staging-next 2025-08-30 (#438642)

doc/hooks/installShellFiles.section.md

···
 {
   nativeBuildInputs = [ installShellFiles ];
 
-  # Sometimes the manpage file has an undesirable name; e.g., it conflicts with
-  # another software with an equal name. It should be renamed before being
-  # installed via installManPage
+  # Sometimes the manpage file has an undersirable name; e.g., it conflicts with
+  # another software with an equal name. To install it with a different name,
+  # the installed name must be provided before the path to the file.
+  #
+  # Below install a manpage "foobar.1" from the source file "./foobar.1", and
+  # also installs the manpage "fromsea.3" from the source file "./delmar.3".
+  postInstall = ''
+    installManPage \
+        foobar.1 \
+        --name fromsea.3 delmar.3
+  '';
+}
+```
+
+The manpage may be the result of a piped input (e.g. `<(cmd)`), in which
+case the name must be provided before the pipe with the `--name` flag.
+
+```nix
+{
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installManPage --name foobar.1 <($out/bin/foobar --manpage)
+  '';
+}
+```
+
+If no parsing of arguments is desired, pass `--` to opt-out of all subsequent
+arguments.
+
+```nix
+{
+  nativeBuildInputs = [ installShellFiles ];
+
+  # Installs a manpage from a file called "--name"
   postInstall = ''
-    mv fromsea.3 delmar.3
-    installManPage foobar.1 delmar.3
+    installManPage -- --name
   '';
 }
 ```
···
 completion files.
 
 By default it will autodetect the shell type from the completion file extension,
-but you may also specify it by passing one of `--bash`, `--fish`, or
-`--zsh`. These flags apply to all paths listed after them (up until another
+but you may also specify it by passing one of `--bash`, `--fish`, `--zsh`, or
+`--nushell`. These flags apply to all paths listed after them (up until another
 shell flag is given). Each path may also have a custom installation name
 provided by providing a flag `--name NAME` before the path. If this flag is not
 provided, zsh completions will be renamed automatically such that `foobar.zsh`
···
     # explicit behavior
     installShellCompletion --bash --name foobar.bash share/completions.bash
     installShellCompletion --fish --name foobar.fish share/completions.fish
+    installShellCompletion --nushell --name foobar share/completions.nu
     installShellCompletion --zsh --name _foobar share/completions.zsh
     # implicit behavior
-    installShellCompletion share/completions/foobar.{bash,fish,zsh}
+    installShellCompletion share/completions/foobar.{bash,fish,zsh,nu}
   '';
 }
 ```
···
     installShellCompletion --cmd foobar \
       --bash <($out/bin/foobar --bash-completion) \
       --fish <($out/bin/foobar --fish-completion) \
+      --nushell <($out/bin/foobar --nushell-completion) \
       --zsh <($out/bin/foobar --zsh-completion)
   '';
 }

doc/languages-frameworks/go.section.md

···
 
 Defaults to `null`
 
+### `buildTestBinaries` {#var-go-buildTestBinaries}
+
+This option allows to compile test binaries instead of the usual binaries produced by a package.
+Go can [compile test into binaries](https://pkg.go.dev/cmd/go#hdr-Test_packages) using the `go test -c` command.
+These binaries can then be executed at a later point (outside the Nix sandbox) to run the tests.
+This is mostly useful for downstream consumers to run integration or end-to-end tests that won't work in the Nix sandbox, for example because they require network access.
 
 ## Versioned toolchains and builders {#ssec-go-toolchain-versions}
 

doc/redirects.json

···
   "strictflexarrays3": [
     "index.html#strictflexarrays3"
   ],
+  "glibcxxassertions": [
+    "index.html#glibcxxassertions"
+  ],
   "tester-shfmt": [
     "index.html#tester-shfmt"
   ],
···
   ],
   "typst-package-scope-and-usage": [
     "index.html#typst-package-scope-and-usage"
+  ],
+  "var-go-buildTestBinaries": [
+    "index.html#var-go-buildTestBinaries"
   ],
   "var-meta-teams": [
     "index.html#var-meta-teams"

doc/release-notes/rl-2511.section.md

···
 
 - The `offrss` package was removed due to lack of upstream maintenance since 2012. It's recommended for users to migrate to another RSS reader
 
+- `installShellFiles`: Allow installManPage to take a piped input, add the `--name` flag for renaming the file when installed. Can also append `--` to opt-out of all subsequent parsing.
+
 - GCC 9, 10, 11, and 12 have been removed, as they have reached end‐of‐life upstream and are no longer supported.
 
 - GHCJS 8.10, exposed via `haskell.compiler.ghcjs` and `haskell.compiler.ghcjs810`, has been removed. Downstream users should migrate their projects to the new JavaScript backend of GHC proper which can be used via `pkgsCross.ghcjs` from Nixpkgs. Haskell packaging code, like `haskellPackages.mkDerivation`, `ghcWithPackages` and `hoogleWithPackages`, also no longer supports GHCJS.
···
 
 - `kbd` package's `outputs` now include a `man` and `scripts` outputs. The `unicode_start` and `unicode_stop` Bash scripts are now part of the `scripts` output, allowing most usages of the `kbd` package to not pull in `bash`.
 
