From ecd11a12cb68ec762d3759c93575c646ba6d1225 Mon Sep 17 00:00:00 2001 From: ghpzin Date: Thu, 25 Sep 2025 22:29:51 +0300 Subject: [PATCH 001/108] onetbb: fix build with gcc15 - add patch from merged upstream PR: https://www.github.com/uxlfoundation/oneTBB/pull/1831 https://github.com/uxlfoundation/oneTBB/commit/712ad98443300aab202f5e93a76472d59b79752a Fixes build failure with gcc15: ``` FAILED: [code=1] test/CMakeFiles/test_concurrent_unordered_map.dir/tbb/test_concurrent_unordered_map.cpp.o ... /nix/store/rd8c9w16nwys8yz1a9j2g2nhjn07464r-gcc-15.2.0/include/c++/15.2.0/bits/new_allocator.h:198:11: error: array subscript 2 is outside array bounds of 'StaticSharedCountingAllocator > >::value_type [1]' {aka 'tbb::detail::d2::list_node [1]'} [-Werror=array-bounds=] 198 | { __p->~_Up(); } | ^~~ compilation terminated due to -Wfatal-errors. cc1plus: all warnings being treated as errors ... FAILED: [code=1] test/CMakeFiles/test_concurrent_unordered_set.dir/tbb/test_concurrent_unordered_set.cpp.o ... /build/source/src/tbb/../../include/tbb/../oneapi/tbb/detail/_concurrent_unordered_base.h:172:20: error: array subscript 'tbb::detail::d2::value_node > >, long unsigned int>[0]' is partly outside array bounds of 'unsigned char [16]' [-Werror=array-bounds=] 172 | ~value_node() {} | ^ compilation terminated due to -Wfatal-errors. cc1plus: all warnings being treated as errors ``` --- pkgs/by-name/on/onetbb/package.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/by-name/on/onetbb/package.nix b/pkgs/by-name/on/onetbb/package.nix index 6cebaf75422c1..45b6f91b01d38 100644 --- a/pkgs/by-name/on/onetbb/package.nix +++ b/pkgs/by-name/on/onetbb/package.nix @@ -49,6 +49,14 @@ stdenv.mkDerivation (finalAttrs: { url = "https://github.com/uxlfoundation/oneTBB/commit/e57411968661ab1205322ba1c84fc1cd90a306c6.patch"; hash = "sha256-PFixW4lYqA5oy4LSwewvxgJbjVKJceRHnp8mgW9zBF0="; }) + + # Fix build with gcc15 + # + (fetchpatch { + name = "onetbb-fix-gcc15-build.patch"; + url = "https://github.com/uxlfoundation/oneTBB/commit/712ad98443300aab202f5e93a76472d59b79752a.patch"; + hash = "sha256-4qoVCy3xQZK6Vp471miE79FSrU0D0Iu6KWMJ08m0EsE="; + }) ]; nativeBuildInputs = [ From cda6074886277d5fd80ae5121958356f08106190 Mon Sep 17 00:00:00 2001 From: ghpzin Date: Wed, 17 Sep 2025 18:27:35 +0300 Subject: [PATCH 002/108] guile: fix build with gcc15 - add "-std=gnu17" to `env.NIX_CFLAGS_COMPILE` Fixes build failure with gcc15: ``` backtrace.c: In function 'scm_init_backtrace': backtrace.c:329:51: error: passing argument 5 of 'scm_c_define_gsubr' from incompatible pointer type [-Wincompatible-pointer-types] 329 | scm_c_define_gsubr ("print-exception", 4, 0, 0, boot_print_exception); | ^~~~~~~~~~~~~~~~~~~~ | | | struct scm_unused_struct * (*)(struct scm_unused_struct *, struct scm_unused_struct *, struct scm_unused_struct *, struct scm_unused_struct *) In file included from backtrace.c:41: gsubr.h:72:71: note: expected 'scm_t_subr' {aka 'struct scm_unused_struct * (*)(void)'} but argument is of type 'struct scm_unused_struct * (*)(struct scm_unused_struct *, struct scm_unused_struct *, struct scm_unused_struct *, struct scm_unused_struct *)' 72 | int req, int opt, int rst, scm_t_subr fcn); | ~~~~~~~~~~~^~~ backtrace.c:66:1: note: 'boot_print_exception' declared here 66 | boot_print_exception (SCM port, SCM frame, SCM key, SCM args) | ^~~~~~~~~~~~~~~~~~~~ ``` --- pkgs/development/interpreters/guile/3.0.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix index d3bf1518868ca..979c1acb56715 100644 --- a/pkgs/development/interpreters/guile/3.0.nix +++ b/pkgs/development/interpreters/guile/3.0.nix @@ -126,6 +126,9 @@ builder rec { # https://github.com/NixOS/nixpkgs/pull/160051#issuecomment-1046193028 ++ lib.optional (stdenv.hostPlatform.isDarwin) "--disable-lto"; + # Fix build with gcc15 + env.NIX_CFLAGS_COMPILE = toString [ "-std=gnu17" ]; + postInstall = '' wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin" '' From 761c2601399210ba7bcc1968cc80535ce0f9df20 Mon Sep 17 00:00:00 2001 From: qzylinra Date: Fri, 3 Oct 2025 17:58:41 +0800 Subject: [PATCH 003/108] scons: 4.7.0 -> 4.10.0 --- pkgs/by-name/sc/scons/no-man-pages.patch | 14 -------------- pkgs/by-name/sc/scons/package.nix | 16 ++++------------ 2 files changed, 4 insertions(+), 26 deletions(-) delete mode 100644 pkgs/by-name/sc/scons/no-man-pages.patch diff --git a/pkgs/by-name/sc/scons/no-man-pages.patch b/pkgs/by-name/sc/scons/no-man-pages.patch deleted file mode 100644 index 4dd459b8261e8..0000000000000 --- a/pkgs/by-name/sc/scons/no-man-pages.patch +++ /dev/null @@ -1,14 +0,0 @@ ---- a/setup.cfg -+++ b/setup.cfg -@@ -67,11 +67,6 @@ console_scripts = - SCons.Tool.docbook = *.* - - --[options.data_files] --. = scons.1 -- scons-time.1 -- sconsign.1 -- - [sdist] - dist_dir=build/dist - diff --git a/pkgs/by-name/sc/scons/package.nix b/pkgs/by-name/sc/scons/package.nix index 3f5c39877a11a..c5447d946740c 100644 --- a/pkgs/by-name/sc/scons/package.nix +++ b/pkgs/by-name/sc/scons/package.nix @@ -6,26 +6,18 @@ }: python3Packages.buildPythonApplication rec { pname = "scons"; - version = "4.7.0"; + version = "4.10.0"; src = fetchFromGitHub { owner = "Scons"; repo = "scons"; - rev = version; - hash = "sha256-7VzGuz9CAUF6MRCEpj5z1FkZD19/Ic+YBukYQocvkr0="; + tag = version; + hash = "sha256-ZmJETrznHH3zsNBO5o8JCvf+6l7NICOAfIqASYzYBaM="; }; pyproject = true; - patches = [ - ./env.patch - ./no-man-pages.patch - # Fix builds on sandboxed Darwin: https://github.com/SCons/scons/pull/4603 - (fetchpatch { - url = "https://github.com/SCons/scons/commit/2d5e3a40a613225b329776ab9dbd9abcd2d24222.patch"; - hash = "sha256-N1xQOvsPTi7a2maEZJQVu6vJ9AoWMqDOsScXHp9KuXI="; - }) - ]; + patches = [ ./env.patch ]; build-system = [ python3Packages.setuptools From 5382ac8362c5fc8f644f74bffd4c2d177bb384de Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 18 Oct 2025 20:39:59 +0000 Subject: [PATCH 004/108] ngtcp2: 1.15.1 -> 1.17.0 --- pkgs/development/libraries/ngtcp2/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix index 9de9314dc37dd..4a06bad00c287 100644 --- a/pkgs/development/libraries/ngtcp2/default.nix +++ b/pkgs/development/libraries/ngtcp2/default.nix @@ -14,11 +14,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "ngtcp2"; - version = "1.15.1"; + version = "1.17.0"; src = fetchurl { url = "https://github.com/ngtcp2/ngtcp2/releases/download/v${finalAttrs.version}/ngtcp2-${finalAttrs.version}.tar.bz2"; - hash = "sha256-Bbf6cvldAd3fvDVuHL89VPx1h1wvY2CGW5gIsDNM75c="; + hash = "sha256-j8hYGdFp5il4pODbNlVILOdJUafqsMdmc3tXoxQY2mE="; }; outputs = [ From a84ad3b71b6bbaaf6942e3b91c5e8c15578c38f6 Mon Sep 17 00:00:00 2001 From: Daniel Woffinden Date: Mon, 20 Oct 2025 22:10:52 +0100 Subject: [PATCH 005/108] python3Packages.regex: rework - fetch from github instead of pypi - eschew `rec` and `with` (https://nix.dev/guides/best-practices.html) --- .../python-modules/regex/default.nix | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix index 4ca491e0e0766..7a581c682ceb7 100644 --- a/pkgs/development/python-modules/regex/default.nix +++ b/pkgs/development/python-modules/regex/default.nix @@ -1,19 +1,24 @@ { - lib, buildPythonPackage, - fetchPypi, + fetchFromGitHub, + lib, python, setuptools, }: -buildPythonPackage rec { - pname = "regex"; +let version = "2025.9.18"; +in +buildPythonPackage { + pname = "regex"; + inherit version; pyproject = true; - src = fetchPypi { - inherit pname version; - hash = "sha256-xbojJ0xhxv70R7pqOTMyl9DCR/UwWdugvKQVysUR7cQ="; + src = fetchFromGitHub { + owner = "mrabarnett"; + repo = "mrab-regex"; + tag = version; + hash = "sha256-s/jaRbQffd1DmGribk8gwTraKEhWfvFZboWXUduhM8A="; }; build-system = [ setuptools ]; @@ -24,13 +29,13 @@ buildPythonPackage rec { pythonImportsCheck = [ "regex" ]; - meta = with lib; { + meta = { description = "Alternative regular expression module, to replace re"; homepage = "https://github.com/mrabarnett/mrab-regex"; license = [ - licenses.asl20 - licenses.cnri-python + lib.licenses.asl20 + lib.licenses.cnri-python ]; - maintainers = with lib.maintainers; [ dwoffinden ]; + maintainers = [ lib.maintainers.dwoffinden ]; }; } From d81ba7d1f23ae8383875e7c77dde8dc671677cc9 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Sun, 26 Oct 2025 18:38:43 +0100 Subject: [PATCH 006/108] lz4: apply fix for CVE-2025-62813 Security issue is disputed by upstream but taking it up to MITRE to change the status is not fast so we might as well apply the patch to avoid false positive. https://github.com/lz4/lz4/issues/1667 --- pkgs/by-name/lz/lz4/package.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/by-name/lz/lz4/package.nix b/pkgs/by-name/lz/lz4/package.nix index 23c13065ae40e..bab192f7c4248 100644 --- a/pkgs/by-name/lz/lz4/package.nix +++ b/pkgs/by-name/lz/lz4/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + fetchpatch, cmake, valgrind, testers, @@ -18,6 +19,14 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-/dG1n59SKBaEBg72pAWltAtVmJ2cXxlFFhP+klrkTos="; }; + patches = [ + (fetchpatch { + name = "CVE-2025-62813.patch"; + url = "https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82.patch"; + hash = "sha256-qOvK0A3MGX14WdhThV7m4G6s+ZMP6eA/07A2BY5nesY="; + }) + ]; + nativeBuildInputs = [ cmake ]; From 650f386cef5fe771378217504244c06f852e7ccc Mon Sep 17 00:00:00 2001 From: Doron Behar Date: Wed, 29 Oct 2025 11:21:18 +0200 Subject: [PATCH 007/108] python313Packages.scipy: 1.16.2 -> 1.16.3 Diff: https://github.com/scipy/scipy/compare/v1.16.2...v1.16.3 Changelog: https://github.com/scipy/scipy/releases/tag/v1.16.3 --- pkgs/development/python-modules/scipy/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix index 663389069579d..16ae631686e4f 100644 --- a/pkgs/development/python-modules/scipy/default.nix +++ b/pkgs/development/python-modules/scipy/default.nix @@ -50,8 +50,8 @@ let # nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy # # The update script uses sed regexes to replace them with the updated hashes. - version = "1.16.2"; - srcHash = "sha256-vWXJyLvOqCC5jwDawWHF6K2GVU2gnvW4a85lF/6tVYg="; + version = "1.16.3"; + srcHash = "sha256-2NVmsJqsUjWSD7oEJhRkRjbKvqwikBJenAhBio/+IuU="; datasetsHashes = { ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3"; ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj"; From 9a13b5860ae21d5f14f2333b48fe6b97ce24a47c Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Wed, 29 Oct 2025 22:52:03 +0100 Subject: [PATCH 008/108] opencv: support building with ffmpeg 8 --- pkgs/by-name/ml/mlt/package.nix | 8 ++++---- pkgs/development/libraries/opencv/4.x.nix | 15 +++++++++++++-- 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/ml/mlt/package.nix b/pkgs/by-name/ml/mlt/package.nix index ae965a28077cf..41e7af71554e9 100644 --- a/pkgs/by-name/ml/mlt/package.nix +++ b/pkgs/by-name/ml/mlt/package.nix @@ -6,7 +6,7 @@ cmake, pkg-config, which, - ffmpeg_7, + ffmpeg, fftw, frei0r, libdv, @@ -71,8 +71,8 @@ stdenv.mkDerivation rec { ]; buildInputs = [ - (opencv4.override { inherit ffmpeg_7; }) - ffmpeg_7 + (opencv4.override { inherit ffmpeg; }) + ffmpeg fftw frei0r libdv @@ -137,7 +137,7 @@ stdenv.mkDerivation rec { ''; passthru = { - ffmpeg = ffmpeg_7; + inherit ffmpeg; }; passthru.updateScript = gitUpdater { diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix index ef861e8ee153e..4c57a88f56005 100644 --- a/pkgs/development/libraries/opencv/4.x.nix +++ b/pkgs/development/libraries/opencv/4.x.nix @@ -3,6 +3,7 @@ stdenv, fetchurl, fetchFromGitHub, + fetchpatch, cmake, pkg-config, unzip, @@ -58,7 +59,7 @@ enableVtk ? false, vtk, enableFfmpeg ? true, - ffmpeg_7, + ffmpeg, enableGStreamer ? true, elfutils, gst_all_1, @@ -299,6 +300,16 @@ effectiveStdenv.mkDerivation { patches = [ ./cmake-don-t-use-OpenCVFindOpenEXR.patch ./0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch + (fetchpatch { + name = "ffmpeg-8-support.patch"; + url = "https://github.com/opencv/opencv/commit/90c444abd387ffa70b2e72a34922903a2f0f4f5a.patch"; + hash = "sha256-iRRparDJoNhrvELH6cAagWcVzpiE2lfivHVxvZyi3ik="; + }) + (fetchpatch { + name = "fix-ffmpeg-8-support.patch"; + url = "https://github.com/opencv/opencv/commit/dbb622b7f59c3f0e5bd3487252ef37cf72dcdcdb.patch"; + hash = "sha256-MS9WizZQu0Gxw/daDDFmETxcDJYRTyhSq/xK0X5lAZM="; + }) ] ++ optionals enableCuda [ ./cuda_opt_flow.patch @@ -365,7 +376,7 @@ effectiveStdenv.mkDerivation { openjpeg ] ++ optionals enableFfmpeg [ - ffmpeg_7 + ffmpeg ] ++ optionals (enableGStreamer && effectiveStdenv.hostPlatform.isLinux) [ elfutils From ab9e086fdb9c970f22157288a8b098b129be7d09 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 30 Oct 2025 12:36:36 +0000 Subject: [PATCH 009/108] yara: 4.5.4 -> 4.5.5 --- pkgs/by-name/ya/yara/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ya/yara/package.nix b/pkgs/by-name/ya/yara/package.nix index 0867a3175cef4..317575a66bfca 100644 --- a/pkgs/by-name/ya/yara/package.nix +++ b/pkgs/by-name/ya/yara/package.nix @@ -19,13 +19,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "yara"; - version = "4.5.4"; + version = "4.5.5"; src = fetchFromGitHub { owner = "VirusTotal"; repo = "yara"; tag = "v${finalAttrs.version}"; - hash = "sha256-vSwjP0wbC65jEOxY9zrHAV1gEhcZ96emqvkuUw20Twc="; + hash = "sha256-a+oLxVJgdDrnOra85PPo8ZlFhinawWHuRtVE39S8yJk="; }; nativeBuildInputs = [ From 96f3c0bbca8d657ddcd2e8b068d2e726b7f2042d Mon Sep 17 00:00:00 2001 From: OPNA2608 Date: Fri, 31 Oct 2025 21:42:21 +0100 Subject: [PATCH 010/108] mjpegtools: Fix build on POWER targets with AltiVec-free baseline I'll leave fixing of the AltiVec code to ppc64le users. --- pkgs/by-name/mj/mjpegtools/package.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/by-name/mj/mjpegtools/package.nix b/pkgs/by-name/mj/mjpegtools/package.nix index ad5ad85e729c6..bfd9320ed0206 100644 --- a/pkgs/by-name/mj/mjpegtools/package.nix +++ b/pkgs/by-name/mj/mjpegtools/package.nix @@ -56,6 +56,13 @@ stdenv.mkDerivation rec { postPatch = '' sed -i -e '/ARCHFLAGS=/s:=.*:=:' configure + '' + # Only ppc64le baseline guarantees AltiVec, no configure option to disable it so just make checks never signal success. + # AltiVec code also fails without disabling new compiler warnings: + # quant_non_intra.c:72:42: error: initialization of '__vector unsigned short *' {aka '__vector(8) short unsigned int *'} from incompatible pointer type 'uint16_t *' {aka 'short unsigned int *'} [-Wincompatible-pointer-types] + + lib.optionalString (!(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian)) '' + substituteInPlace configure \ + --replace-fail 'have_altivec=true' 'have_altivec=false' ''; enableParallelBuilding = true; From 7c4669cdc901b4970827445d71d8e45a82bca60f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 1 Nov 2025 13:01:44 +0000 Subject: [PATCH 011/108] dav1d: 1.5.1 -> 1.5.2 --- pkgs/by-name/da/dav1d/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/da/dav1d/package.nix b/pkgs/by-name/da/dav1d/package.nix index 23d72c245d00c..443ad79790c50 100644 --- a/pkgs/by-name/da/dav1d/package.nix +++ b/pkgs/by-name/da/dav1d/package.nix @@ -27,13 +27,13 @@ assert useVulkan -> withExamples; stdenv.mkDerivation rec { pname = "dav1d"; - version = "1.5.1"; + version = "1.5.2"; src = fetchFromGitHub { owner = "videolan"; repo = "dav1d"; rev = version; - hash = "sha256-qcs9QoZ/uWEQ8l1ChZ8nYctZnnWJ0VvCw1q2rEktC9g="; + hash = "sha256-rxRO5EWjrOUsCYXd2rDDhfcEZbfSuMfjujRAHTqUYhI="; }; outputs = [ From 21b5b17390b8c3cefcdb8dcaef3044fefec045d8 Mon Sep 17 00:00:00 2001 From: Arnout Engelen Date: Mon, 3 Nov 2025 09:39:13 +0100 Subject: [PATCH 012/108] ibus: don't build ui/gtk3 in parallel as that led to inconsistent vala-generated method names Fixes #230290 --- pkgs/tools/inputmethods/ibus/default.nix | 2 ++ pkgs/tools/inputmethods/ibus/vala-parallelism.patch | 13 +++++++++++++ 2 files changed, 15 insertions(+) create mode 100644 pkgs/tools/inputmethods/ibus/vala-parallelism.patch diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix index 3f0701ddaa47b..cb3dcc513f6ae 100644 --- a/pkgs/tools/inputmethods/ibus/default.nix +++ b/pkgs/tools/inputmethods/ibus/default.nix @@ -88,6 +88,8 @@ stdenv.mkDerivation (finalAttrs: { PYTHON = null; }) ./build-without-dbus-launch.patch + # https://github.com/NixOS/nixpkgs/issues/230290 + ./vala-parallelism.patch ]; outputs = [ diff --git a/pkgs/tools/inputmethods/ibus/vala-parallelism.patch b/pkgs/tools/inputmethods/ibus/vala-parallelism.patch new file mode 100644 index 0000000000000..f4c47a76c39cc --- /dev/null +++ b/pkgs/tools/inputmethods/ibus/vala-parallelism.patch @@ -0,0 +1,13 @@ +diff --git a/ui/gtk3/Makefile.am b/ui/gtk3/Makefile.am +index 3ada6501..2066a8f5 100644 +--- a/ui/gtk3/Makefile.am ++++ b/ui/gtk3/Makefile.am +@@ -304,6 +304,8 @@ panelbinding.o: $(srcdir)/panelbinding.c + $(AM_V_CC_no)$(COMPILE) -c -o $@ $< + $(NULL) + ++.NOTPARALLEL: ++ + MAINTAINERCLEANFILES += extension.c panelbinding.c + + man_seven_DATA = ibus-emoji.7 From e2f52405e9d6d5a04d9f6cfea1b1589abc457341 Mon Sep 17 00:00:00 2001 From: Benjamin Sparks Date: Fri, 31 Oct 2025 14:38:45 +0100 Subject: [PATCH 013/108] python3Packages.uv-build: decouple from uv Only 1k / 10k rebuilds come solely from `home-assistant`'s dependency on `uv`. The remainder likely stems from `python3Packages.cryptography`'s transitive dependency on `python3Packages.uv-build` via `python3Packages.cryptography-vector`'s `build-system`. The remaining occurrences in the file are in `passthru.tests` and `meta.{changelog,license}`, so nothing that would influence rebuilds. --- .../python-modules/uv-build/default.nix | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/pkgs/development/python-modules/uv-build/default.nix b/pkgs/development/python-modules/uv-build/default.nix index 84840a3df9e1f..8b39bfbee075d 100644 --- a/pkgs/development/python-modules/uv-build/default.nix +++ b/pkgs/development/python-modules/uv-build/default.nix @@ -1,26 +1,34 @@ { lib, pkgs, + fetchFromGitHub, buildPythonPackage, rustPlatform, callPackage, }: -buildPythonPackage { +buildPythonPackage rec { pname = "uv-build"; + version = "0.9.7"; pyproject = true; - inherit (pkgs.uv) - version - src - cargoDeps - ; + src = fetchFromGitHub { + owner = "astral-sh"; + repo = "uv"; + tag = version; + hash = "sha256-I0Oe6vaH7iQh+Ubp5RIk8Ol6Ni7OPu8HKX0fqLdewyk="; + }; nativeBuildInputs = [ rustPlatform.cargoSetupHook rustPlatform.maturinBuildHook ]; + cargoDeps = rustPlatform.fetchCargoVendor { + inherit pname version src; + hash = "sha256-K/RP7EA0VAAI8TGx+VwfKPmyT6+x4p3kekuoMZ0/egc="; + }; + buildAndTestSubdir = "crates/uv-build"; # $src/.github/workflows/build-binaries.yml#L139 From ddb979669adb5eb8500188e84174f718cd2fa300 Mon Sep 17 00:00:00 2001 From: Benjamin Sparks Date: Fri, 31 Oct 2025 20:01:19 +0100 Subject: [PATCH 014/108] python3Packages.uv-build: passthru.updateScript is unnecessary --- pkgs/development/python-modules/uv-build/default.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/uv-build/default.nix b/pkgs/development/python-modules/uv-build/default.nix index 8b39bfbee075d..e9111bd69b133 100644 --- a/pkgs/development/python-modules/uv-build/default.nix +++ b/pkgs/development/python-modules/uv-build/default.nix @@ -40,7 +40,11 @@ buildPythonPackage rec { doCheck = false; # Run the tests of a package built by `uv_build`. - passthru.tests.built-by-uv = callPackage ./built-by-uv.nix { inherit (pkgs) uv; }; + passthru = { + tests.built-by-uv = callPackage ./built-by-uv.nix { inherit (pkgs) uv; }; + + # updateScript is not needed here, as updating is done on staging + }; meta = { description = "Minimal build backend for uv"; From 379e4a53fd11d8fd3d600e68058380415754fda0 Mon Sep 17 00:00:00 2001 From: Benjamin Sparks Date: Fri, 31 Oct 2025 20:02:14 +0100 Subject: [PATCH 015/108] uv: update updateScript comment --- pkgs/by-name/uv/uv/package.