backend = OIDCAuthenticationBackend()
+ 
+         # Generate a private key to create a test token with
+-        private_key = ec.generate_private_key(ec.SECP256R1, default_backend())
++        private_key = ec.generate_private_key(ec.SECP256R1(), default_backend())
+ 
+         # Make the public key available through the JWKS response
+         public_numbers = private_key.public_key().public_numbers()
diff --git a/pkgs/development/python-modules/mozilla-django-oidc/default.nix b/pkgs/development/python-modules/mozilla-django-oidc/default.nix
index cd44808efc57e..d3eb5ead33d9e 100644
--- a/pkgs/development/python-modules/mozilla-django-oidc/default.nix
+++ b/pkgs/development/python-modules/mozilla-django-oidc/default.nix
@@ -22,6 +22,12 @@ buildPythonPackage rec {
     hash = "sha256-72F1aLLIId+YClTrpOz3bL8LSq6ZhZjjtv8V/GJGkqs=";
   };
 
+  # Fix test with latest cryptography
+  # Upstream PR: https://github.com/mozilla/mozilla-django-oidc/pull/556
+  patches = [
+    ./cryptography.patch
+  ];
+
   nativeBuildInputs = [
     setuptools
   ];

From b77ddfdb649c8488afbdd556107a665843f207f9 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 21:55:38 +0300
Subject: [PATCH 279/306] python313Packages.mozilla-django-oidc: fix patch

---
 .../mozilla-django-oidc/cryptography.patch             | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch b/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch
index a8f5de24f1045..2217168cc0262 100644
--- a/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch
+++ b/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch
@@ -1,13 +1,11 @@
-diff --git a/tests/test_auth.py b/tests/test_auth.py
-index 345de64..a78dab4 100644
 --- a/tests/test_auth.py
 +++ b/tests/test_auth.py
-@@ -1219,7 +1219,7 @@ def test_es256_alg_verification(self, mock_requests):
+@@ -1234,7 +1234,7 @@ class OIDCAuthenticationBackendES256WithJwksEndpointTestCase(TestCase):
          self.backend = OIDCAuthenticationBackend()
  
          # Generate a private key to create a test token with
 -        private_key = ec.generate_private_key(ec.SECP256R1, default_backend())
 +        private_key = ec.generate_private_key(ec.SECP256R1(), default_backend())
- 
-         # Make the public key available through the JWKS response
-         public_numbers = private_key.public_key().public_numbers()
+         private_key_pem = private_key.private_bytes(
+             serialization.Encoding.PEM,
+             serialization.PrivateFormat.PKCS8,

From 73f3c6395273a5966c8a09834fb12869b193a7d0 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Oct 2025 22:14:17 +0300
Subject: [PATCH 280/306] python313Packages.pip-tools: 7.5.1 -> 7.4.1

This reverts commit cb8b359b5fadbb54dd9186001c3e9c4f32b49ff7.

7.5.x breaks home-assistant-chip-wheels.
Revert to 7.4.1 and add patches to fix Click compatibility instead.
---
 .../python-modules/pip-tools/default.nix      | 55 +++++++++++++++----
 1 file changed, 43 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/pip-tools/default.nix b/pkgs/development/python-modules/pip-tools/default.nix
index f73dbc4545503..594d00194db21 100644
--- a/pkgs/development/python-modules/pip-tools/default.nix
+++ b/pkgs/development/python-modules/pip-tools/default.nix
@@ -4,7 +4,8 @@
   buildPythonPackage,
   build,
   click,
-  fetchFromGitHub,
+  fetchPypi,
+  fetchpatch,
   pep517,
   pip,
   pytest-xdist,
@@ -19,19 +20,32 @@
 
 buildPythonPackage rec {
   pname = "pip-tools";
-  version = "7.5.1";
+  version = "7.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchFromGitHub {
-    owner = "jazzband";
-    repo = "pip-tools";
-    tag = "v${version}";
-    hash = "sha256-o2qpaiy+oL3QzfVaGaaRa+2drCjzc6YwNsJlK8NBICY=";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-hkgm9Qc4ZEUOJNvuuFzjkgzfsJhIo9aev1N7Uh8UvMk=";
   };
 
-  patches = [ ./fix-setup-py-bad-syntax-detection.patch ];
+  patches = [
+    ./fix-setup-py-bad-syntax-detection.patch
+
+    # Backport click 8.2 + 8.3 compatibility from 7.5.1
+    # We can't update to 7.5.1 because of https://github.com/jazzband/pip-tools/issues/2231,
+    # which breaks home-assisstant-chip-wheels.
+    (fetchpatch {
+      url = "https://github.com/jazzband/pip-tools/commit/c7f128e7c533033c2436b52c972eee521fe3890c.diff";
+      excludes = [ "pyproject.toml" ];
+      hash = "sha256-cIFAE/VKyyDWVQktPtPPuxY85DtTvH6pK539WD2cDn4=";
+    })
+    (fetchpatch {
+      url = "https://github.com/jazzband/pip-tools/commit/816ee196c543be53ddba0ea33fb4c7e84217b3b3.diff";
+      hash = "sha256-3GTUNWoy/AmpWv7NUCWIZ+coxb1vUgg6CZhwh6FehZo=";
+    })
+  ];
 
   build-system = [ setuptools-scm ];
 
@@ -61,12 +75,29 @@ buildPythonPackage rec {
   disabledTests = [
     # Tests require network access
     "network"
-    "test_bad_setup_file"
-    "test_compile_build_targets_setuptools_no_wheel_dep"
-    "test_compile_recursive_extras_build_targets"
     "test_direct_reference_with_extras"
-    "test_error_in_pyproject_toml"
     "test_local_duplicate_subdependency_combined"
+    "test_bad_setup_file"
+    # Assertion error
+    "test_compile_recursive_extras"
+    "test_combine_different_extras_of_the_same_package"
+    "test_diff_should_not_uninstall"
+    "test_cli_compile_all_extras_with_multiple_packages"
+    # Deprecations
+    "test_error_in_pyproject_toml"
+
+    # pip 25.0 compat issues
+    # https://github.com/jazzband/pip-tools/issues/2112
+    # requirement doesn't end with semicolon
+    "test_resolver"
+    "test_resolver__custom_unsafe_deps"
+    # constraints.txt is now in a tmpdir
+    "test_preserve_via_requirements_constrained_dependencies_when_run_twice"
+    "test_annotate_option"
+    # TypeError("'<' not supported between instances of 'InstallationCandidate' and 'InstallationCandidate'")>.exit_code
+    "test_no_candidates"
+    "test_no_candidates_pre"
+    "test_failure_of_legacy_resolver_prompts_for_backtracking"
   ];
 
   pythonImportsCheck = [ "piptools" ];

From 2834cb85802f5e6cc33eb95150cd3ea90793517a Mon Sep 17 00:00:00 2001
From: dramforever <dramforever@live.com>
Date: Thu, 9 Oct 2025 06:08:12 +0800
Subject: [PATCH 281/306] onetbb: Fix tests on !isx86 by setting
 HWLOC_SYNTHETIC

Getting core info fails on non-x86 because there's no /sys in the build
sandbox, which causes a few tests to fail.  Provide fake topology data
to satisfy those tests.
---
 pkgs/by-name/on/onetbb/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/on/onetbb/package.nix b/pkgs/by-name/on/onetbb/package.nix
index 29e59fdb0512a..ad181f1464ca6 100644
--- a/pkgs/by-name/on/onetbb/package.nix
+++ b/pkgs/by-name/on/onetbb/package.nix
@@ -94,6 +94,11 @@ stdenv.mkDerivation (finalAttrs: {
     NIX_LDFLAGS = lib.optionalString (
       stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17"
     ) "--undefined-version";
+
+    # Some test fail because hwloc tries to read /sys on non-x86, which doesn't
+    # work in the build sandbox, so provide fake data to satisfy it
+    # See: https://www-lb.open-mpi.org/projects/hwloc/doc/v2.12.2/synthetic.html
+    HWLOC_SYNTHETIC = "node:1 core:1 pu:1";
   };
 
   meta = {

From 418d76c79247c20a86a8fb01a09fe1c1e9a62dca Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 9 Oct 2025 15:10:37 +0300
Subject: [PATCH 282/306] python313Packages.{shiboken6,pyside6}: fetch sources
 by tag

There wasn't a tag before, but there is one now. It's the same actual commit.
---
 pkgs/development/python-modules/shiboken6/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/shiboken6/default.nix b/pkgs/development/python-modules/shiboken6/default.nix
index 2ac75ab8a09df..0267a3ad29748 100644
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@@ -17,7 +17,7 @@ stdenv'.mkDerivation (finalAttrs: {
 
   src = fetchgit {
     url = "https://code.qt.io/pyside/pyside-setup.git";
-    rev = "97af685d5b777323690704fb9848f50aa2728ce9";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-zJV4rrqr2bzWFEG1CWOI+y6wbfQDvWAst6T3aSssj6M=";
   };
 

From e8cc1edaac99a43f3c862319adc9bf5000b37e5c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 9 Oct 2025 15:13:53 +0300
Subject: [PATCH 283/306] pipewire: 1.4.8 -> 1.4.9

Diff: https://gitlab.freedesktop.org/pipewire/pipewire/-/compare/1.4.8...1.4.9

Changelog: https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/1.4.9
---
 pkgs/development/libraries/pipewire/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index ae018111a2c37..bb889da7ea812 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -77,7 +77,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pipewire";
-  version = "1.4.8";
+  version = "1.4.9";
 
   outputs = [
     "out"
@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     rev = finalAttrs.version;
-    sha256 = "sha256-o4puApKXW4pQ0DRcLgZTDor8CAxKehn7Zi56/PzrSLU=";
+    sha256 = "sha256-380KY17l6scVchZAoSHswTvceYl427e79eU11JQallc=";
   };
 
   patches = [

From 3cb9ae95839d79ade94123bf3ff22a2485f9a9ff Mon Sep 17 00:00:00 2001
From: dramforever <dramforever@live.com>
Date: Fri, 10 Oct 2025 15:47:09 +0800
Subject: [PATCH 284/306] python3Packages.inkex: Skip .inx file related tests

These fail on libxml2 >= 2.15 because schematron support is disabled.
These should not affect runtime functionality since it's just testing
that files in inkex are well-formed.
---
 pkgs/development/python-modules/inkex/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/inkex/default.nix b/pkgs/development/python-modules/inkex/default.nix
index 534aa8ae551d3..2a77286bd94d5 100644
--- a/pkgs/development/python-modules/inkex/default.nix
+++ b/pkgs/development/python-modules/inkex/default.nix
@@ -72,6 +72,9 @@ buildPythonPackage {
     "tests/test_inkex_gui_window.py"
     # Failed to find pixmap 'image-missing' in /build/source/tests/data/
     "tests/test_inkex_gui_pixmaps.py"
+    # Fails with libxml2 >= 2.15 with "lxml.etree was compiled without Schematron support"
+    "inkex/tester/test_inx_file.py"
+    "tests/test_inkex_inx.py"
   ];
 
   postPatch = ''

From 4f8a51f26e9792d8274b7a546a03f91d8b90a50c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 11 Oct 2025 08:36:25 -0700
Subject: [PATCH 285/306] Revert "python311Packages.tkinter: mark broken"

This reverts commit 2c574b9c4c6f97074c24d4019cf1279a5613134b because
python311Packages.tkinter was fixed in https://github.com/NixOS/nixpkgs/pull/442184.
---
 pkgs/development/python-modules/tkinter/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/python-modules/tkinter/default.nix b/pkgs/development/python-modules/tkinter/default.nix
index 9918d40969c4b..233b2b2b0e4a9 100644
--- a/pkgs/development/python-modules/tkinter/default.nix
+++ b/pkgs/development/python-modules/tkinter/default.nix
@@ -109,7 +109,6 @@ buildPythonPackage {
   pythonImportsCheck = [ "tkinter" ];
 
   meta = {
-    broken = pythonOlder "3.12"; # tommath.h: No such file or directory
     # Based on first sentence from https://docs.python.org/3/library/tkinter.html
     description = "Standard Python interface to the Tcl/Tk GUI toolkit";
     longDescription = ''

From c3dd2c7888dc536a31bb31b540c92ae6cb1fb72f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 11 Oct 2025 08:37:23 -0700
Subject: [PATCH 286/306] Revert "python311Packages.matplotlib: disable Tk on
 Python 3.11"

This reverts commit 22412a6ab0448c78663d60277cc0a47a3f1987f4.
---
 pkgs/development/python-modules/matplotlib/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 926dd24679712..4c23466b9880a 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   buildPythonPackage,
   isPyPy,
-  pythonAtLeast,
   pythonOlder,
 
   # build-system
@@ -53,8 +52,7 @@
 
   # Tk
   # Darwin has its own "MacOSX" backend, PyPy has tkagg backend and does not support tkinter
-  # tkinter fails to build on Python 3.11
-  enableTk ? (!stdenv.hostPlatform.isDarwin && !isPyPy && pythonAtLeast "3.12"),
+  enableTk ? (!stdenv.hostPlatform.isDarwin && !isPyPy),
   tkinter,
 
   # Qt

From 2e667d8bf97325b548394485b9d8d800b058f0d8 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 12 Oct 2025 09:31:41 +0200
Subject: [PATCH 287/306] nodejs_24: skip failing test on darwin

---
 pkgs/development/web/nodejs/nodejs.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 758f9314947ae..208ded1149736 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -428,6 +428,8 @@ let
               "test-cluster-dgram-1"
               "test/sequential/test-http-server-request-timeouts-mixed.js"
             ]
+            # This is failing on newer macOS versions, no fix has yet been provided upstream:
+            ++ lib.optional (majorVersion == "24" && stdenv.buildPlatform.isDarwin) "test-cluster-dgram-1"
           )
         }"
       ];

From 7500b79a6f47b74e6f48152d4bd585c8375327a3 Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Sun, 12 Oct 2025 11:01:51 +0200
Subject: [PATCH 288/306] openssl: disable failing test on cross to musl

---
 pkgs/development/libraries/openssl/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index b3a5a654494db..0d4e99a4394bc 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -87,7 +87,15 @@ let
         substituteInPlace Configurations/unix-Makefile.tmpl \
           --replace 'ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}' \
                     'ENGINESDIR=$(OPENSSLDIR)/engines-{- $sover_dirname -}'
-      '';
+      ''
+      # This test will fail if the error strings between the build libc and host
+      # libc mismatch, e.g. when cross-compiling from glibc to musl
+      +
+        lib.optionalString
+          (finalAttrs.finalPackage.doCheck && stdenv.hostPlatform.libc != stdenv.buildPlatform.libc)
+          ''
+            rm test/recipes/02-test_errstr.t
+          '';
 
       outputs = [
         "bin"

From cdb57da081701af98fcc5944dc8e174548f5584f Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sun, 12 Oct 2025 15:59:55 +0100
Subject: [PATCH 289/306] ruby_{3_3,3_4}: backport patches for GCC 15 and LLVM
 21
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ruby 3.5.0-preview1 is also affected, but it’s several months old
and the patches do not apply cleanly to it. Hopefully that won’t
be a big deal, since the fixes will be picked up on the next update.

Closes: #449970
---
 .../development/interpreters/ruby/default.nix | 36 +++++++++++++++----
 1 file changed, 29 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index d01980ee3a912..4b1ccdd4fdfaa 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -183,13 +183,35 @@ let
           # make: *** [uncommon.mk:373: do-install-all] Error 1
           enableParallelInstalling = false;
 
-          patches = op useBaseRuby ./do-not-update-gems-baseruby-3.2.patch ++ [
-            # When using a baseruby, ruby always sets "libdir" to the build
-            # directory, which nix rejects due to a reference in to /build/ in
-            # the final product. Removing this reference doesn't seem to break
-            # anything and fixes cross compilation.
-            ./dont-refer-to-build-dir.patch
-          ];
+          patches =
+            op useBaseRuby ./do-not-update-gems-baseruby-3.2.patch
+            ++ [
+              # When using a baseruby, ruby always sets "libdir" to the build
+              # directory, which nix rejects due to a reference in to /build/ in
+              # the final product. Removing this reference doesn't seem to break
+              # anything and fixes cross compilation.
+              ./dont-refer-to-build-dir.patch
+            ]
+            ++ ops (lib.versionOlder ver.majMin "3.4") [
+              (fetchpatch {
+                name = "ruby-3.3-fix-llvm-21.patch";
+                url = "https://github.com/ruby/ruby/commit/5a8d7642168f4ea0d9331fded3033c225bbc36c5.patch";
+                excludes = [ "version.h" ];
+                hash = "sha256-dV98gXXTSKM2ZezTvhVXNaKaXJxiWKEeUbqqL360cWw=";
+              })
+            ]
+            ++ ops (lib.versionAtLeast ver.majMin "3.4" && lib.versionOlder ver.majMin "3.5") [
+              (fetchpatch {
+                name = "ruby-3.4-fix-gcc-15-llvm-21-1.patch";
+                url = "https://github.com/ruby/ruby/commit/846bb760756a3bf1ab12d56d8909e104f16e6940.patch";
+                hash = "sha256-+f0mzHsGAe9FT9NWE345BxzaB6vmWzMTvEfWF84uFOs=";
+              })
+              (fetchpatch {
+                name = "ruby-3.4-fix-gcc-15-llvm-21-2.patch";
+                url = "https://github.com/ruby/ruby/commit/18e176659e8afe402cab7d39972f2d56f2cf378f.patch";
+                hash = "sha256-TKPG1hcC1G2WmUkvNV6QSnvUpTEDqrYKrIk/4fAS8QE=";
+              })
+            ];
 
           cargoRoot = opString yjitSupport "yjit";
 

From e8842bd6946846f1f112e20d97f90264b84550c5 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Sun, 12 Oct 2025 13:25:20 -0400
Subject: [PATCH 290/306] nixos/udev: Resolve names late

See: 2203cd2a7c9f18f55f1bb9e1c5466433dfe8c93e
---
 nixos/modules/services/hardware/udev.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index efc9b486149b2..2a76e1a8b26f2 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -156,7 +156,7 @@ let
 
         # Verify all the udev rules
         echo "Verifying udev rules using udevadm verify..."
-        udevadm verify --resolve-names=never --no-style $out
+        udevadm verify --resolve-names=late --no-style $out
         echo "OK"
 
         # If auto-configuration is disabled, then remove

From b38f14f58b2ca404c958f90d8313f0a2887d227c Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Sun, 12 Oct 2025 18:59:38 +0200
Subject: [PATCH 291/306] iproute2: add patch for redefinition error musl

Fixes pkgsMusl.iproute2 after the update to 6.17.0
---
 pkgs/by-name/ip/iproute2/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index 645d8b07fd0d5..ea44bacf92f25 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -36,6 +36,15 @@ stdenv.mkDerivation rec {
       url = "https://lore.kernel.org/netdev/20240804161054.942439-1-dilfridge@gentoo.org/raw";
       hash = "sha256-47obv6mIn/HO47lt47slpTAFDxiQ3U/voHKzIiIGCTM=";
     })
+  ]
+  # Temporarily gated to keep rebuild counts under control.
+  # The proper fix (targeted to staging) is done in https://github.com/NixOS/nixpkgs/pull/451397
+  ++ lib.optionals stdenv.hostPlatform.isMusl [
+    (fetchurl {
+      name = "musl-redefinition.patch";
+      url = "https://lore.kernel.org/netdev/20251012124002.296018-1-yureka@cyberchaos.dev/raw";
+      hash = "sha256-8gSpZb/B5sMd2OilUQqg0FqM9y3GZd5Ch5AXV5wrCZQ=";
+    })
   ];
 
   postPatch = ''

From 4b1c77fd4e5137799e482e9ff21065c377a2ea43 Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Sun, 12 Oct 2025 00:30:06 +0200
Subject: [PATCH 292/306] systemd: new musl patchset