+- `spidermonkey_91` has been removed, as it has been EOL since September 2022.
+
 - `cudaPackages.cudatoolkit-legacy-runfile` has been removed.
 
 - `conduwuit` was removed due to upstream ceasing development and deleting their repository. For existing data, a migration to `matrix-conduit`, `matrix-continuwuity` or `matrix-tuwunel` may be possible.
···
     and the given `ghc` otherwise. This approach is not recommended since it results in mismatched GHC versions.
 
 - `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
+
+- `python3Full` and its versioned attributes (python3xxFull) have been removed. Bluetooth support is now enabled in the default python3 attributes. The X11 support built the tkinter module, which is available as a dedicated attribute on the package set.
 
 - `stdenv.mkDerivation` and other derivation builders that use it no longer allow the value of `env` to be anything but an attribute set, for the purpose of setting environment variables that are available to the [builder](https://nix.dev/manual/nix/latest/store/derivation/#builder) process. An environment variable called `env` can still be provided by means of `mkDerivation { env.env = ...; }`, though we recommend to use a more specific name than "env".
 
···
 
 - [`homebox` 0.20.0](https://github.com/sysadminsmedia/homebox/releases/tag/v0.20.0) changed how assets are stored and hashed. It is recommended to back up your database before this update.
 
+- `installShellCompletion`: now supports Nushell completion files
+
 - New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively.
 
 - `gramps` has been updated to 6.0.0
···
 
 - `searx` was updated to use `envsubst` instead of `sed` for parsing secrets from environment variables.
   If your previous configuration included a secret reference like `server.secret_key = "@SEARX_SECRET_KEY@"`, you must migrate to the new envsubst syntax: `server.secret_key = "$SEARX_SECRET_KEY"`.
+
+- A new hardening flag, `glibcxxassertions` was made available, corresponding to the glibc `_GLIBCXX_ASSERTIONS` option.
 