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix index 11a3d85cf6159..98f9cd0eb5a50 100644 --- a/pkgs/by-name/uv/uv/package.nix +++ b/pkgs/by-name/uv/uv/package.nix @@ -62,7 +62,8 @@ rustPlatform.buildRustPackage (finalAttrs: { passthru = { tests.uv-python = python3Packages.uv; - # Updating `uv` needs to be done on staging. Disabling r-ryantm update bot: + # Updating `uv` needs to be done on staging until the next staging branch-off. + # Disabling r-ryantm update bot: # nixpkgs-update: no auto update updateScript = nix-update-script { }; }; From 23a64c0292c2dc41437e6b4479232e1697baedc6 Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Mon, 3 Nov 2025 22:03:57 +0100 Subject: [PATCH 016/108] libressl: 4.2.0 -> 4.2.1, 4.1.1 -> 4.1.2 --- pkgs/by-name/li/libressl/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix index 279cbdf60f2eb..d9dee846601e8 100644 --- a/pkgs/by-name/li/libressl/default.nix +++ b/pkgs/by-name/li/libressl/default.nix @@ -139,8 +139,8 @@ in }; libressl_4_1 = generic { - version = "4.1.1"; - hash = "sha256-x/96fWddX1dzCUDlzP8dvi3NW3QFtTl+D3/9ZqXtVnk="; + version = "4.1.2"; + hash = "sha256-+6Ti+ip/UjBt96OJlwoQ6YuX6w7bKZqf252/SZmcYeE="; # Fixes build on loongarch64 # https://github.com/libressl/portable/pull/1184 postPatch = '' @@ -158,8 +158,8 @@ in }; libressl_4_2 = generic { - version = "4.2.0"; - hash = "sha256-D326RNfLjfjVPyz78ZVSVLwSjgCJWV8aui+s+u6ECLI="; + version = "4.2.1"; + hash = "sha256-bVwvWFg1iOp5H0yGRQBAcdAN+lVKW/eIoAbKHrWr1ws="; patches = [ common-cmake-install-full-dirs-patch ]; From 78b97f8a475dfdf69a40f17c246748c3c58719e1 Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Mon, 3 Nov 2025 22:09:09 +0100 Subject: [PATCH 017/108] libressl_4_0: remove unsupported package 4.1 and 4.2 are the currently supported versions of LibreSSL. A git grep did not bring up any references, so the package should be safe to remove. --- pkgs/by-name/li/libressl/default.nix | 21 --------------------- pkgs/top-level/all-packages.nix | 1 - 2 files changed, 22 deletions(-) diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix index d9dee846601e8..2667f2c1bf978 100644 --- a/pkgs/by-name/li/libressl/default.nix +++ b/pkgs/by-name/li/libressl/default.nix @@ -117,27 +117,6 @@ let }; in { - libressl_4_0 = generic { - version = "4.0.1"; - hash = "sha256-IClLh3eMJidIk4Y5Q8hjWJebSZ03tJl31r+Gj3tZfL0="; - # Fixes build on loongarch64 - # https://github.com/libressl/portable/pull/1146 - patches = [ - (fetchpatch { - name = "0100-ALT-basic-loongarch64-support.patch"; - url = "https://git.altlinux.org/gears/L/LibreSSL.git?p=LibreSSL.git;a=blob_plain;f=patches/0100-ALT-basic-loongarch64-support.patch;hb=70ddea860b8b62531bd3968bf4d7a5c4b7086776"; - stripLen = 2; - extraPrefix = ""; - postFetch = '' - substituteInPlace "$out" \ - --replace-fail "a//dev/null" "/dev/null" - ''; - hash = "sha256-dEdtmHHiR7twAqgebXv1Owle/KYCak71NhDCp0PdseU="; - }) - common-cmake-install-full-dirs-patch - ]; - }; - libressl_4_1 = generic { version = "4.1.2"; hash = "sha256-+6Ti+ip/UjBt96OJlwoQ6YuX6w7bKZqf252/SZmcYeE="; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 8fcfdba547292..e4ea228bc27ac 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8227,7 +8227,6 @@ with pkgs; zunclient = with python313Packages; toPythonApplication python-zunclient; inherit (callPackages ../by-name/li/libressl { }) - libressl_4_0 libressl_4_1 libressl_4_2 ; From 56a5fc5c7880db42af2c497d4488c1218bc952ae Mon Sep 17 00:00:00 2001 From: Yueh-Shun Li Date: Wed, 20 Aug 2025 21:47:31 +0800 Subject: [PATCH 018/108] rustPlatform.buildRustPackage: specify environment variables via the env attribute --- .../rust/build-rust-package/default.nix | 31 ++++++++++++++----- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix index 7efbc8a9ea36d..1e500cd82c974 100644 --- a/pkgs/build-support/rust/build-rust-package/default.nix +++ b/pkgs/build-support/rust/build-rust-package/default.nix @@ -15,6 +15,16 @@ windows, }: +let + interpolateString = + s: + if lib.isList s then + lib.concatMapStringsSep " " (s: "${s}") (lib.filter (s: s != null) s) + else if s == null then + "" + else + "${s}"; +in lib.extendMkDerivation { constructDrv = stdenv.mkDerivation; @@ -23,6 +33,7 @@ lib.extendMkDerivation { "cargoUpdateHook" "cargoLock" "useFetchCargoVendor" + "RUSTFLAGS" ]; extendDrvArgs = @@ -77,11 +88,19 @@ lib.extendMkDerivation { assert lib.warnIf (args ? useFetchCargoVendor) "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it" true; + { + env = { + PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0; + RUST_LOG = logLevel; + RUSTFLAGS = + lib.optionalString ( + stdenv.hostPlatform.isDarwin && buildType == "debug" + ) "-C split-debuginfo=packed " + # Workaround the existing RUSTFLAGS specified as a list. + + interpolateString (args.RUSTFLAGS or ""); + } + // args.env or { }; - lib.optionalAttrs (stdenv.hostPlatform.isDarwin && buildType == "debug") { - RUSTFLAGS = "-C split-debuginfo=packed " + (args.RUSTFLAGS or ""); - } - // { cargoDeps = if cargoVendorDir != null then null @@ -143,12 +162,8 @@ lib.extendMkDerivation { patches = cargoPatches ++ patches; - PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0; - postUnpack = '' eval "$cargoDepsHook" - - export RUST_LOG=${logLevel} '' + (args.postUnpack or ""); From cdb722fa01b243c104b74efcb896462d218ff8d7 Mon Sep 17 00:00:00 2001 From: Yueh-Shun Li Date: Wed, 20 Aug 2025 22:05:44 +0800 Subject: [PATCH 019/108] rustPlatform: run cargoDepsHook inside cargoSetupPostUnpackHook --- pkgs/build-support/rust/build-rust-package/default.nix | 5 ----- pkgs/build-support/rust/hooks/cargo-setup-hook.sh | 2 ++ 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix index 1e500cd82c974..7ad39a58935c7 100644 --- a/pkgs/build-support/rust/build-rust-package/default.nix +++ b/pkgs/build-support/rust/build-rust-package/default.nix @@ -162,11 +162,6 @@ lib.extendMkDerivation { patches = cargoPatches ++ patches; - postUnpack = '' - eval "$cargoDepsHook" - '' - + (args.postUnpack or ""); - configurePhase = args.configurePhase or '' runHook preConfigure diff --git a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh index 1c779a6541d8a..4ba6760a1a237 100644 --- a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh +++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh @@ -1,6 +1,8 @@ cargoSetupPostUnpackHook() { echo "Executing cargoSetupPostUnpackHook" + eval "${cargoDepsHook-}" + # Some cargo builds include build hooks that modify their own vendor # dependencies. This copies the vendor directory into the build tree and makes # it writable. If we're using a tarball, the unpackFile hook already handles From 6dc97c4c8730981dab85b3aa9a8606db8c769d5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luka=20Bla=C5=A1kovi=C4=87?= Date: Fri, 31 Oct 2025 06:50:17 +0000 Subject: [PATCH 020/108] rust: 1.90.0 -> 1.91.0 Co-authored-by: winston --- .../rust/build-rust-crate/test/default.nix | 1 + .../compilers/rust/{1_90.nix => 1_91.nix} | 42 +++++++++---------- pkgs/development/compilers/rust/rustc.nix | 16 +++---- pkgs/top-level/all-packages.nix | 8 ++-- 4 files changed, 34 insertions(+), 33 deletions(-) rename pkgs/development/compilers/rust/{1_90.nix => 1_91.nix} (51%) diff --git a/pkgs/build-support/rust/build-rust-crate/test/default.nix b/pkgs/build-support/rust/build-rust-crate/test/default.nix index 50e045921387b..d5c56858c6a4e 100644 --- a/pkgs/build-support/rust/build-rust-crate/test/default.nix +++ b/pkgs/build-support/rust/build-rust-crate/test/default.nix @@ -774,6 +774,7 @@ rec { # On Darwin, the debug symbols are in a separate directory. "./bin/test_binary1.dSYM/Contents/Info.plist" "./bin/test_binary1.dSYM/Contents/Resources/DWARF/test_binary1" + "./bin/test_binary1.dSYM/Contents/Resources/Relocations/${stdenv.hostPlatform.rust.platform.arch}/test_binary1.yml" ]; }; diff --git a/pkgs/development/compilers/rust/1_90.nix b/pkgs/development/compilers/rust/1_91.nix similarity index 51% rename from pkgs/development/compilers/rust/1_90.nix rename to pkgs/development/compilers/rust/1_91.nix index 22124d21362be..b349ade55ec27 100644 --- a/pkgs/development/compilers/rust/1_90.nix +++ b/pkgs/development/compilers/rust/1_91.nix @@ -44,8 +44,8 @@ let in import ./default.nix { - rustcVersion = "1.90.0"; - rustcSha256 = "sha256-eZqfnLpO1TUeBxBIvPa1VgdV2QCWSN7zOkB91JYfm34="; + rustcVersion = "1.91.0"; + rustcSha256 = "sha256-Mn9SgVF1MBPworLH9IlVoDPXGPJppLxYYxTWddDUPoo="; llvmSharedForBuild = llvmSharedFor pkgsBuildBuild; llvmSharedForHost = llvmSharedFor pkgsBuildHost; @@ -59,30 +59,30 @@ import ./default.nix # Note: the version MUST be the same version that we are building. Upstream # ensures that each released compiler can compile itself: # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363 - bootstrapVersion = "1.90.0"; + bootstrapVersion = "1.91.0"; # fetch hashes by running `print-hashes.sh ${bootstrapVersion}` bootstrapHashes = { - i686-unknown-linux-gnu = "8f389b9eb1513785f5589816b60b5a7ca3b24c29bedce7ec0d1c2f8c3ccfb0cc"; - x86_64-unknown-linux-gnu = "e453bae1c68d02fe2eae065c5452d5731308164cd154154c6ee442d2fa590685"; - x86_64-unknown-linux-musl = "251c9fe4e3374f2f9f629a7a83238c618e016b1bda1b9de5e8385cb3a6f057fa"; - arm-unknown-linux-gnueabihf = "61f3987f61bf73562f04dcacfee1a2bad8d16d41f7a3f81ad82dd9b9cbc559ce"; - armv7-unknown-linux-gnueabihf = "06cfb7f1bd3ce50480eed73ad9ae4f8f665d154fa4c713bc08541197eecd4ae0"; - aarch64-unknown-linux-gnu = "293f412e3412c3aa3398c78ebbdf898fa08eacad80c85a7332ce1a455504c5fc"; - aarch64-unknown-linux-musl = "b3ac31ca2e1a720709bf4fb678b2a2f98464c55662c516dfffcbdadd95a420c9"; - x86_64-apple-darwin = "3d1d24e1d4bedb421ca1a16060c21f4d803eaefba585c0b5b5d0b1e56692ef4b"; - aarch64-apple-darwin = "a11b52e34f5e80cb25d49f7943ae60e0b069b431727a4c09b2c890ceebee3687"; - powerpc64-unknown-linux-gnu = "39720c905b8a730cfa725b7e201cd238d15c33112bd4c31b168ca6d1cb898cac"; - powerpc64le-unknown-linux-gnu = "4061405099dc0aba379fe7b7a616d320272ef9325114dfa8f106c303f9b5695c"; - powerpc64le-unknown-linux-musl = "0d97ef122126a0de87a8581f48ef85ff0887b733b429ffcec4651699b5444511"; - riscv64gc-unknown-linux-gnu = "42cc3b3bb008e24a39bd98887c43ef32c2d997f801c86ca47f2119e5e3589fcb"; - s390x-unknown-linux-gnu = "345c9b902ebee656533d2cfba39c1a020e6a41a4a9609f87430ff8a5d680d649"; - loongarch64-unknown-linux-gnu = "1c116041a2bc7ab2697218f99ad8cccbe3d6b63fcbf516cb9d985cb00efcdb09"; - loongarch64-unknown-linux-musl = "0ae18468c7cd3872d1b685cf960426aeb7467629f69eabb497bee6f0fff9cb04"; - x86_64-unknown-freebsd = "6c7ebf6acbe00873680a190152d47aeebe76e237195b974c593a67227123b2ef"; + i686-unknown-linux-gnu = "7f455c2b498a6197db7f00d636899ed0fb20ce152f1b1573a3ee524ee98b1b80"; + x86_64-unknown-linux-gnu = "bad9a353330d9f409fe9db790da5701074112f804073506bb2808dd97b940b3c"; + x86_64-unknown-linux-musl = "ac925e53b6cef81445f73e6d45213ab56d11585ac525a3ac21fc09ef4ca664ab"; + arm-unknown-linux-gnueabihf = "4cba316544d91b240529a5e835a42526eaeba85d3574f72b24e7ef73a7bb9132"; + armv7-unknown-linux-gnueabihf = "d86de4cd9e8264ff8dff1b2ec52b8fd2dbb9a01acb6c23ad73e38695d2de98e6"; + aarch64-unknown-linux-gnu = "29c5a608861cc9c06d3f86852a7d7b1a868de2d7ab90d4ff625aeebfb9383390"; + aarch64-unknown-linux-musl = "e97e8821ca7e3aa9986a776cd145ee1b01b8984d31912d345c6059b9535cb72e"; + x86_64-apple-darwin = "b329b458c8074023e5f6934bcd6c0bbef5075ac0090548c3d45a7de82e0c5b0c"; + aarch64-apple-darwin = "ec42d93940933340ee55e67003699ebe264aa82d7cf0d5ae08100c06b1bfacfa"; + powerpc64-unknown-linux-gnu = "9c325b63643bbc4ca98aec820c056f6fb4e82ddc6cc14b1e1382db1f10855ff3"; + powerpc64le-unknown-linux-gnu = "1a357b1e44f7ec7c2da62461a4180d8d8b599dd06045e7e2b83cd7f93972d6d7"; + powerpc64le-unknown-linux-musl = "584b4e37b7c06f850f167b2f8e5095a7a1ca961d8e66c8aae0f4a5ccfba4736e"; + riscv64gc-unknown-linux-gnu = "216a1c6d178e0494ac488f3310e600ef17c62ce38d43e9b14557d1f16f3637f7"; + s390x-unknown-linux-gnu = "e2cda4e86f68e3d4ca9df4f9d80d53fc34a555a96012fceefa4190a388e987d4"; + loongarch64-unknown-linux-gnu = "8121c8d7d9152a835c84bf6b586c107ae582ed051780d37cb1e6f4f9bdad23aa"; + loongarch64-unknown-linux-musl = "58344f7047aceefa44e9aef552b9b84ae3d16fded31a5c6ba9b63abc2c269f43"; + x86_64-unknown-freebsd = "b996571bffafb11951b1a29526bb79518c9f5d74618cf414989b297375c7264f"; }; - selectRustPackage = pkgs: pkgs.rust_1_90; + selectRustPackage = pkgs: pkgs.rust_1_91; } ( diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix index 463c0133015fa..97f86780a4d41 100644 --- a/pkgs/development/compilers/rust/rustc.nix +++ b/pkgs/development/compilers/rust/rustc.nix @@ -62,12 +62,6 @@ stdenv.mkDerivation (finalAttrs: { passthru.isReleaseTarball = true; }; - hardeningDisable = optionals stdenv.cc.isClang [ - # remove once https://github.com/NixOS/nixpkgs/issues/318674 is - # addressed properly - "zerocallusedregs" - ]; - __darwinAllowLocalNetworking = true; # rustc complains about modified source files otherwise @@ -238,6 +232,11 @@ stdenv.mkDerivation (finalAttrs: { # doesn't work) to build a linker. "--disable-llvm-bitcode-linker" ] + ++ optionals (!fastCross && stdenv.targetPlatform.config != "wasm32-unknown-none") [ + # See https://github.com/rust-lang/rust/issues/132802 + "--set=target.wasm32-unknown-unknown.optimized-compiler-builtins=false" + "--set=target.wasm32v1-none.optimized-compiler-builtins=false" + ] ++ optionals (stdenv.targetPlatform.isLinux && !(stdenv.targetPlatform.useLLVM or false)) [ "--enable-profiler" # build libprofiler_builtins ] @@ -281,12 +280,13 @@ stdenv.mkDerivation (finalAttrs: { '' runHook preBuild - mkdir -p build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-{std,rustc}/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/ + mkdir -p build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage{0,1}-{std,rustc}/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/ ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/libstd-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/libstd.so ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/librustc_driver-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/librustc.so ln -s ${rustc.unwrapped}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main + ln -s ${rustc.unwrapped}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage1-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.libstd-stamp - touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc-stamp + touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage{0,1}-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc-stamp python ./x.py --keep-stage=0 --stage=1 build library runHook postBuild diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 5694e78a47a4d..53bef6a102507 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -5290,15 +5290,15 @@ with pkgs; wrapRustcWith = { rustc-unwrapped, ... }@args: callPackage ../build-support/rust/rustc-wrapper args; wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; }; - rust_1_90 = callPackage ../development/compilers/rust/1_90.nix { }; - rust = rust_1_90; + rust_1_91 = callPackage ../development/compilers/rust/1_91.nix { }; + rust = rust_1_91; mrustc = callPackage ../development/compilers/mrustc { }; mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { }; mrustc-bootstrap = callPackage ../development/compilers/mrustc/bootstrap.nix { }; - rustPackages_1_90 = rust_1_90.packages.stable; - rustPackages = rustPackages_1_90; + rustPackages_1_91 = rust_1_91.packages.stable; + rustPackages = rustPackages_1_91; inherit (rustPackages) cargo From e098db85d96bc0447a35483703888d77bf3e2639 Mon Sep 17 00:00:00 2001 From: winston Date: Tue, 4 Nov 2025 13:52:57 +0100 Subject: [PATCH 021/108] cups: use `systemdLibs` instead of `systemd` --- pkgs/by-name/cu/cups/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix index cbb6616f968c7..9af3d80d2e4fb 100644 --- a/pkgs/by-name/cu/cups/package.nix +++ b/pkgs/by-name/cu/cups/package.nix @@ -10,8 +10,8 @@ libtiff, pam, dbus, - enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, - systemd, + enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs, + systemdLibs, acl, gmp, darwin, @@ -76,7 +76,7 @@ stdenv.mkDerivation rec { dbus acl ] - ++ lib.optional enableSystemd systemd; + ++ lib.optional enableSystemd systemdLibs; propagatedBuildInputs = [ gmp ]; From 9b2b69a7c79b5a99c29b59881dd7d0810f70289f Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 4 Nov 2025 14:36:36 +0100 Subject: [PATCH 022/108] libxcrypt: 4.4.38 -> 4.5.0 https://github.com/besser82/libxcrypt/blob/v4.5.0/NEWS --- pkgs/development/libraries/libxcrypt/default.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix index b848ace3879dd..d4d67d533f0f4 100644 --- a/pkgs/development/libraries/libxcrypt/default.nix +++ b/pkgs/development/libraries/libxcrypt/default.nix @@ -12,11 +12,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "libxcrypt"; - version = "4.4.38"; + version = "4.5.0"; src = fetchurl { url = "https://github.com/besser82/libxcrypt/releases/download/v${finalAttrs.version}/libxcrypt-${finalAttrs.version}.tar.xz"; - hash = "sha256-gDBLnDBup5kyfwHZp1Sb2ygxd4kYJjHxtU9FEbQgbdY="; + hash = "sha256-gl52Tk/y5jBK24FM2ilwdLIi1UoE7b2OvHz1j8OvhX0="; }; # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion @@ -78,9 +78,10 @@ stdenv.mkDerivation (finalAttrs: { ''; }; enabledCryptSchemeIds = [ - # https://github.com/besser82/libxcrypt/blob/v4.4.35/lib/hashes.conf + # https://github.com/besser82/libxcrypt/blob/v4.5.0/lib/hashes.conf "y" # yescrypt "gy" # gost_yescrypt + "sm3y" # sm3_yescrypt "7" # scrypt "2b" # bcrypt "2y" # bcrypt_y From 49934b41957bddfd3a9a29de9415df905eaf31e3 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 4 Nov 2025 19:30:01 +0000 Subject: [PATCH 023/108] libdeflate: 1.24 -> 1.25 --- pkgs/by-name/li/libdeflate/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libdeflate/package.nix b/pkgs/by-name/li/libdeflate/package.nix index 0a14d75ea7dcf..c04a7bc35a8ab 100644 --- a/pkgs/by-name/li/libdeflate/package.nix +++ b/pkgs/by-name/li/libdeflate/package.nix @@ -11,13 +11,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libdeflate"; - version = "1.24"; + version = "1.25"; src = fetchFromGitHub { owner = "ebiggers"; repo = "libdeflate"; rev = "v${finalAttrs.version}"; - hash = "sha256-IaXXm9VrZ0Pgb3yTh1fPKkifJDvCxvCfTH08Sdho0Ko="; + hash = "sha256-2TiV3kmFs9j4aYetoYeWg3+MoZ542/0zaD0hwn9b8ZA="; }; cmakeFlags = [ From e1c031bebe89772d6d5e6643625697e7691307fe Mon Sep 17 00:00:00 2001 From: Raphael Robatsch Date: Tue, 4 Nov 2025 22:11:04 +0100 Subject: [PATCH 024/108] mbedtls: 3.6.4 -> 3.6.5 Changes: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.5 --- pkgs/development/libraries/mbedtls/3.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix index 05793b55d0703..f9ddbfd83d821 100644 --- a/pkgs/development/libraries/mbedtls/3.nix +++ b/pkgs/development/libraries/mbedtls/3.nix @@ -1,8 +1,8 @@ { callPackage, fetchurl }: callPackage ./generic.nix { - version = "3.6.4"; - hash = "sha256-y5YqKtjW4IXyIZkoJvwCGC4scx0qdeV40rynHza4NUE="; + version = "3.6.5"; + hash = "sha256-CAMksh7i4mg5zVTYLB/SZWFVmgQBMhPnislLCD9j7+o="; patches = [ # Fixes the build with GCC 14 on aarch64. From 21f767afc22744d52acc9766072e03e297390781 Mon Sep 17 00:00:00 2001 From: andre4ik3 Date: Wed, 5 Nov 2025 07:21:10 +0000 Subject: [PATCH 025/108] systemd: specify default-user-shell This option is used to specify the default shell used for homed users, among other things. By default it is set to `/bin/bash` which doesn't exist on NixOS. Setting this option makes `homectl create` work without having to specify `--shell /run/current-system/sw/bin/bash`. --- pkgs/os-specific/linux/systemd/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 0aa8ce5a68c73..4cea0b2944952 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -445,6 +445,10 @@ stdenv.mkDerivation (finalAttrs: { # independent of upstream changes to the default. (lib.mesonOption "debug-shell" "/bin/sh") + # Use the correct path for Bash for user shells (e.g. used in nspawn and + # homed), which otherwise defaults to /bin/bash. + (lib.mesonOption "default-user-shell" "/run/current-system/sw/bin/bash") + # Attempts to check /usr/sbin and that fails in macOS sandbox because # permission is denied. If /usr/sbin is not a symlink, it defaults to true. # We set it to false since stdenv moves sbin/* to bin and creates a symlink, From b64885283de864bdaf94240279f602b7e94526dc Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 5 Nov 2025 13:20:29 +0100 Subject: [PATCH 026/108] nspr: 4.37 -> 4.38 https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/-FCacePkmj8 --- pkgs/by-name/ns/nspr/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix index 7e24a62ccf392..94327e1475223 100644 --- a/pkgs/by-name/ns/nspr/package.nix +++ b/pkgs/by-name/ns/nspr/package.