---
 pkgs/os-specific/linux/systemd/default.nix    |  83 ++--
 ...-allow-to-choose-libc-implementation.patch |  96 ++++
 ...-meson-do-not-use-libcrypt-libxcrypt.patch |  38 ++
 ...citly-link-with-libintl-when-necessa.patch |  56 +++
 ...n-explicitly-set-_LARGEFILE64_SOURCE.patch |  32 ++
 ...musl-not-define-wchar_t-in-their-hea.patch |  31 ++
 ...l-meson-check-existence-of-renameat2.patch |  91 ++++
 ...fully-disable-gshadow-idn-nss-and-ut.patch |  91 ++++
 ...dummy-gshadow-header-file-for-userdb.patch |  44 ++
 ...k-parse_printf_format-implementation.patch | 447 ++++++++++++++++++
 ...e-GNU-specific-version-of-strerror_r.patch |  74 +++
 .../0011-musl-make-strptime-accept-z.patch    | 137 ++++++
 ...trtoll-accept-strings-start-with-dot.patch |  69 +++
 .../0013-musl-introduce-strerrorname_np.patch |  86 ++++
 ...ummy-functions-for-mallinfo-malloc_i.patch |  60 +++
 ...ummy-function-for-gnu_get_libc_versi.patch |  86 ++++
 ...musl-define-__THROW-when-not-defined.patch |  30 ++
 ...-prctl.h-with-our-own-implementation.patch |  29 ++
 ...inet-if_ether.h-with-our-own-impleme.patch |  72 +++
 ...-musl-add-missing-FTW_CONTINUE-macro.patch |  35 ++
 ...usl-add-several-missing-statx-macros.patch |  90 ++++
 ...ict-between-fcntl.h-and-our-forward..patch |  36 ++
 ...22-musl-redefine-HOST_NAME_MAX-as-64.patch |  29 ++
 ...ple-evaluations-in-CPU_ISSET_S-macro.patch |  62 +++
 ...is-one-less-usable-signal-when-built.patch |  57 +++
 ...h-fix-reading-DT_RUNPATH-or-DT_RPATH.patch |  33 ++
 ...t-util-use-llu-for-formatting-rlim_t.patch |  57 +++
 ...musl-time-util-skip-tm.tm_wday-check.patch |  47 ++
 ...ilter-out-.-and-.-even-if-GLOB_ALTDI.patch | 205 ++++++++
 ...everal-random-fixlets-for-unit-tests.patch | 380 +++++++++++++++
 ...usl-ci-add-build-test-and-unit-tests.patch | 352 ++++++++++++++
 31 files changed, 2986 insertions(+), 49 deletions(-)
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0001-musl-meson-allow-to-choose-libc-implementation.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0002-musl-meson-do-not-use-libcrypt-libxcrypt.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0003-musl-meson-explicitly-link-with-libintl-when-necessa.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0004-musl-meson-explicitly-set-_LARGEFILE64_SOURCE.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0005-musl-meson-make-musl-not-define-wchar_t-in-their-hea.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0006-musl-meson-check-existence-of-renameat2.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0007-musl-meson-gracefully-disable-gshadow-idn-nss-and-ut.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0008-musl-introduce-dummy-gshadow-header-file-for-userdb.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0009-musl-add-fallback-parse_printf_format-implementation.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0010-musl-introduce-GNU-specific-version-of-strerror_r.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0011-musl-make-strptime-accept-z.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0012-musl-make-strtoll-accept-strings-start-with-dot.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0013-musl-introduce-strerrorname_np.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0014-musl-introduce-dummy-functions-for-mallinfo-malloc_i.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0015-musl-introduce-dummy-function-for-gnu_get_libc_versi.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0016-musl-define-__THROW-when-not-defined.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0017-musl-replace-sys-prctl.h-with-our-own-implementation.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0018-musl-replace-netinet-if_ether.h-with-our-own-impleme.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0019-musl-add-missing-FTW_CONTINUE-macro.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0020-musl-add-several-missing-statx-macros.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0021-musl-avoid-conflict-between-fcntl.h-and-our-forward..patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0022-musl-redefine-HOST_NAME_MAX-as-64.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0023-musl-avoid-multiple-evaluations-in-CPU_ISSET_S-macro.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0024-musl-core-there-is-one-less-usable-signal-when-built.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0025-musl-build-path-fix-reading-DT_RUNPATH-or-DT_RPATH.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0026-musl-format-util-use-llu-for-formatting-rlim_t.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0027-musl-time-util-skip-tm.tm_wday-check.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0028-musl-glob-util-filter-out-.-and-.-even-if-GLOB_ALTDI.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0029-musl-test-several-random-fixlets-for-unit-tests.patch
 create mode 100644 pkgs/os-specific/linux/systemd/musl/0030-musl-ci-add-build-test-and-unit-tests.patch

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 5c140453a81f7..964ebdf07d2b6 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -262,55 +262,39 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ]
-  ++ lib.optionals stdenv.hostPlatform.isMusl (
-    let
-      # NOTE: the master-next branch does not have stable URLs.
-      # If we need patches that aren't in master yet, they'll have to be
-      # vendored.
-      oe-core = fetchzip {
-        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-4891f47cdaf919033bf1c02cc12e4805e5db99a0.tar.gz";
-        hash = "sha256-YKL/oC+rPZ2EEVNidEV+pJihZgUv7vLb0OASplgktn4=";
-      };
-    in
-    map (patch: "${oe-core}/meta/recipes-core/systemd/systemd/${patch}") [
-      "0003-missing_type.h-add-comparison_fn_t.patch"
-      "0004-add-fallback-parse_printf_format-implementation.patch"
-      "0005-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch"
-      "0006-add-missing-FTW_-macros-for-musl.patch"
-      "0007-Use-uintmax_t-for-handling-rlim_t.patch"
-      "0008-Define-glibc-compatible-basename-for-non-glibc-syste.patch"
-      "0009-Do-not-disable-buffering-when-writing-to-oom_score_a.patch"
-      "0010-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch"
-      "0011-avoid-redefinition-of-prctl_mm_map-structure.patch"
-      "0012-do-not-disable-buffer-in-writing-files.patch"
-      "0013-Handle-__cpu_mask-usage.patch"
-      "0014-Handle-missing-gshadow.patch"
-      "0015-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch"
-      "0016-pass-correct-parameters-to-getdents64.patch"
-      "0017-Adjust-for-musl-headers.patch"
-      "0018-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch"
-      "0019-errno-util-Make-STRERROR-portable-for-musl.patch"
-      "0020-sd-event-Make-malloc_trim-conditional-on-glibc.patch"
-      "0021-shared-Do-not-use-malloc_info-on-musl.patch"
-      "0022-avoid-missing-LOCK_EX-declaration.patch"
-      "0023-include-signal.h-to-avoid-the-undeclared-error.patch"
-      "0024-undef-stdin-for-references-using-stdin-as-a-struct-m.patch"
-      "0025-adjust-header-inclusion-order-to-avoid-redeclaration.patch"
-      "0026-build-path.c-avoid-boot-time-segfault-for-musl.patch"
-    ]
-    ++ [
-      # add a missing include
-      (fetchpatch {
-        url = "https://github.com/systemd/systemd/commit/34fcd3638817060c79e1186b370e46d9b3a7409f.patch";
-        hash = "sha256-Uaewo3jPrZGJttlLcqO6cCj1w3IGZmvbur4+TBdIPxc=";
-        excludes = [ "src/udev/udevd.c" ];
-      })
-      (fetchpatch {
-        url = "https://gitlab.postmarketos.org/postmarketOS/systemd/-/commit/5760be33bd26d7e7c66a7294c5f6fd6c7044683f.patch";
-        hash = "sha256-Om+OhGyZJfZNpbtMInm3vGagLbbtOY71fDMZXj6pbPY=";
-      })
-    ]
-  );
+  ++ lib.optionals stdenv.hostPlatform.isMusl [
+    # Patchset to build with musl by an upstream systemd contributor:
+    # https://github.com/systemd/systemd/pull/37788
+    # This is vendored here because of the lack of permanent patch urls for the unmerged PR
+    ./musl/0001-musl-meson-allow-to-choose-libc-implementation.patch
+    ./musl/0002-musl-meson-do-not-use-libcrypt-libxcrypt.patch
+    ./musl/0003-musl-meson-explicitly-link-with-libintl-when-necessa.patch
+    ./musl/0004-musl-meson-explicitly-set-_LARGEFILE64_SOURCE.patch
+    ./musl/0005-musl-meson-make-musl-not-define-wchar_t-in-their-hea.patch
+    ./musl/0006-musl-meson-check-existence-of-renameat2.patch
+    ./musl/0007-musl-meson-gracefully-disable-gshadow-idn-nss-and-ut.patch
+    ./musl/0008-musl-introduce-dummy-gshadow-header-file-for-userdb.patch
+    ./musl/0009-musl-add-fallback-parse_printf_format-implementation.patch
+    ./musl/0010-musl-introduce-GNU-specific-version-of-strerror_r.patch
+    ./musl/0011-musl-make-strptime-accept-z.patch
+    ./musl/0012-musl-make-strtoll-accept-strings-start-with-dot.patch
+    ./musl/0013-musl-introduce-strerrorname_np.patch
+    ./musl/0014-musl-introduce-dummy-functions-for-mallinfo-malloc_i.patch
+    ./musl/0015-musl-introduce-dummy-function-for-gnu_get_libc_versi.patch
+    ./musl/0016-musl-define-__THROW-when-not-defined.patch
+    ./musl/0017-musl-replace-sys-prctl.h-with-our-own-implementation.patch
+    ./musl/0018-musl-replace-netinet-if_ether.h-with-our-own-impleme.patch
+    ./musl/0019-musl-add-missing-FTW_CONTINUE-macro.patch
+    ./musl/0020-musl-add-several-missing-statx-macros.patch
+    ./musl/0021-musl-avoid-conflict-between-fcntl.h-and-our-forward..patch
+    ./musl/0022-musl-redefine-HOST_NAME_MAX-as-64.patch
+    ./musl/0023-musl-avoid-multiple-evaluations-in-CPU_ISSET_S-macro.patch
+    ./musl/0024-musl-core-there-is-one-less-usable-signal-when-built.patch
+    ./musl/0025-musl-build-path-fix-reading-DT_RUNPATH-or-DT_RPATH.patch
+    ./musl/0026-musl-format-util-use-llu-for-formatting-rlim_t.patch
+    ./musl/0027-musl-time-util-skip-tm.tm_wday-check.patch
+    ./musl/0028-musl-glob-util-filter-out-.-and-.-even-if-GLOB_ALTDI.patch
+  ];
 