 - `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
 

doc/stdenv/stdenv.chapter.md

···
 sorry, unimplemented: __builtin_clear_padding not supported for variable length aggregates
 ```
 
+#### `glibcxxassertions` {#glibcxxassertions}
+
+Adds the `-D_GLIBCXX_ASSERTIONS` compiler flag. This flag only has an effect on libstdc++ targets, and when defined, enables extra error checking in the form of precondition assertions, such as bounds checking in c++ strings and null pointer checks when dereferencing c++ smart pointers.
+
+These checks may have an impact on performance in some cases.
+
 #### `pacret` {#pacret}
 
 This flag adds the `-mbranch-protection=pac-ret` compiler option on aarch64-linux targets. This uses ARM v8.3's Pointer Authentication feature to sign function return pointers before adding them to the stack. The pointer's authenticity is then validated before returning to its destination. This dramatically increases the difficulty of ROP exploitation techniques.

lib/licenses.nix

···
       free = false;
     };
 
+    adobeUtopia = {
+      fullName = "Adobe Utopia Font License";
+      spdxId = "Adobe-Utopia";
+    };
+
     afl20 = {
       spdxId = "AFL-2.0";
       fullName = "Academic Free License v2.0";
···
     hpndSellVariant = {
       fullName = "Historical Permission Notice and Disclaimer - sell variant";
       spdxId = "HPND-sell-variant";
+    };
+
+    hpndDec = {
+      fullName = "Historical Permission Notice and Disclaimer - DEC variant";
+      spdxId = "HPND-DEC";
     };
 
     hpndDoc = {

nixos/modules/config/console.nix

···
             "${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
             "${config.boot.initrd.systemd.package.kbd}/bin/setfont"
             "${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
-            "${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # Fonts and keyboard layouts are compressed
           ]
           ++ lib.optionals (cfg.font != null && lib.hasPrefix builtins.storeDir cfg.font) [
             "${cfg.font}"

nixos/tests/sssd-ldap.nix

···
               objectClass: posixAccount
               userPassword: ${testPassword}
               homeDirectory: /home/${testUser}
+              loginShell: /run/current-system/sw/bin/bash
               uidNumber: 1234
               gidNumber: 1234
               cn: ""

pkgs/applications/audio/mpg123/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.0";
+  version = "1.33.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-IpDjrt5vTRY+GhdFIWWvM8qtS18JSPmUKc+i2Dhfqp0=";
+    hash = "sha256-LFT6u/ppbc6PmxN8jvekKaBh+P5jPNfQpRGAmFXywhk=";
   };
 
   outputs = [

pkgs/applications/editors/vim/common.nix

···
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1566";
+  version = "9.1.1623";
 
   outputs = [
     "out"
···
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-/hzyjFGjl8Wu9tHtFgnnHtGbcJ5AIjCMUNCScrdIgwU=";
+    hash = "sha256-T7epi6ex9AU4iV/ClSeKlK3T0V0WajiVxnDVevkqaw8=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/networking/sync/rsync/default.nix

···
     hash = "sha256-KSS8s6Hti1UfwQH3QLnw/gogKxFQJ2R89phQ1l/YjFI=";
   };
 
+  patches = [
+    # See: <https://github.com/RsyncProject/rsync/pull/790>
+    ./fix-tests-in-darwin-sandbox.patch
+  ];
+
   nativeBuildInputs = [
     updateAutotoolsGnuConfigScriptsHook
     perl
···
   passthru.tests = { inherit (nixosTests) rsyncd; };
 
   doCheck = true;
+
+  __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
     description = "Fast incremental file transfer utility";

pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch

···
+From 9b104ed9859f17b6ed4c4ad01806c75a0c197dd7 Mon Sep 17 00:00:00 2001
+From: Emily <[e-mail]>
+Date: Tue, 5 Aug 2025 15:55:24 +0100
+Subject: [PATCH] Allow `ls(1)` to fail in test setup
+
+This can happen when the tests are unable to `stat(2)` some files in
+`/etc`, `/bin`, or `/`, due to Unix permissions or other sandboxing. We
+still guard against serious errors, which use exit code 2.
+---
+ testsuite/longdir.test | 4 ++--
+ testsuite/rsync.fns    | 8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/testsuite/longdir.test b/testsuite/longdir.test
+index 8d66bb5f..26747292 100644
+--- a/testsuite/longdir.test
++++ b/testsuite/longdir.test
+@@ -16,9 +16,9 @@ makepath "$longdir" || test_skipped "unable to create long directory"
+ touch "$longdir/1" || test_skipped "unable to create files in long directory"
+ date > "$longdir/1"
+ if [ -r /etc ]; then
+-    ls -la /etc >"$longdir/2"
++    ls -la /etc >"$longdir/2" || [ $? -eq 1 ]
+ else
+-    ls -la / >"$longdir/2"
++    ls -la / >"$longdir/2" || [ $? -eq 1 ]
+ fi
+ checkit "$RSYNC --delete -avH '$fromdir/' '$todir'" "$fromdir/" "$todir"
+ 
+diff --git a/testsuite/rsync.fns b/testsuite/rsync.fns
+index 2ab97b69..f7da363f 100644
+--- a/testsuite/rsync.fns
++++ b/testsuite/rsync.fns
+@@ -195,15 +195,15 @@ hands_setup() {
+     echo some data > "$fromdir/dir/subdir/foobar.baz"
+     mkdir "$fromdir/dir/subdir/subsubdir"
+     if [ -r /etc ]; then
+-	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
++	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
+     else
+-	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