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation rec { pname = "nspr"; - version = "4.37"; + version = "4.38"; src = fetchurl { url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz"; - hash = "sha256-X5NE7Q4xhVvTj4izPJ2auU9wzlR+8yE+SI0VIPYYQPo="; + hash = "sha256-cu5z/8xu9ecGll+FXs9HDsOYbD4YjhKoqABudvazGm8="; }; patches = [ From 8fa2407be42f50a8401951a7e9c45468afb52d75 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 5 Nov 2025 12:47:42 +0000 Subject: [PATCH 027/108] liburcu: 0.15.3 -> 0.15.4 --- pkgs/by-name/li/liburcu/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/liburcu/package.nix b/pkgs/by-name/li/liburcu/package.nix index 3ba541fd11ca0..7a1538aa9defc 100644 --- a/pkgs/by-name/li/liburcu/package.nix +++ b/pkgs/by-name/li/liburcu/package.nix @@ -6,12 +6,12 @@ }: stdenv.mkDerivation rec { - version = "0.15.3"; + version = "0.15.4"; pname = "liburcu"; src = fetchurl { url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2"; - hash = "sha256-Jmh+yE4+EUdZRUyISgir6ved7AmwQYld30xF7BUKy20="; + hash = "sha256-EaFKdmCsm6nAu9Oy2BcYUj0n3GyKnfq9XkAbQGZz7jo="; }; outputs = [ From d6681923240fbd2b44baf680c6ff743a89840022 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 5 Nov 2025 12:57:23 +0000 Subject: [PATCH 028/108] curl: 8.16.0 -> 8.17.0 --- pkgs/by-name/cu/curlMinimal/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix index 2ce9522d6f4d8..f64a4c9de767f 100644 --- a/pkgs/by-name/cu/curlMinimal/package.nix +++ b/pkgs/by-name/cu/curlMinimal/package.nix @@ -86,7 +86,7 @@ assert stdenv.mkDerivation (finalAttrs: { pname = "curl"; - version = "8.16.0"; + version = "8.17.0"; src = fetchurl { urls = [ @@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: { builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version }/curl-${finalAttrs.version}.tar.xz" ]; - hash = "sha256-QMjN28tsxiUcA96kI6Ryps6kA3vmVLpc9d7G6y0i/x0="; + hash = "sha256-lV9ucprWs1ZiYOj+9oYg52ujwxrPChhSRBahhaz3eZI="; }; # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion From e73b7bfc68006ebe95ae4835c1d94c97ad5b1c35 Mon Sep 17 00:00:00 2001 From: Luna Nova Date: Wed, 5 Nov 2025 07:07:55 -0800 Subject: [PATCH 029/108] go: move tests to separate file for sharing between versions --- pkgs/development/compilers/go/1.24.nix | 17 ++++------- pkgs/development/compilers/go/1.25.nix | 38 ++++------------------- pkgs/development/compilers/go/tests.nix | 40 +++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 45 deletions(-) create mode 100644 pkgs/development/compilers/go/tests.nix diff --git a/pkgs/development/compilers/go/1.24.nix b/pkgs/development/compilers/go/1.24.nix index b7c23511bc5ec..005e92264d637 100644 --- a/pkgs/development/compilers/go/1.24.nix +++ b/pkgs/development/compilers/go/1.24.nix @@ -9,16 +9,13 @@ buildPackages, pkgsBuildTarget, targetPackages, - testers, - skopeo, buildGo124Module, + callPackage, }: let goBootstrap = buildPackages.callPackage ./bootstrap122.nix { }; - skopeoTest = skopeo.override { buildGoModule = buildGo124Module; }; - # We need a target compiler which is still runnable at build time, # to handle the cross-building case where build != host == target targetCC = pkgsBuildTarget.targetPackages.stdenv.cc; @@ -195,14 +192,10 @@ stdenv.mkDerivation (finalAttrs: { disallowedReferences = [ goBootstrap ]; passthru = { - inherit goBootstrap skopeoTest; - tests = { - skopeo = testers.testVersion { package = skopeoTest; }; - version = testers.testVersion { - package = finalAttrs.finalPackage; - command = "go version"; - version = "go${finalAttrs.version}"; - }; + inherit goBootstrap; + tests = callPackage ./tests.nix { + go = finalAttrs.finalPackage; + buildGoModule = buildGo124Module; }; }; diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix index 20f8bc52a5338..c26fc7c8304e1 100644 --- a/pkgs/development/compilers/go/1.25.nix +++ b/pkgs/development/compilers/go/1.25.nix @@ -10,20 +10,13 @@ pkgsBuildTarget, targetPackages, # for testing - testers, - runCommand, - bintools, - skopeo, - clickhouse-backup, buildGo125Module, + callPackage, }: let goBootstrap = buildPackages.callPackage ./bootstrap122.nix { }; - skopeoTest = skopeo.override { buildGoModule = buildGo125Module; }; - clickhouse-backupTest = clickhouse-backup.override { buildGoModule = buildGo125Module; }; - # We need a target compiler which is still runnable at build time, # to handle the cross-building case where build != host == target targetCC = pkgsBuildTarget.targetPackages.stdenv.cc; @@ -200,31 +193,10 @@ stdenv.mkDerivation (finalAttrs: { disallowedReferences = [ goBootstrap ]; passthru = { - inherit goBootstrap skopeoTest; - tests = { - skopeo = testers.testVersion { package = skopeoTest; }; - version = testers.testVersion { - package = finalAttrs.finalPackage; - command = "go version"; - version = "go${finalAttrs.version}"; - }; - # Picked clickhouse-backup as a package that sets CGO_ENABLED=0 - # Running and outputting the right version proves a working ELF interpreter was picked - clickhouse-backup = testers.testVersion { package = clickhouse-backupTest; }; - clickhouse-backup-is-pie = runCommand "has-pie" { meta.broken = stdenv.hostPlatform.isStatic; } '' - ${lib.optionalString (!isCross) '' - if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe clickhouse-backup} | grep -Fq "GCC: (GNU)"; then - echo "${lib.getExe clickhouse-backup} has a GCC .comment, but it should have used the internal go linker" - exit 1 - fi - ''} - if ${lib.getExe' bintools "readelf"} -h ${lib.getExe clickhouse-backup} | grep -q "Type:.*DYN"; then - touch $out - else - echo "ERROR: clickhouse-backup is NOT PIE" - exit 1 - fi - ''; + inherit goBootstrap; + tests = callPackage ./tests.nix { + go = finalAttrs.finalPackage; + buildGoModule = buildGo125Module; }; }; diff --git a/pkgs/development/compilers/go/tests.nix b/pkgs/development/compilers/go/tests.nix new file mode 100644 index 0000000000000..74fcfeaebe62e --- /dev/null +++ b/pkgs/development/compilers/go/tests.nix @@ -0,0 +1,40 @@ +{ + lib, + stdenv, + go, + buildGoModule, + skopeo, + testers, + runCommand, + bintools, + clickhouse-backup, +}: +let + skopeo' = skopeo.override { buildGoModule = buildGoModule; }; + clickhouse-backup' = clickhouse-backup.override { buildGoModule = buildGoModule; }; +in +{ + skopeo = testers.testVersion { package = skopeo'; }; + version = testers.testVersion { + package = go; + command = "go version"; + version = "go${go.version}"; + }; + # Picked clickhouse-backup as a package that sets CGO_ENABLED=0 + # Running and outputting the right version proves a working ELF interpreter was picked + clickhouse-backup = testers.testVersion { package = clickhouse-backup'; }; + clickhouse-backup-is-pie = runCommand "has-pie" { meta.broken = stdenv.hostPlatform.isStatic; } '' + ${lib.optionalString (stdenv.buildPlatform == stdenv.targetPlatform) '' + if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe clickhouse-backup'} | grep -Fq "GCC: (GNU)"; then + echo "${lib.getExe clickhouse-backup'} has a GCC .comment, but it should have used the internal go linker" + exit 1 + fi + ''} + if ${lib.getExe' bintools "readelf"} -h ${lib.getExe clickhouse-backup'} | grep -q "Type:.*DYN"; then + touch $out + else + echo "ERROR: clickhouse-backup is NOT PIE" + exit 1 + fi + ''; +} From c877793c947835676d3c2533e341645d3bd14e54 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 5 Nov 2025 15:57:30 +0000 Subject: [PATCH 030/108] hwdata: 0.400 -> 0.401 --- pkgs/by-name/hw/hwdata/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix index 28440ad5a0be7..b8b15bd8ca185 100644 --- a/pkgs/by-name/hw/hwdata/package.nix +++ b/pkgs/by-name/hw/hwdata/package.nix @@ -6,13 +6,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "hwdata"; - version = "0.400"; + version = "0.401"; src = fetchFromGitHub { owner = "vcrhonek"; repo = "hwdata"; rev = "v${finalAttrs.version}"; - hash = "sha256-X3LL3PZjEiGrkntegcSWNW2Wsx/IpdTowSVp/F4ov+E="; + hash = "sha256-2NZwylrUfnzA0aE+xlVZ7QCpCzfW9DwGzRVHirt0TRU="; }; doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus) From 430d7c65508c5609b3124d2eb2864adfdd2a5014 Mon Sep 17 00:00:00 2001 From: Sarah Clark Date: Wed, 5 Nov 2025 11:07:42 -0800 Subject: [PATCH 031/108] python3Packages.prompt-toolkit: build from GitHub --- .../python-modules/prompt-toolkit/default.nix | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/pkgs/development/python-modules/prompt-toolkit/default.nix b/pkgs/development/python-modules/prompt-toolkit/default.nix index b88ff4b53babb..aa13eaaf7ac9a 100644 --- a/pkgs/development/python-modules/prompt-toolkit/default.nix +++ b/pkgs/development/python-modules/prompt-toolkit/default.nix @@ -1,7 +1,7 @@ { lib, buildPythonPackage, - fetchPypi, + fetchFromGitHub, pytestCheckHook, setuptools, wcwidth, @@ -12,10 +12,11 @@ buildPythonPackage rec { version = "3.0.52"; pyproject = true; - src = fetchPypi { - pname = "prompt_toolkit"; - inherit version; - hash = "sha256-KM3hkpKcjnMh3oXeHdvnNvE3UUiwLy4X7dhABCsb6FU="; + src = fetchFromGitHub { + owner = "prompt-toolkit"; + repo = "python-prompt-toolkit"; + tag = version; + hash = "sha256-ggCy7xTvOkjy6DgsO/rPNtQiAQ4FjsK4ShrvkIHioNQ="; }; postPatch = '' @@ -47,7 +48,7 @@ buildPythonPackage rec { with a nice interactive Python shell (called ptpython) built on top. ''; homepage = "https://github.com/jonathanslenders/python-prompt-toolkit"; - changelog = "https://github.com/prompt-toolkit/python-prompt-toolkit/blob/${version}/CHANGELOG"; + changelog = "https://github.com/prompt-toolkit/python-prompt-toolkit/releases/tag/${src.tag}"; license = licenses.bsd3; maintainers = [ ]; }; From 8f1fc93197d273a95e0ac90f9d3460d5e12b1d33 Mon Sep 17 00:00:00 2001 From: Sarah Clark Date: Wed, 5 Nov 2025 11:12:29 -0800 Subject: [PATCH 032/108] python3Packages.prompt-toolkit: add sarahec as maintainer --- pkgs/development/python-modules/prompt-toolkit/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/prompt-toolkit/default.nix b/pkgs/development/python-modules/prompt-toolkit/default.nix index aa13eaaf7ac9a..e1ad037553620 100644 --- a/pkgs/development/python-modules/prompt-toolkit/default.nix +++ b/pkgs/development/python-modules/prompt-toolkit/default.nix @@ -50,6 +50,6 @@ buildPythonPackage rec { homepage = "https://github.com/jonathanslenders/python-prompt-toolkit"; changelog = "https://github.com/prompt-toolkit/python-prompt-toolkit/releases/tag/${src.tag}"; license = licenses.bsd3; - maintainers = [ ]; + maintainers = with lib.maintainers; [ sarahec ]; }; } From 9c637bed6a00af32d6d44cc4192d5d01dc68bbb7 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Wed, 5 Nov 2025 21:04:10 +0000 Subject: [PATCH 033/108] libdrm: 2.4.127 -> 2.4.128 Changes: https://lists.x.org/archives/xorg-announce/2025-November/003639.html --- pkgs/by-name/li/libdrm/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libdrm/package.nix b/pkgs/by-name/li/libdrm/package.nix index 9c38c381502e4..f78ff46011f29 100644 --- a/pkgs/by-name/li/libdrm/package.nix +++ b/pkgs/by-name/li/libdrm/package.nix @@ -16,11 +16,11 @@ stdenv.mkDerivation rec { pname = "libdrm"; - version = "2.4.127"; + version = "2.4.128"; src = fetchurl { url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz"; - hash = "sha256-BRrrPlQqV2IQGP/EQ/sIjdabeO7wzkgItgTOD+rJ9H8="; + hash = "sha256-O7NduHAMKgtWnyxnKaU/VJV4aFazEIVMjeV3gqIr3aw="; }; outputs = [ From bffc1c97f45716164464d7782146b75b1bfa9a1e Mon Sep 17 00:00:00 2001 From: Sarah Clark Date: Wed, 5 Nov 2025 10:38:58 -0800 Subject: [PATCH 034/108] python3Packages.narwhals: disable tests that segfault on darwin --- pkgs/development/python-modules/narwhals/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/development/python-modules/narwhals/default.nix b/pkgs/development/python-modules/narwhals/default.nix index a33dad2029489..049411653ca09 100644 --- a/pkgs/development/python-modules/narwhals/default.nix +++ b/pkgs/development/python-modules/narwhals/default.nix @@ -1,5 +1,6 @@ { lib, + stdenv, buildPythonPackage, dask, duckdb, @@ -82,6 +83,11 @@ buildPythonPackage rec { "test_collect_empty" ]; + disabledTestPaths = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [ + # Segfault in included polars/lazyframe + "tests/tpch_q1_test.py" + ]; + pytestFlags = [ "-Wignore::DeprecationWarning" ]; From 7e415ae00801f1b3acecf1c9c71a4a8dcf76fb3e Mon Sep 17 00:00:00 2001 From: Luna Nova Date: Wed, 5 Nov 2025 07:29:30 -0800 Subject: [PATCH 035/108] go.tests: test skopeo and ashens exe types --- pkgs/development/compilers/go/tests.nix | 41 +++++++++++++++++++------ 1 file changed, 31 insertions(+), 10 deletions(-) diff --git a/pkgs/development/compilers/go/tests.nix b/pkgs/development/compilers/go/tests.nix index 74fcfeaebe62e..e8756419fcfb3 100644 --- a/pkgs/development/compilers/go/tests.nix +++ b/pkgs/development/compilers/go/tests.nix @@ -3,15 +3,19 @@ stdenv, go, buildGoModule, + # A package that relies on CGO skopeo, testers, runCommand, bintools, - clickhouse-backup, + # A package with CGO_ENABLED=0 + athens, }: let skopeo' = skopeo.override { buildGoModule = buildGoModule; }; - clickhouse-backup' = clickhouse-backup.override { buildGoModule = buildGoModule; }; + athens' = athens.override { buildGoModule = buildGoModule; }; + expectedCgoEnabledType = "DYN"; + expectedCgoDisabledType = "DYN"; in { skopeo = testers.testVersion { package = skopeo'; }; @@ -20,20 +24,37 @@ in command = "go version"; version = "go${go.version}"; }; - # Picked clickhouse-backup as a package that sets CGO_ENABLED=0 - # Running and outputting the right version proves a working ELF interpreter was picked - clickhouse-backup = testers.testVersion { package = clickhouse-backup'; }; - clickhouse-backup-is-pie = runCommand "has-pie" { meta.broken = stdenv.hostPlatform.isStatic; } '' + athens = testers.testVersion { package = athens'; }; +} +# bin type tests assume ELF file + linux-specific exe types +// lib.optionalAttrs stdenv.hostPlatform.isLinux { + skopeo-bin-type = runCommand "skopeo-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } '' + bin="${lib.getExe' skopeo' ".skopeo-wrapped"}" + if ! ${lib.getExe' bintools "readelf"} -p .comment $bin | grep -Fq "GCC: (GNU)"; then + echo "${lib.getExe skopeo} should have been externally linked, but no GNU .comment section found" + exit 1 + fi + if ${lib.getExe' bintools "readelf"} -h $bin | grep -q "Type:.*${expectedCgoEnabledType}"; then + touch $out + else + echo "ERROR: $bin is NOT ${expectedCgoEnabledType}" + exit 1 + fi + ''; + athens-bin-type = runCommand "athens-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } '' + bin="${lib.getExe athens'}" ${lib.optionalString (stdenv.buildPlatform == stdenv.targetPlatform) '' - if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe clickhouse-backup'} | grep -Fq "GCC: (GNU)"; then - echo "${lib.getExe clickhouse-backup'} has a GCC .comment, but it should have used the internal go linker" + # For CGO_ENABLED=0 the internal linker should be used, except + # for cross where we rely on external linking by default + if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe athens'} | grep -Fq "GCC: (GNU)"; then + echo "${lib.getExe athens'} has a GCC .comment, but it should have used the internal go linker" exit 1 fi ''} - if ${lib.getExe' bintools "readelf"} -h ${lib.getExe clickhouse-backup'} | grep -q "Type:.*DYN"; then + if ${lib.getExe' bintools "readelf"} -h "$bin" | grep -q "Type:.*${expectedCgoDisabledType}"; then touch $out else - echo "ERROR: clickhouse-backup is NOT PIE" + echo "ERROR: $bin is NOT ${expectedCgoDisabledType}" exit 1 fi ''; From 5cb4fe3fef528395bc769b350a21d85ffec0f4be Mon Sep 17 00:00:00 2001 From: Leon Klingele Date: Thu, 6 Nov 2025 05:24:59 +0100 Subject: [PATCH 036/108] go_1_25: 1.25.3 -> 1.25.4 --- pkgs/development/compilers/go/1.25.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix index 20f8bc52a5338..fcf12a2d82beb 100644 --- a/pkgs/development/compilers/go/1.25.nix +++ b/pkgs/development/compilers/go/1.25.nix @@ -56,11 +56,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "go"; - version = "1.25.3"; + version = "1.25.4"; src = fetchurl { url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz"; - hash = "sha256-qBpLpZPQAV4QxR4mfeP/B8eskU38oDfZUX0ClRcJd5U="; + hash = "sha256-FgBDt/F7bWC1A2lDaRf9qNUDRkC6Oa4kMca5WoicyYw="; }; strictDeps = true; From 4ff7110a0659fc6905f1fac77592a0e7998a72e6 Mon Sep 17 00:00:00 2001 From: winston Date: Thu, 6 Nov 2025 16:15:24 +0100 Subject: [PATCH 037/108] mdbook: fix rust 1.91 tests --- pkgs/by-name/md/mdbook/package.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/by-name/md/mdbook/package.nix b/pkgs/by-name/md/mdbook/package.nix index 6c6074353bd87..66c1293488b92 100644 --- a/pkgs/by-name/md/mdbook/package.nix +++ b/pkgs/by-name/md/mdbook/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + fetchpatch2, nix, rustPlatform, installShellFiles, @@ -22,6 +23,14 @@ rustPlatform.buildRustPackage rec { cargoHash = "sha256-wvTixSVHXglJM+nBMulZNZKF8pZfNd2G8Z+1PlAWmpk="; + patches = [ + (fetchpatch2 { + name = "fix-rust-1.91-tests.patch"; + url = "https://github.com/rust-lang/mdBook/commit/841c68d05e763b031524a2b4d679f033cd15e64c.patch?full_index=1"; + hash = "sha256-KDQhmFX2TWamtdyssFL69MP3vg9LABb+bF8/7vaFsew="; + }) + ]; + nativeBuildInputs = [ installShellFiles ]; postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' From 4d1d61c75c703c1c0cd03de5cad69e63f4c563b0 Mon Sep 17 00:00:00 2001 From: Luna Nova Date: Wed, 5 Nov 2025 07:30:38 -0800 Subject: [PATCH 038/108] go: set buildmode=exe when CGO_ENABLED=0 To avoid breaking previous documented[^1] behavior of CGO_ENABLED=0 producing fully static binaries we set buildmode=exe. Sadly go does not support static-pie binaries so this means these packages lose ASLR. This is likely to be revisited after branch-off, as go packages in the main package set with CGO_ENABLED=0 not having ASLR is not good security posture in the long term and makes go packages inconsistent with other languages. [1]: See #var-go-CGO_ENABLED Fixes: #456953 Fixes: 08aadbf8d4dbdab061b455e3181b16046445b48b --- pkgs/build-support/go/module.nix | 3 +++ pkgs/development/compilers/go/tests.nix | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix index 30542b1d16c6f..ce699c2134545 100644 --- a/pkgs/build-support/go/module.nix +++ b/pkgs/build-support/go/module.nix @@ -253,6 +253,9 @@ lib.extendMkDerivation { if [ -f "$NIX_CC_FOR_TARGET/nix-support/dynamic-linker" ]; then export GO_LDSO=$(cat $NIX_CC_FOR_TARGET/nix-support/dynamic-linker) fi + if [ "$CGO_ENABLED" = "0" ]; then + export GOFLAGS="-buildmode=exe $GOFLAGS" + fi cd "$modRoot" '' + lib.optionalString (finalAttrs.vendorHash != null) '' diff --git a/pkgs/development/compilers/go/tests.nix b/pkgs/development/compilers/go/tests.nix index e8756419fcfb3..3eeaa8b53262c 100644 --- a/pkgs/development/compilers/go/tests.nix +++ b/pkgs/development/compilers/go/tests.nix @@ -15,7 +15,7 @@ let skopeo' = skopeo.override { buildGoModule = buildGoModule; }; athens' = athens.override { buildGoModule = buildGoModule; }; expectedCgoEnabledType = "DYN"; - expectedCgoDisabledType = "DYN"; + expectedCgoDisabledType = "EXE"; in { skopeo = testers.testVersion { package = skopeo'; }; From 954c7a17bb43bdcfc0b64076a95d967bcc05ceba Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Thu, 6 Nov 2025 12:22:24 +0100 Subject: [PATCH 039/108] spandsp: backport additional memory safety fix This one caused a test failure on x86_64-unknown-linux-musl. Closes: https://github.com/NixOS/nixpkgs/issues/458398 --- pkgs/development/libraries/spandsp/default.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/spandsp/default.nix b/pkgs/development/libraries/spandsp/default.nix index 9720e110f7cfd..0a06b112e4c2d 100644 --- a/pkgs/development/libraries/spandsp/default.nix +++ b/pkgs/development/libraries/spandsp/default.nix @@ -13,8 +13,11 @@ patches = [ (fetchpatch { url = "https://github.com/freeswitch/spandsp/commit/f7b96b08db148763039cf3459d0e00da9636eb92.patch"; - includes = [ "spandsp-sim/g1050.c" ]; - hash = "sha256-TwMhWJXQG/UaWddWgice0klp1uATyHMiE6DcsCebXYQ="; + includes = [ + "spandsp-sim/g1050.c" + "spandsp-sim/test_utils.c" + ]; + hash = "sha256-2MmVgyMUK0Zn+mL7IX57Y7brYpgmt4GVlis5/NstuNM="; }) (fetchpatch { url = "https://github.com/freeswitch/spandsp/commit/f47bcdc301fbddad44e918939eed1b361882f740.patch"; From b3c34739368eecb8b564b4270184d259c761095a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Thu, 6 Nov 2025 19:38:13 -0800 Subject: [PATCH 040/108] python3Packages.brotli: 1.1.0 -> 1.2.0 Diff: https://github.com/google/brotli/compare/v1.1.0...v1.2.0 Changelog: https://github.com/google/brotli/blob/v1.2.0/CHANGELOG.md --- .../development/python-modules/brotli/default.nix | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/pkgs/development/python-modules/brotli/default.nix b/pkgs/development/python-modules/brotli/default.nix index ea4b5c43a4552..07ea99c9467c8 100644 --- a/pkgs/development/python-modules/brotli/default.nix +++ b/pkgs/development/python-modules/brotli/default.nix @@ -2,25 +2,29 @@ lib, buildPythonPackage, fetchFromGitHub, + pkgconfig, pytestCheckHook, setuptools, }: buildPythonPackage rec { pname = "brotli"; - version = "1.1.0"; + version = "1.2.0"; pyproject = true; src = fetchFromGitHub { owner = "google"; repo = "brotli"; tag = "v${version}"; - hash = "sha256-U1vAupUthD5W0xvlOKdgm9MAVLqsVyZUaFdeLsDAbDM="; + hash = "sha256-ePfllKdY12hOPuO9uHuXFZ3Bdib6BLD4ghiaeurJZ28="; # .gitattributes is not correct or GitHub does not parse it correct and the archive is missing the test data forceFetchGit = true; }; - build-system = [ setuptools ]; + build-system = [ + pkgconfig + setuptools + ]; # only returns information how to really build dontConfigure = true; @@ -29,10 +33,11 @@ buildPythonPackage rec { enabledTestPaths = [ "python/tests" ]; - meta = with lib; { + meta = { + changelog = "https://github.com/google/brotli/blob/${src.tag}/CHANGELOG.md"; homepage = "https://github.com/google/brotli"; description = "Generic-purpose lossless compression algorithm"; - license = licenses.mit; + license = lib.licenses.mit; maintainers = [ ]; }; } From 086b3bf9c913fb7332a9715ad1920fd9f34b6f69 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Thu, 6 Nov 2025 19:44:32 -0800 Subject: [PATCH 041/108] python3Packages.brotli: unvendor brotli --- pkgs/by-name/br/brotli/package.nix | 8 +++++--- pkgs/development/python-modules/brotli/default.nix | 7 +++++++ pkgs/top-level/python-packages.nix | 4 +++- 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/br/brotli/package.nix b/pkgs/by-name/br/brotli/package.nix index 4c681fd2dcc8d..6cebf122e1bbd 100644 --- a/pkgs/by-name/br/brotli/package.nix +++ b/pkgs/by-name/br/brotli/package.nix @@ -4,12 +4,11 @@ fetchFromGitHub, fetchpatch, cmake, + python3Packages, staticOnly ? stdenv.hostPlatform.isStatic, testers, }: -# ?TODO: there's also python lib in there - stdenv.mkDerivation (finalAttrs: { pname = "brotli"; version = "1.1.0"; @@ -54,7 +53,10 @@ stdenv.mkDerivation (finalAttrs: { cp ../docs/*.3 $out/share/man/man3/ ''; - passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; + passthru.tests = { + pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; + python = python3Packages.brotli; + }; meta = with lib; { homepage = "https://github.com/google/brotli"; diff --git a/pkgs/development/python-modules/brotli/default.nix b/pkgs/development/python-modules/brotli/default.nix index 07ea99c9467c8..fb78ead78779e 100644 --- a/pkgs/development/python-modules/brotli/default.nix +++ b/pkgs/development/python-modules/brotli/default.nix @@ -1,5 +1,6 @@ { lib, + brotli, buildPythonPackage, fetchFromGitHub, pkgconfig, @@ -29,6 +30,12 @@ buildPythonPackage rec { # only returns information how to really build dontConfigure = true; + env.USE_SYSTEM_BROTLI = 1; + + buildInputs = [ + brotli + ]; + nativeCheckInputs = [ pytestCheckHook ]; enabledTestPaths = [ "python/tests" ]; diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index f22805eed7cc1..e173349d06443 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -2189,7 +2189,9 @@ self: super: with self; { brother-ql = callPackage ../development/python-modules/brother-ql { }; - brotli = callPackage ../development/python-modules/brotli { }; + brotli = callPackage ../development/python-modules/brotli { + inherit (pkgs) brotli; + }; brotli-asgi = callPackage ../development/python-modules/brotli-asgi { }; From e1c2b84c0118bd597a3bdcdb3b075002e8b1fd6f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Thu, 6 Nov 2025 21:56:02 -0800 Subject: [PATCH 042/108] python3Packages.fonttools: use default pytestCheckHook --- pkgs/development/python-modules/fonttools/default.nix | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix index 65f72e01e9193..056c4d8df771f 100644 --- a/pkgs/development/python-modules/fonttools/default.nix +++ b/pkgs/development/python-modules/fonttools/default.nix @@ -21,7 +21,7 @@ xattr, skia-pathops, uharfbuzz, - pytest7CheckHook, + pytestCheckHook, }: buildPythonPackage rec { @@ -29,8 +29,6 @@ buildPythonPackage rec { version = "4.60.1"; pyproject = true; - disabled = pythonOlder "3.8"; - src = fetchFromGitHub { owner = "fonttools"; repo = "fonttools"; @@ -68,9 +66,7 @@ buildPythonPackage rec { extras // { all = lib.concatLists (lib.attrValues extras); }; nativeCheckInputs = [ - # test suite fails with pytest>=8.0.1 - # https://github.com/fonttools/fonttools/issues/3458 - pytest7CheckHook + pytestCheckHook ] ++ lib.concatLists ( lib.attrVals ( From 23d8cc9400e8dcbcde35e012d84cbde8d36edafb Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 7 Nov 2025 14:45:43 +0100 Subject: [PATCH 043/108] libxcrypt: 4.5.0 -> 4.5.1 https://github.com/besser82/libxcrypt/blob/v4.5.1/NEWS --- pkgs/development/libraries/libxcrypt/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix index d4d67d533f0f4..203a45fe3ed49 100644 --- a/pkgs/development/libraries/libxcrypt/default.nix +++ b/pkgs/development/libraries/libxcrypt/default.nix @@ -12,11 +12,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "libxcrypt"; - version = "4.5.0"; + version = "4.5.1"; src = fetchurl { url = "https://github.com/besser82/libxcrypt/releases/download/v${finalAttrs.version}/libxcrypt-${finalAttrs.version}.tar.xz"; - hash = "sha256-gl52Tk/y5jBK24FM2ilwdLIi1UoE7b2OvHz1j8OvhX0="; + hash = "sha256-6bRqYjl8FTcpNfanXcOSnGIWHyYgvnt/V/A9aRAsGoY="; }; # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion From 816b7e23bd6749d4264dfaefddf8cb42f4173d61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Fri, 7 Nov 2025 15:32:15 +0100 Subject: [PATCH 044/108] bluez-headers: 5.83 -> 5.84 Changelog: https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog --- pkgs/by-name/bl/bluez-headers/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/bl/bluez-headers/package.nix b/pkgs/by-name/bl/bluez-headers/package.nix index 2ac0d24640fb5..a3e2e4bf15bad 100644 --- a/pkgs/by-name/bl/bluez-headers/package.nix +++ b/pkgs/by-name/bl/bluez-headers/package.nix @@ -10,22 +10,22 @@ stdenv.mkDerivation (finalAttrs: { pname = "bluez-headers"; - version = "5.83"; + version = "5.84"; # This package has the source, because of the emulatorAvailable check in the # bluez function args, that causes an infinite recursion with Python on cross # builds. src = fetchurl { url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz"; - hash = "sha256-EIUi2QnSIFgTmb/sk9qrYgNVOc7vPdo+eZcHhcY70kw="; + hash = "sha256-W6c9Aw97AAh9Z4ALDjIWAa7A+JKCfHLlosg5DYyIaxE="; }; dontConfigure = true; dontBuild = true; installPhase = '' - mkdir -p $out/include/bluetooth - cp -v lib/*.h "$out/include/bluetooth/" + mkdir -p $out/include/ + cp -rv lib/* "$out/include/" ''; meta = { From 34f81670e057311015e9ddb5448630248c6a1428 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 7 Nov 2025 10:05:49 -0800 Subject: [PATCH 045/108] python3Packages.click: fix SystemExit(1) when using click.File's stdin support This fixes upstream issue https://github.com/pallets/click/issues/2939 which e.g. breaks swh. --- pkgs/development/python-modules/click/default.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix index e028343fbb656..368589cac6ef0 100644 --- a/pkgs/development/python-modules/click/default.nix +++ b/pkgs/development/python-modules/click/default.nix @@ -2,6 +2,7 @@ lib, buildPythonPackage, fetchFromGitHub, + fetchpatch, importlib-metadata, pytestCheckHook, @@ -26,6 +27,15 @@ buildPythonPackage rec { hash = "sha256-3FfLKwpfkiGfY2+H2fQoZwLBqfPlV46xw2Bc4YEsyps="; }; + patches = [ + # https://github.com/pallets/click/pull/2940 + (fetchpatch { + name = "fix-SystemExit-when-using-stdin.patch"; + url = "https://github.com/pallets/click/commit/93c6966eb3a575c2b600434d1cc9f4b3aee505ac.patch"; + hash = "sha256-DkVF0JnKbcsdAhgVjWJEDZZ8vr2sf6wba8P3SyRUy6o="; + }) + ]; + build-system = [ flit-core ]; nativeCheckInputs = [ pytestCheckHook ]; From 26a07c82b73c3f57a234dd05ec42a45ac926dd5e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 7 Nov 2025 10:06:51 -0800 Subject: [PATCH 046/108] python3Packages.swh-core: 4.5.2 -> 4.6.0 Diff: https://gitlab.softwareheritage.org/swh/devel/swh-core/-/compare/v4.5.2...v4.6.0 Changelog: https://gitlab.softwareheritage.org/swh/devel/swh-core/-/tags/v4.6.0 --- .../python-modules/swh-core/default.nix | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/swh-core/default.nix b/pkgs/development/python-modules/swh-core/default.nix index abe4979eb1f10..3697adfb58948 100644 --- a/pkgs/development/python-modules/swh-core/default.nix +++ b/pkgs/development/python-modules/swh-core/default.nix @@ -18,6 +18,7 @@ hypothesis, iso8601, lzip, + moto, msgpack, postgresql, postgresqlTestHook, @@ -29,7 +30,9 @@ pytest-postgresql, pytz, requests-mock, + swh-model, systemd, + tqdm, types-deprecated, types-psycopg2, types-pytz, @@ -41,7 +44,7 @@ buildPythonPackage rec { pname = "swh-core"; - version = "4.5.2"; + version = "4.6.0"; pyproject = true; src = fetchFromGitLab { @@ -50,7 +53,7 @@ buildPythonPackage rec { owner = "devel"; repo = "swh-core"; tag = "v${version}"; - hash = "sha256-yNWij9GclQCysQe9Bukr4cHlZgSQqLAuX1KwGWzAK+0="; + hash = "sha256-dI+xfj0DnUbBdYIVycyJQg3B/jnH/eg/Ju8YX2k8Qkc="; }; build-system = [ @@ -58,6 +61,11 @@ buildPythonPackage rec { setuptools-scm ]; + pythonRelaxDeps = [ + # we patched click 8.2.1 + "click" + ]; + dependencies = [ backports-entry-points-selectable click @@ -79,6 +87,7 @@ buildPythonPackage rec { hypothesis iso8601 lzip + moto msgpack postgresql postgresqlTestHook @@ -90,7 +99,9 @@ buildPythonPackage rec { pytest-postgresql pytz requests-mock + swh-model systemd + tqdm types-deprecated types-psycopg2 types-pytz @@ -111,6 +122,7 @@ buildPythonPackage rec { ]; meta = { + changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-core/-/tags/${src.tag}"; description = "Low-level utilities and helpers used by almost all other modules in the stack"; homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-core"; license = lib.licenses.gpl3Only; From c71c20308a5a0c6b8f6e766b90cc73e9601b8cf1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 7 Nov 2025 10:15:59 -0800 Subject: [PATCH 047/108] python3Packages.swh-web-client: unpin click --- pkgs/development/python-modules/swh-web-client/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/development/python-modules/swh-web-client/default.nix b/pkgs/development/python-modules/swh-web-client/default.nix index b7ec8be2d090e..deeba3f3a3b12 100644 --- a/pkgs/development/python-modules/swh-web-client/default.nix +++ b/pkgs/development/python-modules/swh-web-client/default.nix @@ -37,6 +37,11 @@ buildPythonPackage rec { setuptools-scm ]; + pythonRelaxDeps = [ + # we patched click 8.2.1 + "click" + ]; + dependencies = [ click dateutils From 7313cf858d36ded9b981e4cfa0cf101c54a683fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 7 Nov 2025 12:38:02 -0800 Subject: [PATCH 048/108] python3Packages.swh-scanner: fix meta --- pkgs/development/python-modules/swh-scanner/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/swh-scanner/default.nix b/pkgs/development/python-modules/swh-scanner/default.nix index 03fef49e98784..e49ba7eb207e9 100644 --- a/pkgs/development/python-modules/swh-scanner/default.nix +++ b/pkgs/development/python-modules/swh-scanner/default.nix @@ -81,8 +81,9 @@ buildPythonPackage rec { ]; meta = { - description = "Implementation of the Data model of the Software Heritage project, used to archive source code artifacts"; - homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-model"; + changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-scanner/-/tags/${src.tag}"; + description = "Source code scanner to analyze code bases and compare them with source code artifacts archived by Software Heritage"; + homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-scanner"; license = lib.licenses.gpl3Only; maintainers = [ ]; }; From 204fe9a3775a16fe22d255225cd083dd2c3a0fa9 Mon Sep 17 00:00:00 2001 From: Pol Dellaiera Date: Wed, 5 Nov 2025 18:48:12 +0100 Subject: [PATCH 049/108] python3Packages.swh-scanner: disable tests failing on click >= 8.2.0 The patch is no longer needed because the respective test is now disabled. --- .../python-modules/swh-scanner/default.nix | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/pkgs/development/python-modules/swh-scanner/default.nix b/pkgs/development/python-modules/swh-scanner/default.nix index e49ba7eb207e9..5dca94bb53d24 100644 --- a/pkgs/development/python-modules/swh-scanner/default.nix +++ b/pkgs/development/python-modules/swh-scanner/default.nix @@ -2,7 +2,6 @@ lib, buildPythonPackage, fetchFromGitLab, - fetchpatch, setuptools, setuptools-scm, requests, @@ -36,15 +35,6 @@ buildPythonPackage rec { hash = "sha256-baUUuYFapBD7iuDaDP8CSR9f4glVZcS5qBpZddVf7z8="; }; - patches = [ - # To be removed at the next release - # See https://gitlab.softwareheritage.org/swh/devel/swh-scanner/-/merge_requests/160 - (fetchpatch { - url = "https://gitlab.softwareheritage.org/swh/devel/swh-scanner/-/commit/0eb273475826b0074844c7619b767c052562cfe4.patch"; - hash = "sha256-i3hpaQJmHpIYgix+/npICQGtJ/IKVRXcCTm2O1VsR9M="; - }) - ]; - build-system = [ setuptools setuptools-scm @@ -78,6 +68,8 @@ buildPythonPackage rec { disabledTestPaths = [ # pytestRemoveBytecodePhase fails with: "error (ignored): error: opening directory "/tmp/nix-build-python3.12-swh-scanner-0.8.3.drv-5/build/pytest-of-nixbld/pytest-0/test_randomdir_policy_info_cal0/big-directory/dir/dir/dir/ ......" "swh/scanner/tests/test_policy.py" + # TypeError: CliRunner.__init__() got an unexpected keyword argument 'mix_stderr' + "swh/scanner/tests/test_cli.py" ]; meta = { From 305181922cd6fbc60623418ff7c22f7c6ad20426 Mon Sep 17 00:00:00 2001 From: Benjamin Sparks Date: Fri, 7 Nov 2025 22:22:43 +0100 Subject: [PATCH 050/108] uv: 0.9.7 -> 0.9.8 Changelog: https://github.com/astral-sh/uv/releases/tag/0.9.8 --- pkgs/by-name/uv/uv/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix index 98f9cd0eb5a50..a324cbee3d212 100644 --- a/pkgs/by-name/uv/uv/package.nix +++ b/pkgs/by-name/uv/uv/package.nix @@ -18,16 +18,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "uv"; - version = "0.9.7"; + version = "0.9.8"; src = fetchFromGitHub { owner = "astral-sh"; repo = "uv"; tag = finalAttrs.version; - hash = "sha256-I0Oe6vaH7iQh+Ubp5RIk8Ol6Ni7OPu8HKX0fqLdewyk="; + hash = "sha256-e7yvEQggfBLq4akqnVoZTfvcpZLlbQRWr2fruGfF/N4="; }; - cargoHash = "sha256-K/RP7EA0VAAI8TGx+VwfKPmyT6+x4p3kekuoMZ0/egc="; + cargoHash = "sha256-lEGhXwzotvCuDAvVyrt22e/ReotWT7m1lt6d2GL8lFU="; buildInputs = [ rust-jemalloc-sys From c7349ac27b92228d69a152fc2f89b25ffd3d8fc3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 7 Nov 2025 13:32:09 -0800 Subject: [PATCH 051/108] python3Packages.swh-shard: init at 2.2.0 --- .../python-modules/swh-shard/default.nix | 72 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 74 insertions(+) create mode 100644 pkgs/development/python-modules/swh-shard/default.nix diff --git a/pkgs/development/python-modules/swh-shard/default.nix b/pkgs/development/python-modules/swh-shard/default.nix new file mode 100644 index 0000000000000..a07c344b04a28 --- /dev/null +++ b/pkgs/development/python-modules/swh-shard/default.nix @@ -0,0 +1,72 @@ +{ + buildPythonPackage, + click, + cmake, + cmph, + fetchFromGitLab, + lib, + ninja, + pkg-config, + pybind11, + pytest-mock, + pytestCheckHook, + scikit-build-core, + setuptools-scm, +}: + +buildPythonPackage rec { + pname = "swh-shard"; + version = "2.2.0"; + pyproject = true; + + src = fetchFromGitLab { + domain = "gitlab.softwareheritage.org"; + group = "swh"; + owner = "devel"; + repo = "swh-shard"; + tag = "v${version}"; + hash = "sha256-97oZ+Wa8GmyL2V4CnlSvaTbQZJ+mPbg6uVmWd0oxv1Q="; + }; + + build-system = [ + cmake + ninja + pybind11 + scikit-build-core + setuptools-scm + ]; + + nativeBuildInputs = [ + pkg-config + ]; + + dontUseCmakeConfigure = true; + + buildInputs = [ + cmph + ]; + + dependencies = [ + click + ]; + + pythonImportsCheck = [ "swh.shard" ]; + + nativeCheckInputs = [ + pytest-mock + pytestCheckHook + ]; + + preCheck = '' + # import from $out + rm src/swh/shard/*.py + ''; + + meta = { + changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-shard/-/tags/v2.2.0"; + description = "Shard File Format for the Software Heritage Object Storage"; + homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-shard"; + license = lib.licenses.gpl3Only; + maintainers = [ lib.maintainers.dotlambda ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 451502c1d2eee..d089c2fcb4bb7 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -18077,6 +18077,8 @@ self: super: with self; { swh-scheduler = callPackage ../development/python-modules/swh-scheduler { }; + swh-shard = callPackage ../development/python-modules/swh-shard { }; + swh-storage = callPackage ../development/python-modules/swh-storage { }; swh-web-client = callPackage ../development/python-modules/swh-web-client { }; From 2bd851a243ffc1d7e94bf4304b16199a1201a243 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 7 Nov 2025 13:11:21 -0800 Subject: [PATCH 052/108] python3Packages.swh-objstorage: 4.0.0 -> 5.1.0 Diff: https://gitlab.softwareheritage.org/swh/devel/swh-objstorage/-/compare/v4.0.0...v5.1.0 Changelog: https://gitlab.softwareheritage.org/swh/devel/swh-objstorage/-/tags/v4.1.0 https://gitlab.softwareheritage.org/swh/devel/swh-objstorage/-/tags/v4.2.0 https://gitlab.softwareheritage.org/swh/devel/swh-objstorage/-/tags/v5.0.0 https://gitlab.softwareheritage.org/swh/devel/swh-objstorage/-/tags/v5.0.1 https://gitlab.softwareheritage.org/swh/devel/swh-objstorage/-/tags/v5.1.0 --- .../python-modules/swh-objstorage/default.nix | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/swh-objstorage/default.nix b/pkgs/development/python-modules/swh-objstorage/default.nix index 5dda6b224fa52..aac86b8de8964 100644 --- a/pkgs/development/python-modules/swh-objstorage/default.nix +++ b/pkgs/development/python-modules/swh-objstorage/default.nix @@ -18,7 +18,7 @@ tenacity, swh-core, swh-model, - swh-perfecthash, + swh-shard, aiohttp, azure-core, azure-storage-blob, @@ -40,7 +40,7 @@ buildPythonPackage rec { pname = "swh-objstorage"; - version = "4.0.0"; + version = "5.1.0"; pyproject = true; src = fetchFromGitLab { @@ -49,7 +49,7 @@ buildPythonPackage rec { owner = "devel"; repo = "swh-objstorage"; tag = "v${version}"; - hash = "sha256-c0ZH2PMT9DVnpTV5PDyX0Yw4iHiJSolEgq/bMXEwXG8="; + hash = "sha256-NnNT9Lt/LGDIJpUmfkfPn6JnF3k8Usf2UVa88zHPKlg="; }; build-system = [ @@ -71,7 +71,7 @@ buildPythonPackage rec { tenacity swh-core swh-model - swh-perfecthash + swh-shard ]; preCheck = '' @@ -110,6 +110,7 @@ buildPythonPackage rec { ]; meta = { + changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-objstorage/-/tags/${src.tag}"; description = "Content-addressable object storage for the Software Heritage project"; homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-objstorage"; license = lib.licenses.gpl3Only; From f5bdeee8163cd702fc4d5472f929f45a1de1982f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 7 Nov 2025 12:55:44 -0800 Subject: [PATCH 053/108] python3Packages.swh-storage: 3.1.0 -> 4.1.0 Diff: https://gitlab.softwareheritage.org/swh/devel/swh-storage/-/compare/v3.1.0...v4.1.0 Changelog: https://gitlab.softwareheritage.org/swh/devel/swh-storage/-/tags/v3.1.1 https://gitlab.softwareheritage.org/swh/devel/swh-storage/-/tags/v3.1.2 https://gitlab.softwareheritage.org/swh/devel/swh-storage/-/tags/v3.2.0 https://gitlab.softwareheritage.org/swh/devel/swh-storage/-/tags/v3.3.0 https://gitlab.softwareheritage.org/swh/devel/swh-storage/-/tags/v4.0.0 https://gitlab.softwareheritage.org/swh/devel/swh-storage/-/tags/v4.1.0 --- .../python-modules/swh-storage/default.nix | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/swh-storage/default.nix b/pkgs/development/python-modules/swh-storage/default.nix index 74e312d076060..dcf09bf27cf46 100644 --- a/pkgs/development/python-modules/swh-storage/default.nix +++ b/pkgs/development/python-modules/swh-storage/default.nix @@ -12,6 +12,8 @@ iso8601, mypy-extensions, psycopg, + psycopg-pool, + pyasyncore, redis, tenacity, swh-core, @@ -30,7 +32,7 @@ buildPythonPackage rec { pname = "swh-storage"; - version = "3.1.0"; + version = "4.1.0"; pyproject = true; src = fetchFromGitLab { @@ -39,7 +41,7 @@ buildPythonPackage rec { owner = "devel"; repo = "swh-storage"; tag = "v${version}"; - hash = "sha256-Bxwc8OccmqadLjHtmhToHBYHGkD7Fw3Cl3go9VLV/Bs="; + hash = "sha256-JXeHE/wZ3Wcf1I1eGyCNlCGsreiQH6kCYZoDXV1h0A0="; }; build-system = [ @@ -47,6 +49,11 @@ buildPythonPackage rec { setuptools-scm ]; + pythonRelaxDeps = [ + # we patched click 8.2.1 + "click" + ]; + dependencies = [ backports-entry-points-selectable cassandra-driver @@ -56,13 +63,14 @@ buildPythonPackage rec { iso8601 mypy-extensions psycopg + psycopg-pool + pyasyncore redis tenacity swh-core swh-model swh-objstorage - ] - ++ psycopg.optional-dependencies.pool; + ]; pythonImportsCheck = [ "swh.storage" ]; @@ -88,11 +96,13 @@ buildPythonPackage rec { "swh/storage/tests/test_cassandra_migration.py" "swh/storage/tests/test_cassandra_ttl.py" "swh/storage/tests/test_cli_cassandra.py" + "swh/storage/tests/test_cli_object_references_cassandra.py" # Failing tests "swh/storage/tests/test_cli_object_references.py" ]; meta = { + changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-storage/-/tags/${src.tag}"; description = "Abstraction layer over the archive, allowing to access all stored source code artifacts as well as their metadata"; homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-storage"; license = lib.licenses.gpl3Only; From 5e4c2ad71ffd4b580066211c964c4522fb7f03d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 7 Nov 2025 13:37:21 -0800 Subject: [PATCH 054/108] python3Packages.swh-scheduler: 3.1.0 -> 3.3.0 Diff: https://gitlab.softwareheritage.org/swh/devel/swh-scheduler/-/compare/v3.1.0...v3.3.0 Changelog: https://gitlab.softwareheritage.org/swh/devel/swh-scheduler/-/tags/v3.2.0 https://gitlab.softwareheritage.org/swh/devel/swh-scheduler/-/tags/v3.3.0 --- .../python-modules/swh-scheduler/default.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/swh-scheduler/default.nix b/pkgs/development/python-modules/swh-scheduler/default.nix index ba2f4e10d1b3a..7bb37313ed3c5 100644 --- a/pkgs/development/python-modules/swh-scheduler/default.nix +++ b/pkgs/development/python-modules/swh-scheduler/default.nix @@ -30,7 +30,7 @@ buildPythonPackage rec { pname = "swh-scheduler"; - version = "3.1.0"; + version = "3.3.0"; pyproject = true; src = fetchFromGitLab { @@ -39,7 +39,7 @@ buildPythonPackage rec { owner = "devel"; repo = "swh-scheduler"; tag = "v${version}"; - hash = "sha256-YpMHeZVHK8IPIiuBaPNR0D/yB9lIQ3DK7NEAiBmjWpA="; + hash = "sha256-Kv5QH3sj/InKOSjxGtwVxtoAluHx5eIxO5GqcbOs0NY="; }; build-system = [ @@ -47,6 +47,11 @@ buildPythonPackage rec { setuptools-scm ]; + pythonRelaxDeps = [ + # we patched click 8.2.1 + "click" + ]; + dependencies = [ celery flask @@ -80,6 +85,7 @@ buildPythonPackage rec { disabledTests = [ "test_setup_log_handler_with_env_configuration" ]; meta = { + changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-scheduler/-/tags/${src.tag}"; description = "Job scheduler for the Software Heritage project"; homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-scheduler"; license = lib.licenses.gpl3Only; From bda1897cab076085445e30dc80971aedc4f2bd8d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 8 Nov 2025 01:07:35 +0000 Subject: [PATCH 055/108] waf: 2.1.6 -> 2.1.7 --- pkgs/by-name/wa/waf/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/wa/waf/package.nix b/pkgs/by-name/wa/waf/package.nix index 6f4fe6d9cba23..ad1b14998c635 100644 --- a/pkgs/by-name/wa/waf/package.nix +++ b/pkgs/by-name/wa/waf/package.nix @@ -12,13 +12,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "waf"; - version = "2.1.6"; + version = "2.1.7"; src = fetchFromGitLab { owner = "ita1024"; repo = "waf"; rev = "waf-${finalAttrs.version}"; - hash = "sha256-srBBRe7OLNM86OVJYYk6A0EYJi+rdJ/xG7f+YBdrclE="; + hash = "sha256-qJDnox7+MUtAK8NaaDgEdRVU4YVA8f5Ky9Suv/qLI3g="; }; nativeBuildInputs = [ From bd84f9838a210ee1d9a616cd4b441e89cd6526a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Sat, 8 Nov 2025 09:39:35 +0100 Subject: [PATCH 056/108] Revert "spandsp: backport additional memory safety fix" This reverts commit 09ad6013c68ecfb655bfe613b4ecb10acb32cca3. --- .../development/libraries/spandsp/default.nix | 32 +++---------------- 1 file changed, 5 insertions(+), 27 deletions(-) diff --git a/pkgs/development/libraries/spandsp/default.nix b/pkgs/development/libraries/spandsp/default.nix index 87996abdeeb0a..9720e110f7cfd 100644 --- a/pkgs/development/libraries/spandsp/default.nix +++ b/pkgs/development/libraries/spandsp/default.nix @@ -2,8 +2,6 @@ fetchurl, fetchpatch, callPackage, - lib, - stdenv, }: (callPackage ./common.nix { }) rec { @@ -13,31 +11,11 @@ sha256 = "0rclrkyspzk575v8fslzjpgp4y2s4x7xk3r55ycvpi4agv33l1fc"; }; patches = [ - # FIXME: clean up rebuild avoidance on staging. - ( - if - lib.elem stdenv.hostPlatform.config [ - "arm64-apple-darwin" - "aarch64-unknown-linux-gnu" - "x86_64-apple-darwin" - "x86_64-unknown-linux-gnu" - ] - then - fetchpatch { - url = "https://github.com/freeswitch/spandsp/commit/f7b96b08db148763039cf3459d0e00da9636eb92.patch"; - includes = [ "spandsp-sim/g1050.c" ]; - hash = "sha256-TwMhWJXQG/UaWddWgice0klp1uATyHMiE6DcsCebXYQ="; - } - else - fetchpatch { - url = "https://github.com/freeswitch/spandsp/commit/f7b96b08db148763039cf3459d0e00da9636eb92.patch"; - includes = [ - "spandsp-sim/g1050.c" - "spandsp-sim/test_utils.c" - ]; - hash = "sha256-2MmVgyMUK0Zn+mL7IX57Y7brYpgmt4GVlis5/NstuNM="; - } - ) + (fetchpatch { + url = "https://github.com/freeswitch/spandsp/commit/f7b96b08db148763039cf3459d0e00da9636eb92.patch"; + includes = [ "spandsp-sim/g1050.c" ]; + hash = "sha256-TwMhWJXQG/UaWddWgice0klp1uATyHMiE6DcsCebXYQ="; + }) (fetchpatch { url = "https://github.com/freeswitch/spandsp/commit/f47bcdc301fbddad44e918939eed1b361882f740.patch"; hash = "sha256-O+lIC3V92GVFoiHsUQOXkoTN2hJ7v5+LQP7RrAhvwlY="; From af42991dea426b106e496b0910c0f7ee13e7810e Mon Sep 17 00:00:00 2001 From: ssoss Date: Fri, 19 Sep 2025 15:23:24 -0500 Subject: [PATCH 057/108] treewide: update AppArmor policies Update AppArmor policies to use modern conventions. This includes * Including abi version * Adding conditional include of local/ policy file * Use of the profile keyword * Start file rules with a pathname Author: ssoss --- nixos/modules/security/apparmor/includes.nix | 30 +++++----- nixos/modules/services/networking/murmur.nix | 56 +++++++++---------- .../modules/services/torrent/transmission.nix | 20 +++---- nixos/modules/services/web-apps/miniflux.nix | 9 ++- .../networking/p2p/transmission/4.nix | 17 +++--- pkgs/by-name/in/inetutils/package.nix | 6 +- .../libapparmor/apparmorRulesFromClosure.nix | 16 +++--- 7 files changed, 80 insertions(+), 74 deletions(-) diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix index 4b759e1d94f99..92f5aa8d66b22 100644 --- a/nixos/modules/security/apparmor/includes.nix +++ b/nixos/modules/security/apparmor/includes.nix @@ -19,7 +19,7 @@ let mode ? "r", trail ? "", }: - lib.optionalString (hasAttr path etc) "${mode} ${config.environment.etc.