   postPatch = ''
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
@@ -622,6 +606,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "zshcompletiondir" "no")
   ]
   ++ lib.optionals stdenv.hostPlatform.isMusl [
+    (lib.mesonOption "libc" "musl")
     (lib.mesonBool "gshadow" false)
     (lib.mesonBool "idn" false)
   ];
diff --git a/pkgs/os-specific/linux/systemd/musl/0001-musl-meson-allow-to-choose-libc-implementation.patch b/pkgs/os-specific/linux/systemd/musl/0001-musl-meson-allow-to-choose-libc-implementation.patch
new file mode 100644
index 0000000000000..a40515f9ec293
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0001-musl-meson-allow-to-choose-libc-implementation.patch
@@ -0,0 +1,96 @@
+From 0e2b9909fed24a682c8566f9df8bbac4e9347186 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 7 Jul 2025 14:11:19 +0900
+Subject: [PATCH 01/30] musl: meson: allow to choose libc implementation
+
+This also introduces skelton directories for storing musl specific code.
+---
+ meson.build               | 17 +++++++++++++++--
+ meson_options.txt         |  2 ++
+ src/libc/meson.build      |  2 ++
+ src/libc/musl/meson.build |  5 +++++
+ 4 files changed, 24 insertions(+), 2 deletions(-)
+ create mode 100644 src/libc/musl/meson.build
+
+diff --git a/meson.build b/meson.build
+index 238b935372..bea62f0eb6 100644
+--- a/meson.build
++++ b/meson.build
+@@ -72,7 +72,10 @@ conf.set10('SD_BOOT', false)
+ 
+ # Create a title-less summary section early, so it ends up first in the output.
+ # More items are added later after they have been detected.
+-summary({'build mode' : get_option('mode')})
++summary({
++        'libc'       : get_option('libc'),
++        'build mode' : get_option('mode'),
++})
+ 
+ #####################################################################
+ 
+@@ -2042,7 +2045,14 @@ dbus_programs = []
+ boot_stubs = []
+ 
+ # This is similar to system_includes below, but for passing custom_target().
+-system_include_args = [
++system_include_args = []
++if get_option('libc') == 'musl'
++        system_include_args += [
++                '-isystem', meson.project_build_root()  / 'src/include/musl',
++                '-isystem', meson.project_source_root() / 'src/include/musl',
++        ]
++endif
++system_include_args += [
+         '-isystem', meson.project_build_root()  / 'src/include/override',
+         '-isystem', meson.project_source_root() / 'src/include/override',
+         '-isystem', meson.project_build_root()  / 'src/include/uapi',
+@@ -2060,6 +2070,9 @@ system_includes = [
+                 is_system : true,
+         ),
+ ]
++if get_option('libc') == 'musl'
++        system_includes += include_directories('src/include/musl', is_system : true)
++endif
+ 
+ basic_includes = [
+         include_directories(
+diff --git a/meson_options.txt b/meson_options.txt
+index d8dec33ec4..ad203ba301 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -397,6 +397,8 @@ option('ima', type : 'boolean',
+ option('ipe', type : 'boolean',
+        description : 'IPE support')
+ 
++option('libc', type : 'combo', choices : ['glibc', 'musl'],
++       description : 'libc implementation to be used')
+ option('acl', type : 'feature', deprecated : { 'true' : 'enabled', 'false' : 'disabled' },
+        description : 'libacl support')
+ option('audit', type : 'feature', deprecated : { 'true' : 'enabled', 'false' : 'disabled' },
+diff --git a/src/libc/meson.build b/src/libc/meson.build
+index eeee98c9d6..306512ffd7 100644
+--- a/src/libc/meson.build
++++ b/src/libc/meson.build
+@@ -16,6 +16,8 @@ libc_wrapper_sources = files(
+         'xattr.c',
+ )
+ 
++subdir('musl')
++
+ sources += libc_wrapper_sources
+ 
+ libc_wrapper_static = static_library(
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+new file mode 100644
+index 0000000000..a876230c67
+--- /dev/null
++++ b/src/libc/musl/meson.build
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: LGPL-2.1-or-later
++
++if get_option('libc') != 'musl'
++        subdir_done()
++endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0002-musl-meson-do-not-use-libcrypt-libxcrypt.patch b/pkgs/os-specific/linux/systemd/musl/0002-musl-meson-do-not-use-libcrypt-libxcrypt.patch
new file mode 100644
index 0000000000000..b59b77dd77120
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0002-musl-meson-do-not-use-libcrypt-libxcrypt.patch
@@ -0,0 +1,38 @@
+From 03010a0716f509b448c84a35bc2723a6f08e0c09 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Wed, 23 Jul 2025 10:24:14 +0900
+Subject: [PATCH 02/30] musl: meson: do not use libcrypt/libxcrypt
+
+Otherwise, when both glibc and musl are installed, libxcrypt or glibc's
+libcrypt may be picked even when we are building systemd with musl.
+Let's not use libcrypt/libxcrypt in that case.
+---
+ meson.build | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index bea62f0eb6..06be36409f 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1013,10 +1013,14 @@ else
+         libatomic = []
+ endif
+ 
+-libcrypt = dependency('libcrypt', 'libxcrypt', required : false)
+-if not libcrypt.found()
+-        # fallback to use find_library() if libcrypt is provided by glibc, e.g. for LibreELEC.
+-        libcrypt = cc.find_library('crypt')
++if get_option('libc') == 'musl'
++        libcrypt = []
++else
++        libcrypt = dependency('libcrypt', 'libxcrypt', required : false)
++        if not libcrypt.found()
++                # fallback to use find_library() if libcrypt is provided by glibc, e.g. for LibreELEC.
++                libcrypt = cc.find_library('crypt')
++        endif
+ endif
+ 
+ foreach func : [
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0003-musl-meson-explicitly-link-with-libintl-when-necessa.patch b/pkgs/os-specific/linux/systemd/musl/0003-musl-meson-explicitly-link-with-libintl-when-necessa.patch
new file mode 100644
index 0000000000000..000c6c65d6f62
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0003-musl-meson-explicitly-link-with-libintl-when-necessa.patch
@@ -0,0 +1,56 @@
+From bf4cb5aeeef23c5f12e6d2258bb8f3d12059f59f Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sat, 6 Sep 2025 16:25:41 +0900
+Subject: [PATCH 03/30] musl: meson: explicitly link with libintl when
+ necessary
+
+On some musl based distributions provides dgettext() by libintl.so.
+Hence, we need to add dependency in that case.
+---
+ meson.build          | 17 +++++++++++++++++
+ src/home/meson.build |  1 +
+ 2 files changed, 18 insertions(+)
+
+diff --git a/meson.build b/meson.build
+index 06be36409f..054752c339 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1002,6 +1002,23 @@ libm = cc.find_library('m')
+ libdl = cc.find_library('dl')
+ libcap = dependency('libcap')
+ 
++# On some distributions that uses musl (e.g. Alpine), libintl.h may be provided by gettext rather than musl.
++# In that case, we need to explicitly link with libintl.so.
++if get_option('libc') == 'musl'
++        if cc.has_function('dgettext', prefix : '''#include <libintl.h>''', args : '-D_GNU_SOURCE')
++                libintl = []
++        else
++                libintl = cc.find_library('intl')
++                if not cc.has_function('dgettext', prefix : '''#include <libintl.h>''', args : '-D_GNU_SOURCE',
++                                       dependencies : libintl)
++                        error('dgettext() not found.')
++                endif
++        endif
++else
++        # When building with glibc, we assume that libintl.h is provided by glibc.
++        libintl = []
++endif
++
+ # On some architectures, libatomic is required. But on some installations,
+ # it is found, but actual linking fails. So let's try to use it opportunistically.
+ # If it is installed, but not needed, it will be dropped because of --as-needed.
+diff --git a/src/home/meson.build b/src/home/meson.build
+index 1937e6f56c..3305334707 100644
+--- a/src/home/meson.build
++++ b/src/home/meson.build
+@@ -115,6 +115,7 @@ modules += [
+                 'sources' : pam_systemd_home_sources,
+                 'dependencies' : [
+                         libcrypt,
++                        libintl,
+                         libpam_misc,
+                         libpam,
+                         threads,
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0004-musl-meson-explicitly-set-_LARGEFILE64_SOURCE.patch b/pkgs/os-specific/linux/systemd/musl/0004-musl-meson-explicitly-set-_LARGEFILE64_SOURCE.patch
new file mode 100644
index 0000000000000..17de4bd3b5dde
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0004-musl-meson-explicitly-set-_LARGEFILE64_SOURCE.patch
@@ -0,0 +1,32 @@
+From 59f993d1acb069f3f2b7d6c71b91696388692702 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 10 Jun 2025 00:29:46 +0900
+Subject: [PATCH 04/30] musl: meson: explicitly set _LARGEFILE64_SOURCE
+
+glibc sets it when _GNU_SOURCE is defined, however, musl does not.
+Let's explicitly define it to make getdents64() and struct dirent64
+available even when building with musl.
+---
+ meson.build | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/meson.build b/meson.build
+index 054752c339..37fb1c2765 100644
+--- a/meson.build
++++ b/meson.build
+@@ -560,6 +560,12 @@ conf.set10('HAVE_WARNING_ZERO_AS_NULL_POINTER_CONSTANT', have)
+ conf.set('_GNU_SOURCE', 1)
+ conf.set('__SANE_USERSPACE_TYPES__', true)
+ 
++if get_option('libc') == 'musl'
++        # glibc always defines _LARGEFILE64_SOURCE when _GNU_SOURCE is set, but musl does not do that,
++        # and it is necessary for making getdents64() and struct dirent64 exist.
++        conf.set('_LARGEFILE64_SOURCE', 1)
++endif
++
+ conf.set('SIZEOF_DEV_T', cc.sizeof('dev_t', prefix : '#include <sys/types.h>'))
+ conf.set('SIZEOF_INO_T', cc.sizeof('ino_t', prefix : '#include <sys/types.h>'))
+ conf.set('SIZEOF_RLIM_T', cc.sizeof('rlim_t', prefix : '#include <sys/resource.h>'))
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0005-musl-meson-make-musl-not-define-wchar_t-in-their-hea.patch b/pkgs/os-specific/linux/systemd/musl/0005-musl-meson-make-musl-not-define-wchar_t-in-their-hea.patch
new file mode 100644
index 0000000000000..faab7be7ca922
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0005-musl-meson-make-musl-not-define-wchar_t-in-their-hea.patch
@@ -0,0 +1,31 @@
+From a8cc582e42dd9fd6b2304003f3e5ab7637c21b73 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 9 Jun 2025 13:37:38 +0900
+Subject: [PATCH 05/30] musl: meson: make musl not define wchar_t in their
+ header
+
+Otherwise, musl defines wchar_t as int, which conflicts with the
+assumption by sd-boot, i.e. wchar_t is 2 bytes.
+---
+ src/boot/meson.build | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/boot/meson.build b/src/boot/meson.build
+index ba0b309acf..bea96bb2e3 100644
+--- a/src/boot/meson.build
++++ b/src/boot/meson.build
+@@ -179,6 +179,11 @@ if get_option('mode') == 'developer' and get_option('debug')
+         efi_c_args += '-DEFI_DEBUG'
+ endif
+ 
++if get_option('libc') == 'musl'
++        # To make musl not define wchar_t as int, rather than short.
++        efi_c_args += '-D__DEFINED_wchar_t'
++endif
++
+ efi_c_ld_args = [
+         '-nostdlib',
+         '-static-pie',
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0006-musl-meson-check-existence-of-renameat2.patch b/pkgs/os-specific/linux/systemd/musl/0006-musl-meson-check-existence-of-renameat2.patch
new file mode 100644
index 0000000000000..9109275b4eb87
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0006-musl-meson-check-existence-of-renameat2.patch
@@ -0,0 +1,91 @@
+From b9904ed6818232d9ad9bb496747b79a6c9606819 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 9 Jun 2025 13:00:37 +0900
+Subject: [PATCH 06/30] musl: meson: check existence of renameat2()
+
+musl-1.2.5 does not provide renameat2(). Note, it is added by
+https://github.com/kraj/musl/commit/05ce67fea99ca09cd4b6625cff7aec9cc222dd5a,
+hence hopefully it will be provided by musl-1.2.6 or newer.
+---
+ meson.build               |  5 +++++
+ src/include/musl/stdio.h  | 13 +++++++++++++
+ src/libc/musl/meson.build |  4 ++++
+ src/libc/musl/stdio.c     | 11 +++++++++++
+ 4 files changed, 33 insertions(+)
+ create mode 100644 src/include/musl/stdio.h
+ create mode 100644 src/libc/musl/stdio.c
+
+diff --git a/meson.build b/meson.build
+index 37fb1c2765..71e422f545 100644
+--- a/meson.build
++++ b/meson.build
+@@ -581,6 +581,7 @@ assert(long_max > 100000)
+ conf.set_quoted('LONG_MAX_STR', '@0@'.format(long_max))
+ 
+ foreach ident : [
++        ['renameat2',         '''#include <stdio.h>''',         get_option('libc') == 'musl'], # since musl-1.2.6
+         ['set_mempolicy',     '''#include <sys/syscall.h>'''],  # declared at numaif.h provided by libnuma, which we do not use
+         ['get_mempolicy',     '''#include <sys/syscall.h>'''],  # declared at numaif.h provided by libnuma, which we do not use
+         ['strerrorname_np',   '''#include <string.h>'''],       # since glibc-2.32
+@@ -614,6 +615,10 @@ foreach ident : [
+         ['pivot_root',        '''#include <unistd.h>'''],       # no known header declares pivot_root
+ ]
+ 
++        if ident.length() >= 3 and not ident[2]
++                continue
++        endif
++
+         have = cc.has_function(ident[0], prefix : ident[1], args : '-D_GNU_SOURCE')
+         conf.set10('HAVE_' + ident[0].to_upper(), have)
+ endforeach
+diff --git a/src/include/musl/stdio.h b/src/include/musl/stdio.h
+new file mode 100644
+index 0000000000..d677201f45
+--- /dev/null
++++ b/src/include/musl/stdio.h
+@@ -0,0 +1,13 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <stdio.h>
++
++#if !HAVE_RENAMEAT2
++#  define RENAME_NOREPLACE (1 << 0)
++#  define RENAME_EXCHANGE  (1 << 1)
++#  define RENAME_WHITEOUT  (1 << 2)
++
++int missing_renameat2(int __oldfd, const char *__old, int __newfd, const char *__new, unsigned __flags);
++#  define renameat2 missing_renameat2
++#endif
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index a876230c67..8d06d919ef 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -3,3 +3,7 @@
+ if get_option('libc') != 'musl'
+         subdir_done()
+ endif
++
++libc_wrapper_sources += files(
++        'stdio.c',
++)
+diff --git a/src/libc/musl/stdio.c b/src/libc/musl/stdio.c
+new file mode 100644
+index 0000000000..102a22cd5c
+--- /dev/null
++++ b/src/libc/musl/stdio.c
+@@ -0,0 +1,11 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <stdio.h>
++#include <sys/syscall.h>
++#include <unistd.h>
++
++#if !HAVE_RENAMEAT2
++int missing_renameat2(int __oldfd, const char *__old, int __newfd, const char *__new, unsigned __flags) {
++        return syscall(__NR_renameat2, __oldfd, __old, __newfd, __new, __flags);
++}
++#endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0007-musl-meson-gracefully-disable-gshadow-idn-nss-and-ut.patch b/pkgs/os-specific/linux/systemd/musl/0007-musl-meson-gracefully-disable-gshadow-idn-nss-and-ut.patch
new file mode 100644
index 0000000000000..8f3d16510d20c
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0007-musl-meson-gracefully-disable-gshadow-idn-nss-and-ut.patch
@@ -0,0 +1,91 @@
+From 1a5f752e2a80e206474f04fe5c1990fdb08742bd Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 22 Jun 2025 02:16:25 +0900
+Subject: [PATCH 07/30] musl: meson: gracefully disable gshadow, idn, nss, and
+ utmp support
+
+- musl does not support gshadow, and does not provide gshadow.h,
+- musl does not provide NI_IDN flag,
+- musl does not support nss, and does not provide nss.h which is necessary
+  for each nss modules,
+- musl does not support utmp, and all utmp related functions do nothing,
+  see https://github.com/kraj/musl/blob/v1.2.5/src/legacy/utmpx.c
+---
+ meson.build | 33 ++++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 71e422f545..5f235d5113 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1638,11 +1638,9 @@ foreach term : ['analyze',
+                 'efi',
+                 'environment-d',
+                 'firstboot',
+-                'gshadow',
+                 'hibernate',
+                 'hostnamed',
+                 'hwdb',
+-                'idn',
+                 'ima',
+                 'ipe',
+                 'initrd',
+@@ -1654,8 +1652,6 @@ foreach term : ['analyze',
+                 'mountfsd',
+                 'networkd',
+                 'nsresourced',
+-                'nss-myhostname',
+-                'nss-systemd',
+                 'oomd',
+                 'portabled',
+                 'pstore',
+@@ -1671,7 +1667,6 @@ foreach term : ['analyze',
+                 'tmpfiles',
+                 'tpm',
+                 'userdb',
+-                'utmp',
+                 'vconsole',
+                 'xdg-autostart']
+         have = get_option(term)
+@@ -1681,14 +1676,34 @@ endforeach
+ 
+ enable_sysusers = conf.get('ENABLE_SYSUSERS') == 1
+ 
++foreach term : ['gshadow',
++                'idn',
++                'nss-myhostname',
++                'nss-systemd',
++                'utmp']
++
++        have = get_option(term)
++        if have and get_option('libc') == 'musl'
++                warning('@0@ support is requested but it is not supported when building with musl, disabling it.'.format(term))
++                have = false
++        endif
++        name = 'ENABLE_' + term.underscorify().to_upper()
++        conf.set10(name, have)
++endforeach
++
+ foreach tuple : [['nss-mymachines', 'machined'],
+                  ['nss-resolve',    'resolve']]
+         want = get_option(tuple[0])
+-        if want.allowed()
+-                have = get_option(tuple[1])
+-                if want.enabled() and not have
+-                        error('@0@ is requested but @1@ is disabled'.format(tuple[0], tuple[1]))
++        if want.enabled()
++                if get_option('libc') == 'musl'
++                        error('@0@ is requested but it is not supported when building with musl.'.format(tuple[0]))
+                 endif
++                if not get_option(tuple[1])
++                        error('@0@ is requested but @1@ is disabled.'.format(tuple[0], tuple[1]))
++                endif
++                have = true
++        elif want.allowed()
++                have = get_option(tuple[1]) and get_option('libc') != 'musl'
+         else
+                 have = false
+         endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0008-musl-introduce-dummy-gshadow-header-file-for-userdb.patch b/pkgs/os-specific/linux/systemd/musl/0008-musl-introduce-dummy-gshadow-header-file-for-userdb.patch
new file mode 100644
index 0000000000000..50bc22cfe6787
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0008-musl-introduce-dummy-gshadow-header-file-for-userdb.patch
@@ -0,0 +1,44 @@
+From 7e023763fb7f56b7c1ea6fa139d79ec2c3e0164f Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 21 Sep 2025 15:24:06 +0900
+Subject: [PATCH 08/30] musl: introduce dummy gshadow header file for userdb
+
+Even 'gshadow' meson option is disabled, src/shared/userdb.c and
+src/shared/user-record-nss.c include gshadow.h unconditionally.
+Let's introduce dummy header to make them compiled gracefully.
+---
+ src/include/musl/gshadow.h | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+ create mode 100644 src/include/musl/gshadow.h
+
+diff --git a/src/include/musl/gshadow.h b/src/include/musl/gshadow.h
+new file mode 100644
+index 0000000000..b57c74ca83
+--- /dev/null
++++ b/src/include/musl/gshadow.h
+@@ -0,0 +1,22 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include <errno.h>
++#include <stddef.h>
++
++struct sgrp {
++        char *sg_namp;
++        char *sg_passwd;
++        char **sg_adm;
++        char **sg_mem;
++};
++
++static inline int getsgnam_r(
++                const char *__name,
++                struct sgrp *__result_buf,
++                char *__buffer,
++                size_t __buflen,
++                struct sgrp **__result) {
++
++        return EOPNOTSUPP; /* this function returns positive errno in case of error. */
++}
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0009-musl-add-fallback-parse_printf_format-implementation.patch b/pkgs/os-specific/linux/systemd/musl/0009-musl-add-fallback-parse_printf_format-implementation.patch
new file mode 100644
index 0000000000000..d4347746067e7
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0009-musl-add-fallback-parse_printf_format-implementation.patch
@@ -0,0 +1,447 @@
+From 444acef17881cbc27057bd85b7dc07b332c03d67 Mon Sep 17 00:00:00 2001
+From: Emil Renner Berthing <systemd@esmil.dk>
+Date: Sat, 22 May 2021 20:26:24 +0200
+Subject: [PATCH 09/30] musl: add fallback parse_printf_format() implementation
+
+musl does not provide parse_printf_format(). Let's introduce a fallback
+method.
+
+Co-authored-by: Yu Watanabe <watanabe.yu+github@gmail.com>
+---
+ src/include/musl/printf.h |  35 +++++
+ src/libc/musl/meson.build |   1 +
+ src/libc/musl/printf.c    | 276 ++++++++++++++++++++++++++++++++++++++
+ src/test/meson.build      |   6 +
+ src/test/test-printf.c    |  67 +++++++++
+ 5 files changed, 385 insertions(+)
+ create mode 100644 src/include/musl/printf.h
+ create mode 100644 src/libc/musl/printf.c
+ create mode 100644 src/test/test-printf.c
+
+diff --git a/src/include/musl/printf.h b/src/include/musl/printf.h
+new file mode 100644
+index 0000000000..4242392c89
+--- /dev/null
++++ b/src/include/musl/printf.h
+@@ -0,0 +1,35 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++/* Copyright 2014 Emil Renner Berthing <systemd@esmil.dk> */
++#pragma once
++
++#include <features.h>
++#include <stddef.h>
++
++#ifdef __GLIBC__
++#include_next <printf.h>
++#else
++
++enum {              /* C type: */
++        PA_INT,     /* int */
++        PA_CHAR,    /* int, cast to char */
++        PA_WCHAR,   /* wide char */
++        PA_STRING,  /* const char *, a '\0'-terminated string */
++        PA_WSTRING, /* const wchar_t *, wide character string */
++        PA_POINTER, /* void * */
++        PA_FLOAT,   /* float */
++        PA_DOUBLE,  /* double */
++        PA_LAST,
++};
++
++/* Flag bits that can be set in a type returned by `parse_printf_format'.  */
++#  define PA_FLAG_MASK        0xff00
++#  define PA_FLAG_LONG_LONG   (1 << 8)
++#  define PA_FLAG_LONG_DOUBLE PA_FLAG_LONG_LONG
++#  define PA_FLAG_LONG        (1 << 9)
++#  define PA_FLAG_SHORT       (1 << 10)
++#  define PA_FLAG_PTR         (1 << 11)
++
++#  define parse_printf_format missing_parse_printf_format
++#endif
++
++size_t missing_parse_printf_format(const char *fmt, size_t n, int *types);
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index 8d06d919ef..3e205e1eb1 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -5,5 +5,6 @@ if get_option('libc') != 'musl'
+ endif
+ 
+ libc_wrapper_sources += files(
++        'printf.c',
+         'stdio.c',
+ )
+diff --git a/src/libc/musl/printf.c b/src/libc/musl/printf.c
+new file mode 100644
+index 0000000000..33c4acd27f
+--- /dev/null
++++ b/src/libc/musl/printf.c
+@@ -0,0 +1,276 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++/* Copyright 2014 Emil Renner Berthing <systemd@esmil.dk> */
++
++#include <limits.h>
++#include <../musl/printf.h> /* This file is also compiled when built with glibc. */
++#include <stdint.h>
++#include <string.h>
++
++static const char* consume_nonarg(const char *fmt) {
++        do {
++                if (*fmt == '\0')
++                        return fmt;
++        } while (*fmt++ != '%');
++        return fmt;
++}
++
++static const char* consume_num(const char *fmt) {
++        for (;*fmt >= '0' && *fmt <= '9'; fmt++)
++                /* do nothing */;
++        return fmt;
++}
++
++static const char* consume_argn(const char *fmt, size_t *arg) {
++        const char *p = fmt;
++        size_t val = 0;
++
++        if (*p < '1' || *p > '9')
++                return fmt;
++        do {
++                val = 10*val + (*p++ - '0');
++        } while (*p >= '0' && *p <= '9');
++
++        if (*p != '$')
++                return fmt;
++        *arg = val;
++        return p+1;
++}
++
++static const char* consume_flags(const char *fmt) {
++        for (;;)
++                switch (*fmt) {
++                case '#':
++                case '0':
++                case '-':
++                case ' ':
++                case '+':
++                case '\'':
++                case 'I':
++                        fmt++;
++                        continue;
++                default:
++                        return fmt;
++                }
++}
++
++enum state {
++        BARE,
++        LPRE,
++        LLPRE,
++        HPRE,
++        HHPRE,
++        BIGLPRE,
++        ZTPRE,
++        JPRE,
++        STOP,
++};
++
++enum type {
++        NONE,
++        PTR,
++        STR,
++        WSTR,
++        INT,
++        LONG,
++        LLONG,
++        SHORT,
++        IMAX,
++        SIZET,
++        CHAR,
++        WCHAR,
++        PDIFF,
++        DBL,
++        LDBL,
++        NPTR,
++        MAXTYPE,
++};
++
++static const short pa_types[MAXTYPE] = {
++        [NONE]   = PA_INT,
++        [PTR]    = PA_POINTER,
++        [STR]    = PA_STRING,
++        [WSTR]   = PA_WSTRING,
++        [INT]    = PA_INT,
++        [SHORT]  = PA_INT | PA_FLAG_SHORT,
++        [LONG]   = PA_INT | PA_FLAG_LONG,
++        [CHAR]   = PA_CHAR,
++        [WCHAR]  = PA_WCHAR,
++        [DBL]    = PA_DOUBLE,
++        [LDBL]   = PA_DOUBLE | PA_FLAG_LONG_DOUBLE,
++        [NPTR]   = PA_FLAG_PTR,
++};
++
++static int state_to_pa_type(unsigned state) {
++        switch (state) {
++        case LLONG:
++#if LONG_MAX != LLONG_MAX
++                return PA_INT | PA_FLAG_LONG_LONG;
++#else
++                return PA_INT | PA_FLAG_LONG;
++#endif
++
++        case IMAX:
++#if LONG_MAX != LLONG_MAX
++                if (sizeof(intmax_t) > sizeof(long))
++                        return PA_INT | PA_FLAG_LONG_LONG;
++#endif
++                if (sizeof(intmax_t) > sizeof(int))
++                        return PA_INT | PA_FLAG_LONG;
++                return PA_INT;
++
++        case SIZET:
++#if LONG_MAX != LLONG_MAX
++                if (sizeof(size_t) > sizeof(long))
++                        return PA_INT | PA_FLAG_LONG_LONG;
++#endif
++                if (sizeof(size_t) > sizeof(int))
++                        return PA_INT | PA_FLAG_LONG;
++                return PA_INT;
++        default:
++                return pa_types[state];
++        }
++}
++
++#define S(x) [(x)-'A']
++#define E(x) (STOP + (x))
++
++static const unsigned char states[]['z'-'A'+1] = {
++        { /* 0: bare types */
++                S('d') = E(INT),    S('i') = E(INT),
++                S('o') = E(INT),    S('u') = E(INT),    S('x') = E(INT),    S('X') = E(INT),
++                S('e') = E(DBL),    S('f') = E(DBL),    S('g') = E(DBL),    S('a') = E(DBL),
++                S('E') = E(DBL),    S('F') = E(DBL),    S('G') = E(DBL),    S('A') = E(DBL),
++                S('c') = E(CHAR),   S('C') = E(WCHAR),
++                S('s') = E(STR),    S('S') = E(WSTR),   S('p') = E(PTR),
++                S('n') = E(NPTR),
++                S('m') = E(NONE),
++                S('l') = LPRE,      S('q') = LLPRE,     S('h') = HPRE,      S('L') = BIGLPRE,
++                S('z') = ZTPRE,     S('Z') = ZTPRE,     S('j') = JPRE,      S('t') = ZTPRE,
++        },
++        { /* 1: l-prefixed */
++                S('d') = E(LONG),   S('i') = E(LONG),
++                S('o') = E(LONG),   S('u') = E(LONG),   S('x') = E(LONG),   S('X') = E(LONG),
++                S('e') = E(DBL),    S('f') = E(DBL),    S('g') = E(DBL),    S('a') = E(DBL),
++                S('E') = E(DBL),    S('F') = E(DBL),    S('G') = E(DBL),    S('A') = E(DBL),
++                S('c') = E(CHAR),   S('s') = E(STR),
++                S('n') = E(NPTR),
++                S('l') = LLPRE,
++        },
++        { /* 2: ll-prefixed */
++                S('d') = E(LLONG),  S('i') = E(LLONG),