++	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
+     fi
+     mkdir "$fromdir/dir/subdir/subsubdir2"
+     if [ -r /bin ]; then
+-	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
++	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
+     else
+-	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
++	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
+     fi
+ 
+ #      echo testing head:
+-- 
+2.50.1
+

pkgs/applications/version-management/git/default.nix

···
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.50.1";
+  version = "2.51.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [
     CGI
···
         }.tar.xz"
       else
         "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-fj5sNt7L2PHu3RTULbZnS+A2ccIgSGS++ipBdWxcj8Q=";
+    hash = "sha256-YKfCJRzC5YjVzYe65WcmBhfG3gwi3KnNv8TH0riZC2I=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
···
     # Fix references to gettext introduced by ./git-sh-i18n.patch
     substituteInPlace git-sh-i18n.sh \
         --subst-var-by gettext ${gettext}
+    substituteInPlace contrib/credential/libsecret/Makefile \
+        --replace-fail 'pkg-config' "$PKG_CONFIG"
   ''
   + lib.optionalString doInstallCheck ''
     # ensure we are using the correct shell when executing the test scripts
···
     cp -a contrib $out/share/git/
     mkdir -p $out/share/bash-completion/completions
     ln -s $out/share/git/contrib/completion/git-prompt.sh $out/share/bash-completion/completions/
-    # only readme, developed in another repo
-    rm -r contrib/hooks/multimail
-    mkdir -p $out/share/git-core/contrib
-    cp -a contrib/hooks/ $out/share/git-core/contrib/
-    substituteInPlace $out/share/git-core/contrib/hooks/pre-auto-gc-battery \
-      --replace ' grep' ' ${gnugrep}/bin/grep' \
 
     # grep is a runtime dependency, need to patch so that it's found
     substituteInPlace $out/libexec/git-core/git-sh-setup \

pkgs/applications/version-management/git/git-send-email-honor-PATH.patch

···
 diff --git a/Documentation/git-send-email.adoc b/Documentation/git-send-email.adoc
-index 7f223db42d..7e46a07d31 100644
+index 5d13a856a7..5c9978c1e4 100644
 --- a/Documentation/git-send-email.adoc
 +++ b/Documentation/git-send-email.adoc
-@@ -177,7 +177,7 @@ Sending
+@@ -190,7 +190,7 @@ Sending
  	The command will be executed in the shell if necessary.  Default
  	is the value of `sendemail.sendmailCmd`.  If unspecified, and if
- 	--smtp-server is also unspecified, git-send-email will search
--	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH.
-+	for `sendmail` in $PATH.
+ 	`--smtp-server` is also unspecified, `git send-email` will search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and `$PATH`.
++	for `sendmail` in `$PATH`.
  
  --smtp-encryption=<encryption>::
  	Specify in what way encrypting begins for the SMTP connection.
-@@ -233,9 +233,9 @@ a password is obtained using 'git-credential'.
- --smtp-server=<host>::
+@@ -247,7 +247,7 @@ a password is obtained using linkgit:git-credential[1].
  	If set, specifies the outgoing SMTP server to use (e.g.
  	`smtp.example.com` or a raw IP address).  If unspecified, and if
--	`--sendmail-cmd` is also unspecified, the default is to search
--	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH if such a
--	program is available, falling back to `localhost` otherwise.
-+	`--sendmail-cmd` is also unspecified, the default is to search for
-+	`sendmail` in $PATH if such a program is available, falling back to
-+	`localhost` otherwise.
+ 	`--sendmail-cmd` is also unspecified, the default is to search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and `$PATH` if such a
++	for `sendmail` in `$PATH` if such a
+ 	program is available, falling back to `localhost` otherwise.
  +
  For backward compatibility, this option can also specify a full pathname
- of a sendmail-like program instead; the program must support the `-i`
 diff --git a/git-send-email.perl b/git-send-email.perl
 index 798d59b84f..69c9cc2a7d 100755
 --- a/git-send-email.perl

pkgs/build-support/build-mozilla-mach/default.nix

···
       (
         if (lib.versionAtLeast version "143") then
           nss_latest
-        else if (lib.versionAtLeast version "129") then
+        else if (lib.versionAtLeast version "141") then
           nss_3_114
         else
-          nss_esr # 3.90
+          nss_esr
       )
     ]
     ++ lib.optional alsaSupport alsa-lib

pkgs/build-support/cc-wrapper/add-hardening.sh

···
 
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pie pic strictoverflow format trivialautovarinit zerocallusedregs)
+  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pie pic strictoverflow glibcxxassertions format trivialautovarinit zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
···
     pacret)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pacret >&2; fi
       hardeningCFlagsBefore+=('-mbranch-protection=pac-ret')
+      ;;
+    glibcxxassertions)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling glibcxxassertions >&2; fi
+      hardeningCFlagsBefore+=('-D_GLIBCXX_ASSERTIONS')
       ;;
     stackprotector)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi

pkgs/build-support/go/module.nix

···
       # Go build flags.
       GOFLAGS ? [ ],
 