${path}.source}${trail},"; + lib.optionalString (hasAttr path etc) "${config.environment.etc.${path}.source}${trail} ${mode},"; in if isAttrs arg then go arg else go { path = arg; }; in @@ -93,19 +93,19 @@ in ]; "abstractions/base" = '' include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base" - r ${pkgs.stdenv.cc.libc}/share/locale/**, - r ${pkgs.stdenv.cc.libc}/share/locale.alias, - r ${config.i18n.glibcLocales}/lib/locale/locale-archive, + ${pkgs.stdenv.cc.libc}/share/locale/** r, + ${pkgs.stdenv.cc.libc}/share/locale.alias r, + ${config.i18n.glibcLocales}/lib/locale/locale-archive r, ${etcRule "localtime"} - r ${pkgs.tzdata}/share/zoneinfo/**, - r ${pkgs.stdenv.cc.libc}/share/i18n/**, + ${pkgs.tzdata}/share/zoneinfo/** r, + ${pkgs.stdenv.cc.libc}/share/i18n/** r, ''; "abstractions/bash" = '' include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash" # bash inspects filesystems at startup # and /etc/mtab is linked to /proc/mounts - r @{PROC}/mounts, + @{PROC}/mounts r, # system-wide bash configuration '' @@ -296,8 +296,8 @@ in # looking up users by name or id, groups by name or id, hosts by name # or IP, etc. These operations may be performed through files, dns, # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here. - mr ${getLib pkgs.nss}/lib/libnss_*.so*, - mr ${getLib pkgs.nss}/lib64/libnss_*.so*, + ${getLib pkgs.nss}/lib/libnss_*.so* mr, + ${getLib pkgs.nss}/lib64/libnss_*.so* mr, '' + lib.concatMapStringsSep "\n" etcRule [ "group" @@ -463,11 +463,11 @@ in include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs" # For the NixOS module: security.acme - r /var/lib/acme/*/cert.pem, - r /var/lib/acme/*/chain.pem, - r /var/lib/acme/*/fullchain.pem, + /var/lib/acme/*/cert.pem r, + /var/lib/acme/*/chain.pem r, + /var/lib/acme/*/fullchain.pem r, - r /etc/pki/tls/certs/, + /etc/pki/tls/certs/ r, '' + lib.concatMapStringsSep "\n" etcRule [ @@ -510,8 +510,8 @@ in ]; "abstractions/ssl_keys" = '' # security.acme NixOS module - r /var/lib/acme/*/full.pem, - r /var/lib/acme/*/key.pem, + /var/lib/acme/*/full.pem r, + /var/lib/acme/*/key.pem r, ''; "abstractions/vulkan" = '' include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/vulkan" diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix index c67b4ac473900..9b1cf76860e32 100644 --- a/nixos/modules/services/networking/murmur.nix +++ b/nixos/modules/services/networking/murmur.nix @@ -401,40 +401,40 @@ in ]; security.apparmor.policies."bin.mumble-server".profile = '' + abi , include - ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} { + profile ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} { include include include include "${pkgs.apparmorRulesFromClosure { name = "mumble-server"; } cfg.package}" - pix ${cfg.package}/bin/.mumble-server-wrapped, - - r ${config.environment.etc."os-release".source}, - r ${config.environment.etc."lsb-release".source}, - owner rwk ${cfg.stateDir}/murmur.sqlite, - owner rw ${cfg.stateDir}/murmur.sqlite-journal, - owner r ${cfg.stateDir}/, - r /run/murmur/murmurd.pid, - r /run/murmur/murmurd.ini, - r ${configFile}, - '' - + lib.optionalString cfg.logToFile '' - rw /var/log/murmur/murmurd.log, - '' - + lib.optionalString (cfg.sslCert != null) '' - r ${cfg.sslCert}, - '' - + lib.optionalString (cfg.sslKey != null) '' - r ${cfg.sslKey}, - '' - + lib.optionalString (cfg.sslCa != null) '' - r ${cfg.sslCa}, - '' - + lib.optionalString (cfg.dbus != null) '' - dbus bus=${cfg.dbus} - '' - + '' + ${cfg.package}/bin/.mumble-server-wrapped pix, + + ${config.environment.etc."os-release".source} r, + ${config.environment.etc."lsb-release".source} r, + owner ${cfg.stateDir}/murmur.sqlite rwk, + owner ${cfg.stateDir}/murmur.sqlite-journal rw, + owner ${cfg.stateDir}/ r, + /run/murmur/murmurd.pid r, + /run/murmur/murmurd.ini r, + ${configFile} r, + ${lib.optionalString cfg.logToFile '' + /var/log/murmur/murmurd.log rw, + ''} + ${lib.optionalString (cfg.sslCert != null) '' + ${cfg.sslCert} r, + ''} + ${lib.optionalString (cfg.sslKey != null) '' + ${cfg.sslKey} r, + ''} + ${lib.optionalString (cfg.sslCa != null) '' + ${cfg.sslCa} r, + ''} + ${lib.optionalString (cfg.dbus != null) '' + dbus bus=${cfg.dbus}, + ''} + include if exists } ''; }; diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix index 3f6ed9eff4d1d..87493ec6ba624 100644 --- a/nixos/modules/services/torrent/transmission.nix +++ b/nixos/modules/services/torrent/transmission.nix @@ -585,23 +585,23 @@ in include "${cfg.package.apparmor}/bin.transmission-daemon" ''; security.apparmor.includes."local/bin.transmission-daemon" = '' - r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE}, + ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE} r, - owner rw ${cfg.home}/${settingsDir}/**, - rw ${cfg.settings.download-dir}/**, + owner ${cfg.home}/${settingsDir}/** rw, + ${cfg.settings.download-dir}/** rw, ${optionalString cfg.settings.incomplete-dir-enabled '' - rw ${cfg.settings.incomplete-dir}/**, + ${cfg.settings.incomplete-dir}/** rw, ''} ${optionalString cfg.settings.watch-dir-enabled '' - r${optionalString cfg.settings.trash-original-torrent-files "w"} ${cfg.settings.watch-dir}/**, + ${cfg.settings.watch-dir}/** r${optionalString cfg.settings.trash-original-torrent-files "w"}, ''} profile dirs { - rw ${cfg.settings.download-dir}/**, + ${cfg.settings.download-dir}/** rw, ${optionalString cfg.settings.incomplete-dir-enabled '' - rw ${cfg.settings.incomplete-dir}/**, + ${cfg.settings.incomplete-dir}/** rw, ''} ${optionalString cfg.settings.watch-dir-enabled '' - r${optionalString cfg.settings.trash-original-torrent-files "w"} ${cfg.settings.watch-dir}/**, + ${cfg.settings.watch-dir}/** r${optionalString cfg.settings.trash-original-torrent-files "w"}, ''} } @@ -612,12 +612,12 @@ in # any existing profile for script-torrent-done-filename # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges= # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs - px ${cfg.settings.script-torrent-done-filename} -> &@{dirs}, + ${cfg.settings.script-torrent-done-filename} px -> &@{dirs}, '' } ${optionalString (cfg.webHome != null) '' - r ${cfg.webHome}/**, + ${cfg.webHome}/** r, ''} ''; }; diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix index 572e4f1700d6d..03447395fef6b 100644 --- a/nixos/modules/services/web-apps/miniflux.nix +++ b/nixos/modules/services/web-apps/miniflux.nix @@ -207,15 +207,18 @@ in environment.systemPackages = [ cfg.package ]; security.apparmor.policies."bin.miniflux".profile = '' + abi , include - ${cfg.package}/bin/miniflux { + + profile ${cfg.package}/bin/miniflux { include include include include include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}" - r ${cfg.package}/bin/miniflux, - rw /run/miniflux/**, + ${cfg.package}/bin/miniflux r, + /run/miniflux/** rw, + include if exists } ''; }; diff --git a/pkgs/applications/networking/p2p/transmission/4.nix b/pkgs/applications/networking/p2p/transmission/4.nix index be91f8d4bf07f..a49cc0c788fac 100644 --- a/pkgs/applications/networking/p2p/transmission/4.nix +++ b/pkgs/applications/networking/p2p/transmission/4.nix @@ -175,21 +175,22 @@ stdenv.mkDerivation (finalAttrs: { postInstall = '' mkdir $apparmor cat >$apparmor/bin.transmission-daemon <, include - $out/bin/transmission-daemon { + profile $out/bin/transmission-daemon { include include include include "${apparmorRules}" - r @{PROC}/sys/kernel/random/uuid, - r @{PROC}/sys/vm/overcommit_memory, - r @{PROC}/@{pid}/environ, - r @{PROC}/@{pid}/mounts, - rwk /tmp/tr_session_id_*, + @{PROC}/sys/kernel/random/uuid r, + @{PROC}/sys/vm/overcommit_memory r, + @{PROC}/@{pid}/environ r, + @{PROC}/@{pid}/mounts r, + /tmp/tr_session_id_* rwk, - r $out/share/transmission/public_html/**, + $out/share/transmission/public_html/** r, - include + include if exists } EOF install -Dm0444 -t $out/share/icons ../qt/icons/transmission.svg diff --git a/pkgs/by-name/in/inetutils/package.nix b/pkgs/by-name/in/inetutils/package.nix index ee1a08aee9469..ffc901683e0d1 100644 --- a/pkgs/by-name/in/inetutils/package.nix +++ b/pkgs/by-name/in/inetutils/package.nix @@ -71,16 +71,18 @@ stdenv.mkDerivation rec { postInstall = '' mkdir $apparmor cat >$apparmor/bin.ping <, + include + profile $out/bin/ping { include include include include "${apparmorRulesFromClosure { name = "ping"; } [ stdenv.cc.libc ]}" - include capability net_raw, network inet raw, network inet6 raw, mr $out/bin/ping, + include if exists } EOF ''; diff --git a/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix b/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix index a12b8f0459be7..3de57c122ce6c 100644 --- a/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix +++ b/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix @@ -9,18 +9,18 @@ # TODO: factorize here some other common paths # that may emerge from use cases. baseRules ? [ - "r $path" - "r $path/etc/**" - "mr $path/share/**" + "$path r" + "$path/etc/** r" + "$path/share/** mr" # Note that not all libraries are prefixed with "lib", # eg. glibc-2.30/lib/ld-2.30.so - "mr $path/lib/**.so*" - "mr $path/lib64/**.so*" + "$path/lib/**.so* mr" + "$path/lib64/**.so* mr" # eg. glibc-2.30/lib/gconv/gconv-modules - "r $path/lib/**" - "r $path/lib64/**" + "$path/lib/** r" + "$path/lib64/** r" # Internal executables - "ixr $path/libexec/**" + "$path/libexec/** ixr" ], name ? "", }: From f789192d2ba9f2d10ac2d1a296186f1e2d2b720c Mon Sep 17 00:00:00 2001 From: Hraban Luyat Date: Sat, 8 Nov 2025 12:33:36 -0500 Subject: [PATCH 058/108] sbcl: 2.5.9 -> 2.5.10 --- pkgs/development/compilers/sbcl/default.nix | 2 +- pkgs/top-level/all-packages.nix | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix index 943c9ca627e20..aa202adfa4cf4 100644 --- a/pkgs/development/compilers/sbcl/default.nix +++ b/pkgs/development/compilers/sbcl/default.nix @@ -29,8 +29,8 @@ let "2.4.10".sha256 = "sha256-zus5a2nSkT7uBIQcKva+ylw0LOFGTD/j5FPy3hDF4vg="; # By unofficial and very loose convention we keep the latest version of # SBCL, and the previous one in case someone quickly needs to roll back. - "2.5.7".sha256 = "sha256-xPr+t5VpnVvP+QhQkazHYtz15V+FI1Yl89eu8SyJ0dM="; "2.5.9".sha256 = "sha256-0bGQItQ9xJPtyXK25ZyTrmaEyWP90rQTsJZeGM1r0eI="; + "2.5.10".sha256 = "sha256-v1+0nypC82s+AD0uTSNDhq3fB9ndjKhjRlaSfMls4SU="; }; # Collection of pre-built SBCL binaries for platforms that need them for # bootstrapping. Ideally these are to be avoided. If ECL (or any other diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 70ef8cf167afa..028cf56984099 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -9071,23 +9071,23 @@ with pkgs; "3000" ]; }; - sbcl_2_5_7 = wrapLisp { - pkg = callPackage ../development/compilers/sbcl { version = "2.5.7"; }; + sbcl_2_5_9 = wrapLisp { + pkg = callPackage ../development/compilers/sbcl { version = "2.5.9"; }; faslExt = "fasl"; flags = [ "--dynamic-space-size" "3000" ]; }; - sbcl_2_5_9 = wrapLisp { - pkg = callPackage ../development/compilers/sbcl { version = "2.5.9"; }; + sbcl_2_5_10 = wrapLisp { + pkg = callPackage ../development/compilers/sbcl { version = "2.5.10"; }; faslExt = "fasl"; flags = [ "--dynamic-space-size" "3000" ]; }; - sbcl = sbcl_2_5_9; + sbcl = sbcl_2_5_10; sbclPackages = recurseIntoAttrs sbcl.pkgs; From 2a40420e0468e1442cde730e1cb3edf19cba2f65 Mon Sep 17 00:00:00 2001 From: Marcus Ramberg Date: Sat, 8 Nov 2025 23:27:23 +0100 Subject: [PATCH 059/108] xkeyboard-config: 2.45 -> 2.46 --- pkgs/by-name/xk/xkeyboard-config/package.nix | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/pkgs/by-name/xk/xkeyboard-config/package.nix b/pkgs/by-name/xk/xkeyboard-config/package.nix index 666de77d7b000..918b2064e007a 100644 --- a/pkgs/by-name/xk/xkeyboard-config/package.nix +++ b/pkgs/by-name/xk/xkeyboard-config/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchurl, - fetchpatch2, pkg-config, meson, ninja, @@ -14,23 +13,13 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "xkeyboard-config"; - version = "2.45"; + version = "2.46"; src = fetchurl { url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-${finalAttrs.version}.tar.xz"; - hash = "sha256-Fp4HWpLZV6V3h8GZ6E41nfKTG3GWwcW0o9V27mI1qHw="; + hash = "sha256-EMWCGPtg0I+x97MDBN6zukdhMZWqigioHxlyd1zMNkA="; }; - patches = [ - # Patch that reverts a commit in 2.45 that broke the us-mac keyboard layout. - # Remove when 2.46 is released. - # https://github.com/NixOS/nixpkgs/issues/426375 - (fetchpatch2 { - url = "https://gitlab.freedesktop.org/xkeyboard-config/xkeyboard-config/-/commit/11dbaeb23d06c0d21efe538c90b44ffc8fc3a071.patch"; - hash = "sha256-qZkO1GQvbtTFeXqCuA7bjgQX5jq9c+LiKa/ziP1w2sI="; - }) - ]; - strictDeps = true; nativeBuildInputs = [ From 7ac1c1c2036c51447e4d991de70ca05f0c0c0f2e Mon Sep 17 00:00:00 2001 From: Pol Dellaiera Date: Sun, 9 Nov 2025 12:22:43 +0100 Subject: [PATCH 060/108] bash: fix usage of `finalAttrs` pattern Issue introduced in #435033 in 305c5f1f12a8d20953ffbba1628ef0a52620bf7a --- pkgs/shells/bash/5.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix index 0ca4ca768b5d3..017edfe2613ef 100644 --- a/pkgs/shells/bash/5.nix +++ b/pkgs/shells/bash/5.nix @@ -278,7 +278,7 @@ lib.warnIf (withDocs != null) mainProgram = "bash"; identifiers.cpeParts = let - versionSplit = lib.split "p" version; + versionSplit = lib.split "p" fa.version; in { vendor = "gnu"; From 151aa96218a188a74f2959e84c999bd041ed88a1 Mon Sep 17 00:00:00 2001 From: Pol Dellaiera Date: Wed, 10 Sep 2025 15:52:19 +0200 Subject: [PATCH 061/108] bash: replace `util-linux` with `util-linuxMinimal` --- pkgs/shells/bash/5.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix index 017edfe2613ef..243cd9e7fc3a1 100644 --- a/pkgs/shells/bash/5.nix +++ b/pkgs/shells/bash/5.nix @@ -5,7 +5,7 @@ fetchurl, updateAutotoolsGnuConfigScriptsHook, bison, - util-linux, + util-linuxMinimal, coreutils, libredirect, glibcLocales, @@ -167,7 +167,7 @@ lib.warnIf (withDocs != null) doCheck = true; nativeCheckInputs = attrs.nativeCheckInputs or [ ] ++ [ - util-linux + util-linuxMinimal libredirect.hook glibcLocales gnused From e6de6e6025dbe56e4470dafc244e03573c6577e7 Mon Sep 17 00:00:00 2001 From: Pol Dellaiera Date: Wed, 10 Sep 2025 15:52:50 +0200 Subject: [PATCH 062/108] bash: minor reformating - Replace `lib.optional` with `lib.optionals` when dealing with lists - Remove `with lib;` from `meta` --- pkgs/shells/bash/5.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix index 243cd9e7fc3a1..015872e3b2f7a 100644 --- a/pkgs/shells/bash/5.nix +++ b/pkgs/shells/bash/5.nix @@ -49,7 +49,7 @@ lib.warnIf (withDocs != null) # bionic libc is super weird and has issues with fortify outside of its own libc, check this comment: # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593 # or you can check libc/include/sys/cdefs.h in bionic source code - ++ lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify"; + ++ lib.optionals (stdenv.hostPlatform.libc == "bionic") [ "fortify" ]; outputs = [ "out" @@ -130,9 +130,9 @@ lib.warnIf (withDocs != null) updateAutotoolsGnuConfigScriptsHook bison ] - ++ lib.optional stdenv.hostPlatform.isDarwin stdenv.cc.bintools; + ++ lib.optionals stdenv.hostPlatform.isDarwin [ stdenv.cc.bintools ]; - buildInputs = lib.optional interactive readline; + buildInputs = lib.optionals interactive [ readline ]; enableParallelBuilding = true; @@ -255,7 +255,7 @@ lib.warnIf (withDocs != null) }); }; - meta = with lib; { + meta = { homepage = "https://www.gnu.org/software/bash/"; description = "GNU Bourne-Again Shell, the de facto standard shell on Linux" @@ -270,8 +270,8 @@ lib.warnIf (withDocs != null) interactive use. In addition, most sh scripts can be run by Bash without modification. ''; - license = licenses.gpl3Plus; - platforms = platforms.all; + license = lib.licenses.gpl3Plus; + platforms = lib.platforms.all; # https://github.com/NixOS/nixpkgs/issues/333338 badPlatforms = [ lib.systems.inspect.patterns.isMinGW ]; maintainers = with lib.maintainers; [ infinisil ]; From 63264b282d685b9c718efebcd491ccf99b7c09db Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Tue, 4 Nov 2025 02:40:02 +0000 Subject: [PATCH 063/108] =?UTF-8?q?libadwaita:=201.8.0=20=E2=86=92=201.8.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://gitlab.gnome.org/GNOME/libadwaita/-/compare/1.8.0...1.8.1 Changelog-reviewed-by: Jan Tojnar --- pkgs/by-name/li/libadwaita/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libadwaita/package.nix b/pkgs/by-name/li/libadwaita/package.nix index dd4ea744d0c18..e29c04dd5b15d 100644 --- a/pkgs/by-name/li/libadwaita/package.nix +++ b/pkgs/by-name/li/libadwaita/package.nix @@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "libadwaita"; - version = "1.8.0"; + version = "1.8.1"; outputs = [ "out" @@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "GNOME"; repo = "libadwaita"; tag = finalAttrs.version; - hash = "sha256-neF7nt7x3QhSsWuWGouqniFlDHw1Soco7Dpzhy15gWE="; + hash = "sha256-9CcmzwQYZZc6dZAv6x90Od4lrRcYZIejzPgm6S1vz/U="; }; depsBuildBuild = [ From ac81241294b6e408851e96d46dee8b84d6da7989 Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Tue, 4 Nov 2025 02:40:31 +0000 Subject: [PATCH 064/108] =?UTF-8?q?librsvg:=202.61.2=20=E2=86=92=202.61.3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://gitlab.gnome.org/GNOME/librsvg/-/compare/2.61.2...2.61.3 Changelog-reviewed-by: Jan Tojnar --- pkgs/by-name/li/librsvg/package.nix | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/pkgs/by-name/li/librsvg/package.nix b/pkgs/by-name/li/librsvg/package.nix index 978cc3cad3b71..4e4b9f0003785 100644 --- a/pkgs/by-name/li/librsvg/package.nix +++ b/pkgs/by-name/li/librsvg/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchurl, - fetchpatch, pkg-config, meson, ninja, @@ -50,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "librsvg"; - version = "2.61.2"; + version = "2.61.3"; outputs = [ "out" @@ -62,23 +61,13 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz"; - hash = "sha256-RkTYNiPdYcxEecKzw3Lh2isoFVLryQA1yNGsUC6x3AA="; + hash = "sha256-pW0sgNdErS8nGPhd9Gb+cdJP8fm8Pl71iL3k1+h4FfI="; }; - patches = [ - (fetchpatch { - # https://gitlab.gnome.org/GNOME/librsvg/-/merge_requests/1149 - # libxml 2.15+ requires adjustments to error handling - # remove next librsvg release - url = "https://gitlab.gnome.org/GNOME/librsvg/-/commit/6663df8e9aec323f0c124e97a7c7447a90c67c4a.patch"; - hash = "sha256-+iyRvxVMxSCW0IIizXXheBFytwhBtU4cyJNTBebCOSg="; - }) - ]; - cargoDeps = rustPlatform.fetchCargoVendor { inherit (finalAttrs) src; name = "librsvg-deps-${finalAttrs.version}"; - hash = "sha256-OZspQg9ryDNILUZMiB77vIF0uGCMyVe7blX5BJk102k="; + hash = "sha256-5uNkjfZhETuG8Sjw66zapYXOj4dgz9Ziry2kAV+pvZQ="; dontConfigure = true; }; From c97c40e9cf219a88404e6e346cdce86d9601e341 Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Tue, 4 Nov 2025 02:40:36 +0000 Subject: [PATCH 065/108] =?UTF-8?q?at-spi2-core:=202.58.0=20=E2=86=92=202.?= =?UTF-8?q?58.