++                S('o') = E(LLONG),  S('u') = E(LLONG),  S('x') = E(LLONG),  S('X') = E(LLONG),
++                S('n') = E(NPTR),
++        },
++        { /* 3: h-prefixed */
++                S('d') = E(SHORT),  S('i') = E(SHORT),
++                S('o') = E(SHORT),  S('u') = E(SHORT),  S('x') = E(SHORT),  S('X') = E(SHORT),
++                S('n') = E(NPTR),
++                S('h') = HHPRE,
++        },
++        { /* 4: hh-prefixed */
++                S('d') = E(CHAR),   S('i') = E(CHAR),
++                S('o') = E(CHAR),   S('u') = E(CHAR),   S('x') = E(CHAR),   S('X') = E(CHAR),
++                S('n') = E(NPTR),
++        },
++        { /* 5: L-prefixed */
++                S('e') = E(LDBL),   S('f') = E(LDBL),   S('g') = E(LDBL),   S('a') = E(LDBL),
++                S('E') = E(LDBL),   S('F') = E(LDBL),   S('G') = E(LDBL),   S('A') = E(LDBL),
++        },
++        { /* 6: z- or t-prefixed (assumed to be same size) */
++                S('d') = E(SIZET),  S('i') = E(SIZET),
++                S('o') = E(SIZET),  S('u') = E(SIZET),  S('x') = E(SIZET),  S('X') = E(SIZET),
++                S('n') = E(NPTR),
++        },
++        { /* 7: j-prefixed */
++                S('d') = E(IMAX),   S('i') = E(IMAX),
++                S('o') = E(IMAX),   S('u') = E(IMAX),   S('x') = E(IMAX),   S('X') = E(IMAX),
++                S('n') = E(NPTR),
++        },
++};
++
++size_t missing_parse_printf_format(const char *fmt, size_t n, int *types) {
++        size_t i = 0;
++        size_t last = 0;
++
++        memset(types, 0, n);
++
++        for (;;) {
++                size_t arg;
++
++                fmt = consume_nonarg(fmt);
++                if (*fmt == '\0')
++                        break;
++                if (*fmt == '%') {
++                        fmt++;
++                        continue;
++                }
++                arg = 0;
++                fmt = consume_argn(fmt, &arg);
++                /* flags */
++                fmt = consume_flags(fmt);
++                /* width */
++                if (*fmt == '*') {
++                        size_t warg = 0;
++                        fmt = consume_argn(fmt+1, &warg);
++                        if (warg == 0)
++                                warg = ++i;
++                        if (warg > last)
++                                last = warg;
++                        if (warg <= n && types[warg-1] == NONE)
++                                types[warg-1] = INT;
++                } else
++                        fmt = consume_num(fmt);
++                /* precision */
++                if (*fmt == '.') {
++                        fmt++;
++                        if (*fmt == '*') {
++                                size_t parg = 0;
++                                fmt = consume_argn(fmt+1, &parg);
++                                if (parg == 0)
++                                        parg = ++i;
++                                if (parg > last)
++                                        last = parg;
++                                if (parg <= n && types[parg-1] == NONE)
++                                        types[parg-1] = INT;
++                        } else {
++                                if (*fmt == '-')
++                                        fmt++;
++                                fmt = consume_num(fmt);
++                        }
++                }
++                /* length modifier and conversion specifier */
++                unsigned state = BARE;
++                for (;;) {
++                        unsigned char c = *fmt;
++
++                        if (c == '\0')
++                                break;
++
++                        fmt++;
++
++                        if (c < 'A' || c > 'z')
++                                break;
++
++                        state = states[state]S(c);
++                        if (state == 0 || state >= STOP)
++                                break;
++                }
++
++                if (state <= STOP) /* %m or invalid format */
++                        continue;
++
++                if (arg == 0)
++                        arg = ++i;
++                if (arg > last)
++                        last = arg;
++                if (arg <= n)
++                        types[arg-1] = state - STOP;
++        }
++
++        if (last > n)
++                last = n;
++        for (i = 0; i < last; i++)
++                types[i] = state_to_pa_type(types[i]);
++
++        return last;
++}
+diff --git a/src/test/meson.build b/src/test/meson.build
+index da04b82d47..1dd61effc0 100644
+--- a/src/test/meson.build
++++ b/src/test/meson.build
+@@ -403,6 +403,12 @@ executables += [
+                 'dependencies' : libacl,
+                 'type' : 'manual',
+         },
++        test_template + {
++                'sources' : files(
++                        'test-printf.c',
++                        '../libc/musl/printf.c'
++                ),
++        },
+         test_template + {
+                 'sources' : files('test-process-util.c'),
+                 'dependencies' : threads,
+diff --git a/src/test/test-printf.c b/src/test/test-printf.c
+new file mode 100644
+index 0000000000..28497e902d
+--- /dev/null
++++ b/src/test/test-printf.c
+@@ -0,0 +1,67 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <../musl/printf.h>
++
++#include "memory-util.h"
++#include "strv.h"
++#include "tests.h"
++
++static void test_parse_printf_format_one(const char *fmt) {
++        int arg_types_x[128] = {}, arg_types_y[128] = {};
++        size_t x, y;
++
++        log_debug("/* %s(%s) */", __func__, fmt);
++
++        x = parse_printf_format(fmt, ELEMENTSOF(arg_types_x), arg_types_x);
++        y = missing_parse_printf_format(fmt, ELEMENTSOF(arg_types_y), arg_types_y);
++
++        for (size_t i = 0; i < x; i++)
++                log_debug("x[%zu]=%i", i, arg_types_x[i]);
++        for (size_t i = 0; i < y; i++)
++                log_debug("y[%zu]=%i", i, arg_types_y[i]);
++
++        ASSERT_EQ(memcmp_nn(arg_types_x, x * sizeof(int), arg_types_y, y * sizeof(int)), 0);
++}
++
++TEST(parse_printf_format) {
++        FOREACH_STRING(s, "d", "i", "o", "u", "x", "X", "n")
++                FOREACH_STRING(p, "", "hh", "h", "l", "ll", "j", "z", "Z", "t") {
++                        _cleanup_free_ char *fmt = NULL;
++
++                        ASSERT_NOT_NULL(fmt = strjoin("%", p, s));
++                        test_parse_printf_format_one(fmt);
++                }
++
++        FOREACH_STRING(s, "e", "E", "f", "F", "g", "G", "a", "A")
++                FOREACH_STRING(p, "", "L") {
++                        _cleanup_free_ char *fmt = NULL;
++
++                        ASSERT_NOT_NULL(fmt = strjoin("%", p, s));
++                        test_parse_printf_format_one(fmt);
++                }
++
++        FOREACH_STRING(s, "c", "s")
++                FOREACH_STRING(p, "", "l") {
++                        _cleanup_free_ char *fmt = NULL;
++
++                        ASSERT_NOT_NULL(fmt = strjoin("%", p, s));
++                        test_parse_printf_format_one(fmt);
++                }
++
++        FOREACH_STRING(s, "C", "S", "p", "m", "%") {
++                _cleanup_free_ char *fmt = NULL;
++
++                ASSERT_NOT_NULL(fmt = strjoin("%", s));
++                test_parse_printf_format_one(fmt);
++        }
++
++        test_parse_printf_format_one("asfhghejmlahpgakdmsalc");
++        test_parse_printf_format_one("%d%i%o%u%x%X");
++        test_parse_printf_format_one("%e%E%f%F%g%G%a%A");
++        test_parse_printf_format_one("%c%s%C%S%p%n%m%%");
++        test_parse_printf_format_one("%03d%-05d%+i%hhu%hu%hx%lx");
++        test_parse_printf_format_one("%llx%x%LE%ji%zi%zu%zi%zu%Zi%Zu%tu");
++        test_parse_printf_format_one("%l");
++}
++
++DEFINE_TEST_MAIN(LOG_DEBUG);
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0010-musl-introduce-GNU-specific-version-of-strerror_r.patch b/pkgs/os-specific/linux/systemd/musl/0010-musl-introduce-GNU-specific-version-of-strerror_r.patch
new file mode 100644
index 0000000000000..dd09c69ce95f0
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0010-musl-introduce-GNU-specific-version-of-strerror_r.patch
@@ -0,0 +1,74 @@
+From 8fd471ff028cd3d5df5ee944fdbcefc7e77abc3d Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 23 Jan 2023 23:39:46 -0800
+Subject: [PATCH 10/30] musl: introduce GNU specific version of strerror_r()
+
+musl provides XSI compliant strerror_r(), and it is slightly different
+from the one by glibc.
+Let's introduce a tiny wrapper to convert XSI strerror_r() to GNU one.
+---
+ src/include/musl/string.h |  7 +++++++
+ src/libc/musl/meson.build |  1 +
+ src/libc/musl/string.c    | 26 ++++++++++++++++++++++++++
+ 3 files changed, 34 insertions(+)
+ create mode 100644 src/include/musl/string.h
+ create mode 100644 src/libc/musl/string.c
+
+diff --git a/src/include/musl/string.h b/src/include/musl/string.h
+new file mode 100644
+index 0000000000..cc3da63012
+--- /dev/null
++++ b/src/include/musl/string.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <string.h>
++
++char* strerror_r_gnu(int errnum, char *buf, size_t buflen);
++#define strerror_r strerror_r_gnu
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index 3e205e1eb1..a64f292081 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -7,4 +7,5 @@ endif
+ libc_wrapper_sources += files(
+         'printf.c',
+         'stdio.c',
++        'string.c',
+ )
+diff --git a/src/libc/musl/string.c b/src/libc/musl/string.c
+new file mode 100644
+index 0000000000..c2a9f4a169
+--- /dev/null
++++ b/src/libc/musl/string.c
+@@ -0,0 +1,26 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <errno.h>
++#include <stdio.h>
++#include <string.h>
++
++/* The header errno.h overrides strerror_r with strerror_r_gnu, hence we need to undef it here. */
++#undef strerror_r
++
++char* strerror_r_gnu(int errnum, char *buf, size_t buflen) {
++        int saved_errno = errno;
++        const char *msg = strerror(errnum);
++        size_t l = strlen(msg);
++        if (l >= buflen) {
++                if (buflen > 0) {
++                        if (buflen > 1)
++                                memcpy(buf, msg, buflen - 1);
++                        buf[buflen - 1] = '\0';
++                }
++                errno = ERANGE;
++        } else {
++                memcpy(buf, msg, l + 1);
++                errno = saved_errno;
++        }
++        return buf;
++}
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0011-musl-make-strptime-accept-z.patch b/pkgs/os-specific/linux/systemd/musl/0011-musl-make-strptime-accept-z.patch
new file mode 100644
index 0000000000000..bbffbc8c8a53a
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0011-musl-make-strptime-accept-z.patch
@@ -0,0 +1,137 @@
+From bf670a5af2a78f81ee9396b5b5da49b2df07fcfd Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 9 Sep 2025 08:31:22 +0900
+Subject: [PATCH 11/30] musl: make strptime() accept "%z"
+
+musl v1.2.5 does not support %z specifier in strptime(). Since
+https://github.com/kraj/musl/commit/fced99e93daeefb0192fd16304f978d4401d1d77
+%z is supported, but it only supports strict RFC-822/ISO 8601 format,
+that is, 4 digits with sign (e.g. +0900 or -1400), but does not support
+extended format: 2 digits or colon separated 4 digits (e.g. +09 or -14:00).
+Let's add fallback logic to make it support the extended timezone spec.
+---
+ src/include/musl/time.h   |  7 ++++
+ src/libc/musl/meson.build |  1 +
+ src/libc/musl/time.c      | 86 +++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 94 insertions(+)
+ create mode 100644 src/include/musl/time.h
+ create mode 100644 src/libc/musl/time.c
+
+diff --git a/src/include/musl/time.h b/src/include/musl/time.h
+new file mode 100644
+index 0000000000..349f9a3577
+--- /dev/null
++++ b/src/include/musl/time.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <time.h>
++
++char* strptime_fallback(const char *s, const char *format, struct tm *tm);
++#define strptime strptime_fallback
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index a64f292081..5fb590e868 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -8,4 +8,5 @@ libc_wrapper_sources += files(
+         'printf.c',
+         'stdio.c',
+         'string.c',
++        'time.c',
+ )
+diff --git a/src/libc/musl/time.c b/src/libc/musl/time.c
+new file mode 100644
+index 0000000000..12108166b2
+--- /dev/null
++++ b/src/libc/musl/time.c
+@@ -0,0 +1,86 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <stdbool.h>
++#include <string.h>
++#include <time.h>
++
++/* The header time.h overrides strptime with strerror_fallback, hence we need to undef it here. */
++#undef strptime
++
++char* strptime_fallback(const char *s, const char *format, struct tm *tm) {
++        /* First try native strptime() as is, and if it succeeds, return the resuit as is. */
++        char *k = strptime(s, format, tm);
++        if (k)
++                return k;
++
++        /* Check inputs for safety. */
++        if (!s || !format || !tm)
++                return NULL;
++
++        /* We only fallback if the format is exactly "%z". */
++        if (strcmp(format, "%z") != 0)
++                return NULL;
++
++        /* In the below, we parse timezone specifiction compatible with RFC-822/ISO 8601 and its extensions
++         * (e.g. +06, +0900, or -03:00). */
++
++        bool positive;
++        switch (*s) {
++        case '+':
++                positive = true;
++                break;
++        case '-':
++                positive = false;
++                break;
++        default:
++                return NULL;
++        }
++
++        s++;
++
++        if (*s < '0' || *s > '9')
++                return NULL;
++        long t = (*s - '0') * 10 * 60 * 60;
++
++        s++;
++
++        if (*s < '0' || *s > '9')
++                return NULL;
++        t += (*s - '0') * 60 * 60;
++
++        s++;
++
++        if (*s == '\0') /* 2 digits case */
++                goto finalize;
++
++        if (*s == ':') /* skip colon */
++                s++;
++
++        if (*s < '0' || *s >= '6') /* refuse minutes equal to or larger than 60 */
++                return NULL;
++        t += (*s - '0') * 10 * 60;
++
++        s++;
++
++        if (*s < '0' || *s > '9')
++                return NULL;
++        t += (*s - '0') * 60;
++
++        s++;
++
++        if (*s != '\0')
++                return NULL;
++
++finalize:
++        if (t > 24 * 60 * 60) /* refuse larger than 24 hours */
++                return NULL;
++
++        if (!positive)
++                t = -t;
++
++        *tm = (struct tm) {
++                .tm_gmtoff = t,
++        };
++
++        return (char*) s;
++}
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0012-musl-make-strtoll-accept-strings-start-with-dot.patch b/pkgs/os-specific/linux/systemd/musl/0012-musl-make-strtoll-accept-strings-start-with-dot.patch
new file mode 100644
index 0000000000000..2833a951a3d2a
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0012-musl-make-strtoll-accept-strings-start-with-dot.patch
@@ -0,0 +1,69 @@
+From d97f38a2ffd0aca2a1d7b8a5bbbd1994e786c7bc Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 9 Sep 2025 09:10:44 +0900
+Subject: [PATCH 12/30] musl: make strtoll() accept strings start with dot
+
+glibc accepts strings start with '.' and returns 0, but musl refuses
+them. Let's accept them, as our code assumes the function accept such
+strings.
+---
+ src/include/musl/stdlib.h |  7 +++++++
+ src/libc/musl/meson.build |  1 +
+ src/libc/musl/stdlib.c    | 19 +++++++++++++++++++
+ 3 files changed, 27 insertions(+)
+ create mode 100644 src/include/musl/stdlib.h
+ create mode 100644 src/libc/musl/stdlib.c
+
+diff --git a/src/include/musl/stdlib.h b/src/include/musl/stdlib.h
+new file mode 100644
+index 0000000000..ecfd6ccb43
+--- /dev/null
++++ b/src/include/musl/stdlib.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <stdlib.h>
++
++long long strtoll_fallback(const char *nptr, char **endptr, int base);
++#define strtoll strtoll_fallback
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index 5fb590e868..ea09af9fa5 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -7,6 +7,7 @@ endif
+ libc_wrapper_sources += files(
+         'printf.c',
+         'stdio.c',
++        'stdlib.c',
+         'string.c',
+         'time.c',
+ )
+diff --git a/src/libc/musl/stdlib.c b/src/libc/musl/stdlib.c
+new file mode 100644
+index 0000000000..d4e2714217
+--- /dev/null
++++ b/src/libc/musl/stdlib.c
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <stdlib.h>
++
++/* The header stdlib.h overrides strtoll with strtoll_fallback, hence we need to undef it here. */
++#undef strtoll
++
++long long strtoll_fallback(const char *nptr, char **endptr, int base) {
++        /* glibc returns 0 if the first character is '.' without error, but musl returns as an error.
++         * As our code assumes the glibc behavior, let's accept string starts with '.'. */
++        if (nptr && *nptr == '.') {
++                if (endptr)
++                        *endptr = (char*) nptr;
++                return 0;
++        }
++
++        /* Otherwise, use the native strtoll(). */
++        return strtoll(nptr, endptr, base);
++}
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0013-musl-introduce-strerrorname_np.patch b/pkgs/os-specific/linux/systemd/musl/0013-musl-introduce-strerrorname_np.patch
new file mode 100644
index 0000000000000..5203caf09f3db
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0013-musl-introduce-strerrorname_np.patch
@@ -0,0 +1,86 @@
+From 96b9f85d08be6f60768d1ebcdaf77e8e5dafebf6 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Fri, 5 Sep 2025 09:20:50 +0900
+Subject: [PATCH 13/30] musl: introduce strerrorname_np()
+
+musl does not provide strerrorname_np(). Thus, we need to implement it.
+---
+ src/include/musl/string.h                 |  2 ++
+ src/libc/musl/generate-strerrorname_np.sh | 39 +++++++++++++++++++++++
+ src/libc/musl/meson.build                 |  7 ++++
+ 3 files changed, 48 insertions(+)
+ create mode 100755 src/libc/musl/generate-strerrorname_np.sh
+
+diff --git a/src/include/musl/string.h b/src/include/musl/string.h
+index cc3da63012..7317c8dea0 100644
+--- a/src/include/musl/string.h
++++ b/src/include/musl/string.h
+@@ -5,3 +5,5 @@
+ 
+ char* strerror_r_gnu(int errnum, char *buf, size_t buflen);
+ #define strerror_r strerror_r_gnu
++
++const char* strerrorname_np(int errnum);
+diff --git a/src/libc/musl/generate-strerrorname_np.sh b/src/libc/musl/generate-strerrorname_np.sh
+new file mode 100755
+index 0000000000..0e0fb8b187
+--- /dev/null
++++ b/src/libc/musl/generate-strerrorname_np.sh
+@@ -0,0 +1,39 @@
++#!/usr/bin/env bash
++# SPDX-License-Identifier: LGPL-2.1-or-later
++set -eu
++set -o pipefail
++
++# This is based on src/basic/generate-errno-list.sh.
++
++# ECANCELLED, EDEADLOCK, ENOTSUP, EREFUSED, and EWOULDBLOCK are defined as aliases of
++# ECANCELED, EDEADLK, EOPNOTSUPP, ECONNREFUSED, and EAGAIN, respectively. Let's drop them.
++
++CC=${1:?}
++shift
++
++cat <<'EOF'
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <errno.h>
++#include <stddef.h>
++#include <string.h>
++
++static const char * const errno_table[] = {
++EOF
++
++$CC -dM -include errno.h - </dev/null | \
++    grep -Ev '^#define[[:space:]]+(ECANCELLED|EDEADLOCK|ENOTSUP|EREFUSED|EWOULDBLOCK)' | \
++    awk '/^#define[ \t]+E[^ _]+[ \t]+/ { printf "        [%s] = \"%s\",\n", $2, $2; }' | \
++    sort
++
++cat <<'EOF'
++};
++
++const char* strerrorname_np(int errnum) {
++        if (errnum < 0)
++                errnum = -errnum;
++        if ((size_t) errnum >= sizeof(errno_table) / sizeof(errno_table[0]))
++                return NULL;
++        return errno_table[errnum];
++}
++EOF
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index ea09af9fa5..1cb6bf28c1 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -11,3 +11,10 @@ libc_wrapper_sources += files(
+         'string.c',
+         'time.c',
+ )
++
++generator= files('generate-strerrorname_np.sh')
++libc_wrapper_sources += custom_target(
++        input : generator,
++        output : 'strerrorname_np.c',
++        command : [env, 'bash', generator, cpp],
++        capture : true)
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0014-musl-introduce-dummy-functions-for-mallinfo-malloc_i.patch b/pkgs/os-specific/linux/systemd/musl/0014-musl-introduce-dummy-functions-for-mallinfo-malloc_i.patch
new file mode 100644
index 0000000000000..41a8c6b4e2aa7
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0014-musl-introduce-dummy-functions-for-mallinfo-malloc_i.patch
@@ -0,0 +1,60 @@
+From 331e8b9158f1bb3b4ff5db2c17a16a60640e0c12 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 10 Jun 2025 00:40:59 +0900
+Subject: [PATCH 14/30] musl: introduce dummy functions for mallinfo(),
+ malloc_info(), and malloc_trim()
+
+These functions are not provided by musl.
+---
+ src/include/musl/malloc.h | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+ create mode 100644 src/include/musl/malloc.h
+
+diff --git a/src/include/musl/malloc.h b/src/include/musl/malloc.h
+new file mode 100644
+index 0000000000..9d15d4bf91
+--- /dev/null
++++ b/src/include/musl/malloc.h
+@@ -0,0 +1,39 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include <errno.h>
++#include <stdio.h>
++
++/* struct mallinfo2 will be defined and struct mallinfo is converted to struct mallinfo2 in
++ * override/malloc.h. Hence, here we define struct mallinfo. */
++
++struct mallinfo {
++        int arena;    /* non-mmapped space allocated from system */
++        int ordblks;  /* number of free chunks */
++        int smblks;   /* number of fastbin blocks */
++        int hblks;    /* number of mmapped regions */
++        int hblkhd;   /* space in mmapped regions */
++        int usmblks;  /* always 0, preserved for backwards compatibility */
++        int fsmblks;  /* space available in freed fastbin blocks */
++        int uordblks; /* total allocated space */
++        int fordblks; /* total free space */
++        int keepcost; /* top-most, releasable (via malloc_trim) space */
++};
++
++static inline struct mallinfo mallinfo(void) {
++        return (struct mallinfo) {};
++}
++
++static inline int malloc_info(int options, FILE *stream) {
++        if (options != 0)
++                errno = EINVAL;
++        else
++                errno = EOPNOTSUPP;
++        return -1;
++}
++
++static inline int malloc_trim(size_t pad) {
++        return 0;
++}
++
++#include_next <malloc.h>
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0015-musl-introduce-dummy-function-for-gnu_get_libc_versi.patch b/pkgs/os-specific/linux/systemd/musl/0015-musl-introduce-dummy-function-for-gnu_get_libc_versi.patch
new file mode 100644
index 0000000000000..4ec71eb7e25ae
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0015-musl-introduce-dummy-function-for-gnu_get_libc_versi.patch
@@ -0,0 +1,86 @@
+From 5067b1cfac07dbb50d7813b2a900b1b6f8e6e4bd Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 8 Jun 2025 10:07:54 +0900
+Subject: [PATCH 15/30] musl: introduce dummy function for
+ gnu_get_libc_version()
+
+As the header gnu/libc-version.h and gnu_get_libc_version() function
+are glibc specific, and musl does not provide them.
+---
+ src/include/musl/gnu/libc-version.h | 8 ++++++++
+ src/shared/condition.c              | 9 +++++++--
+ src/test/test-condition.c           | 8 +++++---
+ 3 files changed, 20 insertions(+), 5 deletions(-)
+ create mode 100644 src/include/musl/gnu/libc-version.h
+
+diff --git a/src/include/musl/gnu/libc-version.h b/src/include/musl/gnu/libc-version.h
+new file mode 100644
+index 0000000000..8ad0ed16b8
+--- /dev/null
++++ b/src/include/musl/gnu/libc-version.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include <stddef.h>
++
++static inline const char* gnu_get_libc_version(void) {
++        return NULL;
++}
+diff --git a/src/shared/condition.c b/src/shared/condition.c
+index b09eff1bfb..b27b24aba7 100644
+--- a/src/shared/condition.c
++++ b/src/shared/condition.c
+@@ -255,8 +255,13 @@ static int condition_test_version(Condition *c, char **env) {
+         if (streq(word, "systemd"))
+                 return condition_test_version_cmp(p, STRINGIFY(PROJECT_VERSION));
+ 
+-        if (streq(word, "glibc"))
+-                return condition_test_version_cmp(p, gnu_get_libc_version());
++        if (streq(word, "glibc")) {
++                const char *v = gnu_get_libc_version();
++                if (!v)
++                        return false; /* built with musl */
++
++                return condition_test_version_cmp(p, v);
++        }
+ 
+         /* if no predicate has been set, default to "kernel" and use the whole parameter as condition */
+         if (!streq(word, "kernel"))
+diff --git a/src/test/test-condition.c b/src/test/test-condition.c
+index 11b3a42418..898c111ffe 100644
+--- a/src/test/test-condition.c
++++ b/src/test/test-condition.c
+@@ -669,8 +669,10 @@ TEST(condition_test_version) {
+         condition_free(condition);
+ 
+         /* Test glibc version */
++        bool expected = !!gnu_get_libc_version();
++
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, "glibc > 1", false, false)));
+-        ASSERT_OK_POSITIVE(condition_test(condition, environ));
++        ASSERT_OK_EQ(condition_test(condition, environ), expected);
+         condition_free(condition);
+ 
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, "glibc < 2", false, false)));
+@@ -678,7 +680,7 @@ TEST(condition_test_version) {
+         condition_free(condition);
+ 
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, "glibc < 9999", false, false)));
+-        ASSERT_OK_POSITIVE(condition_test(condition, environ));
++        ASSERT_OK_EQ(condition_test(condition, environ), expected);
+         condition_free(condition);
+ 
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, "glibc > 9999", false, false)));
+@@ -688,7 +690,7 @@ TEST(condition_test_version) {
+         v = strjoina("glibc = ", gnu_get_libc_version());
+ 
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, v, false, false)));
+-        ASSERT_OK_POSITIVE(condition_test(condition, environ));
++        ASSERT_OK_EQ(condition_test(condition, environ), expected);
+         condition_free(condition);
+ 
+         v = strjoina("glibc != ", gnu_get_libc_version());
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0016-musl-define-__THROW-when-not-defined.patch b/pkgs/os-specific/linux/systemd/musl/0016-musl-define-__THROW-when-not-defined.patch
new file mode 100644
index 0000000000000..16fc6570320a4
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0016-musl-define-__THROW-when-not-defined.patch
@@ -0,0 +1,30 @@
+From 65a6110f75e3bcf980aa4138ad18c06f351b78f5 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 9 Jun 2025 14:00:55 +0900
+Subject: [PATCH 16/30] musl: define __THROW when not defined
+
+__THROW is internally used by glibc headers, hence our implementation of
+net/if.h and sys/mount.h also use it. However, musl does not provide
+the macro. Let's define it when not defined.
+---
+ src/include/musl/features.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+ create mode 100644 src/include/musl/features.h
+
+diff --git a/src/include/musl/features.h b/src/include/musl/features.h
+new file mode 100644
+index 0000000000..bd6d00a9d4
+--- /dev/null
++++ b/src/include/musl/features.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <features.h>
++
++#ifndef __THROW
++#define __THROW
++#endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0017-musl-replace-sys-prctl.h-with-our-own-implementation.patch b/pkgs/os-specific/linux/systemd/musl/0017-musl-replace-sys-prctl.h-with-our-own-implementation.patch
new file mode 100644
index 0000000000000..4d733f000d473