+      # Instead of building binary targets with 'go install', build test binaries with 'go test'.
+      # The binaries found in $out/bin can be executed as go tests outside of the sandbox.
+      # This is mostly useful outside of nixpkgs, for example to build integration/e2e tests
+      # that won't run within the sandbox.
+      buildTestBinaries ? false,
+
       ...
     }@args:
     {
···
                   export NIX_BUILD_CORES=1
               fi
               for pkg in $(getGoDirs ""); do
-                echo "Building subPackage $pkg"
-                buildGoDir install "$pkg"
+                ${
+                  if buildTestBinaries then
+                    ''
+                      echo "Building test binary for $pkg"
+                      buildGoDir "test -c -o $GOPATH/bin/" "$pkg"
+                    ''
+                  else
+                    ''
+                      echo "Building subPackage $pkg"
+                      buildGoDir install "$pkg"
+                    ''
+                }
               done
             ''
           + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
···
           ''
         );
 
-      doCheck = args.doCheck or true;
+      doCheck = args.doCheck or (!buildTestBinaries);
       checkPhase =
         args.checkPhase or ''
           runHook preCheck

pkgs/build-support/go/tests.nix

···
+{
+  lib,
+  callPackage,
+}:
+
+lib.packagesFromDirectoryRecursive {
+  inherit callPackage;
+  directory = ./tests;
+}

pkgs/build-support/go/tests/build-test-binaries/go.mod

···
+module build-test-binaries
+
+go 1.24

pkgs/build-support/go/tests/build-test-binaries/main_test.go

···
+package main
+
+import "testing"
+
+func TestHelloFromTest(t *testing.T) {
+	t.Log("Hello from test")
+}

pkgs/build-support/go/tests/build-test-binaries/package.nix

···
+{
+  buildGoModule,
+  runCommandCC,
+}:
+
+let
+  testPackage = buildGoModule {
+    name = "build-test-binaries";
+    src = ./.;
+    vendorHash = null;
+    buildTestBinaries = true;
+  };
+in
+
+runCommandCC "build-test-binaries-check"
+  {
+    nativeBuildInputs = [ testPackage ];
+    passthru = { inherit testPackage; };
+  }
+  ''
+    fail() {
+      echo "Test failed: $1" >&2
+      exit 1
+    }
+
+    command -v build-test-binaries.test ||
+      fail "build-test-binaries.test not found in PATH"
+
+    build-test-binaries.test -test.v | tee $out ||
+      fail "build-test-binaries.test failed"
+
+    grep -q "Hello from test" $out ||
+      fail "Output does not contain expected string"
+  ''

pkgs/build-support/make-desktopitem/default.nix

···
 
   `attrs`
 
-  : An AttrSet with the following definitions. See https://specifications.freedesktop.org/desktop-entry-spec/1.4/recognized-keys.html#id-1.7.6 for definitions.
+  : An AttrSet with the following definitions. See https://specifications.freedesktop.org/desktop-entry-spec/1.5/recognized-keys.html#id-1.7.6 for definitions.
 
     - `name` (string): The name of the desktop file (excluding the .desktop or .directory file extensions)
     - `destination` (string): The directory that will contain the desktop entry file (Default: "/share/applications")
···
     - `startupNotify` (bool): The `StartupNotify` of the desktop entry
     - `startupWMClass` (string): The `StartupWMClass` of the desktop entry
     - `url` (string): The `URL` of the Link-type desktop entry
-    - `prefersNonDefaultGPU` (bool): The `PrefersNonDefaultGPU` (non-standard) of the desktop entry
+    - `prefersNonDefaultGPU` (bool): The `PrefersNonDefaultGPU` of the desktop entry
+    - `singleMainWindow` (bool): The `SingleMainWindow` of the desktop entry
     - `extraConfig` (AttrSet): Additional values to be added literally to the final item, e.g. vendor extensions
 
   # Output
···
 
   # Developer Note
 
-  All possible values are as defined by the spec, version 1.4.
+  All possible values are as defined by the spec, version 1.5.
   Please keep in spec order for easier maintenance.
   When adding a new value, don't forget to update the Version field below!
   See https://specifications.freedesktop.org/desktop-entry-spec/latest
···
     startupWMClass ? null,
     url ? null,
     prefersNonDefaultGPU ? null,
-    # not supported until version 1.5, which is not supported by our desktop-file-utils as of 2022-02-23
-    # singleMainWindow ? null,
+    singleMainWindow ? null,
     extraConfig ? { }, # Additional values to be added literally to the final item, e.g. vendor extensions
   }:
   let
···
     # Please keep in spec order.
     mainSection = {
       "Type" = type;
-      "Version" = "1.4";
+      "Version" = "1.5";
       "Name" = desktopName;
       "GenericName" = genericName;
       "NoDisplay" = boolOrNullToString noDisplay;
···
       "StartupWMClass" = startupWMClass;
       "URL" = url;
       "PrefersNonDefaultGPU" = boolOrNullToString prefersNonDefaultGPU;
-      # "SingleMainWindow" = boolOrNullToString singleMainWindow;
+      "SingleMainWindow" = boolOrNullToString singleMainWindow;
     }
     // extraConfig;
 

pkgs/build-support/rust/hooks/cargo-build-hook.sh

···
 
     local flagsArray=(
         "-j" "$NIX_BUILD_CORES"
-        "--target" "@rustcTarget@"
+        "--target" "@rustcTargetSpec@"