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://gitlab.gnome.org/GNOME/at-spi2-core/-/compare/2.58.0...2.58.1 Changelog-reviewed-by: Jan Tojnar --- pkgs/by-name/at/at-spi2-core/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/at/at-spi2-core/package.nix b/pkgs/by-name/at/at-spi2-core/package.nix index c9879d33eed53..46cca49221798 100644 --- a/pkgs/by-name/at/at-spi2-core/package.nix +++ b/pkgs/by-name/at/at-spi2-core/package.nix @@ -29,7 +29,7 @@ stdenv.mkDerivation rec { pname = "at-spi2-core"; - version = "2.58.0"; + version = "2.58.1"; outputs = [ "out" @@ -39,7 +39,7 @@ stdenv.mkDerivation rec { src = fetchurl { url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor version}/at-spi2-core-${version}.tar.xz"; - hash = "sha256-390zANong6IZaf+t4oiYF/t8GQak75JJfrpllps9q1o="; + hash = "sha256-fzdKajjNcP9LMsnToDEL+oBNlG/tTJ5pp9SfrNy5Xpw="; }; # TODO apply unconditionally on rebuild From 49b5f1758b95a3adc01b6ef5b376d15c2bfbdd41 Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Tue, 4 Nov 2025 02:40:37 +0000 Subject: [PATCH 066/108] =?UTF-8?q?gdk-pixbuf:=202.44.3=20=E2=86=92=202.44?= =?UTF-8?q?.4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/compare/2.44.3...2.44.4 Changelog-reviewed-by: Jan Tojnar --- pkgs/development/libraries/gdk-pixbuf/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix index 9ae7a4c31133c..f62230c7649e0 100644 --- a/pkgs/development/libraries/gdk-pixbuf/default.nix +++ b/pkgs/development/libraries/gdk-pixbuf/default.nix @@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "gdk-pixbuf"; - version = "2.44.3"; + version = "2.44.4"; outputs = [ "out" @@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: { in fetchurl { url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz"; - hash = "sha256-QKktzCN/+UtjqAwVmj9vIs1Z9vtJYfIBx4eZ+iyKwKY="; + hash = "sha256-k6Gqw/FCeuc0Vzl1gqLDjQSWOKgBeIzL1fSMpge9vRc="; }; patches = [ From d62659af20ed81f27659b0621840c36692c4c2e6 Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Tue, 4 Nov 2025 02:40:43 +0000 Subject: [PATCH 067/108] =?UTF-8?q?dconf:=200.40.0=20=E2=86=92=200.49.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://gitlab.gnome.org/GNOME/dconf/-/compare/0.40.0...0.49.0 Changelog-reviewed-by: Jan Tojnar --- pkgs/by-name/dc/dconf/package.nix | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/pkgs/by-name/dc/dconf/package.nix b/pkgs/by-name/dc/dconf/package.nix index 916d5551f93cd..70ef73c207612 100644 --- a/pkgs/by-name/dc/dconf/package.nix +++ b/pkgs/by-name/dc/dconf/package.nix @@ -25,9 +25,9 @@ withDocs ? withIntrospection, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "dconf"; - version = "0.40.0"; + version = "0.49.0"; outputs = [ "out" @@ -37,8 +37,8 @@ stdenv.mkDerivation rec { ++ lib.optional withDocs "devdoc"; src = fetchurl { - url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz"; - sha256 = "0cs5nayg080y8pb9b7qccm1ni8wkicdmqp1jsgc22110r6j24zyg"; + url = "mirror://gnome/sources/dconf/${lib.versions.majorMinor finalAttrs.version}/dconf-${finalAttrs.version}.tar.xz"; + sha256 = "FqR+SaWBVtu5ZXjhcIMlKZ5MGe6pvhKNW9Ev0JY9bDY="; }; nativeBuildInputs = [ @@ -79,15 +79,13 @@ stdenv.mkDerivation rec { !stdenv.hostPlatform.isAarch32 && !stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isDarwin; postPatch = '' - chmod +x meson_post_install.py tests/test-dconf.py - patchShebangs meson_post_install.py - patchShebangs tests/test-dconf.py + chmod +x tests/test-dconf.py tests/shellcheck.sh + patchShebangs tests/test-dconf.py tests/shellcheck.sh ''; passthru = { updateScript = gnome.updateScript { - packageName = pname; - versionPolicy = "odd-unstable"; + packageName = "dconf"; }; tests = { inherit (nixosTests) dconf; }; }; @@ -103,4 +101,4 @@ stdenv.mkDerivation rec { teams = [ teams.gnome ]; mainProgram = "dconf"; }; -} +}) From f8cc14e813bcf3854a0e4a5e3365da969259e275 Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Tue, 4 Nov 2025 02:40:43 +0000 Subject: [PATCH 068/108] =?UTF-8?q?python3.pkgs.pygobject3:=203.54.3=20?= =?UTF-8?q?=E2=86=92=203.54.5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://gitlab.gnome.org/GNOME/pygobject/-/compare/3.54.3...3.54.5 Changelog-reviewed-by: Jan Tojnar --- pkgs/development/python-modules/pygobject/3.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix index 9825af96472eb..c058a77b461a4 100644 --- a/pkgs/development/python-modules/pygobject/3.nix +++ b/pkgs/development/python-modules/pygobject/3.nix @@ -18,7 +18,7 @@ buildPythonPackage rec { pname = "pygobject"; - version = "3.54.3"; + version = "3.54.5"; outputs = [ "out" @@ -30,8 +30,8 @@ buildPythonPackage rec { format = "other"; src = fetchurl { - url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz"; - hash = "sha256-qNoJE0oPfVZJHPJBIUXjWqdOkddg6PM3CWoc2guSuuc="; + url = "mirror://gnome/sources/pygobject/${lib.versions.majorMinor version}/pygobject-${version}.tar.gz"; + hash = "sha256-tmVvY0j1JFYGzxXqSMOEx/BRVsderSBsGyRsgKIvtYU="; }; depsBuildBuild = [ pkg-config ]; @@ -63,8 +63,8 @@ buildPythonPackage rec { passthru = { updateScript = gnome.updateScript { - packageName = pname; - attrPath = "python3.pkgs.${pname}3"; + packageName = "pygobject"; + attrPath = "python3.pkgs.pygobject3"; versionPolicy = "odd-unstable"; }; }; From e8eec12a02db1a046908552af0b94b77f2815c4d Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Tue, 4 Nov 2025 02:40:46 +0000 Subject: [PATCH 069/108] =?UTF-8?q?gsettings-desktop-schemas:=2049.0=20?= =?UTF-8?q?=E2=86=92=2049.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://gitlab.gnome.org/GNOME/gsettings-desktop-schemas/-/compare/49.0...49.1 Changelog-reviewed-by: Jan Tojnar --- pkgs/by-name/gs/gsettings-desktop-schemas/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix b/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix index cbeece5a07aa9..c4ee1db9fae9a 100644 --- a/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix +++ b/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix @@ -17,11 +17,11 @@ stdenv.mkDerivation rec { pname = "gsettings-desktop-schemas"; - version = "49.0"; + version = "49.1"; src = fetchurl { url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz"; - hash = "sha256-kSkFzEU4KIikdwLtEQHGsI69ASKjKmfZQKuBFqlsUg0="; + hash = "sha256-d3p/g9XlqAdrm/gJyyQQGxsbqcIwI148PejhOWjtDmM="; }; strictDeps = true; From 02a2649448e58058bbfe72812765144c5b1d848d Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Tue, 4 Nov 2025 02:40:58 +0000 Subject: [PATCH 070/108] =?UTF-8?q?gi-docgen:=202025.4=20=E2=86=92=202025.?= =?UTF-8?q?5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://gitlab.gnome.org/GNOME/gi-docgen/-/compare/2025.4...2025.5 Changelog-reviewed-by: Jan Tojnar --- pkgs/by-name/gi/gi-docgen/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gi/gi-docgen/package.nix b/pkgs/by-name/gi/gi-docgen/package.nix index 1ff554f2f4a50..9e04c34259145 100644 --- a/pkgs/by-name/gi/gi-docgen/package.nix +++ b/pkgs/by-name/gi/gi-docgen/package.nix @@ -9,13 +9,13 @@ python3.pkgs.buildPythonApplication rec { pname = "gi-docgen"; - version = "2025.4"; + version = "2025.5"; format = "other"; src = fetchurl { url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz"; - hash = "sha256-Zshl1Fn+vfteQHiojfBhg2IMPpH3JtHcYI2I7jYFUm4="; + hash = "sha256-JXmjP/h7Yi0Q0QLJG30OzlBjQLcONNu2UiFj4WyQrKM="; }; depsBuildBuild = [ From c3ee2059dbc412b3ca33f2ff2f15a224f7bd9888 Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Sun, 9 Nov 2025 21:50:55 +0100 Subject: [PATCH 071/108] python3Packages.pycurl: support curl 8.17.0+ This fixes test failure against Curl 8.17.0 and later, as some Kerberos globals were removed/changed. Signed-off-by: Sefa Eyeoglu --- pkgs/development/python-modules/pycurl/default.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix index beac9451932a5..224a3f9ebe6f8 100644 --- a/pkgs/development/python-modules/pycurl/default.nix +++ b/pkgs/development/python-modules/pycurl/default.nix @@ -34,6 +34,13 @@ buildPythonPackage rec { url = "https://github.com/pycurl/pycurl/commit/eb7f52eeef85feb6c117678d52803050bbdd7bc8.patch"; hash = "sha256-hdwazS7R9duuMd/7S3SNAxVcToo3GhtyWu/1Q6qTMYc="; }) + # curl 8.17+ compatibility + # https://github.com/pycurl/pycurl/pull/909 + (fetchpatch { + name = "pycurl-8.17.0-compat.patch"; + url = "https://github.com/pycurl/pycurl/commit/ea92e3ca230a3ff3d464cb6816102fa157177aca.patch"; + hash = "sha256-kmlsG0SFfS9FdRNp8pPgudcWK6hSyD9x5oAedZLgBcY="; + }) ]; preConfigure = '' From 3bdaa7e23f2e9398c68162507484fd8acfbd6878 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 10 Nov 2025 00:38:04 +0000 Subject: [PATCH 072/108] isocodes: 4.18.0 -> 4.19.0 --- pkgs/by-name/is/isocodes/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/is/isocodes/package.nix b/pkgs/by-name/is/isocodes/package.nix index 68c43ab4be2aa..a8af805b92de5 100644 --- a/pkgs/by-name/is/isocodes/package.nix +++ b/pkgs/by-name/is/isocodes/package.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "iso-codes"; - version = "4.18.0"; + version = "4.19.0"; src = fetchurl { url = with finalAttrs; "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/v${version}/${pname}-v${version}.tar.gz"; - hash = "sha256-UR9nv0tRqnfxfEWtv/UzJCtQ8eNw/kmlcGtjQZAvrIc="; + hash = "sha256-SxQ6iR/rfRu2TkT+PvJT7za6EYXR0SnBQlM43G5G4n0="; }; nativeBuildInputs = [ From 804bca8429aaf887cc053266361dfe7498b02b0c Mon Sep 17 00:00:00 2001 From: Lee Bousfield Date: Sun, 9 Nov 2025 20:07:03 -0500 Subject: [PATCH 073/108] curlMinimal: fix build by removing duplicate patch This reverts commit 5aadca9efb935cc56866c5ecf52d0d1070b1df88. --- .../curlMinimal/fix-h2-paused-transfers.patch | 27 ------------------- pkgs/by-name/cu/curlMinimal/package.nix | 8 ------ 2 files changed, 35 deletions(-) delete mode 100644 pkgs/by-name/cu/curlMinimal/fix-h2-paused-transfers.patch diff --git a/pkgs/by-name/cu/curlMinimal/fix-h2-paused-transfers.patch b/pkgs/by-name/cu/curlMinimal/fix-h2-paused-transfers.patch deleted file mode 100644 index 50e202684b8cb..0000000000000 --- a/pkgs/by-name/cu/curlMinimal/fix-h2-paused-transfers.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 7e91f24c73256af59ac9061c41b73a184c4690aa Mon Sep 17 00:00:00 2001 -From: Stefan Eissing -Date: Mon, 3 Nov 2025 15:07:57 +0100 -Subject: [PATCH] cw-out: fix EAGAIN handling on pause - -The interim CURLE_AGAIN result was not always converted to a -CURLE_OK and then caused write callers to report a failure. - -Fixes #19334 -Reported-by: pennae on github -Closes #19338 ---- - lib/cw-out.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/lib/cw-out.c b/lib/cw-out.c -index 1f4031649267..9c0a36e7e5e2 100644 ---- a/lib/cw-out.c -+++ b/lib/cw-out.c -@@ -302,6 +302,7 @@ static CURLcode cw_out_buf_flush(struct cw_out_ctx *ctx, - &consumed); - if(result && (result != CURLE_AGAIN)) - return result; -+ result = CURLE_OK; - - if(consumed) { - if(consumed == curlx_dyn_len(&cwbuf->b)) { diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix index 15231677d29c0..f64a4c9de767f 100644 --- a/pkgs/by-name/cu/curlMinimal/package.nix +++ b/pkgs/by-name/cu/curlMinimal/package.nix @@ -98,14 +98,6 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-lV9ucprWs1ZiYOj+9oYg52ujwxrPChhSRBahhaz3eZI="; }; - patches = [ - # Bug introduced in curl@fa915b (8.16.0) https://github.com/curl/curl/issues/19334 Paused - # HTTP/2 transfers will return the wrong errors and trash the whole - # transfer. Remove this patch once curl is updated to 8.17.0 which will be - # released on the 5th November 2025. - ./fix-h2-paused-transfers.patch - ]; - # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion # necessary for FreeBSD code path in configure postPatch = '' From 553ae2c241b9d5525aac5d34088878fca53a42f9 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 10 Nov 2025 20:29:01 +0100 Subject: [PATCH 074/108] libxcrypt: 4.5.1 -> 4.5.2 https://github.com/besser82/libxcrypt/blob/v4.5.2/NEWS --- pkgs/development/libraries/libxcrypt/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix index 203a45fe3ed49..075c25104dc2d 100644 --- a/pkgs/development/libraries/libxcrypt/default.nix +++ b/pkgs/development/libraries/libxcrypt/default.nix @@ -12,11 +12,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "libxcrypt"; - version = "4.5.1"; + version = "4.5.2"; src = fetchurl { url = "https://github.com/besser82/libxcrypt/releases/download/v${finalAttrs.version}/libxcrypt-${finalAttrs.version}.tar.xz"; - hash = "sha256-6bRqYjl8FTcpNfanXcOSnGIWHyYgvnt/V/A9aRAsGoY="; + hash = "sha256-cVE6McAaQovM1TZ6Mv2V8RXW2sUPtbYMd51ceUKuwHE="; }; # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion From 686c0c4f5e8217bb66525b2634f498f0cf89f3ad Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Mon, 10 Nov 2025 20:48:51 +0000 Subject: [PATCH 075/108] fluidsynth: 2.5.0 -> 2.5.1 Changes: https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.1 --- pkgs/by-name/fl/fluidsynth/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/fl/fluidsynth/package.nix b/pkgs/by-name/fl/fluidsynth/package.nix index 88e0135024215..60852d919bf6b 100644 --- a/pkgs/by-name/fl/fluidsynth/package.nix +++ b/pkgs/by-name/fl/fluidsynth/package.nix @@ -13,13 +13,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "fluidsynth"; - version = "2.5.0"; + version = "2.5.1"; src = fetchFromGitHub { owner = "FluidSynth"; repo = "fluidsynth"; tag = "v${finalAttrs.version}"; - hash = "sha256-ouPCbXg9vgxSAHsReC7dmF1cstQZ1HaUoWcLChE35Hk="; + hash = "sha256-gTkW2X7fcmxJwYf13Yma6cBigz4sbsb99dBSYTDlcyY="; fetchSubmodules = true; }; From f93a104922f934f31060c3d76c34b9ddcd8ce10b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luka=20Bla=C5=A1kovi=C4=87?= Date: Tue, 11 Nov 2025 06:08:54 +0000 Subject: [PATCH 076/108] rust: 1.91.0 -> 1.91.1 --- pkgs/development/compilers/rust/1_91.nix | 40 ++++++++++++------------ 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/pkgs/development/compilers/rust/1_91.nix b/pkgs/development/compilers/rust/1_91.nix index b349ade55ec27..a5fee800afa45 100644 --- a/pkgs/development/compilers/rust/1_91.nix +++ b/pkgs/development/compilers/rust/1_91.nix @@ -44,8 +44,8 @@ let in import ./default.nix { - rustcVersion = "1.91.0"; - rustcSha256 = "sha256-Mn9SgVF1MBPworLH9IlVoDPXGPJppLxYYxTWddDUPoo="; + rustcVersion = "1.91.1"; + rustcSha256 = "sha256-ONziBdOfYVcSYfBEQjehzp7+y5cOdg2OxNlXr1tEVyM="; llvmSharedForBuild = llvmSharedFor pkgsBuildBuild; llvmSharedForHost = llvmSharedFor pkgsBuildHost; @@ -59,27 +59,27 @@ import ./default.nix # Note: the version MUST be the same version that we are building. Upstream # ensures that each released compiler can compile itself: # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363 - bootstrapVersion = "1.91.0"; + bootstrapVersion = "1.91.1"; # fetch hashes by running `print-hashes.sh ${bootstrapVersion}` bootstrapHashes = { - i686-unknown-linux-gnu = "7f455c2b498a6197db7f00d636899ed0fb20ce152f1b1573a3ee524ee98b1b80"; - x86_64-unknown-linux-gnu = "bad9a353330d9f409fe9db790da5701074112f804073506bb2808dd97b940b3c"; - x86_64-unknown-linux-musl = "ac925e53b6cef81445f73e6d45213ab56d11585ac525a3ac21fc09ef4ca664ab"; - arm-unknown-linux-gnueabihf = "4cba316544d91b240529a5e835a42526eaeba85d3574f72b24e7ef73a7bb9132"; - armv7-unknown-linux-gnueabihf = "d86de4cd9e8264ff8dff1b2ec52b8fd2dbb9a01acb6c23ad73e38695d2de98e6"; - aarch64-unknown-linux-gnu = "29c5a608861cc9c06d3f86852a7d7b1a868de2d7ab90d4ff625aeebfb9383390"; - aarch64-unknown-linux-musl = "e97e8821ca7e3aa9986a776cd145ee1b01b8984d31912d345c6059b9535cb72e"; - x86_64-apple-darwin = "b329b458c8074023e5f6934bcd6c0bbef5075ac0090548c3d45a7de82e0c5b0c"; - aarch64-apple-darwin = "ec42d93940933340ee55e67003699ebe264aa82d7cf0d5ae08100c06b1bfacfa"; - powerpc64-unknown-linux-gnu = "9c325b63643bbc4ca98aec820c056f6fb4e82ddc6cc14b1e1382db1f10855ff3"; - powerpc64le-unknown-linux-gnu = "1a357b1e44f7ec7c2da62461a4180d8d8b599dd06045e7e2b83cd7f93972d6d7"; - powerpc64le-unknown-linux-musl = "584b4e37b7c06f850f167b2f8e5095a7a1ca961d8e66c8aae0f4a5ccfba4736e"; - riscv64gc-unknown-linux-gnu = "216a1c6d178e0494ac488f3310e600ef17c62ce38d43e9b14557d1f16f3637f7"; - s390x-unknown-linux-gnu = "e2cda4e86f68e3d4ca9df4f9d80d53fc34a555a96012fceefa4190a388e987d4"; - loongarch64-unknown-linux-gnu = "8121c8d7d9152a835c84bf6b586c107ae582ed051780d37cb1e6f4f9bdad23aa"; - loongarch64-unknown-linux-musl = "58344f7047aceefa44e9aef552b9b84ae3d16fded31a5c6ba9b63abc2c269f43"; - x86_64-unknown-freebsd = "b996571bffafb11951b1a29526bb79518c9f5d74618cf414989b297375c7264f"; + i686-unknown-linux-gnu = "b596ac56c67cf893e58ecf3263e59ac10157e9f50047e8d3d84faf288273ea47"; + x86_64-unknown-linux-gnu = "1c955c040dd087e4751d15588ddec288b4208bea16f8ec5046c164877e55fff7"; + x86_64-unknown-linux-musl = "e690ea46a73b11268c0487a4bca440142d69de7c0ca062fcdf2b99ad0e42e8e5"; + arm-unknown-linux-gnueabihf = "4899619845a875b2e51825943fad66cf42dced0e1f66470222ff0653776bd59e"; + armv7-unknown-linux-gnueabihf = "c51a61f304c0019c57169b964ec26f7a7ff7dcefaf42b973237f96fb457b25c8"; + aarch64-unknown-linux-gnu = "50213385f288b8760b2efd54ac066ef9a76475e778cbe3b0fcbd3f898fc00674"; + aarch64-unknown-linux-musl = "d374258cd00b4069e44266ab58b321208187511606236ebcc791a5a2d86554e1"; + x86_64-apple-darwin = "05adbd08e6535ed22a9c3d8f11d90df51eb6393488cbbb0c81f2b18d56e4d1ee"; + aarch64-apple-darwin = "f6727c9ab64a5b2a15623f29a023faf0c6a6aeb1347d102b88d595e5c1d9beae"; + powerpc64-unknown-linux-gnu = "94d86d13af288c4a06c8ea8b563e3889d55cc6064a06defd3b612eeeda902b93"; + powerpc64le-unknown-linux-gnu = "355f8043cd506fa718892eeedeebc9d6cc3de1a7757fdb8385c7bdc4cbc853ac"; + powerpc64le-unknown-linux-musl = "c17d51f54c00a371fbab80519b454a901a4b36b9f5a3a692e8816480d8f87067"; + riscv64gc-unknown-linux-gnu = "08230d9c59105270b2e06c5e87078a2a478efcacef8a88aedcccca9f317fa492"; + s390x-unknown-linux-gnu = "fb87330d72636d30f0a9b4b640f994186fc3ad0c0f3c89b2e0f7f31cfd7885f6"; + loongarch64-unknown-linux-gnu = "be6f676ae2ad80d4242798429915f708e3ecae7c895936c5fee172a4f7f2eec8"; + loongarch64-unknown-linux-musl = "7b071bc98d1e42dd802cc5b5bb83a9467d02ad6621231363519c869d322dcd5f"; + x86_64-unknown-freebsd = "9e231fa573b6bb99654a689687aede2014d4c21ac3c8422534c990c859632f50"; }; selectRustPackage = pkgs: pkgs.rust_1_91; From e253e326e04aedee95f062982aa0cda903f24d99 Mon Sep 17 00:00:00 2001 From: Marcin Serwin Date: Tue, 11 Nov 2025 15:27:39 +0100 Subject: [PATCH 077/108] sdl2-compat: revert breaking upstream change Fixes segmentation fault in Dwarf Fortress. See https://github.com/NixOS/nixpkgs/pull/457099#issuecomment-3517117420 Signed-off-by: Marcin Serwin --- pkgs/by-name/sd/sdl2-compat/package.nix | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/sd/sdl2-compat/package.nix b/pkgs/by-name/sd/sdl2-compat/package.nix index 0aec5ddf963f8..e16eb5927cec0 100644 --- a/pkgs/by-name/sd/sdl2-compat/package.nix +++ b/pkgs/by-name/sd/sdl2-compat/package.nix @@ -2,6 +2,7 @@ cmake, lib, fetchFromGitHub, + fetchpatch2, ninja, sdl3, stdenv, @@ -71,7 +72,15 @@ stdenv.mkDerivation (finalAttrs: { doCheck = true; - patches = [ ./find-headers.patch ]; + patches = [ + ./find-headers.patch + + # https://github.com/libsdl-org/sdl2-compat/pull/545 + (fetchpatch2 { + url = "https://github.com/libsdl-org/sdl2-compat/commit/b799076c72c2492224e81544f58f92b737cccbd3.patch?full_index=1"; + hash = "sha256-fAc8yBlT+XFHDKcF4MFgBAz2WtXGmhYzNNrjaGSr+do="; + }) + ]; setupHook = ./setup-hook.sh; postFixup = '' From fa27a7eb0f5091c480acc1483a70a1844e2473a1 Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Tue, 11 Nov 2025 20:15:39 +0100 Subject: [PATCH 078/108] squashfsTools: 4.7.2 -> 4.7.4 --- pkgs/by-name/sq/squashfsTools/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/sq/squashfsTools/package.nix b/pkgs/by-name/sq/squashfsTools/package.nix index 9f475c41f4466..5039d9079bccd 100644 --- a/pkgs/by-name/sq/squashfsTools/package.nix +++ b/pkgs/by-name/sq/squashfsTools/package.nix @@ -14,13 +14,13 @@ stdenv.mkDerivation rec { pname = "squashfs"; - version = "4.7.2"; + version = "4.7.4"; src = fetchFromGitHub { owner = "plougher"; repo = "squashfs-tools"; rev = version; - hash = "sha256-iQ+pBt+jvqI6zgZRV2MZM3CeFqiXe8Z+SS+rLOB4DLw="; + hash = "sha256-xvTSGVwtzJjoAIF6GClASUIB5eIk+uquQNNzHIuwkuY="; }; strictDeps = true; From ea793d8374b3449fd95dc80b6c7dc19ef147537a Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Tue, 11 Nov 2025 20:37:48 +0000 Subject: [PATCH 079/108] liburcu: 0.15.4 -> 0.15.5 Changes: https://raw.githubusercontent.com/urcu/userspace-rcu/v0.15.5/ChangeLog --- pkgs/by-name/li/liburcu/package.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/liburcu/package.nix b/pkgs/by-name/li/liburcu/package.nix index 7a1538aa9defc..e7dae0dec76db 100644 --- a/pkgs/by-name/li/liburcu/package.nix +++ b/pkgs/by-name/li/liburcu/package.nix @@ -3,15 +3,16 @@ stdenv, fetchurl, perl, + gitUpdater, }: stdenv.mkDerivation rec { - version = "0.15.4"; + version = "0.15.5"; pname = "liburcu"; src = fetchurl { url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2"; - hash = "sha256-EaFKdmCsm6nAu9Oy2BcYUj0n3GyKnfq9XkAbQGZz7jo="; + hash = "sha256-sveHqKg1EsMlmecc2rzFExRklHuCAUiWvRFBOy14LeE="; }; outputs = [ @@ -27,6 +28,11 @@ stdenv.mkDerivation rec { preCheck = "patchShebangs tests/unit"; doCheck = true; + passthru.updateScript = gitUpdater { + url = "https://git.lttng.org/userspace-rcu.git"; + rev-prefix = "v"; + }; + meta = { description = "Userspace RCU (read-copy-update) library"; homepage = "https://lttng.org/urcu"; From 13edef035739e46c90830b3694d90edaee80336e Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 11 Nov 2025 20:39:59 +0100 Subject: [PATCH 080/108] nspr: 4.38 -> 4.38.2 https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/V7GVSScpn5w https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/qFuz87KunGc --- pkgs/by-name/ns/nspr/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix index 94327e1475223..d16052a7603cf 100644 --- a/pkgs/by-name/ns/nspr/package.nix +++ b/pkgs/by-name/ns/nspr/package.