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0017-musl-replace-sys-prctl.h-with-our-own-implementation.patch
@@ -0,0 +1,29 @@
+From 75aa46c9399664d2a1cdabefcad2899ebfabc741 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 23 Jun 2025 16:00:21 +0900
+Subject: [PATCH 17/30] musl: replace sys/prctl.h with our own implementation
+
+To avoid conflicts between musl's sys/prctl.h and linux/prctl.h.
+---
+ src/include/musl/sys/prctl.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+ create mode 100644 src/include/musl/sys/prctl.h
+
+diff --git a/src/include/musl/sys/prctl.h b/src/include/musl/sys/prctl.h
+new file mode 100644
+index 0000000000..2c830d2649
+--- /dev/null
++++ b/src/include/musl/sys/prctl.h
+@@ -0,0 +1,9 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++/* This is for avoiding conflicts between musl's sys/prctl.h and linux/prctl.h. */
++
++#include <features.h>
++#include <linux/prctl.h>        /* IWYU pragma: export */
++
++int prctl(int, ...);
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0018-musl-replace-netinet-if_ether.h-with-our-own-impleme.patch b/pkgs/os-specific/linux/systemd/musl/0018-musl-replace-netinet-if_ether.h-with-our-own-impleme.patch
new file mode 100644
index 0000000000000..c0044956ad0f7
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0018-musl-replace-netinet-if_ether.h-with-our-own-impleme.patch
@@ -0,0 +1,72 @@
+From 6e77a74ca91e689a43651d9eeb5f8f40893eed76 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 23 Jun 2025 16:08:37 +0900
+Subject: [PATCH 18/30] musl: replace netinet/if_ether.h with our own
+ implementation
+
+musl's netinet/if_ether.h conflicts with linux/if_ether.h.
+The reimplementation is mostly equivalent with what glibc does.
+
+This also unset __UAPI_DEF_ETHHDR before including linux/if_ether.h,
+otherwise struct ethhdr may not be defined by the header when it is
+defined.
+---
+ src/include/musl/linux/if_ether.h   |  5 +++++
+ src/include/musl/netinet/if_ether.h | 33 +++++++++++++++++++++++++++++
+ 2 files changed, 38 insertions(+)
+ create mode 100644 src/include/musl/linux/if_ether.h
+ create mode 100644 src/include/musl/netinet/if_ether.h
+
+diff --git a/src/include/musl/linux/if_ether.h b/src/include/musl/linux/if_ether.h
+new file mode 100644
+index 0000000000..e28cd4a014
+--- /dev/null
++++ b/src/include/musl/linux/if_ether.h
+@@ -0,0 +1,5 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#undef __UAPI_DEF_ETHHDR
++#include_next <linux/if_ether.h>
+diff --git a/src/include/musl/netinet/if_ether.h b/src/include/musl/netinet/if_ether.h
+new file mode 100644
+index 0000000000..62f4ac03b3
+--- /dev/null
++++ b/src/include/musl/netinet/if_ether.h
+@@ -0,0 +1,33 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++/* glibc's netinet/if_ether.h does the following:
++ * - include linux/if_ether.h, net/ethernet.h, and net/if_arp.h,
++ * - define struct ether_arp, and relevant macros,
++ * - define ETHER_MAP_IP_MULTICAST() macro (currently we do not use it).
++ * However, musl's netinet/if_ether.h conflicts with linux/if_ether.h.
++ * Let's use the same way that glibc uses. */
++
++#include <linux/if_ether.h>     /* IWYU pragma: export */
++#include <net/ethernet.h>       /* IWYU pragma: export */
++#include <net/if_arp.h>         /* IWYU pragma: export */
++
++/*
++ * Ethernet Address Resolution Protocol.
++ *
++ * See RFC 826 for protocol description.  Structure below is adapted
++ * to resolving internet addresses.  Field names used correspond to
++ * RFC 826.
++ */
++struct  ether_arp {
++        struct  arphdr ea_hdr;          /* fixed-size header */
++        uint8_t arp_sha[ETH_ALEN];      /* sender hardware address */
++        uint8_t arp_spa[4];             /* sender protocol address */
++        uint8_t arp_tha[ETH_ALEN];      /* target hardware address */
++        uint8_t arp_tpa[4];             /* target protocol address */
++};
++#define arp_hrd ea_hdr.ar_hrd
++#define arp_pro ea_hdr.ar_pro
++#define arp_hln ea_hdr.ar_hln
++#define arp_pln ea_hdr.ar_pln
++#define arp_op  ea_hdr.ar_op
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0019-musl-add-missing-FTW_CONTINUE-macro.patch b/pkgs/os-specific/linux/systemd/musl/0019-musl-add-missing-FTW_CONTINUE-macro.patch
new file mode 100644
index 0000000000000..24855be78c21d
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0019-musl-add-missing-FTW_CONTINUE-macro.patch
@@ -0,0 +1,35 @@
+From 7d4b4e49729f7c7d5164ba2c5040ed522d68ee7a Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Mon, 25 Feb 2019 15:00:06 +0800
+Subject: [PATCH 19/30] musl: add missing FTW_CONTINUE macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is to avoid build failures like below for musl.
+
+  test-recurse-dir.c:23:24: error: ‘FTW_CONTINUE’ undeclared
+
+Co-authored-by: Yu Watanabe <watanabe.yu+github@gmail.com>
+---
+ src/include/musl/ftw.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+ create mode 100644 src/include/musl/ftw.h
+
+diff --git a/src/include/musl/ftw.h b/src/include/musl/ftw.h
+new file mode 100644
+index 0000000000..fd153734d0
+--- /dev/null
++++ b/src/include/musl/ftw.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <ftw.h>
++
++#ifndef FTW_CONTINUE
++#define FTW_CONTINUE 0
++#endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0020-musl-add-several-missing-statx-macros.patch b/pkgs/os-specific/linux/systemd/musl/0020-musl-add-several-missing-statx-macros.patch
new file mode 100644
index 0000000000000..6dd1589019b01
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0020-musl-add-several-missing-statx-macros.patch
@@ -0,0 +1,90 @@
+From c306693ac26aef3d5fb06fa0981d911bda9b93d7 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 22 Jun 2025 00:38:58 +0900
+Subject: [PATCH 20/30] musl: add several missing statx macros
+
+glibc's sys/stat.h includes linux/stat.h, and we have copy of it from
+the latest kernel, hence all new flags are always defined.
+However, musl's sys/stat.h does not include linux/stat.h, and moreover,
+they conflict with each other, hence we cannot include both header
+simultaneously. Let's define missing macros to support musl.
+---
+ src/include/musl/sys/stat.h | 66 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 66 insertions(+)
+ create mode 100644 src/include/musl/sys/stat.h
+
+diff --git a/src/include/musl/sys/stat.h b/src/include/musl/sys/stat.h
+new file mode 100644
+index 0000000000..610dd3e699
+--- /dev/null
++++ b/src/include/musl/sys/stat.h
+@@ -0,0 +1,66 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <sys/stat.h>
++
++#include <assert.h>
++#include <stddef.h>
++
++/* musl's sys/stat.h does not include linux/stat.h, and unfortunately they conflict with each other.
++ * Hence, some relatively new macros need to be explicitly defined here. */
++
++/* Before 23ab04a8630225371455d5f4538fd078665bb646, statx.stx_mnt_id is not defined. */
++#ifndef STATX_MNT_ID
++static_assert(offsetof(struct statx, __pad1) == offsetof(struct statx, stx_dev_minor) + sizeof(uint32_t), "");
++#define stx_mnt_id __pad1[0]
++#endif
++
++#ifndef STATX_MNT_ID
++#define STATX_MNT_ID            0x00001000U
++#endif
++#ifndef STATX_DIOALIGN
++#define STATX_DIOALIGN          0x00002000U
++#endif
++#ifndef STATX_MNT_ID_UNIQUE
++#define STATX_MNT_ID_UNIQUE     0x00004000U
++#endif
++#ifndef STATX_SUBVOL
++#define STATX_SUBVOL            0x00008000U
++#endif
++#ifndef STATX_WRITE_ATOMIC
++#define STATX_WRITE_ATOMIC      0x00010000U
++#endif
++#ifndef STATX_DIO_READ_ALIGN
++#define STATX_DIO_READ_ALIGN    0x00020000U
++#endif
++
++#ifndef STATX_ATTR_COMPRESSED
++#define STATX_ATTR_COMPRESSED   0x00000004
++#endif
++#ifndef STATX_ATTR_IMMUTABLE
++#define STATX_ATTR_IMMUTABLE    0x00000010
++#endif
++#ifndef STATX_ATTR_APPEND
++#define STATX_ATTR_APPEND       0x00000020
++#endif
++#ifndef STATX_ATTR_NODUMP
++#define STATX_ATTR_NODUMP       0x00000040
++#endif
++#ifndef STATX_ATTR_ENCRYPTED
++#define STATX_ATTR_ENCRYPTED    0x00000800
++#endif
++#ifndef STATX_ATTR_AUTOMOUNT
++#define STATX_ATTR_AUTOMOUNT    0x00001000
++#endif
++#ifndef STATX_ATTR_MOUNT_ROOT
++#define STATX_ATTR_MOUNT_ROOT   0x00002000
++#endif
++#ifndef STATX_ATTR_VERITY
++#define STATX_ATTR_VERITY       0x00100000
++#endif
++#ifndef STATX_ATTR_DAX
++#define STATX_ATTR_DAX          0x00200000
++#endif
++#ifndef STATX_ATTR_WRITE_ATOMIC
++#define STATX_ATTR_WRITE_ATOMIC 0x00400000
++#endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0021-musl-avoid-conflict-between-fcntl.h-and-our-forward..patch b/pkgs/os-specific/linux/systemd/musl/0021-musl-avoid-conflict-between-fcntl.h-and-our-forward..patch
new file mode 100644
index 0000000000000..a024e58f2d256
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0021-musl-avoid-conflict-between-fcntl.h-and-our-forward..patch
@@ -0,0 +1,36 @@
+From a8209a45e73f4c8b1f4e4e174d2d5fbc8a9ac4df Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 22 Jul 2025 03:37:37 +0900
+Subject: [PATCH 21/30] musl: avoid conflict between fcntl.h and our forward.h
+
+glibc defines AT_FDCWD as -100, but musl defines it as (-100).
+In forward.h, we also define AT_FDCWD as -100, hence musl's fcntl.h
+conflicts with forward.h. This is for avoiding the conflict.
+---
+ src/include/musl/fcntl.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+ create mode 100644 src/include/musl/fcntl.h
+
+diff --git a/src/include/musl/fcntl.h b/src/include/musl/fcntl.h
+new file mode 100644
+index 0000000000..e69f13087d
+--- /dev/null
++++ b/src/include/musl/fcntl.h
+@@ -0,0 +1,14 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++/* glibc defines AT_FDCWD as -100, but musl defines it as (-100). Hence, musl's fcntl.h conflicts with
++ * forward.h. To avoid the conflict, here temporary undef AT_FDCWD before including fcntl.h. */
++#ifdef AT_FDCWD
++#undef AT_FDCWD
++#endif
++
++#include_next <fcntl.h>
++
++/* Then, undef AT_FDCWD by fcntl.h and redefine it as consistent with forward.h */
++#undef AT_FDCWD
++#define AT_FDCWD -100
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0022-musl-redefine-HOST_NAME_MAX-as-64.patch b/pkgs/os-specific/linux/systemd/musl/0022-musl-redefine-HOST_NAME_MAX-as-64.patch
new file mode 100644
index 0000000000000..4e47c4c14e1dd
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0022-musl-redefine-HOST_NAME_MAX-as-64.patch
@@ -0,0 +1,29 @@
+From 4a06464ea72d06859c54fca4d7bc361e2f4b069c Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 7 Sep 2025 06:16:02 +0900
+Subject: [PATCH 22/30] musl: redefine HOST_NAME_MAX as 64
+
+glibc defines HOST_NAME_MAX as 64 and our code rely on that, but musl
+defines the constant as 255. Let's redefine it.
+---
+ src/include/musl/limits.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+ create mode 100644 src/include/musl/limits.h
+
+diff --git a/src/include/musl/limits.h b/src/include/musl/limits.h
+new file mode 100644
+index 0000000000..fadf71d66f
+--- /dev/null
++++ b/src/include/musl/limits.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <limits.h>
++
++/* HOST_NAME_MAX should be 64 on linux, but musl uses the one by POSIX (255). */
++#undef HOST_NAME_MAX
++#define HOST_NAME_MAX 64
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0023-musl-avoid-multiple-evaluations-in-CPU_ISSET_S-macro.patch b/pkgs/os-specific/linux/systemd/musl/0023-musl-avoid-multiple-evaluations-in-CPU_ISSET_S-macro.patch
new file mode 100644
index 0000000000000..a397f554fb897
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0023-musl-avoid-multiple-evaluations-in-CPU_ISSET_S-macro.patch
@@ -0,0 +1,62 @@
+From 1aecd86536aef53e92a4903794259300815a9e62 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 1 Jul 2025 12:53:14 +0900
+Subject: [PATCH 23/30] musl: avoid multiple evaluations in CPU_ISSET_S() macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+musl's CPU_ISSET_S() macro does not avoid multiple evaluations, and it
+only accepts simple variable or constant.
+
+Fixes the following error.
+```
+../src/shared/cpu-set-util.c: In function ‘cpu_set_to_mask_string’:
+../src/shared/cpu-set-util.c:101:41: warning: operation on ‘i’ may be undefined [-Werror=sequence-point]
+  101 |                         if (CPU_ISSET_S(--i, c->allocated, c->set))
+      |                                         ^
+```
+---
+ src/include/musl/sched.h | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+ create mode 100644 src/include/musl/sched.h
+
+diff --git a/src/include/musl/sched.h b/src/include/musl/sched.h
+new file mode 100644
+index 0000000000..d6e7100ee4
+--- /dev/null
++++ b/src/include/musl/sched.h
+@@ -0,0 +1,30 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <sched.h>
++
++/* This is for avoiding multiple evaluations in musl's __CPU_op_S() macro. */
++
++#undef __CPU_op_S
++#undef CPU_SET_S
++#undef CPU_CLR_S
++#undef CPU_ISSET_S
++#undef CPU_SET
++#undef CPU_CLR
++#undef CPU_ISSET
++
++#define __CPU_op_S(i, size, set, op) \
++        ({                           \
++                typeof(i) _i = (i);                                     \
++                                                                        \
++                _i / 8U >= (size) ? 0 :                                 \
++                        (((unsigned long*) (set))[_i / 8 / sizeof(long)] op (1UL << (_i % (8 * sizeof(long))))); \
++        })
++
++#define CPU_SET_S(i, size, set) __CPU_op_S(i, size, set, |=)
++#define CPU_CLR_S(i, size, set) __CPU_op_S(i, size, set, &=~)
++#define CPU_ISSET_S(i, size, set) __CPU_op_S(i, size, set, &)
++
++#define CPU_SET(i, set) CPU_SET_S(i, sizeof(cpu_set_t), set)
++#define CPU_CLR(i, set) CPU_CLR_S(i, sizeof(cpu_set_t), set)
++#define CPU_ISSET(i, set) CPU_ISSET_S(i, sizeof(cpu_set_t), set)
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0024-musl-core-there-is-one-less-usable-signal-when-built.patch b/pkgs/os-specific/linux/systemd/musl/0024-musl-core-there-is-one-less-usable-signal-when-built.patch
new file mode 100644
index 0000000000000..5a173be962bee
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0024-musl-core-there-is-one-less-usable-signal-when-built.patch
@@ -0,0 +1,57 @@
+From c00d31373a8f5b922dd947a6d6d6098df0429762 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 7 Sep 2025 08:53:07 +0900
+Subject: [PATCH 24/30] musl: core: there is one less usable signal when built
+ with musl
+
+musl internally reserves one more signal, hence we can only use 29
+signals.
+---
+ src/core/manager.c          | 4 ++--
+ src/test/test-signal-util.c | 7 ++++++-
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index d85896577f..86cb11905f 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -526,7 +526,7 @@ static int manager_setup_signals(Manager *m) {
+         assert_se(sigaction(SIGCHLD, &sa, NULL) == 0);
+ 
+         /* We make liberal use of realtime signals here. On Linux/glibc we have 30 of them, between
+-         * SIGRTMIN+0 ... SIGRTMIN+30 (aka SIGRTMAX). */
++         * SIGRTMIN+0 ... SIGRTMIN+30 (aka SIGRTMAX). When musl is used SIGRTMAX is SIGRTMIN+29. */
+ 
+         assert_se(sigemptyset(&mask) == 0);
+         sigset_add_many(&mask,
+@@ -571,7 +571,7 @@ static int manager_setup_signals(Manager *m) {
+                         SIGRTMIN+28, /* systemd: set log target to kmsg */
+                         SIGRTMIN+29, /* systemd: set log target to syslog-or-kmsg (obsolete) */
+ 
+-                        /* ... one free signal here SIGRTMIN+30 ... */
++                        /* ... one free signal here SIGRTMIN+30 (glibc only) ... */
+                         -1);
+         assert_se(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
+ 
+diff --git a/src/test/test-signal-util.c b/src/test/test-signal-util.c
+index 7d069a7fb2..f26b48f3f2 100644
+--- a/src/test/test-signal-util.c
++++ b/src/test/test-signal-util.c
+@@ -13,8 +13,13 @@ TEST(rt_signals) {
+         info(SIGRTMIN);
+         info(SIGRTMAX);
+ 
+-        /* We use signals SIGRTMIN+0 to SIGRTMIN+30 unconditionally */
++        /* We use signals SIGRTMIN+0 to SIGRTMIN+29 unconditionally. SIGRTMIN+30 can be used only when
++         * built with glibc. */
++#ifdef __GLIBC__
+         assert_se(SIGRTMAX - SIGRTMIN >= 30);
++#else
++        assert_se(SIGRTMAX - SIGRTMIN >= 29);
++#endif
+ }
+ 
+ static void test_signal_to_string_one(int val) {
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0025-musl-build-path-fix-reading-DT_RUNPATH-or-DT_RPATH.patch b/pkgs/os-specific/linux/systemd/musl/0025-musl-build-path-fix-reading-DT_RUNPATH-or-DT_RPATH.patch
new file mode 100644
index 0000000000000..4a78440837ed4
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0025-musl-build-path-fix-reading-DT_RUNPATH-or-DT_RPATH.patch
@@ -0,0 +1,33 @@
+From 7cade54777e9b715ca5b1023dd8fead64d1f4b3e Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sat, 6 Sep 2025 12:06:06 +0900
+Subject: [PATCH 25/30] musl: build-path: fix reading DT_RUNPATH or DT_RPATH
+
+musl records DT_STRTAB as offset, rather than address. So, need to add
+obtained bias to read runpath or rpath.
+---
+ src/basic/build-path.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/basic/build-path.c b/src/basic/build-path.c
+index 577ff72bce..3212089379 100644
+--- a/src/basic/build-path.c
++++ b/src/basic/build-path.c
+@@ -34,11 +34,11 @@ static int get_runpath_from_dynamic(const ElfW(Dyn) *d, ElfW(Addr) bias, const c
+                         break;
+ 
+                 case DT_STRTAB:
+-                        /* On MIPS and RISC-V DT_STRTAB records an offset, not a valid address, so it has to be adjusted
+-                         * using the bias calculated earlier. */
++                        /* On MIPS, RISC-V, or with musl, DT_STRTAB records an offset, not a valid address,
++                         * so it has to be adjusted using the bias calculated earlier. */
+                         if (d->d_un.d_val != 0)
+                                 strtab = (const char *) ((uintptr_t) d->d_un.d_val
+-#if defined(__mips__) || defined(__riscv)
++#if defined(__mips__) || defined(__riscv) || !defined(__GLIBC__)
+                                          + bias
+ #endif
+                                 );
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0026-musl-format-util-use-llu-for-formatting-rlim_t.patch b/pkgs/os-specific/linux/systemd/musl/0026-musl-format-util-use-llu-for-formatting-rlim_t.patch
new file mode 100644
index 0000000000000..e59e6aeae62cf
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0026-musl-format-util-use-llu-for-formatting-rlim_t.patch
@@ -0,0 +1,57 @@
+From 65cd003563fe1b8f1f1b3e1c1198b3d63f993820 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 9 Jun 2025 12:00:01 +0900
+Subject: [PATCH 26/30] musl: format-util: use %llu for formatting rlim_t
+
+glibc uses uint32_t or uint64_t for rlim_t, while musl uses unsigned long long.
+---
+ meson.build             |  7 +++++++
+ src/basic/format-util.h | 14 ++++++++------
+ 2 files changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 5f235d5113..66579b9182 100644
+--- a/meson.build
++++ b/meson.build
+@@ -572,6 +572,13 @@ conf.set('SIZEOF_RLIM_T', cc.sizeof('rlim_t', prefix : '#include <sys/resource.h
+ conf.set('SIZEOF_TIME_T', cc.sizeof('time_t', prefix : '#include <sys/time.h>'))
+ conf.set('SIZEOF_TIMEX_MEMBER', cc.sizeof('typeof(((struct timex *)0)->freq)', prefix : '#include <sys/timex.h>'))
+ 
++if get_option('libc') == 'musl'
++        if conf.get('SIZEOF_RLIM_T') != 8
++                error('Unexpected size of rlim_t: @0@'.format(conf.get('SIZEOF_RLIM_T')))
++        endif
++        conf.set_quoted('RLIM_FMT', '%llu')
++endif
++
+ long_max = cc.compute_int(
+         'LONG_MAX',
+         prefix : '#include <limits.h>',
+diff --git a/src/basic/format-util.h b/src/basic/format-util.h
+index e42f788ce6..d40ca5818a 100644
+--- a/src/basic/format-util.h
++++ b/src/basic/format-util.h
+@@ -39,12 +39,14 @@ assert_cc(sizeof(gid_t) == sizeof(uint32_t));
+ #  error Unknown timex member size
+ #endif
+ 
+-#if SIZEOF_RLIM_T == 8
+-#  define RLIM_FMT "%" PRIu64
+-#elif SIZEOF_RLIM_T == 4
+-#  define RLIM_FMT "%" PRIu32
+-#else
+-#  error Unknown rlim_t size
++#ifndef RLIM_FMT
++#  if SIZEOF_RLIM_T == 8
++#    define RLIM_FMT "%" PRIu64
++#  elif SIZEOF_RLIM_T == 4
++#    define RLIM_FMT "%" PRIu32
++#  else
++#    error Unknown rlim_t size
++#  endif
+ #endif
+ 
+ #if SIZEOF_DEV_T == 8
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0027-musl-time-util-skip-tm.tm_wday-check.patch b/pkgs/os-specific/linux/systemd/musl/0027-musl-time-util-skip-tm.tm_wday-check.patch
new file mode 100644
index 0000000000000..fd9a00fb3b5d7
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0027-musl-time-util-skip-tm.tm_wday-check.patch
@@ -0,0 +1,47 @@
+From 524396a3058a08955683038dae86cf5aaaf10847 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 8 Sep 2025 15:08:49 +0900
+Subject: [PATCH 27/30] musl: time-util: skip tm.tm_wday check
+
+musl does not set tm_wday when it is explicitly requested.
+The check is not necessary at all, it is just for safety.
+Let's skip it when built with musl.
+---
+ src/basic/time-util.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/src/basic/time-util.c b/src/basic/time-util.c
+index 38591b0604..c890141a99 100644
+--- a/src/basic/time-util.c
++++ b/src/basic/time-util.c
+@@ -668,10 +668,14 @@ static int parse_timestamp_impl(
+         _cleanup_free_ char *t_alloc = NULL;
+         usec_t usec, plus = 0, minus = 0;
+         bool with_tz = false;
+-        int r, weekday = -1;
+         unsigned fractional = 0;
+         const char *k;
+         struct tm tm, copy;
++        int r;
++#ifndef __GLIBC__
++        _unused_
++#endif
++        int weekday = -1;
+ 
+         /* Allowed syntaxes:
+          *
+@@ -921,8 +925,11 @@ from_tm:
+         assert(plus == 0);
+         assert(minus == 0);
+ 
++#ifdef __GLIBC__
++        /* musl does not set tm_wday field and set 0 unless it is explicitly requested by %w or so. */
+         if (weekday >= 0 && tm.tm_wday != weekday)
+                 return -EINVAL;
++#endif
+ 
+         if (gmtoff < 0) {
+                 plus = -gmtoff * USEC_PER_SEC;
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0028-musl-glob-util-filter-out-.-and-.-even-if-GLOB_ALTDI.patch b/pkgs/os-specific/linux/systemd/musl/0028-musl-glob-util-filter-out-.-and-.-even-if-GLOB_ALTDI.patch
new file mode 100644
index 0000000000000..de2b0a251f020
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0028-musl-glob-util-filter-out-.-and-.-even-if-GLOB_ALTDI.patch
@@ -0,0 +1,205 @@
+From d59cd7edd78901db8fd88c86258f6830e35e91df Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 25 Feb 2019 14:56:21 +0800
+Subject: [PATCH 28/30] musl: glob-util: filter out . and .. even if
+ GLOB_ALTDIRFUNC is not supported
+
+musl neither support GLOB_ALTDIRFUNC nor GLOB_BRACE.
+Let's make safe_glob() work even when GLOB_ALTDIRFUNC is not supported.
+Currently, GLOB_BRACE is simply ignored when it is not supported.
+---
+ src/basic/glob-util.c     | 75 +++++++++++++++++++++++++++++++++++++--
+ src/basic/glob-util.h     |  9 ++++-
+ src/include/musl/glob.h   | 21 +++++++++++
+ src/test/test-glob-util.c | 10 ++++++
+ 4 files changed, 112 insertions(+), 3 deletions(-)
+ create mode 100644 src/include/musl/glob.h
+
+diff --git a/src/basic/glob-util.c b/src/basic/glob-util.c
+index 5843ef088f..84b369be87 100644
+--- a/src/basic/glob-util.c
++++ b/src/basic/glob-util.c
+@@ -9,9 +9,42 @@
+ #include "string-util.h"
+ #include "strv.h"
+ 
++static bool safe_glob_verify(const char *p, const char *prefix) {
++        if (isempty(p))
++                return false; /* should not happen, but for safey. */
++
++        if (prefix) {
++                /* Skip the prefix, as we allow dots in prefix.
++                 * Note, glob() does not normalize paths, hence do not use path_startswith(). */
++                p = startswith(p, prefix);
++                if (!p)
++                        return false; /* should not happen, but for safety. */
++        }
++
++        for (;;) {
++                p += strspn(p, "/");
++                if (*p == '\0')
++                        return true;
++                if (*p == '.') {
++                        p++;
++                        if (IN_SET(*p, '/', '\0'))
++                                return false; /* refuse dot */
++                        if (*p == '.') {
++                                p++;
++                                if (IN_SET(*p, '/', '\0'))
++                                        return false; /* refuse dot dot */
++                        }
++                }
++
++                p += strcspn(p, "/");
++                if (*p == '\0')
++                        return true;
++        }
++}
++
+ DEFINE_TRIVIAL_DESTRUCTOR(closedir_wrapper, void, closedir);
+ 
+-int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***ret) {
++int safe_glob_internal(const char *path, int flags, bool use_gnu_extension, opendir_t opendir_func, char ***ret) {
+         _cleanup_(globfree) glob_t g = {
+                 .gl_closedir = closedir_wrapper,
+                 .gl_readdir = (struct dirent* (*)(void *)) readdir_no_dot,
+@@ -23,8 +56,16 @@ int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***
+ 
+         assert(path);
+ 
++        // TODO: expand braces if GLOB_BRACE is specified but not supported.
++
++#if GLOB_ALTDIRFUNC == 0
++        use_gnu_extension = false;
++#else
++        SET_FLAG(flags, GLOB_ALTDIRFUNC, use_gnu_extension);
++#endif
++
+         errno = 0;
+-        r = glob(path, flags | GLOB_ALTDIRFUNC, NULL, &g);
++        r = glob(path, flags, NULL, &g);
+         if (r == GLOB_NOMATCH)
+                 return -ENOENT;
+         if (r == GLOB_NOSPACE)
+@@ -32,6 +73,36 @@ int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***
+         if (r != 0)
+                 return errno_or_else(EIO);
+ 
++        if (!use_gnu_extension) {
++                _cleanup_free_ char *prefix = NULL;
++                r = glob_non_glob_prefix(path, &prefix);
++                if (r < 0 && r != -ENOENT)
++                        return r;
++
++                _cleanup_strv_free_ char **filtered = NULL;
++                size_t n_filtered = 0;
++                STRV_FOREACH(p, g.gl_pathv) {
++                        if (!safe_glob_verify(*p, prefix))
++                                continue;
++
++                        if (!ret)
++                                return 0; /* Found at least one entry, let's return earlier. */
++
++                        /* When musl is used, each entry is not a head of allocated memory. Hence, it is
++                         * necessary to copy the string. */
++                        r = strv_extend_with_size(&filtered, &n_filtered, *p);
++                        if (r < 0)
++                                return r;
++                }
++
++                if (n_filtered == 0)
++                        return -ENOENT;
++
++                assert(ret);
++                *ret = TAKE_PTR(filtered);
++                return 0;
++        }
++
+         if (strv_isempty(g.gl_pathv))
+                 return -ENOENT;
+ 
+diff --git a/src/basic/glob-util.h b/src/basic/glob-util.h
+index ea3e869319..36bfd6716c 100644
+--- a/src/basic/glob-util.h
++++ b/src/basic/glob-util.h
+@@ -7,7 +7,14 @@
+ 
+ typedef DIR* (*opendir_t)(const char *);
+ 
+-int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***ret);
++int safe_glob_internal(const char *path, int flags, bool use_gnu_extension, opendir_t opendir_func, char ***ret);
++static inline int safe_glob_test(const char *path, int flags, char ***ret) {
++        /* This is for testing the fallback logic for the case GLOB_ALTDIRFUNC is not supported. */
++        return safe_glob_internal(path, flags, false, NULL, ret);
++}
++static inline int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***ret) {