         "--offline"
     )
 

pkgs/build-support/rust/hooks/cargo-check-hook.sh

···
     fi
 
     flagsArray+=(
-        "--target" "@rustcTarget@"
+        "--target" "@rustcTargetSpec@"
         "--offline"
     )
 

pkgs/build-support/rust/hooks/cargo-nextest-hook.sh

···
     fi
 
     local flagsArray=(
-        "--target" "@rustcTarget@"
+        "--target" "@rustcTargetSpec@"
         "--offline"
     )
 

pkgs/build-support/rust/hooks/default.nix

···
   cargoBuildHook = makeSetupHook {
     name = "cargo-build-hook.sh";
     substitutions = {
-      inherit (stdenv.targetPlatform.rust) rustcTarget;
+      inherit (stdenv.targetPlatform.rust) rustcTargetSpec;
       inherit (rust.envVars) setEnv;
 
     };
···
   cargoCheckHook = makeSetupHook {
     name = "cargo-check-hook.sh";
     substitutions = {
-      inherit (stdenv.targetPlatform.rust) rustcTarget;
+      inherit (stdenv.targetPlatform.rust) rustcTargetSpec;
       inherit (rust.envVars) setEnv;
     };
     passthru.tests = {
···
     name = "cargo-nextest-hook.sh";
     propagatedBuildInputs = [ cargo-nextest ];
     substitutions = {
-      inherit (stdenv.targetPlatform.rust) rustcTarget;
+      inherit (stdenv.targetPlatform.rust) rustcTargetSpec;
     };
     passthru.tests = {
       test = tests.rust-hooks.cargoNextestHook;
···
       pkgsHostTarget.rustc
     ];
     substitutions = {
-      inherit (stdenv.targetPlatform.rust) rustcTarget;
+      inherit (stdenv.targetPlatform.rust) rustcTargetSpec;
       inherit (rust.envVars) setEnv;
 
     };

pkgs/build-support/rust/hooks/maturin-build-hook.sh

···
     local flagsArray=(
         "--jobs=$NIX_BUILD_CORES"
         "--offline"
-        "--target" "@rustcTarget@"
+        "--target" "@rustcTargetSpec@"
         "--manylinux" "off"
         "--strip"
         "--release"

pkgs/build-support/setup-hooks/compress-man-pages.sh

···
     # Compress all uncompressed manpages.  Don't follow symlinks, etc.
     # gzip -f is needed to not error out on hard links.
     find "$dir"/share/man/ -type f -a '!' -regex '.*\.\(bz2\|gz\|xz\)$' -print0 \
-        | xargs -0 -n1 -P "$NIX_BUILD_CORES" gzip -f
+        | xargs -0 -n1 -P "$NIX_BUILD_CORES" gzip -n -f
 
     # Point symlinks to compressed manpages.
     find "$dir"/share/man/ -type l -a '!' -regex '.*\.\(bz2\|gz\|xz\)$' -print0 \

pkgs/build-support/testers/expect-failure.sh

···
 #
 # NOTE: This MUST be done after the original builder has finished!
 #       Otherwise we could pollute its environment.
-if [ -e "${NIX_ATTRS_SH_FILE:-}" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
+if [ -e "${NIX_ATTRS_SH_FILE:-}" ]; then . "$NIX_ATTRS_SH_FILE"; fi
 
 # Variables injected by replaceVars
 #

pkgs/by-name/an/anvil-editor/package.nix

···
 {
   lib,
   stdenv,
-  buildGo123Module,
+  buildGoModule,
   fetchzip,
   pkg-config,
   copyDesktopItems,
···
   buildPackages,
 }:
 
-buildGo123Module (finalAttrs: {
+buildGoModule (finalAttrs: {
   pname = "anvil-editor";
   version = "0.6";
 
···
 
   vendorHash = "sha256-1oFBV7D7JgOt5yYAxVvC4vL4ccFv3JrNngZbo+5pzrk=";
 
-  anvilExtras = buildGo123Module {
+  anvilExtras = buildGoModule {
     pname = "anvil-editor-extras";
     inherit (finalAttrs) version src meta;
     vendorHash = "sha256-4pfk5XuwDbCWFZIF+1l+dy8NfnGNjgHmSg9y6/RnTSo=";
···
     vulkan-headers
     libGL
     xorg.libX11
+    xorg.libxcb
     xorg.libXcursor
     xorg.libXfixes
   ];
···
     mainProgram = "anvil";
     maintainers = with lib.maintainers; [ aleksana ];
     platforms = with lib.platforms; unix ++ windows;
+    # Doesn't build with >buildGo123Module.
+    # Multiple errors like the following:
+    # '> vendor/gioui.org/internal/vk/vulkan.go:1916:9: cannot define new methods on non-local type SurfaceCapabilities'
+    broken = true;
   };
 })

pkgs/by-name/ar/arpa2common/package.nix

···
   graphviz,
   libsodium,
   lmdb,
-  openssl,
+  krb5,
   pkg-config,
   ragel,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "arpa2common";
-  version = "2.6.2";
+  version = "2.6.4";
 
   src = fetchFromGitLab {
     owner = "arpa2";
     repo = "arpa2common";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-eWfWaO6URCK2FWQ+NYAoeCONkovgsVDPSRQVCGFnW3s=";
+    hash = "sha256-qqdc+eYLnYQs2Q7sk0D5Trr1GbRTmV1w4sZiVwFwfMw=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.com/arpa2/arpa2common/-/commit/13ea82df60b87a5367db00a8c6f3502e8ecb7298.patch";
-      hash = "sha256-V9Dhr6PeArqXnuXmFuDjcirlGl7xovq7VQZsrbbMFSk=";
-    })
-  ];
+  postPatch = ''
+    sed '1i#include <stddef.h>' -i lib/identity/identity.rl
+  '';
 
   nativeBuildInputs = [
     cmake
···
     e2fsprogs
     libsodium
     lmdb
-    openssl
     ragel
+  ];
+
+  buildInputs = [
+    krb5
   ];
 
   meta = {

pkgs/by-name/ar/arrow-cpp/package.nix

···
   openssl,
   perl,
   pkg-config,
-  protobuf,
+  protobuf_31,
   python3,
   rapidjson,
   re2,
···
     libbacktrace
     lz4
     nlohmann_json # alternative JSON parser to rapidjson
-    protobuf # substrait requires protobuf
+    protobuf_31 # substrait requires protobuf
     rapidjson
     re2
     snappy
···
   ++ lib.optionals enableFlight [
     grpc
     openssl
-    protobuf
+    protobuf_31
     sqlite
   ]
   ++ lib.optionals enableS3 [