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation rec { pname = "nspr"; - version = "4.38"; + version = "4.38.2"; src = fetchurl { url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz"; - hash = "sha256-cu5z/8xu9ecGll+FXs9HDsOYbD4YjhKoqABudvazGm8="; + hash = "sha256-5Akvrqt3vcmzLbERPkIVlI7naOJsRmbbO1pgs18skQU="; }; patches = [ From c0d24a0c7eb0942fa6e9d56679c473968a4073f5 Mon Sep 17 00:00:00 2001 From: Will Fancher Date: Tue, 11 Nov 2025 23:44:33 -0500 Subject: [PATCH 081/108] nixos/tests/systemd-shutdown: Don't check for return of poweroff command Given the nature of the command, our backdoor is likely to be killed before it can return the status to the test driver. --- nixos/tests/systemd-shutdown.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/systemd-shutdown.nix b/nixos/tests/systemd-shutdown.nix index f4685605bb612..827cbac300d80 100644 --- a/nixos/tests/systemd-shutdown.nix +++ b/nixos/tests/systemd-shutdown.nix @@ -27,7 +27,7 @@ in # automatically and that 'systemd-shutdown' runs our script. machine.wait_for_unit("multi-user.target") # .shutdown() would wait for the machine to power off - machine.succeed("systemctl poweroff") + machine.execute("systemctl poweroff", check_return=False) # Message printed by systemd-shutdown machine.wait_for_console_text("Unmounting '/oldroot'") machine.wait_for_console_text("${msg}") From 32220aae456b9c06ebf042588dee75fb20f8a14b Mon Sep 17 00:00:00 2001 From: Will Fancher Date: Sun, 9 Nov 2025 00:59:52 -0500 Subject: [PATCH 082/108] systemd: 258.1 -> 258.2 --- ...-placeholder-for-DEFAULT_PATH_NORMAL.patch | 20 ++++++++++--------- pkgs/os-specific/linux/systemd/default.nix | 14 ++----------- 2 files changed, 13 insertions(+), 21 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch index 1168d1249858a..e49f506639d53 100644 --- a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch +++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch @@ -6,24 +6,26 @@ Subject: [PATCH] path-util.h: add placeholder for DEFAULT_PATH_NORMAL This will be the $PATH used to lookup ExecStart= etc. options, which systemd itself uses extensively. --- - src/basic/path-util.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) + src/basic/path-util.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/basic/path-util.h b/src/basic/path-util.h -index 45518c07e5..94bef2f4b4 100644 +index a3a82574dd..b836dba7f1 100644 --- a/src/basic/path-util.h +++ b/src/basic/path-util.h -@@ -9,10 +9,10 @@ +@@ -9,11 +9,11 @@ #define PATH_MERGED_BIN(x) x "bin" #define PATH_MERGED_BIN_NULSTR(x) x "bin\0" --#define DEFAULT_PATH_WITH_SBIN PATH_SPLIT_BIN("/usr/local/") ":" PATH_SPLIT_BIN("/usr/") +-#define DEFAULT_PATH_WITH_FULL_SBIN PATH_SPLIT_BIN("/usr/local/") ":" PATH_SPLIT_BIN("/usr/") +-#define DEFAULT_PATH_WITH_LOCAL_SBIN PATH_SPLIT_BIN("/usr/local/") ":" PATH_MERGED_BIN("/usr/") -#define DEFAULT_PATH_WITHOUT_SBIN PATH_MERGED_BIN("/usr/local/") ":" PATH_MERGED_BIN("/usr/") -+#define DEFAULT_PATH_WITH_SBIN "@defaultPathNormal@" -+#define DEFAULT_PATH_WITHOUT_SBIN DEFAULT_PATH_WITH_SBIN ++#define DEFAULT_PATH_WITH_FULL_SBIN "@defaultPathNormal@" ++#define DEFAULT_PATH_WITH_LOCAL_SBIN DEFAULT_PATH_WITH_FULL_SBIN ++#define DEFAULT_PATH_WITHOUT_SBIN DEFAULT_PATH_WITH_FULL_SBIN --#define DEFAULT_PATH_COMPAT PATH_SPLIT_BIN("/usr/local/") ":" PATH_SPLIT_BIN("/usr/") ":" PATH_SPLIT_BIN("/") -+#define DEFAULT_PATH_COMPAT DEFAULT_PATH_WITH_SBIN +-#define DEFAULT_PATH_COMPAT DEFAULT_PATH_WITH_FULL_SBIN ":" PATH_SPLIT_BIN("/") ++#define DEFAULT_PATH_COMPAT DEFAULT_PATH_WITH_FULL_SBIN const char* default_PATH(void); diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 0aa8ce5a68c73..9aa2ef52ced4e 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -203,13 +203,13 @@ let in stdenv.mkDerivation (finalAttrs: { inherit pname; - version = "258.1"; + version = "258.2"; src = fetchFromGitHub { owner = "systemd"; repo = "systemd"; rev = "v${finalAttrs.version}"; - hash = "sha256-LA+6/d9W3CxK0G2sXsPHM4BVLf8IzsWW6IxJFby6/JU="; + hash = "sha256-1iWeuNefDOIEUSTzxzvt+jfcs6sSMPhxQfdwp0mqUjQ="; }; # On major changes, or when otherwise required, you *must* : @@ -221,16 +221,6 @@ stdenv.mkDerivation (finalAttrs: { # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all # patches patches = [ - # https://github.com/systemd/systemd/pull/39094 - (fetchpatch { - url = "https://github.com/systemd/systemd/commit/8b4ee3d68d2e70d9a396b74d155eab3b11763311.patch"; - hash = "sha256-JJDaSHQjd1QZ18CQHq40viB0AF/0MiescmZUcc/6LDg="; - }) - (fetchpatch { - url = "https://github.com/systemd/systemd/commit/13b0e7fc6d2623800ba04b104f3b628388c9f5e6.patch"; - hash = "sha256-X+tY3NjfRJpF6wvd++xEps0DIFTbX/6Zw9oO4Y9FmNI="; - }) - ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch ./0003-Fix-NixOS-containers.patch From 260d060a329884a61ef6953004d0f2fa0e326967 Mon Sep 17 00:00:00 2001 From: Will Fancher Date: Wed, 12 Nov 2025 00:00:46 -0500 Subject: [PATCH 083/108] libcap: 2.76 -> 2.77 --- pkgs/by-name/li/libcap/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libcap/package.nix b/pkgs/by-name/li/libcap/package.nix index 76e0ee1d0fe6a..12efcebbca35d 100644 --- a/pkgs/by-name/li/libcap/package.nix +++ b/pkgs/by-name/li/libcap/package.nix @@ -28,11 +28,11 @@ assert usePam -> pam != null; stdenv.mkDerivation rec { pname = "libcap"; - version = "2.76"; + version = "2.77"; src = fetchurl { url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz"; - hash = "sha256-Yp2kqymQDQ9/zDYicHN0MRmSX9cRyZoWibv1ybQMjm8="; + hash = "sha256-iXvBi0Svwmxw54zq09uzHhVKzCS+4IWloJB5qI2/b1I="; }; outputs = [ From 315c37461ac0909e8af00fe9d5989a985fb2db15 Mon Sep 17 00:00:00 2001 From: Will Fancher Date: Mon, 10 Nov 2025 05:58:25 -0500 Subject: [PATCH 084/108] libcap: Fix cross compilation. Since #442965, the `go run` command that `libcap` does at one point is no longer able to use the linker included in the go compiler, so it uses `$CC` instead. But `libcap`'s `Makefile` uses the wrong compiler for this. This patch has been submitted to the maintainer upstream. Include it in nixpkgs for now, until it's accepted and a new release is made. --- pkgs/by-name/li/libcap/package.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/li/libcap/package.nix b/pkgs/by-name/li/libcap/package.nix index 12efcebbca35d..8e3efdd4d5206 100644 --- a/pkgs/by-name/li/libcap/package.nix +++ b/pkgs/by-name/li/libcap/package.nix @@ -3,6 +3,7 @@ lib, buildPackages, fetchurl, + fetchpatch, runtimeShell, pkgsBuildHost, usePam ? !isStatic, @@ -73,6 +74,13 @@ stdenv.mkDerivation rec { "LIBCSTATIC=yes" ]; + patches = [ + (fetchpatch { + url = "https://git.kernel.org/pub/scm/libs/libcap/libcap.git/patch/?id=d628b3bfe40338d4efff6b0ae50f250a0eb884c7"; + hash = "sha256-Eiv/BOJZkduL+hOEJd8K1LQd9wvOeCKchE2GaLcerVc="; + }) + ]; + postPatch = '' patchShebangs ./progs/mkcapshdoc.sh @@ -86,11 +94,6 @@ stdenv.mkDerivation rec { --replace 'lib_prefix=$(exec_prefix)' "lib_prefix=$lib" \ --replace 'inc_prefix=$(prefix)' "inc_prefix=$dev" \ --replace 'man_prefix=$(prefix)' "man_prefix=$doc" - '' - + lib.optionalString withGo '' - # disable cross compilation for artifacts which are run as part of the build - substituteInPlace go/Makefile \ - --replace-fail '$(GO) run' 'GOOS= GOARCH= $(GO) run' ''; installFlags = [ "RAISE_SETFCAP=no" ]; From f8f2cec9f4e603d907eea04d4a3524d69ecb2dc1 Mon Sep 17 00:00:00 2001 From: Bobby Rong Date: Wed, 12 Nov 2025 23:49:52 +0800 Subject: [PATCH 085/108] spidermonkey_140: 140.4.0 -> 140.5.0 https://github.com/mozilla-firefox/firefox/commits/FIREFOX_140_5_0esr_RELEASE/js/src/build https://github.com/mozilla-firefox/firefox/commits/FIREFOX_140_5_0esr_RELEASE/build --- pkgs/development/interpreters/spidermonkey/140.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/spidermonkey/140.nix b/pkgs/development/interpreters/spidermonkey/140.nix index af269d60324a1..862aa494d2404 100644 --- a/pkgs/development/interpreters/spidermonkey/140.nix +++ b/pkgs/development/interpreters/spidermonkey/140.nix @@ -1,4 +1,4 @@ import ./common.nix { - version = "140.4.0"; - hash = "sha512-z84L3PbUWZx7lrzNn9E5C/s2RduSdqNpowdgzmgZhQqqQlGGnmvTxdhYLqNyi5IHYsXxb3zhLOFRw+dDJ7jIEQ=="; + version = "140.5.0"; + hash = "sha512-QSI2oly+oXG9W9U15Fw7pAlXqU4fjdOrdCQeCqHEB1/LjTlLlhlZnWDOPkVj5xLIJfqL7EQXlPIpNWgC9ysoYQ=="; } From 44ccacb64174fcf6abd2b4083994e66086691ca1 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 12 Nov 2025 19:56:06 +0000 Subject: [PATCH 086/108] ibusMinimal: 1.5.32 -> 1.5.33 --- pkgs/tools/inputmethods/ibus/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix index 3f0701ddaa47b..191ec0ada795e 100644 --- a/pkgs/tools/inputmethods/ibus/default.nix +++ b/pkgs/tools/inputmethods/ibus/default.nix @@ -67,13 +67,13 @@ in stdenv.mkDerivation (finalAttrs: { pname = "ibus"; - version = "1.5.32"; + version = "1.5.33"; src = fetchFromGitHub { owner = "ibus"; repo = "ibus"; tag = finalAttrs.version; - hash = "sha256-Rp2Aw2C2LXMBp8++pnZtPHiPoFDERpkDsKd0E//twuY="; + hash = "sha256-cpNZI6KbL9zUJHw1szpWl4lOEAvlBdd+FA6xGh1sYYY="; }; patches = [ From b21e8939d36fbb0b05c259ad4183ebc5c4e88de4 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Wed, 12 Nov 2025 21:53:11 +0000 Subject: [PATCH 087/108] sratom:0.6.18 -> 0.6.20 Changes: https://drobilla.net/2025/11/12/sratom-0-6-20.html --- pkgs/by-name/sr/sratom/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/sr/sratom/package.nix b/pkgs/by-name/sr/sratom/package.nix index bcff1fc39ee97..b55a15c1785a8 100644 --- a/pkgs/by-name/sr/sratom/package.nix +++ b/pkgs/by-name/sr/sratom/package.nix @@ -13,7 +13,7 @@ stdenv.mkDerivation rec { pname = "sratom"; - version = "0.6.18"; + version = "0.6.20"; outputs = [ "out" @@ -22,7 +22,7 @@ stdenv.mkDerivation rec { src = fetchurl { url = "https://download.drobilla.net/${pname}-${version}.tar.xz"; - hash = "sha256-TGptngtNbAHMBqiEmRD+zrkuZmyzh3nGFN0kBKmTHpI="; + hash = "sha256-OCbpGGyrxDyl41n8w9gjgGAjL1+KIJC+XcmrOQ5bZHc="; }; strictDeps = true; From eab80dad0a6c6209a706e5ff0d708793126bc662 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Thu, 13 Nov 2025 11:13:41 +0800 Subject: [PATCH 088/108] uv: 0.9.8 -> 0.9.9 --- pkgs/by-name/uv/uv/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix index a324cbee3d212..0ab5dfc752597 100644 --- a/pkgs/by-name/uv/uv/package.nix +++ b/pkgs/by-name/uv/uv/package.nix @@ -18,16 +18,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "uv"; - version = "0.9.8"; + version = "0.9.9"; src = fetchFromGitHub { owner = "astral-sh"; repo = "uv"; tag = finalAttrs.version; - hash = "sha256-e7yvEQggfBLq4akqnVoZTfvcpZLlbQRWr2fruGfF/N4="; + hash = "sha256-i9vdpHA9EfXmw5fhK1tTZG0T2zOlDbjPCGBIizvQzZw="; }; - cargoHash = "sha256-lEGhXwzotvCuDAvVyrt22e/ReotWT7m1lt6d2GL8lFU="; + cargoHash = "sha256-RZkIjHQElqrj+UAz+q6w1CYW3E5/YW9uy2E5KpKvw+w="; buildInputs = [ rust-jemalloc-sys From 38c1e3b317440f9ae5bf128df563464a550ccfba Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Thu, 13 Nov 2025 06:42:23 +0000 Subject: [PATCH 089/108] sord: 0.16.18 -> 0.16.20 Changes: https://gitlab.com/drobilla/sord/-/blob/v0.16.20/NEWS?ref_type=tags --- pkgs/by-name/so/sord/package.nix | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/so/sord/package.nix b/pkgs/by-name/so/sord/package.nix index bec23bbd710cd..3575d79cf8b50 100644 --- a/pkgs/by-name/so/sord/package.nix +++ b/pkgs/by-name/so/sord/package.nix @@ -2,7 +2,7 @@ lib, stdenv, doxygen, - fetchFromGitHub, + fetchFromGitLab, meson, ninja, pcre2, @@ -14,13 +14,14 @@ stdenv.mkDerivation rec { pname = "sord"; - version = "0.16.18"; + version = "0.16.20"; - src = fetchFromGitHub { + src = fetchFromGitLab { + domain = "gitlab.com"; owner = "drobilla"; repo = "sord"; - rev = "v${version}"; - hash = "sha256-cFobmmO2RHJdfCgTyGigzsdLpj7YF6U3r71i267Azks="; + tag = "v${version}"; + hash = "sha256-+f3dxhcxVoub+KeI5c5/J87SVvAawrm5cZgo2qogdRM="; }; outputs = [ From 41377a3b2f24d2fbf183a0de9f9617eb094388bc Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 13 Nov 2025 07:45:27 +0000 Subject: [PATCH 090/108] munge: 0.5.16 -> 0.5.17 --- pkgs/by-name/mu/munge/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mu/munge/package.nix b/pkgs/by-name/mu/munge/package.nix index ecfd36396afdc..1fbd0e3947d61 100644 --- a/pkgs/by-name/mu/munge/package.nix +++ b/pkgs/by-name/mu/munge/package.nix @@ -11,13 +11,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "munge"; - version = "0.5.16"; + version = "0.5.17"; src = fetchFromGitHub { owner = "dun"; repo = "munge"; rev = "munge-${finalAttrs.version}"; - sha256 = "sha256-fv42RMUAP8Os33/iHXr70i5Pt2JWZK71DN5vFI3q7Ak="; + sha256 = "sha256-MfxED81P4ipdP4fuxwmpNrAeej3ZH+qiHIt5bSrct1o="; }; nativeBuildInputs = [ From 7c6575cbe41563aed941970c2affc7e8c44d3d31 Mon Sep 17 00:00:00 2001 From: Juergen Fitschen Date: Fri, 7 Nov 2025 19:24:19 +0100 Subject: [PATCH 091/108] ncurses: fix unicode support It has become opt-out instead of opt-in in ncurses version 6.5. --- pkgs/development/libraries/ncurses/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix index 16ee5939891d7..fdaed1c507580 100644 --- a/pkgs/development/libraries/ncurses/default.nix +++ b/pkgs/development/libraries/ncurses/default.nix @@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: { "--with-versioned-syms" ] ++ lib.optional (!finalAttrs.separateDebugInfo) "--without-debug" - ++ lib.optional unicodeSupport "--enable-widec" + ++ lib.optional (!unicodeSupport) "--disable-widec" ++ lib.optional (!withCxx) "--without-cxx" ++ lib.optional (abiVersion == "5") "--with-abi-version=5" ++ lib.optional stdenv.hostPlatform.isNetBSD "--enable-rpath" From 9b704b809bee3f1d6f487fc0d44e654e77f15137 Mon Sep 17 00:00:00 2001 From: Martin Joerg Date: Thu, 13 Nov 2025 17:06:16 +0000 Subject: [PATCH 092/108] python3Packages.swh-perfecthash: remove swh-perfecthash was renamed to swh-shard see https://gitlab.softwareheritage.org/swh/devel/swh-perfecthash/-/merge_requests/26 follow-up to c7349ac27b92228d69a152fc2f89b25ffd3d8fc3 --- .../swh-perfecthash/default.nix | 62 ------------------- pkgs/top-level/python-aliases.nix | 1 + pkgs/top-level/python-packages.nix | 2 - 3 files changed, 1 insertion(+), 64 deletions(-) delete mode 100644 pkgs/development/python-modules/swh-perfecthash/default.nix diff --git a/pkgs/development/python-modules/swh-perfecthash/default.nix b/pkgs/development/python-modules/swh-perfecthash/default.nix deleted file mode 100644 index ec3e2fa0e9086..0000000000000 --- a/pkgs/development/python-modules/swh-perfecthash/default.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ - lib, - buildPythonPackage, - fetchFromGitLab, - setuptools, - setuptools-scm, - cffi, - pytestCheckHook, - pytest-mock, - pkgs, # only for cmph -}: - -buildPythonPackage rec { - pname = "swh-perfecthash"; - version = "1.3.2"; - pyproject = true; - - src = fetchFromGitLab { - domain = "gitlab.softwareheritage.org"; - group = "swh"; - owner = "devel"; - repo = "swh-perfecthash"; - tag = "v${version}"; - hash = "sha256-cG0h0lfSSooA7Mzrlsi5yIcbkbxQZ7mI5NtiB7D5Crs="; - }; - - build-system = [ - setuptools - setuptools-scm - ]; - - dependencies = [ - cffi - pkgs.cmph - ]; - - # The installed library clashes with the `swh` directory remaining in the source path. - # Usually, we get around this by `rm -rf` the python source files to ensure that the installed package is used. - # Here, we cannot do that as it would also remove the tests which are also in the `swh` directory. - preCheck = '' - rm -rf swh/perfecthash/*.py - ''; - - pythonImportsCheck = [ "swh.perfecthash" ]; - - nativeCheckInputs = [ - pytestCheckHook - pytest-mock - ]; - - disabledTests = [ - # Flake tests - "test_build_speed" - ]; - - meta = { - description = "Perfect hash table for software heritage object storage"; - homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-perfecthash"; - license = lib.licenses.gpl3Only; - maintainers = [ ]; - }; -} diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix index 5bc10d38a8e2d..9004fef57ca61 100644 --- a/pkgs/top-level/python-aliases.nix +++ b/pkgs/top-level/python-aliases.nix @@ -445,6 +445,7 @@ mapAliases { sqlalchemy_migrate = throw "'sqlalchemy_migrate' has been renamed to/replaced by 'sqlalchemy-migrate'"; # Converted to throw 2025-10-29 subunit2sql = throw "subunit2sql has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04 supervise_api = throw "'supervise_api' has been renamed to/replaced by 'supervise-api'"; # Converted to throw 2025-10-29 + swh-perfecthash = throw "'swh-perfecthash' has been renamed to/replaced by 'swh-shard'"; # added 2025-11-13 synologydsm-api = throw "'synologydsm-api' has been renamed to/replaced by 'py-synologydsm-api'"; # Converted to throw 2025-10-29 systemd = throw "systemd was removed because it was misnamed; use systemd-python instead"; # added 2025-11-09 sysv_ipc = throw "'sysv_ipc' has been renamed to/replaced by 'sysv-ipc'"; # Converted to throw 2025-10-29 diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index cef0d9710aaf3..9c109c9e9cfe4 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -18082,8 +18082,6 @@ self: super: with self; { swh-objstorage = callPackage ../development/python-modules/swh-objstorage { }; - swh-perfecthash = callPackage ../development/python-modules/swh-perfecthash { }; - swh-scanner = callPackage ../development/python-modules/swh-scanner { }; swh-scheduler = callPackage ../development/python-modules/swh-scheduler { }; From ec23723e29796180b51a32af4173382c2f1d81a5 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 14 Nov 2025 02:50:18 +0000 Subject: [PATCH 093/108] utf8proc: 2.11.0 -> 2.11.1 --- pkgs/by-name/ut/utf8proc/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ut/utf8proc/package.nix b/pkgs/by-name/ut/utf8proc/package.nix index 049a99ef79e78..28577b96d6633 100644 --- a/pkgs/by-name/ut/utf8proc/package.nix +++ b/pkgs/by-name/ut/utf8proc/package.nix @@ -11,13 +11,13 @@ stdenv.mkDerivation rec { pname = "utf8proc"; - version = "2.11.0"; + version = "2.11.1"; src = fetchFromGitHub { owner = "JuliaStrings"; repo = "utf8proc"; rev = "v${version}"; - hash = "sha256-iNITnxA1cacOBRU/XV22yzjB0XUOCYsaLLLPYLa+AoA="; + hash = "sha256-fFeevzek6Oql+wMmkZXVzKlDh3wZ6AjGCKJFsXBaqzg="; }; nativeBuildInputs = [ cmake ]; From 1b3055d4ecb8a318325bc7c0ed09c4dc43200a4b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Thu, 13 Nov 2025 22:34:18 -0800 Subject: [PATCH 094/108] python3Packages.pikepdf: 10.0.0 -> 10.0.2 Diff: https://github.com/pikepdf/pikepdf/compare/v10.0.0...v10.0.2 Changelog: https://github.com/pikepdf/pikepdf/blob/v10.0.2/docs/releasenotes/version10.md --- pkgs/development/python-modules/pikepdf/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix index 8227e6c2e080e..4c636e8e40ea0 100644 --- a/pkgs/development/python-modules/pikepdf/default.nix +++ b/pkgs/development/python-modules/pikepdf/default.nix @@ -25,7 +25,7 @@ buildPythonPackage rec { pname = "pikepdf"; - version = "10.0.0"; + version = "10.0.2"; pyproject = true; src = fetchFromGitHub { @@ -38,7 +38,7 @@ buildPythonPackage rec { postFetch = '' rm "$out/.git_archival.txt" ''; - hash = "sha256-DiNRjN4tnADaFOxLV9wdvJe9KEOb+h9IOSzaPGtGuk0="; + hash = "sha256-ncWgIcQp6/GOrNwIvwJ4nvf+SUfr0N53MXYq9LpfiB4="; }; patches = [ From ce37d84094757a3bd7d244144c3edc63de5ce5ee Mon Sep 17 00:00:00 2001 From: Luna Nova Date: Fri, 14 Nov 2025 05:31:07 -0800 Subject: [PATCH 095/108] go: revert default PIE changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverts default PIE patch for go. Does not reintroduce usages of removed "pie" hardening flag. I've made a right mess 😿; we have to back go default PIE out late. building with -race was just reported broken, there isn't time to investigate. fixing is a mass rebuild. People are using nixpkgs' go outside of nix derivations to produce executables to copy into containers. buildGoModule currently sets buildmode=exe when CGO_ENABLED=0 but this does nothing to maintain the existing interface for external users. We are fortunate that backing out the go PIE change in this manner does not reintroduce breakage of pkgsMusl.rclone etc that previously occurred when buildmode=pie *wasn't* set. The gcc `--enable-default-pie` approach turns out to not cause problems when mixed with a non-PIE go externally linked build. Historical issues were due to our linker wrapper being less smart about enabling PIE. Default PIE for go should be revisited post branch off. Fixes: #456953 Fixes: #461539 --- pkgs/build-support/go/module.nix | 3 -- pkgs/development/compilers/go/1.24.nix | 29 ------------------- pkgs/development/compilers/go/1.25.nix | 29 ------------------- .../compilers/go/go-default-pie.patch | 13 --------- 4 files changed, 74 deletions(-) delete mode 100644 pkgs/development/compilers/go/go-default-pie.patch diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix index ce699c2134545..30542b1d16c6f 100644 --- a/pkgs/build-support/go/module.nix +++ b/pkgs/build-support/go/module.nix @@ -253,9 +253,6 @@ lib.extendMkDerivation { if [ -f "$NIX_CC_FOR_TARGET/nix-support/dynamic-linker" ]; then export GO_LDSO=$(cat $NIX_CC_FOR_TARGET/nix-support/dynamic-linker) fi - if [ "$CGO_ENABLED" = "0" ]; then - export GOFLAGS="-buildmode=exe $GOFLAGS" - fi cd "$modRoot" '' + lib.optionalString (finalAttrs.vendorHash != null) '' diff --git a/pkgs/development/compilers/go/1.24.nix b/pkgs/development/compilers/go/1.24.nix index da57d07f72056..cdd21e4c40040 100644 --- a/pkgs/development/compilers/go/1.24.nix +++ b/pkgs/development/compilers/go/1.24.nix @@ -21,30 +21,6 @@ let targetCC = pkgsBuildTarget.targetPackages.stdenv.cc; isCross = stdenv.buildPlatform != stdenv.targetPlatform; - - # In order for buildmode=pie to work either Go's internal linker must know how - # to produce position-independent executables or Go must be using an external linker. - # - # go-default-pie.patch tries to enable position-independent codegen (PIE) only when the platform - # reports support (via BuildModeSupported(..., "pie", ...)). - # - # That probe is not fully reliable: for example, `pkgsi686Linux.go` can fail during bootstrap - # with message 'default PIE binary requires external (cgo) linking, but cgo is not enabled' - # despite CGO being enabled. (we set `CGO_ENABLED=1`). - # - # To avoid such breakage, limit this patch to a small set of explicitly tested platforms - # rather than relying on the general BuildModeSupported("pie") check. - supportsDefaultPie = - let - hasPie = { - "amd64" = true; - "arm64" = true; - "ppc64le" = true; - "riscv64" = true; - }; - in - hasPie.