++        return safe_glob_internal(path, flags, true, opendir_func, ret);
++}
+ static inline int safe_glob(const char *path, int flags, char ***ret) {
+         return safe_glob_full(path, flags, NULL, ret);
+ }
+diff --git a/src/include/musl/glob.h b/src/include/musl/glob.h
+new file mode 100644
+index 0000000000..58e6c50678
+--- /dev/null
++++ b/src/include/musl/glob.h
+@@ -0,0 +1,21 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <glob.h>
++
++/* Here, we set 0 to GLOB_ALTDIRFUNC and GLOB_BRACE, rather than the values used by glibc,
++ * to indicate that glob() does not support these flags. */
++
++#ifndef GLOB_ALTDIRFUNC
++#define GLOB_ALTDIRFUNC 0
++#define gl_flags    __dummy1
++#define gl_closedir __dummy2[0]
++#define gl_readdir  __dummy2[1]
++#define gl_opendir  __dummy2[2]
++#define gl_lstat    __dummy2[3]
++#define gl_stat     __dummy2[4]
++#endif
++
++#ifndef GLOB_BRACE
++#define GLOB_BRACE 0
++#endif
+diff --git a/src/test/test-glob-util.c b/src/test/test-glob-util.c
+index a9880f15c8..730961d172 100644
+--- a/src/test/test-glob-util.c
++++ b/src/test/test-glob-util.c
+@@ -61,20 +61,30 @@ TEST(safe_glob) {
+ 
+         fn = strjoina(template, "/*");
+         ASSERT_ERROR(safe_glob(fn, /* flags = */ 0, &v), ENOENT);
++        ASSERT_ERROR(safe_glob_test(fn, /* flags = */ 0, &v), ENOENT);
+ 
+         fn2 = strjoina(template, "/.*");
+         ASSERT_ERROR(safe_glob(fn2, GLOB_NOSORT|GLOB_BRACE, &v), ENOENT);
++        ASSERT_ERROR(safe_glob_test(fn2, GLOB_NOSORT|GLOB_BRACE, &v), ENOENT);
+ 
+         fname = strjoina(template, "/.foobar");
+         ASSERT_OK(touch(fname));
+ 
+         ASSERT_ERROR(safe_glob(fn, /* flags = */ 0, &v), ENOENT);
++        ASSERT_ERROR(safe_glob_test(fn, /* flags = */ 0, &v), ENOENT);
+ 
+         ASSERT_OK(safe_glob(fn2, GLOB_NOSORT|GLOB_BRACE, &v));
+         ASSERT_EQ(strv_length(v), 1u);
+         ASSERT_STREQ(v[0], fname);
+         ASSERT_NULL(v[1]);
+ 
++        v = strv_free(v);
++
++        ASSERT_OK(safe_glob_test(fn2, GLOB_NOSORT|GLOB_BRACE, &v));
++        ASSERT_EQ(strv_length(v), 1u);
++        ASSERT_STREQ(v[0], fname);
++        ASSERT_NULL(v[1]);
++
+         (void) rm_rf(template, REMOVE_ROOT|REMOVE_PHYSICAL);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0029-musl-test-several-random-fixlets-for-unit-tests.patch b/pkgs/os-specific/linux/systemd/musl/0029-musl-test-several-random-fixlets-for-unit-tests.patch
new file mode 100644
index 0000000000000..4e8fa289dd41e
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0029-musl-test-several-random-fixlets-for-unit-tests.patch
@@ -0,0 +1,380 @@
+From 2c3c84939b930986b31bc0f28e9a08bf43786255 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 9 Sep 2025 13:34:31 +0900
+Subject: [PATCH 29/30] musl: test: several random fixlets for unit tests
+
+---
+ src/boot/test-efi-string.c             | 36 ++++++++++++++++++++------
+ src/libsystemd/sd-bus/test-bus-error.c |  6 +++++
+ src/test/meson.build                   |  1 +
+ src/test/test-errno-util.c             | 12 ++++++++-
+ src/test/test-fileio.c                 | 10 ++++++-
+ src/test/test-locale-util.c            |  7 ++++-
+ src/test/test-os-util.c                |  6 ++++-
+ src/test/test-seccomp.c                |  8 ++++--
+ src/test/test-time-util.c              | 24 +++++++++++++++++
+ test/meson.build                       |  2 ++
+ test/test-sysusers.sh.in               | 22 +++++++++++++++-
+ 11 files changed, 119 insertions(+), 15 deletions(-)
+
+diff --git a/src/boot/test-efi-string.c b/src/boot/test-efi-string.c
+index e0d3bd9b71..af6dd1fb64 100644
+--- a/src/boot/test-efi-string.c
++++ b/src/boot/test-efi-string.c
+@@ -410,13 +410,27 @@ TEST(startswith8) {
+         ASSERT_NULL(startswith8(NULL, ""));
+ }
+ 
+-#define TEST_FNMATCH_ONE(pattern, haystack, expect)                                     \
+-        ({                                                                              \
+-                ASSERT_EQ(fnmatch(pattern, haystack, 0), expect ? 0 : FNM_NOMATCH);     \
+-                ASSERT_EQ(efi_fnmatch(u##pattern, u##haystack), expect);                \
++#define TEST_FNMATCH_ONE_FULL(pattern, haystack, expect, skip_libc)     \
++        ({                                                              \
++                if (!skip_libc)                                         \
++                        ASSERT_EQ(fnmatch(pattern, haystack, 0), expect ? 0 : FNM_NOMATCH); \
++                ASSERT_EQ(efi_fnmatch(u##pattern, u##haystack), expect); \
+         })
+ 
++#define TEST_FNMATCH_ONE(pattern, haystack, expect)             \
++        TEST_FNMATCH_ONE_FULL(pattern, haystack, expect, false)
++
+ TEST(efi_fnmatch) {
++        bool skip_libc;
++
++#ifdef __GLIBC__
++        skip_libc = false;
++#else
++        /* It seems musl is too strict in handling "[]" (or has a bug?). Anyway, let's skip some test cases
++         * when built with musl. The behavior of efi_fnmatch() does not need to match musl's fnmatch(). */
++        skip_libc = true;
++#endif
++
+         TEST_FNMATCH_ONE("", "", true);
+         TEST_FNMATCH_ONE("abc", "abc", true);
+         TEST_FNMATCH_ONE("aBc", "abc", false);
+@@ -447,18 +461,18 @@ TEST(efi_fnmatch) {
+         TEST_FNMATCH_ONE("[abc", "a", false);
+         TEST_FNMATCH_ONE("[][!] [][!] [][!]", "[ ] !", true);
+         TEST_FNMATCH_ONE("[]-] []-]", "] -", true);
+-        TEST_FNMATCH_ONE("[1\\]] [1\\]]", "1 ]", true);
++        TEST_FNMATCH_ONE_FULL("[1\\]] [1\\]]", "1 ]", true, skip_libc);
+         TEST_FNMATCH_ONE("[$-\\+]", "&", true);
+         TEST_FNMATCH_ONE("[1-3A-C] [1-3A-C]", "2 B", true);
+         TEST_FNMATCH_ONE("[3-5] [3-5] [3-5]", "3 4 5", true);
+         TEST_FNMATCH_ONE("[f-h] [f-h] [f-h]", "f g h", true);
+-        TEST_FNMATCH_ONE("[a-c-f] [a-c-f] [a-c-f] [a-c-f] [a-c-f]", "a b c - f", true);
+-        TEST_FNMATCH_ONE("[a-c-f]", "e", false);
++        TEST_FNMATCH_ONE_FULL("[a-c-f] [a-c-f] [a-c-f] [a-c-f] [a-c-f]", "a b c - f", true, skip_libc);
++        TEST_FNMATCH_ONE_FULL("[a-c-f]", "e", false, skip_libc);
+         TEST_FNMATCH_ONE("[--0] [--0] [--0]", "- . 0", true);
+         TEST_FNMATCH_ONE("[+--] [+--] [+--]", "+ , -", true);
+         TEST_FNMATCH_ONE("[f-l]", "m", false);
+         TEST_FNMATCH_ONE("[b]", "z-a", false);
+-        TEST_FNMATCH_ONE("[a\\-z]", "b", false);
++        TEST_FNMATCH_ONE_FULL("[a\\-z]", "b", false, skip_libc);
+         TEST_FNMATCH_ONE("?a*b[.-0]c", "/a/b/c", true);
+         TEST_FNMATCH_ONE("debian-*-*-*.*", "debian-jessie-2018-06-17-kernel-image-5.10.0-16-amd64.efi", true);
+ 
+@@ -674,8 +688,14 @@ TEST(xvasprintf_status) {
+         test_printf_one("string");
+         test_printf_one("%%-%%%%");
+ 
++#ifdef __GLIBC__
+         test_printf_one("%p %p %32p %*p %*p", NULL, (void *) 0xF, &errno, 0, &saved_argc, 20, &saved_argv);
+         test_printf_one("%-10p %-32p %-*p %-*p", NULL, &errno, 0, &saved_argc, 20, &saved_argv);
++#else
++        /* musl prints NULL as 0, while glibc and our implementation print it as (nil). */
++        test_printf_one("%p %32p %*p %*p", (void *) 0xF, &errno, 0, &saved_argc, 20, &saved_argv);
++        test_printf_one("%-32p %-*p %-*p", &errno, 0, &saved_argc, 20, &saved_argv);
++#endif
+ 
+         test_printf_one("%c %3c %*c %*c %-8c", '1', '!', 0, 'a', 9, '_', '>');
+ 
+diff --git a/src/libsystemd/sd-bus/test-bus-error.c b/src/libsystemd/sd-bus/test-bus-error.c
+index c6b86be621..d69eb984dc 100644
+--- a/src/libsystemd/sd-bus/test-bus-error.c
++++ b/src/libsystemd/sd-bus/test-bus-error.c
+@@ -232,7 +232,13 @@ TEST(sd_bus_error_set_errnof) {
+         errno = EACCES;
+         assert_se(asprintf(&str, "%m") >= 0);
+         assert_se(streq(error.message, str));
++#ifdef __GLIBC__
+         assert_se(error._need_free == 0);
++#else
++        /* musl's strerror_l() always writes error message in the given buffer, hence the we need to
++         * free it. */
++        assert_se(error._need_free == 1);
++#endif
+ 
+         str = mfree(str);
+         sd_bus_error_free(&error);
+diff --git a/src/test/meson.build b/src/test/meson.build
+index 1dd61effc0..4bdfc65f04 100644
+--- a/src/test/meson.build
++++ b/src/test/meson.build
+@@ -16,6 +16,7 @@ test_env = {
+         'PROJECT_BUILD_ROOT' : meson.project_build_root(),
+         'SYSTEMD_SLOW_TESTS' : want_slow_tests ? '1' : '0',
+         'PYTHONDONTWRITEBYTECODE' : '1',
++        'SYSTEMD_LIBC' : get_option('libc'),
+ }
+ if conf.get('ENABLE_LOCALED') == 1
+         test_env += {'SYSTEMD_LANGUAGE_FALLBACK_MAP' : language_fallback_map}
+diff --git a/src/test/test-errno-util.c b/src/test/test-errno-util.c
+index 1a0154fb05..1ad067b2c7 100644
+--- a/src/test/test-errno-util.c
++++ b/src/test/test-errno-util.c
+@@ -26,18 +26,28 @@ TEST(STRERROR) {
+         log_info("STRERROR(%d), STRERROR(%d) → %s, %s", 200, 201, STRERROR(200), STRERROR(201));
+ 
+         const char *a = STRERROR(200), *b = STRERROR(201);
++#ifdef __GLIBC__
+         ASSERT_NOT_NULL(strstr(a, "200"));
+         ASSERT_NOT_NULL(strstr(b, "201"));
++#else
++        /* musl provides catch all error message for unknown error number. */
++        ASSERT_STREQ(a, "No error information");
++        ASSERT_STREQ(b, "No error information");
++#endif
+ 
+         /* Check with negative values */
+         ASSERT_STREQ(a, STRERROR(-200));
+         ASSERT_STREQ(b, STRERROR(-201));
+ 
+         const char *c = STRERROR(INT_MAX);
++        log_info("STRERROR(%d) → %s", INT_MAX, c);
++#ifdef __GLIBC__
+         char buf[DECIMAL_STR_MAX(int)];
+         xsprintf(buf, "%d", INT_MAX);  /* INT_MAX is hexadecimal, use printf to convert to decimal */
+-        log_info("STRERROR(%d) → %s", INT_MAX, c);
+         ASSERT_NOT_NULL(strstr(c, buf));
++#else
++        ASSERT_STREQ(c, "No error information");
++#endif
+ }
+ 
+ TEST(STRERROR_OR_ELSE) {
+diff --git a/src/test/test-fileio.c b/src/test/test-fileio.c
+index e0ae30bbb9..ad572056c2 100644
+--- a/src/test/test-fileio.c
++++ b/src/test/test-fileio.c
+@@ -400,7 +400,15 @@ TEST(write_string_stream) {
+ 
+         f = fdopen(fd, "r");
+         assert_se(f);
+-        assert_se(write_string_stream(f, "boohoo", 0) < 0);
++#ifdef __GLIBC__
++        ASSERT_ERROR(write_string_stream(f, "boohoo", 0), EBADF);
++#else
++        /* Even the file is opened with the read-only mode, fputs() and fputc() by musl succeed but nothing
++         * actually written, thus write_string_stream() also succeeds. */
++        ASSERT_OK(write_string_stream(f, "boohoo", 0));
++        rewind(f);
++        ASSERT_NULL(fgets(buf, sizeof(buf), f));
++#endif
+         f = safe_fclose(f);
+ 
+         f = fopen(fn, "r+");
+diff --git a/src/test/test-locale-util.c b/src/test/test-locale-util.c
+index e264cff5dd..faa7ac4211 100644
+--- a/src/test/test-locale-util.c
++++ b/src/test/test-locale-util.c
+@@ -50,7 +50,12 @@ TEST(locale_is_installed) {
+         assert_se(locale_is_installed("\x01gar\x02 bage\x03") == 0);
+ 
+         /* Definitely not installed */
+-        assert_se(locale_is_installed("zz_ZZ") == 0);
++#ifdef __GLIBC__
++        ASSERT_OK_ZERO(locale_is_installed("zz_ZZ"));
++#else
++        /* musl seems to return a non-null locale object even if it is not installed. */
++        ASSERT_OK_POSITIVE(locale_is_installed("zz_ZZ"));
++#endif
+ }
+ 
+ TEST(keymaps) {
+diff --git a/src/test/test-os-util.c b/src/test/test-os-util.c
+index fcab1139c2..902062560f 100644
+--- a/src/test/test-os-util.c
++++ b/src/test/test-os-util.c
+@@ -127,7 +127,11 @@ TEST(os_release_support_ended) {
+ 
+         ASSERT_TRUE(os_release_support_ended("1999-01-01", false, NULL));
+         ASSERT_FALSE(os_release_support_ended("2037-12-31", false, NULL));
+-        assert_se(os_release_support_ended("-1-1-1", true, NULL) == -EINVAL);
++#ifdef __GLIBC__
++        ASSERT_ERROR(os_release_support_ended("-1-1-1", true, NULL), EINVAL);
++#else
++        ASSERT_ERROR(os_release_support_ended("-1-1-1", true, NULL), ERANGE);
++#endif
+ 
+         r = os_release_support_ended(NULL, false, NULL);
+         if (r < 0)
+diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c
+index 13c65a93cd..a9953b2c98 100644
+--- a/src/test/test-seccomp.c
++++ b/src/test/test-seccomp.c
+@@ -553,9 +553,13 @@ TEST(memory_deny_write_execute_mmap) {
+                 assert_se(seccomp_memory_deny_write_execute() >= 0);
+ 
+                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+-#if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__) || defined(__loongarch_lp64)
++#if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__) || defined(__loongarch_lp64) || !defined(__GLIBC__)
+                 assert_se(p == MAP_FAILED);
+-                assert_se(errno == EPERM);
++#  ifdef __GLIBC__
++                ASSERT_EQ(errno, EPERM);
++#  else
++                ASSERT_EQ(errno, ENOMEM);
++#  endif
+ #endif
+                 /* Depending on kernel, libseccomp, and glibc versions, other architectures
+                  * might fail or not. Let's not assert success. */
+diff --git a/src/test/test-time-util.c b/src/test/test-time-util.c
+index 7569f89ca0..203f8a148d 100644
+--- a/src/test/test-time-util.c
++++ b/src/test/test-time-util.c
+@@ -406,6 +406,25 @@ static void test_format_timestamp_impl(usec_t x) {
+         const char *xx = FORMAT_TIMESTAMP(x);
+         ASSERT_NOT_NULL(xx);
+ 
++#ifndef __GLIBC__
++        /* Because of the timezone change, format_timestamp() may set timezone that is currently unused.
++         * E.g. Africa/Juba may set EAT, but currently it uses CAT/CAST. */
++        const char *space;
++        ASSERT_NOT_NULL(space = strrchr(xx, ' '));
++        const char *tz = space + 1;
++        if (!streq_ptr(tz, tzname[0]) &&
++            !streq_ptr(tz, tzname[1]) &&
++            parse_gmtoff(tz, NULL) < 0) {
++
++                log_warning("@" USEC_FMT " → %s, timezone '%s' is currently unused, ignoring.", x, xx, tz);
++
++                /* Verify the generated string except for the timezone part. Of course, in most cases, parsed
++                 * time does not match with the input, hence only check if it is parsable. */
++                ASSERT_OK(parse_timestamp(strndupa_safe(xx, space - xx), NULL));
++                return;
++        }
++#endif
++
+         usec_t y;
+         ASSERT_OK(parse_timestamp(xx, &y));
+         const char *yy = FORMAT_TIMESTAMP(y);
+@@ -1116,7 +1135,12 @@ TEST(in_utc_timezone) {
+         assert_se(setenv("TZ", ":UTC", 1) >= 0);
+         assert_se(in_utc_timezone());
+         ASSERT_STREQ(tzname[0], "UTC");
++#ifdef __GLIBC__
+         ASSERT_STREQ(tzname[1], "UTC");
++#else
++        /* musl sets an empty string to tzname[1] when DST is not used by the timezone. */
++        ASSERT_STREQ(tzname[1], "");
++#endif
+         assert_se(timezone == 0);
+         assert_se(daylight == 0);
+ 
+diff --git a/test/meson.build b/test/meson.build
+index 505a14aa81..1f1ec0a0e1 100644
+--- a/test/meson.build
++++ b/test/meson.build
+@@ -13,6 +13,7 @@ if conf.get('ENABLE_SYSUSERS') == 1
+                      # https://github.com/mesonbuild/meson/issues/2681
+                      args : exe.full_path(),
+                      depends : exe,
++                     env : test_env,
+                      suite : 'sysusers')
+ 
+                 if have_standalone_binaries
+@@ -22,6 +23,7 @@ if conf.get('ENABLE_SYSUSERS') == 1
+                              # https://github.com/mesonbuild/meson/issues/2681
+                              args : exe.full_path(),
+                              depends : exe,
++                             env : test_env,
+                              suite : 'sysusers')
+                 endif
+         endif
+diff --git a/test/test-sysusers.sh.in b/test/test-sysusers.sh.in
+index 3218923590..ae7bfee2fe 100755
+--- a/test/test-sysusers.sh.in
++++ b/test/test-sysusers.sh.in
+@@ -13,6 +13,12 @@ TESTDIR=$(mktemp --tmpdir --directory "test-sysusers.XXXXXXXXXX")
+ # shellcheck disable=SC2064
+ trap "rm -rf '$TESTDIR'" EXIT INT QUIT PIPE
+ 
++skip_nis() {
++    # musl seems to not support NIS entries. Let's skip the test case for NIS entries.
++    local path=${1:?}
++    [[ "${SYSTEMD_LIBC:-}" == musl && "${path##*/}" == "test-11.input" ]]
++}
++
+ prepare_testdir() {
+     mkdir -p "$TESTDIR/etc/sysusers.d/"
+     mkdir -p "$TESTDIR/usr/lib/sysusers.d/"
+@@ -50,6 +56,7 @@ rm -f "$TESTDIR"/etc/sysusers.d/* "$TESTDIR"/usr/lib/sysusers.d/*
+ 
+ # happy tests
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f"
+     prepare_testdir "${f%.input}"
+     cp "$f" "$TESTDIR/usr/lib/sysusers.d/test.conf"
+@@ -59,6 +66,7 @@ for f in $(find "$SOURCE"/test-*.input | sort -V); do
+ done
+ 
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f on stdin"
+     prepare_testdir "${f%.input}"
+     touch "$TESTDIR/etc/sysusers.d/test.conf"
+@@ -68,6 +76,7 @@ for f in $(find "$SOURCE"/test-*.input | sort -V); do
+ done
+ 
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f on stdin with --replace"
+     prepare_testdir "${f%.input}"
+     touch "$TESTDIR/etc/sysusers.d/test.conf"
+@@ -133,6 +142,7 @@ SYS_GID_MAX999
+ EOF
+ 
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f (with login.defs)"
+     prepare_testdir "${f%.input}"
+     cp "$f" "$TESTDIR/usr/lib/sysusers.d/test.conf"
+@@ -149,6 +159,7 @@ mv "$TESTDIR/etc/login.defs" "$TESTDIR/etc/login.defs.moved"
+ ln -s ../../../../../etc/login.defs.moved "$TESTDIR/etc/login.defs"
+ 
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f (with login.defs symlinked)"
+     prepare_testdir "${f%.input}"
+     cp "$f" "$TESTDIR/usr/lib/sysusers.d/test.conf"
+@@ -161,13 +172,22 @@ done
+ 
+ rm -f "$TESTDIR"/etc/sysusers.d/* "$TESTDIR"/usr/lib/sysusers.d/*
+ 
++preprocess_error() {
++    # Convert error message for ERANGE from glibc to musl.
++    if [[ "${SYSTEMD_LIBC:-}" == musl ]]; then
++        sed -e 's/Numerical result out of range/Result not representable/' "${1:?}"
++    else
++        cat "${1:?}"
++    fi
++}
++
+ # tests for error conditions
+ for f in $(find "$SOURCE"/unhappy-*.input | sort -V); do
+     echo "*** Running test $f"
+     prepare_testdir "${f%.input}"
+     cp "$f" "$TESTDIR/usr/lib/sysusers.d/test.conf"
+     SYSTEMD_LOG_LEVEL=info "$SYSUSERS" --root="$TESTDIR" 2>&1 | tail -n1 | sed -r 's/^[^:]+:[^:]+://' >"$TESTDIR/err"
+-    if ! diff -u "$TESTDIR/err"  "${f%.*}.expected-err" >&2; then
++    if ! diff -u "$TESTDIR/err"  <(preprocess_error "${f%.*}.expected-err") >&2; then
+         echo >&2 "**** Unexpected error output for $f"
+         cat >&2 "$TESTDIR/err"
+         exit 1
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0030-musl-ci-add-build-test-and-unit-tests.patch b/pkgs/os-specific/linux/systemd/musl/0030-musl-ci-add-build-test-and-unit-tests.patch
new file mode 100644
index 0000000000000..51eec7e78ac3d
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0030-musl-ci-add-build-test-and-unit-tests.patch
@@ -0,0 +1,352 @@
+From b9a6cd49a4d4c6a40968224f5aac20586273b171 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 9 Sep 2025 13:42:24 +0900
+Subject: [PATCH 30/30] musl: ci: add build test and unit tests
+
+---
+ .github/workflows/build-test-musl.sh  | 125 ++++++++++++++++++++++++++
+ .github/workflows/linter.yml          |   9 ++
+ .github/workflows/unit-tests-musl.sh  |  55 ++++++++++++
+ .github/workflows/unit-tests-musl.yml | 112 +++++++++++++++++++++++
+ 4 files changed, 301 insertions(+)
+ create mode 100755 .github/workflows/build-test-musl.sh
+ create mode 100755 .github/workflows/unit-tests-musl.sh
+ create mode 100644 .github/workflows/unit-tests-musl.yml
+
+diff --git a/.github/workflows/build-test-musl.sh b/.github/workflows/build-test-musl.sh
+new file mode 100755
+index 0000000000..bc38924666
+--- /dev/null
++++ b/.github/workflows/build-test-musl.sh
+@@ -0,0 +1,125 @@
++#!/bin/bash
++# SPDX-License-Identifier: LGPL-2.1-or-later
++
++set -eux
++
++if ! command -v musl-gcc 2>/dev/null; then
++    echo "musl-gcc is not installed, skipping the test."
++    exit 0
++fi
++
++. /etc/os-release
++
++TMPDIR=$(mktemp -d)
++
++cleanup() (
++    set +e
++
++    if [[ -d "$TMPDIR" ]]; then
++        rm -rf "$TMPDIR"
++    fi
++)
++
++trap cleanup EXIT ERR INT TERM
++
++mkdir -p "${TMPDIR}/build"
++mkdir -p "${TMPDIR}/include"
++
++CFLAGS="-idirafter ${TMPDIR}/include"
++
++LINKS=(
++    acl
++    archive.h
++    archive_entry.h
++    asm-generic
++    audit-records.h
++    audit_logging.h
++    bpf
++    bzlib.h
++    dwarf.h
++    elfutils
++    fido.h
++    gcrypt.h
++    gelf.h
++    gnutls
++    idn2.h
++    libaudit.h
++    libcryptsetup.h
++    libelf.h
++    libkmod.h
++    lz4.h
++    lz4frame.h
++    lz4hc.h
++    lzma
++    lzma.h
++    microhttpd.h
++    mtd
++    openssl
++    pcre2.h
++    pwquality.h
++    qrencode.h
++    seccomp-syscalls.h
++    seccomp.h
++    security
++    sys/acl.h
++    sys/capability.h
++    tss2
++    xen
++    xkbcommon
++    zconf.h
++    zlib.h
++    zstd.h
++    zstd_errors.h
++)
++
++if [[ "$ID" == arch ]]; then
++    LINKS+=(
++        asm
++        curl
++        gpg-error.h
++        libiptc
++        linux
++    )
++elif [[ "$ID" == centos ]]; then
++    LINKS+=(
++        asm
++        curl
++        gpg-error.h
++        linux
++        selinux
++    )
++elif [[ "$ID" == fedora ]]; then
++    LINKS+=(
++        asm
++        curl
++        gpg-error.h
++        libiptc
++        linux
++        selinux
++    )
++elif [[ "$ID" == debian ]] || [[ "$ID" == ubuntu ]]; then
++    # Currently, debian/ubuntu does not provide crypt.h for musl. Hence, this does not work.
++
++    CFLAGS="$CFLAGS -idirafter /usr/include/$(uname -m)-linux-gnu"
++
++    LINKS+=(
++        linux
++        selinux
++        sys/apparmor.h
++    )
++fi
++
++for t in "${LINKS[@]}"; do
++    [[ -e "/usr/include/$t" ]]
++    link="${TMPDIR}/include/${t}"
++    mkdir -p "${link%/*}"
++    ln -s "/usr/include/$t" "$link"
++done
++
++env CC=musl-gcc \
++    CXX=musl-gcc \
++    CFLAGS="$CFLAGS" \
++    CXXFLAGS="$CFLAGS" \
++    meson setup --werror -Ddbus-interfaces-dir=no -Dlibc=musl "${TMPDIR}/build"
++
++ninja -v -C "${TMPDIR}/build"
+diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
+index c107b2da1e..b92a00478c 100644
+--- a/.github/workflows/linter.yml
++++ b/.github/workflows/linter.yml
+@@ -49,6 +49,12 @@ jobs:
+           [Build]
+           ToolsTreeDistribution=fedora
+           ToolsTreeRelease=rawhide
++
++          [Content]
++          Packages=
++                libgcrypt-devel
++                libgpg-error-devel
++                musl-gcc
+           EOF
+ 
+           mkosi -f box -- true
+@@ -77,3 +83,6 @@ jobs:
+ 
+       - name: Run clang-tidy
+         run: mkosi box -- meson test -C build --suite=clang-tidy --print-errorlogs --no-stdsplit
++
++      - name: Build with musl
++        run: mkosi box -- .github/workflows/build-test-musl.sh
+diff --git a/.github/workflows/unit-tests-musl.sh b/.github/workflows/unit-tests-musl.sh
+new file mode 100755
+index 0000000000..f6e2b2f536
+--- /dev/null
++++ b/.github/workflows/unit-tests-musl.sh
+@@ -0,0 +1,55 @@
++#!/usr/bin/env bash
++# SPDX-License-Identifier: LGPL-2.1-or-later
++
++# shellcheck disable=SC2206
++PHASES=(${@:-SETUP BUILD RUN CLEANUP})
++
++function info() {
++    echo -e "\033[33;1m$1\033[0m"
++}
++function run_meson() {
++    if ! meson "$@"; then
++        find . -type f -name meson-log.txt -exec cat '{}' +
++        return 1
++    fi
++}
++
++set -ex
++
++for phase in "${PHASES[@]}"; do
++    case $phase in
++        SETUP)
++            info "Setup phase"
++            # Alpine still uses split-usr.
++            for i in /bin/* /sbin/*; do
++                ln -rs "$i" "/usr/$i";
++            done
++            ;;
++        BUILD)
++            info "Build phase"
++            run_meson setup --werror -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true -Dlibc=musl build
++            ninja -C build -v
++            ;;
++        RUN)
++            info "Run phase"
++            # Create dummy machine ID.
++            echo '052e58f661f94bd080e258b96aea3f7b' > /etc/machine-id
++
++            # Start dbus for several unit tests.
++            mkdir -p /var/run/dbus
++            /usr/bin/dbus-daemon --system || :
++
++            # Here, we explicitly set SYSTEMD_IN_CHROOT=yes as unfortunately runnin_in_chroot() does not
++            # correctly detect the environment.
++            env \
++                SYSTEMD_IN_CHROOT=yes \
++                meson test -C build -v
++            ;;
++        CLEANUP)
++            info "Cleanup phase"
++            ;;
++        *)
++            echo >&2 "Unknown phase '$phase'"
++            exit 1
++    esac
++done
+diff --git a/.github/workflows/unit-tests-musl.yml b/.github/workflows/unit-tests-musl.yml
+new file mode 100644
+index 0000000000..e30974254c
+--- /dev/null
++++ b/.github/workflows/unit-tests-musl.yml
+@@ -0,0 +1,112 @@
++---
++# vi: ts=2 sw=2 et:
++# SPDX-License-Identifier: LGPL-2.1-or-later
++#
++name: Unit tests (musl)
++on:
++  pull_request:
++    paths:
++      - '**/meson.build'
++      - '.github/workflows/**'
++      - 'meson_options.txt'
++      - 'src/**'
++      - 'test/fuzz/**'
++
++permissions:
++  contents: read
++
++jobs:
++  build:
++    runs-on: ubuntu-latest
++    steps:
++      - name: Repository checkout
++        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
++
++      - name: Install build dependencies
++        uses: jirutka/setup-alpine@v1
++        with:
++          arch: x86_64
++          branch: edge
++          packages: >
++            acl
++            acl-dev
++            audit-dev
++            bash
++            bash-completion-dev
++            bpftool
++            build-base
++            bzip2-dev
++            coreutils
++            cryptsetup-dev
++            curl-dev
++            dbus
++            dbus-dev
++            elfutils-dev
++            gettext-dev
++            git
++            glib-dev
++            gnutls-dev
++            gperf
++            grep
++            iproute2
++            iptables-dev
++            kbd
++            kexec-tools
++            kmod
++            kmod-dev
++            libapparmor-dev
++            libarchive-dev
++            libbpf-dev
++            libcap-dev
++            libcap-utils
++            libfido2-dev
++            libgcrypt-dev
++            libidn2-dev
++            libmicrohttpd-dev
++            libpwquality-dev
++            libqrencode-dev
++            libseccomp-dev
++            libselinux-dev
++            libxkbcommon-dev
++            linux-pam-dev
++            lz4-dev
++            meson
++            openssl
++            openssl-dev
++            p11-kit-dev
++            pcre2-dev
++            pkgconf
++            polkit-dev
++            py3-elftools
++            py3-jinja2
++            py3-pefile
++            py3-pytest
++            py3-lxml
++            quota-tools
++            rsync
++            sfdisk
++            tpm2-tss-dev
++            tpm2-tss-esys
++            tpm2-tss-rc
++            tpm2-tss-tcti-device
++            tzdata
++            util-linux-dev
++            util-linux-login
++            util-linux-misc
++            valgrind-dev
++            xen-dev
++            zlib-dev
++            zstd-dev
++
++      - name: Setup
++        run: .github/workflows/unit-tests-musl.sh SETUP
++        shell: alpine.sh --root {0}
++      - name: Build
++        run: .github/workflows/unit-tests-musl.sh BUILD
++        shell: alpine.sh {0}
++      - name: Run
++        run: .github/workflows/unit-tests-musl.sh RUN
++        shell: alpine.sh --root {0}
++      - name: Cleanup
++        run: .github/workflows/unit-tests-musl.sh CLEANUP
++        shell: alpine.sh --root {0}
+-- 
+2.51.0
+