···
     LZ4_ROOT = lz4;
     ZSTD_ROOT = zstd.dev;
   };
+
+  # fails tests on glibc with this enabled
+  hardeningDisable = [ "glibcxxassertions" ];
 
   preConfigure = ''
     patchShebangs build-support/

pkgs/by-name/at/at-spi2-core/package.nix

···
   libXi,
   libXext,
   gnome,
-  systemd,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemdLibs,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
 }:
 
 stdenv.mkDerivation rec {
···
   ]
   ++ lib.optionals systemdSupport [
     # libsystemd is a needed for dbus-broker support
-    systemd
+    systemdLibs
   ];
 
   # In atspi-2.pc dbus-1 glib-2.0

pkgs/by-name/at/atf/package.nix

···
     kyua
   ];
 
+  # Don’t install the test programs for ATF itself; they’re useless
+  # other than as part of the `installCheckPhase`, and they contain
+  # non‐reproducible references to the build directory.
+  postInstall = ''
+    rm -r $out/tests
+  '';
+
   installCheckPhase = ''
     runHook preInstallCheck
     HOME=$TMPDIR PATH=$out/bin:$PATH kyua test

pkgs/by-name/au/audiofile/package.nix

···
     }:
     fetchpatch {
       inherit sha256 name;
-      url = "https://salsa.debian.org/multimedia-team/audiofile/raw/debian/0.3.6-4/debian/patches/${debname}";
+      url = "https://salsa.debian.org/multimedia-team/audiofile/raw/debian/0.3.6-7/debian/patches/${debname}";
     };
 
 in
···
       name = "CVE-2017-6833.patch";
       debname = "10_Check-for-division-by-zero-in-BlockCodec-runPull.patch";
       sha256 = "1rlislkjawq98bbcf1dgl741zd508wwsg85r37ca7pfdf6wgl6z7";
+    })
+    (fetchDebianPatch {
+      name = "CVE-2018-13440.patch";
+      debname = "11_CVE-2018-13440.patch";
+      sha256 = "sha256-qDfjiBJ4QXgn8588Ra1X0ViH0jBjtFS/+2zEGIUIhuo=";
+    })
+    (fetchDebianPatch {
+      name = "CVE-2018-17095.patch";
+      debname = "12_CVE-2018-17095.patch";
+      sha256 = "sha256-FC89EFZuRLcj5x4wZVqUlitEMTRPSZk+qzQpIoVk9xY=";
+    })
+    (fetchDebianPatch {
+      name = "CVE-2022-24599.patch";
+      debname = "0013-Fix-CVE-2022-24599.patch";
+      sha256 = "sha256-DHJQ4B6cvKfSlXy66ZC5RNaCMDaygj8dWLZZhJnhw1E=";
+    })
+    (fetchDebianPatch {
+      name = "1_CVE-2019-13147.patch";
+      debname = "0014-Partial-fix-of-CVE-2019-13147.patch";
+      sha256 = "sha256-clb/XiIZbmttPr2dT9AZsbQ97W6lwifEwMO4l2ZEh0k=";
+    })
+    (fetchDebianPatch {
+      name = "2_CVE-2019-13147.patch";
+      debname = "0015-Partial-fix-of-CVE-2019-13147.patch";
+      sha256 = "sha256-JOZIw962ae7ynnjJXGO29i8tuU5Dhk67DmB0o5/vSf4=";
     })
   ];
 

pkgs/by-name/av/avalanchego/package.nix

···
 {
-  buildGo123Module,
+  buildGoModule,
   fetchFromGitHub,
   lib,
   nix-update-script,
 }:
 
-buildGo123Module (finalAttrs: {
+buildGoModule (finalAttrs: {
   pname = "avalanchego";
   version = "1.13.2";
 

pkgs/by-name/az/azahar/package.nix

···
     pipewire
     qt6.qtwayland
     xorg.libX11
+    xorg.libxcb
     xorg.libXext
   ]
   ++ optionals stdenv.hostPlatform.isDarwin [

pkgs/by-name/ba/bash-completion/package.nix

···
     hash = "sha256-M2m9XkGKdfuZCGOSWu1bQgOYrOuzIOxMAwaz6uI/EHo=";
   };
 
+  postPatch = ''
+    # fix `mount -t` tab completion
+    substituteInPlace bash_completion \
+      --replace-fail "/lib/modules" "/run/booted-system/kernel-modules/lib/modules"
+  '';
+
   strictDeps = true;
   nativeBuildInputs = [ autoreconfHook ];
 

pkgs/by-name/bl/bluez-headers/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+# This package only provides the bluetooth headers from the bluez package
+# for consumption in Python, which cannot consume bluez.dev due to multiple
+# infinite recursion paths.
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bluez-headers";
+  version = "5.83";
+
+  # This package has the source, because of the emulatorAvailable check in the
+  # bluez function args, that causes an infinite recursion with Python on cross
+  # builds.
+  src = fetchurl {
+    url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
+    hash = "sha256-EIUi2QnSIFgTmb/sk9qrYgNVOc7vPdo+eZcHhcY70kw=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/include/bluetooth
+    cp -v lib/*.h "$out/include/bluetooth/"
+  '';
+
+  meta = {
+    homepage = "https://www.bluez.org/";
+    description = "Official Linux Bluetooth protocol stack";
+    changelog = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog?h=${finalAttrs.version}";
+    license = with lib.licenses; [
+      bsd2
+      gpl2Plus
+      lgpl21Plus
+      mit
+    ];
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/bl/bluez/package.nix

···
   stdenv,
   alsa-lib,
   autoreconfHook,
+  bluez-headers,
   dbus,
   docutils,
   ell,
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez";
-  version = "5.83";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EIUi2QnSIFgTmb/sk9qrYgNVOc7vPdo+eZcHhcY70kw=";
-  };
+  inherit (bluez-headers) version src;
 
   patches = [
     (fetchurl {
···
   };
 
   meta = {
-    homepage = "https://www.bluez.org/";
-    description = "Official Linux Bluetooth protocol stack";
-    changelog = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog?h=${finalAttrs.version}";
-    license = with lib.licenses; [
-      bsd2
-      gpl2Plus
-      lgpl21Plus
-      mit
-    ];