${stdenv.hostPlatform.go.GOARCH} or false - && hasPie.${stdenv.targetPlatform.go.GOARCH} or false; in stdenv.mkDerivation (finalAttrs: { pname = "go"; @@ -86,11 +62,6 @@ stdenv.mkDerivation (finalAttrs: { ./remove-tools-1.11.patch ./go_no_vendor_checks-1.23.patch ./go-env-go_ldso.patch - ] - ++ lib.optionals supportsDefaultPie [ - (replaceVars ./go-default-pie.patch { - inherit (stdenv.targetPlatform.go) GOARCH; - }) ]; inherit (stdenv.targetPlatform.go) GOOS GOARCH GOARM; diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix index fc472c987040b..e807f81f4ab71 100644 --- a/pkgs/development/compilers/go/1.25.nix +++ b/pkgs/development/compilers/go/1.25.nix @@ -22,30 +22,6 @@ let targetCC = pkgsBuildTarget.targetPackages.stdenv.cc; isCross = stdenv.buildPlatform != stdenv.targetPlatform; - - # go-default-pie.patch tries to enable position-independent codegen (PIE) only when the platform - # reports support (via BuildModeSupported(..., "pie", ...)). - # - # In order for buildmode=pie to work either Go's internal linker must know how - # to produce position-independent executables or Go must be using an external linker. - # - # That probe is not fully reliable: for example, `pkgsi686Linux.go` can fail during bootstrap - # with message 'default PIE binary requires external (cgo) linking, but cgo is not enabled' - # despite CGO being enabled. (we set `CGO_ENABLED=1`). - # - # To avoid such breakage, limit this patch to a small set of explicitly tested platforms - # rather than relying on the general BuildModeSupported("pie") check. - supportsDefaultPie = - let - hasPie = { - "amd64" = true; - "arm64" = true; - "ppc64le" = true; - "riscv64" = true; - }; - in - hasPie.${stdenv.hostPlatform.go.GOARCH} or false - && hasPie.${stdenv.targetPlatform.go.GOARCH} or false; in stdenv.mkDerivation (finalAttrs: { pname = "go"; @@ -87,11 +63,6 @@ stdenv.mkDerivation (finalAttrs: { ./remove-tools-1.11.patch ./go_no_vendor_checks-1.23.patch ./go-env-go_ldso.patch - ] - ++ lib.optionals supportsDefaultPie [ - (replaceVars ./go-default-pie.patch { - inherit (stdenv.targetPlatform.go) GOARCH; - }) ]; inherit (stdenv.targetPlatform.go) GOOS GOARCH GOARM; diff --git a/pkgs/development/compilers/go/go-default-pie.patch b/pkgs/development/compilers/go/go-default-pie.patch deleted file mode 100644 index bce8d8dafd3de..0000000000000 --- a/pkgs/development/compilers/go/go-default-pie.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/src/internal/platform/supported.go b/src/internal/platform/supported.go -index f9706a6988..abac42d550 100644 ---- a/src/internal/platform/supported.go -+++ b/src/internal/platform/supported.go -@@ -249,7 +253,7 @@ func DefaultPIE(goos, goarch string, isRace bool) bool { - case "darwin": - return true - } -- return false -+ return goarch == "@GOARCH@" && BuildModeSupported("gc", "pie", goos, goarch) - } - - // ExecutableHasDWARF reports whether the linked executable includes DWARF From 8ac5939e56fe4f5befa99f81626e65238316ee45 Mon Sep 17 00:00:00 2001 From: Yureka Date: Sat, 15 Nov 2025 00:39:03 +0100 Subject: [PATCH 096/108] electron_38: fix build with Rust 1.91 --- ...o_sanitize-cfi-to-sanitize-cfi-off-2.patch | 13 +++++++++ pkgs/development/tools/electron/common.nix | 28 +++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 pkgs/development/tools/electron/CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-2.patch diff --git a/pkgs/development/tools/electron/CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-2.patch b/pkgs/development/tools/electron/CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-2.patch new file mode 100644 index 0000000000000..87140cbd11e66 --- /dev/null +++ b/pkgs/development/tools/electron/CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-2.patch @@ -0,0 +1,13 @@ +diff --git a/third_party/crabbyavif/src/src/reformat/libyuv.rs b/third_party/crabbyavif/src/src/reformat/libyuv.rs +index dd12964..4ae9dc0 100644 +--- a/third_party/crabbyavif/src/src/reformat/libyuv.rs ++++ b/third_party/crabbyavif/src/src/reformat/libyuv.rs +@@ -823,7 +823,7 @@ fn rgb_to_yuv_conversion_function( + } + } + +-#[cfg_attr(feature = "disable_cfi", no_sanitize(cfi))] ++#[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))] + pub(crate) fn rgb_to_yuv(rgb: &rgb::Image, image: &mut image::Image) -> AvifResult<()> { + let conversion_function = rgb_to_yuv_conversion_function(rgb, image)?; + let plane_u8 = image.plane_ptrs_mut(); diff --git a/pkgs/development/tools/electron/common.nix b/pkgs/development/tools/electron/common.nix index 1cc57988ff230..2fb4b0dccb199 100644 --- a/pkgs/development/tools/electron/common.nix +++ b/pkgs/development/tools/electron/common.nix @@ -106,6 +106,34 @@ in url = "https://github.com/chromium/chromium/commit/23d818d3c7fba4658248f17fd7b8993199242aa9.patch"; hash = "sha256-JVv36PgU/rr34jrhgCyf4Pp8o5j2T8fD1xBVH1avT48="; }) + # Fix build with Rust 1.91.0 + # https://chromium-review.googlesource.com/c/chromium/src/+/6949745 + (fetchpatch { + name = "Remove-unicode_width-from-rust-dependencies.patch"; + url = "https://github.com/chromium/chromium/commit/0420449584e2afb7473393f536379efe194ba23c.patch"; + hash = "sha256-2x1QoKkZEBfJw0hBjaErN/E47WrVfZvDngAXSIDzJs4="; + }) + (fetchpatch { + name = "CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-1.patch"; + url = "https://github.com/webmproject/CrabbyAvif/commit/4c70b98d1ebc8a210f2919be7ccabbcf23061cb5.patch"; + extraPrefix = "third_party/crabbyavif/src/"; + stripLen = 1; + hash = "sha256-E8/PmL+8+ZSoDO6L0/YOygIsliCDmcaBptXsi2L6ETQ="; + }) + # backport of https://github.com/webmproject/CrabbyAvif/commit/3ba05863e84fd3acb4f4af2b4545221b317a2e55 + ./CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-2.patch + # https://chromium-review.googlesource.com/c/chromium/src/+/6879484 + (fetchpatch { + name = "crabbyavif-BUILD-gn-Temporarily-remove-disable_cfi-feature.patch"; + url = "https://github.com/chromium/chromium/commit/e46275404d8f8a65ed84b3e583e9b78e4298acc7.patch"; + hash = "sha256-2Dths53ervzCPKFbAVxeBHxtPHckxYhesJhaYZbxGSA="; + }) + # https://chromium-review.googlesource.com/c/chromium/src/+/6960510 + (fetchpatch { + name = "crabbyavif-BUILD-gn-Enable-disable_cfi-feature.patch"; + url = "https://github.com/chromium/chromium/commit/9415f40bc6f853547f791e633be638c71368ce56.patch"; + hash = "sha256-+M4gI77SoQ4dYIe/iGFgIwF1fS/6KQ8s16vj8ht/rik="; + }) ]; npmRoot = "third_party/node"; From db5e5b3bfcd1d8f9a8eda716be181fceeecc40cf Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Thu, 13 Nov 2025 09:07:52 +0000 Subject: [PATCH 097/108] protobuf: 33.0 -> 33.1 Diff: https://github.com/protocolbuffers/protobuf/compare/v33.0...v33.1 Changelog: https://github.com/protocolbuffers/protobuf/releases/tag/v33.1 --- pkgs/development/libraries/protobuf/33.nix | 4 ++-- pkgs/development/python-modules/protobuf/6.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/libraries/protobuf/33.nix b/pkgs/development/libraries/protobuf/33.nix index 24ace1256005f..6365e5fac5a59 100644 --- a/pkgs/development/libraries/protobuf/33.nix +++ b/pkgs/development/libraries/protobuf/33.nix @@ -2,8 +2,8 @@ callPackage ./generic.nix ( { - version = "33.0"; - hash = "sha256-VoMMMyPGAyjhXrYw7muHFBRjYshfqgLZZPPOXCfmmPs="; + version = "33.1"; + hash = "sha256-IW6wLkr/NwIZy5N8s+7Fe9CSexXgliW8QSlvmUD+g5Q="; } // args ) diff --git a/pkgs/development/python-modules/protobuf/6.nix b/pkgs/development/python-modules/protobuf/6.nix index f5ce6a82e7166..bba5b5da6dacb 100644 --- a/pkgs/development/python-modules/protobuf/6.nix +++ b/pkgs/development/python-modules/protobuf/6.nix @@ -9,12 +9,12 @@ buildPythonPackage rec { pname = "protobuf"; - version = "6.33.0"; + version = "6.33.1"; pyproject = true; src = fetchPypi { inherit pname version; - hash = "sha256-FAMD1cjSA3cwxUj4x7k7ILsdwwG+KAw3i4K4iUWJyVQ="; + hash = "sha256-l/ZXV+jQmHDeb9lzrt25L4VDVgcjXSCy3+2TQF0AyFs="; }; build-system = [ setuptools ]; From f710823c96adcfa943b9f504c99206a7e2e6365b Mon Sep 17 00:00:00 2001 From: winston Date: Sat, 15 Nov 2025 16:27:13 +0100 Subject: [PATCH 098/108] ncurses: set unicodeSupport flag according to abiVersion --- pkgs/development/libraries/ncurses/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix index fdaed1c507580..39e73047f2bd8 100644 --- a/pkgs/development/libraries/ncurses/default.nix +++ b/pkgs/development/libraries/ncurses/default.nix @@ -65,7 +65,8 @@ stdenv.mkDerivation (finalAttrs: { "--with-versioned-syms" ] ++ lib.optional (!finalAttrs.separateDebugInfo) "--without-debug" - ++ lib.optional (!unicodeSupport) "--disable-widec" + ++ lib.optional (unicodeSupport && abiVersion == "5") "--enable-widec" + ++ lib.optional (!unicodeSupport && abiVersion == "6") "--disable-widec" ++ lib.optional (!withCxx) "--without-cxx" ++ lib.optional (abiVersion == "5") "--with-abi-version=5" ++ lib.optional stdenv.hostPlatform.isNetBSD "--enable-rpath" From 08b559f34f09070bba98d114c69f73de03e64daa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 16 Nov 2025 06:59:56 -0800 Subject: [PATCH 099/108] python3Packages.mitmproxy: unpin brotli --- pkgs/development/python-modules/mitmproxy/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix index f0ce75afc2079..eacee3afb4b6b 100644 --- a/pkgs/development/python-modules/mitmproxy/default.nix +++ b/pkgs/development/python-modules/mitmproxy/default.nix @@ -50,6 +50,7 @@ buildPythonPackage rec { pythonRelaxDeps = [ "bcrypt" + "brotli" "cryptography" "flask" "h2" From e467c7d5b9990fe62ae4d014b8ed599b63728942 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 16 Nov 2025 07:11:51 -0800 Subject: [PATCH 100/108] python3Packages.mitmproxy: add NixOS test to passthru.tests --- pkgs/development/python-modules/mitmproxy/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix index eacee3afb4b6b..78cc884abc32d 100644 --- a/pkgs/development/python-modules/mitmproxy/default.nix +++ b/pkgs/development/python-modules/mitmproxy/default.nix @@ -18,6 +18,7 @@ ldap3, mitmproxy-rs, msgpack, + nixosTests, publicsuffix2, pyopenssl, pyparsing, @@ -147,6 +148,10 @@ buildPythonPackage rec { pythonImportsCheck = [ "mitmproxy" ]; + passthru.tests = { + inherit (nixosTests) mitmproxy; + }; + meta = with lib; { description = "Man-in-the-middle proxy"; homepage = "https://mitmproxy.org/"; From 395cd8c94118fbc9adbe502813bf5839fd7ce43e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 16 Nov 2025 13:13:20 -0800 Subject: [PATCH 101/108] python3Packages.mmengine: don't test coverage --- pkgs/development/python-modules/mmengine/default.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/development/python-modules/mmengine/default.nix b/pkgs/development/python-modules/mmengine/default.nix index 0217e140b77ba..5a0a50a8bc200 100644 --- a/pkgs/development/python-modules/mmengine/default.nix +++ b/pkgs/development/python-modules/mmengine/default.nix @@ -21,7 +21,6 @@ # tests bitsandbytes, - coverage, dvclive, lion-pytorch, lmdb, @@ -89,7 +88,6 @@ buildPythonPackage rec { nativeCheckInputs = [ bitsandbytes - coverage dvclive lion-pytorch lmdb From 9a1edfaa8eb4d4396afc05c58f13636b024a1b6b Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 18 Nov 2025 01:05:22 +0100 Subject: [PATCH 102/108] Revert "protobuf: 32.1 -> 33.0" This reverts commit 1ab437d8561bec9706026be67612adebc5454290. This breaks the use of e.g onnxruntime and tensorflow in the same Python process, since they now introduce the default systemd protobuf (33) and the statically linked protobuf in tensorflow (32.1). This breakage is visible in the frigate tests, which segfault due to this misalignment. --- pkgs/top-level/all-packages.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 3d76761ec997f..92c42ad953100 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8240,7 +8240,7 @@ with pkgs; prospector = callPackage ../development/tools/prospector { }; - protobuf = protobuf_33; + protobuf = protobuf_32; inherit ({ From 7f6e1d5d5957ba3221dc34d481a320c021572cd4 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 18 Nov 2025 01:15:24 +0100 Subject: [PATCH 103/108] protobuf: add version alignment hint The version is important to match, as long as the default tensorflow package we consume is a binary wheel that ships with a statically linked protobuf version. A mismatch of protobuf versions in a single process can lead to memory corruption, because of ABI incompatibilities between protobuf versions. --- pkgs/top-level/all-packages.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 92c42ad953100..a6e86008719d7 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8240,6 +8240,8 @@ with pkgs; prospector = callPackage ../development/tools/prospector { }; + # this version should align with the static protobuf version linked into python3.pkgs.tensorflow + # $ nix-shell -I nixpkgs=$(git rev-parse --show-toplevel) -p python3.pkgs.tensorflow --run "python3 -c 'import google.protobuf; print(google.protobuf.__version__)'" protobuf = protobuf_32; inherit From e4fd781d80082e304919b096a56284aff5e6a1c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Wed, 19 Nov 2025 08:32:58 +0100 Subject: [PATCH 104/108] Revert "at-spi2-core: patch build on darwin" This reverts commit e69b54bfd0060ad2eda6e96f52c6eeb1e2e0787e. This fixes the build again (on aarch64-darwin for me). The removed patch is contained in the .1 bump: https://hydra.nixos.org/build/313569266/nixlog/1/tail --- pkgs/by-name/at/at-spi2-core/package.nix | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/pkgs/by-name/at/at-spi2-core/package.nix b/pkgs/by-name/at/at-spi2-core/package.nix index 46cca49221798..1ca88332ea10a 100644 --- a/pkgs/by-name/at/at-spi2-core/package.nix +++ b/pkgs/by-name/at/at-spi2-core/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchurl, - fetchpatch, meson, ninja, pkg-config, @@ -42,15 +41,6 @@ stdenv.mkDerivation rec { hash = "sha256-fzdKajjNcP9LMsnToDEL+oBNlG/tTJ5pp9SfrNy5Xpw="; }; - # TODO apply unconditionally on rebuild - patches = lib.optionals stdenv.isDarwin [ - (fetchpatch { - name = "timersub.patch"; - url = "https://github.com/GNOME/at-spi2-core/commit/02108ea1b96db0189b2d4a9eceb843e1f13b7bdf.diff"; - hash = "sha256-pVBhawfRnJoXmovl9CAmzh+YWJkbvlOVrCs8XanjP00="; - }) - ]; - nativeBuildInputs = [ glib meson From c6b92cddb589f4804250aef986060a60fa743247 Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 21 Nov 2025 12:33:45 +0300 Subject: [PATCH 105/108] gtk4: 4.20.2 -> 4.20.3 Changelog: https://gitlab.gnome.org/GNOME/gtk/-/raw/4.20.3/NEWS --- pkgs/development/libraries/gtk/4.x.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix index 9b5a9daaa063f..8b6881e136ac6 100644 --- a/pkgs/development/libraries/gtk/4.x.nix +++ b/pkgs/development/libraries/gtk/4.x.nix @@ -69,7 +69,7 @@ in stdenv.mkDerivation (finalAttrs: { pname = "gtk4"; - version = "4.20.2"; + version = "4.20.3"; outputs = [ "out" @@ -85,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor finalAttrs.version}/gtk-${finalAttrs.version}.tar.xz"; - hash = "sha256-XoJA7eyvr/K4uvRmO9zqpmjvEKIHvuTX+Q4BDhC93Fw="; + hash = "sha256-KHPykDCIpmxxFz6i7YX/riZqZrlyw6SEK7svbxh+wVM="; }; depsBuildBuild = [ From e9d374194e7c2455c970b2084c95a77adda657c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Sat, 22 Nov 2025 08:03:17 +0100 Subject: [PATCH 106/108] gtk4: patch build on i686-linux https://gitlab.gnome.org/GNOME/gtk/-/issues/7883 https://hydra.nixos.org/build/314121859/nixlog/1/tail --- pkgs/development/libraries/gtk/4.x.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix index 8b6881e136ac6..9522692b4b564 100644 --- a/pkgs/development/libraries/gtk/4.x.nix +++ b/pkgs/development/libraries/gtk/4.x.nix @@ -4,6 +4,7 @@ buildPackages, replaceVars, fetchurl, + fetchpatch, pkg-config, docutils, gettext, @@ -88,6 +89,12 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-KHPykDCIpmxxFz6i7YX/riZqZrlyw6SEK7svbxh+wVM="; }; + # TODO: make it unconditional on rebuild, drop on version >= 4.20.4 + patches = lib.optional stdenv.hostPlatform.is32bit (fetchpatch { + url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/3b7ed49f26700c65fa9c6f41cf40d4fd5f921756.diff"; + hash = "sha256-P6cE7fnR5W+H0EWQWJ3hYSu4MwMygPIfS6e0IiXlQv8="; + }); + depsBuildBuild = [ pkg-config ]; From 8aacc8aa8829727680cd353d4997c116b910e87e Mon Sep 17 00:00:00 2001 From: K900 Date: Sat, 22 Nov 2025 12:21:30 +0300 Subject: [PATCH 107/108] mlt: 7.32.0 -> 7.34.1 --- pkgs/by-name/ml/mlt/package.nix | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/ml/mlt/package.nix b/pkgs/by-name/ml/mlt/package.nix index 41e7af71554e9..718ef3ef656cd 100644 --- a/pkgs/by-name/ml/mlt/package.nix +++ b/pkgs/by-name/ml/mlt/package.nix @@ -25,6 +25,7 @@ cudaSupport ? config.cudaSupport, cudaPackages ? { }, enableJackrack ? stdenv.hostPlatform.isLinux, + gdk-pixbuf, glib, ladspa-sdk, ladspaPlugins, @@ -40,13 +41,13 @@ stdenv.mkDerivation rec { pname = "mlt"; - version = "7.32.0"; + version = "7.34.1"; src = fetchFromGitHub { owner = "mltframework"; repo = "mlt"; tag = "v${version}"; - hash = "sha256-8T5FXXGs7SxL6nD+R1Q/0Forsdp5Xux4S3VLvgqXzw8="; + hash = "sha256-zdfjl4ZrdmX445hYx2CoKj1NuXQslQpTC5m96zPrZes="; # The submodule contains glaxnimate code, since MLT uses internally some functions defined in glaxnimate. # Since glaxnimate is not available as a library upstream, we cannot remove for now this dependency on # submodules until upstream exports glaxnimate as a library: https://gitlab.com/mattbas/glaxnimate/-/issues/545 @@ -71,6 +72,7 @@ stdenv.mkDerivation rec { ]; buildInputs = [ + gdk-pixbuf (opencv4.override { inherit ffmpeg; }) ffmpeg fftw @@ -118,9 +120,18 @@ stdenv.mkDerivation rec { ++ lib.optionals enablePython [ "-DSWIG_PYTHON=ON" ] - ++ lib.optionals (qt != null) [ - "-DMOD_QT${lib.versions.major qt.qtbase.version}=ON" - "-DMOD_GLAXNIMATE${if lib.versions.major qt.qtbase.version == "5" then "" else "_QT6"}=ON" + ++ lib.optionals (qt == null) [ + "-DMOD_QT6=OFF" + ] + ++ lib.optionals (qt != null && lib.versions.major qt.qtbase.version == "5") [ + "-DMOD_QT=ON" + "-DMOD_QT6=OFF" + "-DMOD_GLAXNIMATE=ON" + ] + ++ lib.optionals (qt != null && lib.versions.major qt.qtbase.version == "6") [ + "-DMOD_QT6=ON" + "-DMOD_QT=OFF" + "-DMOD_GLAXNIMATE_QT6=ON" ]; preFixup = '' From e6066a2284d49cbd182ee190de1114ef25f098ef Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Wed, 19 Nov 2025 23:11:40 +0100 Subject: [PATCH 108/108] grub2: apply November security fixes https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html Fixes CVE-2025-54770, CVE-2025-54771, CVE-2025-61661, CVE-2025-61662, CVE-2025-61663 and CVE-2025-61664. --- pkgs/tools/misc/grub/default.nix | 41 ++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix index 68f3921354a1b..774117d941fd4 100644 --- a/pkgs/tools/misc/grub/default.nix +++ b/pkgs/tools/misc/grub/default.nix @@ -510,6 +510,47 @@ stdenv.mkDerivation rec { url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c448f511e74cb7c776b314fcb7943f98d3f22b6d"; hash = "sha256-64gMhCEW0aYHt46crX/qN/3Hj8MgvWLazgQlVXqe8LE="; }) + # https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html + (fetchpatch { + name = "1_commands_test_fix_error_in_recursion_depth_calculation.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cc9d621dd06bfa12eac511b37b4ceda5bd2f8246"; + hash = "sha256-GpLpqTKr2ke/YaxnZIO1Kh9wpde44h2mvwcODcAL/nk="; + }) + (fetchpatch { + name = "2_CVE-2025-54771.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4fb4cbc941981894a00ba8e75d634a41967a27f"; + hash = "sha256-yWowlAMVXdfIyC+BiB00IZvTwIybvaPhxAyz0MPjQuY="; + }) + (fetchpatch { + name = "3_CVE-2025-54770.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=10e58a14db20e17d1b6a39abe38df01fef98e29d"; + hash = "sha256-1ROc5n7sApw7aGr+y8gygFqVkifLdgOD3RPaW9b8aQQ="; + }) + (fetchpatch { + name = "4_CVE-2025-61662.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8ed78fd9f0852ab218cc1f991c38e5a229e43807"; + hash = "sha256-mG+vcZHbF4duY2YoYAzPBQRHfWvp5Fvgtm0XBk7JqqM="; + }) + (fetchpatch { + name = "5_CVE-2025-61663_CVE-2025-61664.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05d3698b8b03eccc49e53491bbd75dba15f40917"; + hash = "sha256-kgtXhZmAQpassEf8+RzqkghAzLrCcRoRMMnfunF/0J8="; + }) + (fetchpatch { + name = "6_tests_lib_functional_test_unregister_commands_on_module_unload.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9df1e693e70c5a274b6d60dc76efe2694b89c2fc"; + hash = "sha256-UzyYkpP7vivx2jzxi7BMP9h9OB2yraswrMW4g9UWsbI="; + }) + (fetchpatch { + name = "7_CVE-2025-61661.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=549a9cc372fd0b96a4ccdfad0e12140476cc62a3"; + hash = "sha256-2mlDoVXY7Upwx4QBeAMOHUtoUlyx1MDDmabnrwK1gEY="; + }) + (fetchpatch { + name = "8_commands_usbtest_ensure_string_length_is_sufficient_in_usb_string_processing.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7debdce1e98907e65223a4b4c53a41345ac45e53"; + hash = "sha256-2ALvrmwxvpjQYjGNrQ0gyGotpk0kgmYlJXMF1xXrnEw="; + }) ]; postPatch =