From f0166da268940ec4a78504a83a15b61871eb1552 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 13 Oct 2025 08:59:35 +0200
Subject: [PATCH 293/306] ruby: avoid rebuilding default ruby on linux for now

---
 pkgs/development/interpreters/ruby/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 4b1ccdd4fdfaa..348708f573a08 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -192,7 +192,8 @@ let
               # anything and fixes cross compilation.
               ./dont-refer-to-build-dir.patch
             ]
-            ++ ops (lib.versionOlder ver.majMin "3.4") [
+            # TODO: drop the isClang condition
+            ++ ops (lib.versionOlder ver.majMin "3.4" && stdenv.cc.isClang) [
               (fetchpatch {
                 name = "ruby-3.3-fix-llvm-21.patch";
                 url = "https://github.com/ruby/ruby/commit/5a8d7642168f4ea0d9331fded3033c225bbc36c5.patch";

From 8410064ee9cc8a821a4b6a8627a6b31e3bd46e6a Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Mon, 13 Oct 2025 18:46:59 +0200
Subject: [PATCH 294/306] qadwaitadecorations: fix build with Qt 6.10

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/qa/qadwaitadecorations/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/qa/qadwaitadecorations/package.nix b/pkgs/by-name/qa/qadwaitadecorations/package.nix
index 7a1f1abb20371..0517d0a13cbdb 100644
--- a/pkgs/by-name/qa/qadwaitadecorations/package.nix
+++ b/pkgs/by-name/qa/qadwaitadecorations/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   cmake,
   qt5,
   qt6,
@@ -30,6 +31,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Zg2G3vuRD/kK5C2fFq6Cft218uFyBvfXtO1DHKQECFQ=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/FedoraQt/QAdwaitaDecorations/pull/88
+      name = "Fix build with Qt 6.10";
+      url = "https://github.com/FedoraQt/QAdwaitaDecorations/commit/e6da80a440218b87e441c8a698014ef3962af98b.patch?full_index=1";
+      hash = "sha256-7ZmceoOzUDHvvCX+8SwuX+DIi65d6hYIYfpikMiN0wM=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];

From 0067a449865dcd42f697ddb939c7f737bfff9779 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 13 Oct 2025 11:01:39 -0700
Subject: [PATCH 295/306] python3Packages.langchain-tests: unpin syrupy

---
 pkgs/development/python-modules/langchain-tests/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-tests/default.nix b/pkgs/development/python-modules/langchain-tests/default.nix
index c9c3659a7ae34..e27b6900b30f6 100644
--- a/pkgs/development/python-modules/langchain-tests/default.nix
+++ b/pkgs/development/python-modules/langchain-tests/default.nix
@@ -49,6 +49,7 @@ buildPythonPackage rec {
     # That prevents us from updating individual components.
     "langchain-core"
     "numpy"
+    "syrupy"
   ];
 
   dependencies = [

From 9d8f8d668c094527948b209741d99cffccc1ef6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oliv=C3=A9r=20Falvai?= <ofalvai@gmail.com>
Date: Wed, 15 Oct 2025 07:40:56 +0200
Subject: [PATCH 296/306] python3Packages.setproctitle: fix darwin build

Some tests got re-enabled in https://github.com/NixOS/nixpkgs/pull/444696, but one of them fails on Darwin: https://github.com/dvarrazzo/py-setproctitle/blob/master/tests/setproctitle_test.py#L73C5-L73C29

I couldn't figure out the root cause, maybe it has to do with the Nix builder environment or the nixbld user running the tests? I verified that the library works when invoked from a Nix shell by a regular user.
---
 pkgs/development/python-modules/setproctitle/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/setproctitle/default.nix b/pkgs/development/python-modules/setproctitle/default.nix
index fdb412cb499e9..aa1211029abbd 100644
--- a/pkgs/development/python-modules/setproctitle/default.nix
+++ b/pkgs/development/python-modules/setproctitle/default.nix
@@ -5,6 +5,7 @@
   setuptools,
   pytestCheckHook,
   procps,
+  stdenv,
 }:
 
 buildPythonPackage rec {
@@ -26,6 +27,9 @@ buildPythonPackage rec {
     procps
   ];
 
+  # Setting the process title fails on macOS in the Nix builder environment (regardless of sandboxing)
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [ "test_setproctitle_darwin" ];
+
   pythonImportsCheck = [ "setproctitle" ];
 
   meta = {

From 72a533422c2257f50cf240d8ba21339b4eb09dd8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 15 Oct 2025 11:38:20 +0200
Subject: [PATCH 297/306] python3Packages.setproctitle: avoid rebuild on linux
 for now

---
 pkgs/development/python-modules/setproctitle/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/setproctitle/default.nix b/pkgs/development/python-modules/setproctitle/default.nix
index aa1211029abbd..e99a269901394 100644
--- a/pkgs/development/python-modules/setproctitle/default.nix
+++ b/pkgs/development/python-modules/setproctitle/default.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   ];
 
   # Setting the process title fails on macOS in the Nix builder environment (regardless of sandboxing)
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [ "test_setproctitle_darwin" ];
+  disabledTests = if stdenv.hostPlatform.isDarwin then [ "test_setproctitle_darwin" ] else null;
 
   pythonImportsCheck = [ "setproctitle" ];
 

From 98c1b23f3dca2a1b1b9d3510b8b93990627544c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 15 Oct 2025 13:48:34 +0200
Subject: [PATCH 298/306] bmake: avoid a bad test on darwin

https://hydra.nixos.org/build/309555861/nixlog/2/tail
Feel free to do deeper investigation and/or better fix.
---
 pkgs/by-name/bm/bmake/package.nix | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/bm/bmake/package.nix b/pkgs/by-name/bm/bmake/package.nix
index 6cdfb11e29544..ad3ed152731b4 100644
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -57,13 +57,17 @@ stdenv.mkDerivation (finalAttrs: {
   # * directive-export{,-gmake}: another failure related to TZ variables
   # * opt-keep-going-indirect: not yet known
   # * varmod-localtime: musl doesn't support TZDIR and this test relies on impure, implicit paths
-  env.BROKEN_TESTS = lib.concatStringsSep " " [
-    "cmd-interrupt"
-    "directive-export"
-    "directive-export-gmake"
-    "opt-keep-going-indirect"
-    "varmod-localtime"
-  ];
+  env.BROKEN_TESTS = lib.concatStringsSep " " (
+    [
+      "cmd-interrupt"
+      "directive-export"
+      "directive-export-gmake"
+      "opt-keep-going-indirect"
+      "varmod-localtime"
+    ]
+    # TODO: drop the name-conditioning on stdenv rebuild
+    ++ lib.optional (stdenv.isDarwin && lib.getName stdenv != "bootstrap-stage1-stdenv-darwin") "export"
+  );
 
   strictDeps = true;
 

From 15d63fdcb7f981ffc5d18c200d21acb5363a0499 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oliv=C3=A9r=20Falvai?= <ofalvai@gmail.com>
Date: Thu, 16 Oct 2025 08:09:20 +0200
Subject: [PATCH 299/306] python3Packages.commoncode: 32.2.1 -> 32.3.0 Fixes
 build after click 8.2 upgrade

---
 pkgs/development/python-modules/commoncode/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/commoncode/default.nix b/pkgs/development/python-modules/commoncode/default.nix
index 5a90c3bd3a4a9..a107a6fd888db 100644
--- a/pkgs/development/python-modules/commoncode/default.nix
+++ b/pkgs/development/python-modules/commoncode/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "commoncode";
-  version = "32.2.1";
+  version = "32.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "nexB";
     repo = "commoncode";
     tag = "v${version}";
-    hash = "sha256-dCiERdNVup95UnvmJEzkpQsRvpk2eKqvwD6jkEBrXfE=";
+    hash = "sha256-FL9t8r53AJLR5D2XSEOq7qVHgvvHIbtPW5iVpSQCVsQ=";
   };
 
   dontConfigure = true;

From 253a0165f072ce797c28da2dae9bd9610fd07069 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Thu, 16 Oct 2025 21:18:28 +0000
Subject: [PATCH 300/306] nixos/systemd-initrd: only include glibc nss modules
 on glibc systems

---
 nixos/modules/system/boot/systemd/initrd.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index f2b1b4fc7ede6..ba5f67058bd9e 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -568,9 +568,6 @@ in
         "${cfg.package.util-linux}/bin/umount"
         "${cfg.package.util-linux}/bin/sulogin"
 
-        # so NSS can look up usernames
-        "${pkgs.glibc}/lib/libnss_files.so.2"
-
         # Resolving sysroot symlinks without code exec
         "${config.system.nixos-init.package}/bin/chroot-realpath"
         # Find the etc paths
@@ -586,7 +583,8 @@ in
         "${pkgs.bashNonInteractive}/bin"
       ]
       ++ jobScripts
-      ++ map (c: builtins.removeAttrs c [ "text" ]) (builtins.attrValues cfg.contents);
+      ++ map (c: builtins.removeAttrs c [ "text" ]) (builtins.attrValues cfg.contents)
+      ++ lib.optional (pkgs.hostPlatform.libc == "glibc") "${pkgs.glibc}/lib/libnss_files.so.2";
 
       targets.initrd.aliases = [ "default.target" ];
       units =

From 28e43000dbfb5fea8593ca3d07b62d3f7d0b605d Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Sun, 19 Oct 2025 17:28:46 +0800
Subject: [PATCH 301/306] qt6.qtwebengine: fix build

---
 .../libraries/qt-6/modules/qtwebengine/default.nix     | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
index d06abd2441b9a..df88eb6d473e4 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
@@ -7,6 +7,7 @@
   buildPackages,
   bison,
   coreutils,
+  fetchpatch2,
   flex,
   gperf,
   ninja,
@@ -110,6 +111,15 @@ qtModule {
 
     # Reproducibility QTBUG-136068
     ./gn-object-sorted.patch
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    # https://chromium-review.googlesource.com/c/chromium/src/+/6633292
+    (fetchpatch2 {
+      url = "https://github.com/chromium/chromium/commit/b0ff8c3b258a8816c05bdebf472dbba719d3c491.patch?full_index=1";
+      stripLen = 1;
+      extraPrefix = "src/3rdparty/chromium/";
+      hash = "sha256-zDIlHd8bBtrThkFnrcyA13mhXYIQt6sKsi6qAyQ34yo=";
+    })
   ];
 
   postPatch = ''

From a0816fc3641d3527c03908fb89d1aace8c9178be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Lima?= <me@limwa.pt>
Date: Sat, 18 Oct 2025 16:17:47 +0100
Subject: [PATCH 302/306] ceph.python.pkgs.cryptography: disable mem leak tests
 on all platforms

---
 .../filesystems/ceph/old-python-packages/cryptography.nix   | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix b/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
index 38d7e112fa61a..f10d285617a78 100644
--- a/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
+++ b/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
@@ -109,10 +109,12 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # save compute time by not running benchmarks
     "tests/bench"
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     # aarch64-darwin forbids W+X memory, but this tests depends on it:
     # * https://cffi.readthedocs.io/en/latest/using.html#callbacks
+    # furthermore, this test fails with OpenSSL 3.6.0, probably due to:
+    # * https://github.com/openssl/openssl/issues/28757
+    # * https://github.com/openssl/openssl/issues/28770
+    # * https://github.com/openssl/openssl/issues/28888
     "tests/hazmat/backends/test_openssl_memleak.py"
   ];
 

From 67e1598f9133bfa73e6641dd37607d14b7cfc993 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Sun, 19 Oct 2025 16:16:01 -0400
Subject: [PATCH 303/306] nixos/test/login: Fix uaccess test.

This PR https://github.com/systemd/systemd/pull/36444 caused this bug
https://github.com/systemd/systemd/issues/39043, which is fixed in
this PR https://github.com/systemd/systemd/pull/39071. In short,
`uaccess` doesn't work with `OPTIONS+="static_node=..."` udev rules,
and `/dev/snd/timer` is a static node. 258.1 needs to wait for the
next staging cycle, so for now let's just use a non-static node.
---
 nixos/tests/login.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix
index bd0d3b7bc0058..ab80b8aaabf02 100644
--- a/nixos/tests/login.nix
+++ b/nixos/tests/login.nix
@@ -48,12 +48,13 @@
         machine.wait_for_file("/home/alice/done")
 
     with subtest("Systemd gives and removes device ownership as needed"):
-        machine.succeed("getfacl /dev/snd/timer | grep -q alice")
+        # Change back to /dev/snd/timer after systemd-258.1
+        machine.succeed("getfacl /dev/dri/card0 | grep -q alice")
         machine.send_key("alt-f1")
         machine.wait_until_succeeds("[ $(fgconsole) = 1 ]")
-        machine.fail("getfacl /dev/snd/timer | grep -q alice")
+        machine.fail("getfacl /dev/dri/card0 | grep -q alice")
         machine.succeed("chvt 2")
-        machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice")
+        machine.wait_until_succeeds("getfacl /dev/dri/card0 | grep -q alice")
 
     with subtest("Virtual console logout"):
         machine.send_chars("exit\n")

From a905b1d8e129c3af9317f73e826b487f86e176dc Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 20 Oct 2025 11:19:41 +0300
Subject: [PATCH 304/306] nixos/systemd-initrd: fix eval under allowAliases =
 false

---
 nixos/modules/system/boot/systemd/initrd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index ba5f67058bd9e..04c814b7ec6eb 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -584,7 +584,7 @@ in
       ]
       ++ jobScripts
       ++ map (c: builtins.removeAttrs c [ "text" ]) (builtins.attrValues cfg.contents)
-      ++ lib.optional (pkgs.hostPlatform.libc == "glibc") "${pkgs.glibc}/lib/libnss_files.so.2";
+      ++ lib.optional (pkgs.stdenv.hostPlatform.libc == "glibc") "${pkgs.glibc}/lib/libnss_files.so.2";
 
       targets.initrd.aliases = [ "default.target" ];
       units =

From e25ac51eccac1334692fa1c2dd5c453b17529758 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 21 Oct 2025 09:00:34 +0200
Subject: [PATCH 305/306] opensshTest: drop softhsm (failing part of the tests)

https://github.com/NixOS/nixpkgs/issues/453782
---
 pkgs/tools/networking/openssh/common.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 5b672b6d6b7a2..7eb07d0748423 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -144,7 +144,8 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
   ]
   ++ lib.optional (!stdenv.hostPlatform.isDarwin) hostname
-  ++ lib.optional (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl) softhsm;
+  # TODO: softhsm is currently breaking the tests; see #453782
+  ++ lib.optional (false && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl) softhsm;
 
   preCheck = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) (
     ''
@@ -193,7 +194,8 @@ stdenv.mkDerivation (finalAttrs: {
       # set up NIX_REDIRECTS for direct invocations
       set -a; source ~/.ssh/environment.base; set +a
     ''
-    + lib.optionalString (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl) ''
+    # See softhsm in nativeCheckInputs above.
+    + lib.optionalString (!finalAttrs.doCheck && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl) ''
       # The extra tests check PKCS#11 interactions, which softhsm emulates with software only
       substituteInPlace regress/test-exec.sh \
         --replace /usr/local/lib/softhsm/libsofthsm2.so ${lib.getLib softhsm}/lib/softhsm/libsofthsm2.so

From 5ee8efde226d7b800f3496da386a68673e1b1aa6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 21 Oct 2025 09:08:08 +0200
Subject: [PATCH 306/306] opensshTest: nixfmt after the previous commit

I'm sorry.
---
 pkgs/tools/networking/openssh/common.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 7eb07d0748423..5f495f89f11a4 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -195,11 +195,14 @@ stdenv.mkDerivation (finalAttrs: {
       set -a; source ~/.ssh/environment.base; set +a
     ''
     # See softhsm in nativeCheckInputs above.
-    + lib.optionalString (!finalAttrs.doCheck && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl) ''
-      # The extra tests check PKCS#11 interactions, which softhsm emulates with software only
-      substituteInPlace regress/test-exec.sh \
-        --replace /usr/local/lib/softhsm/libsofthsm2.so ${lib.getLib softhsm}/lib/softhsm/libsofthsm2.so
-    ''
+    +
+      lib.optionalString
+        (!finalAttrs.doCheck && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl)
+        ''
+          # The extra tests check PKCS#11 interactions, which softhsm emulates with software only
+          substituteInPlace regress/test-exec.sh \
+            --replace /usr/local/lib/softhsm/libsofthsm2.so ${lib.getLib softhsm}/lib/softhsm/libsofthsm2.so
+        ''
   );
   # integration tests hard to get working on darwin with its shaky
   # sandbox