     mainProgram = "btinfo";
-    maintainers = with lib.maintainers; [ ];
-    platforms = lib.platforms.linux;
+    inherit (bluez-headers.meta)
+      changelog
+      description
+      homepage
+      license
+      maintainers
+      platforms
+      ;
   };
 })

pkgs/by-name/bm/bmake/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bmake";
-  version = "20250707";
+  version = "20250804";
 
   src = fetchurl {
     url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-phJApAZdkMOSXdd0+Po9c97sGnMiiobulfzYIGPSiwg=";
+    hash = "sha256-C0kDdkSyUyBtLnENRuMoWeYt/ixsjnIYrkOfLvUN6K0=";
   };
 
   patches = [

pkgs/by-name/bp/bpftools/include-asm-types-for-powerpc64.patch

···
+diff '--color=auto' -ruN a/tools/include/uapi/linux/types.h b/tools/include/uapi/linux/types.h
+--- a/tools/include/uapi/linux/types.h	2025-05-18 06:26:10.000000000 +0000
++++ b/tools/include/uapi/linux/types.h	2025-07-04 08:00:39.772748792 +0000
+@@ -2,7 +2,7 @@
+ #ifndef _UAPI_LINUX_TYPES_H
+ #define _UAPI_LINUX_TYPES_H
+ 
+-#include <asm-generic/int-ll64.h>
++#include <asm/types.h>
+ 
+ /* copied from linux:include/uapi/linux/types.h */
+ #define __bitwise

pkgs/by-name/bp/bpftools/package.nix

···
 
   separateDebugInfo = true;
 
+  patches = [
+    # fix unknown type name '__vector128' on powerpc64*
+    # https://www.spinics.net/lists/bpf/msg28613.html
+    ./include-asm-types-for-powerpc64.patch
+  ];
+
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [
     python3

pkgs/by-name/bt/btrfs-progs/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.15";
+  version = "6.16";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-V9pCjdIZn9iNg+zxytBWeM54ZA735S12M76Yh872dLs=";
+    hash = "sha256-Makw+HN8JhioJK1L0f3YP1QQPg6qFaqtxIT/rjNGb8U=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bu/bubblewrap/package.nix

···
     hash = "sha256-8IDMLQPeO576N1lizVudXUmTV6hNOiowjzRpEWBsZ+U=";
   };
 
+  outputs = [
+    "out"
+    "dev"
+  ];
+
   postPatch = ''
     substituteInPlace tests/libtest.sh \
       --replace "/var/tmp" "$TMPDIR"

pkgs/by-name/ca/cacert/package.nix

···
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  srcVersion = "3.114";
+  srcVersion = "3.115";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
···
           owner = "nss-dev";
           repo = "nss";
           rev = "NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM";
-          hash = "sha256-YVtXk1U9JtqfOH7+m/+bUI/yXJcydqjjGbCy/5xbMe8=";
+          hash = "sha256-8PeFeaIOtjBZJLBx3ONwZlK5SaLnjKEFoZWvVsu/3tA=";
         };
 
     dontBuild = true;

pkgs/by-name/ca/cargo-c/package.nix

···
 
 let
   # this version may need to be updated along with package version
-  cargoVersion = "0.89.0";
+  cargoVersion = "0.90.0";
 in
 rustPlatform.buildRustPackage rec {
   pname = "cargo-c";
-  version = "0.10.14";
+  version = "0.10.15";
 
   src = fetchCrate {
     inherit pname;
     version = "${version}+cargo-${cargoVersion}";
-    hash = "sha256-t6cbufPdpyaFzwEFWt19Nid2S5FXCJCS+SHJ0aJICX0=";
+    hash = "sha256-szqDSHGihE+Oj8L3EBlC5XH4kSBYOptd0Xtk3MhXooQ=";
   };
 
-  cargoHash = "sha256-nW+akmbpIGZnhJLBdwDAGI4m5eSwdT2Z/iY2RV4zMQY=";
+  cargoHash = "sha256-36ygs/EhCktG1jmBnP9c7EgnfcWnGrqqcW3qAw+Yfy4=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ce/certinfo/package.nix

···
 {
   stdenv,
   lib,
-  buildGo123Module,
+  buildGoModule,
   fetchFromGitHub,
   libX11,
 }:
 
-buildGo123Module rec {
+buildGoModule rec {
   pname = "certinfo";
   version = "1.0.24";
 

pkgs/by-name/cr/cryptsetup/package.nix

···
   rebuildMan ? false,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cryptsetup";
-  version = "2.8.0";
+  version = "2.8.1";
 
   outputs = [
     "bin"
···
   separateDebugInfo = true;
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-zJ4tN8JahxzqN1ILKNUyIHsMFnD7EPxU1oBx9j9SQ6I=";
+    url =
+      "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor finalAttrs.version}/"
+      + "cryptsetup-${finalAttrs.version}.tar.xz";
+    hash = "sha256-LDN563ZZfcq1CRFEmwE+JpfEv/zHFtu/DZsOj7u0b7Q=";
   };
 
   patches = [
···
   meta = {
     homepage = "https://gitlab.com/cryptsetup/cryptsetup/";
     description = "LUKS for dm-crypt";
-    changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${version}/docs/v${version}-ReleaseNotes";
+    changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${finalAttrs.version}/docs/v${finalAttrs.version}-ReleaseNotes";
     license = lib.licenses.gpl2Plus;
     mainProgram = "cryptsetup";
     maintainers = with lib.maintainers; [
···
     ];
     platforms = with lib.platforms; linux;
   };
-}
+})

pkgs/by-name/e2/e2fsprogs/package.nix

···
   e2fsprogs,
   runCommand,
   libarchive,
+  bash,
+  bashNonInteractive,
 }:
 
 stdenv.mkDerivation rec {
   pname = "e2fsprogs";
   version = "1.47.3";
+
+  __structuredAttrs = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/tytso/e2fsprogs/v${version}/e2fsprogs-${version}.tar.xz";
···
     "out"
     "man"
     "info"
+    "scripts"
   ]
   ++ lib.optionals withFuse [ "fuse2fs" ];
+
+  strictDeps = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [
···
     libuuid
     gettext
     libarchive
+    bash
   ]
   ++ lib.optionals withFuse [ fuse3 ];
 
···
     if [ -f $out/lib/${pname}/e2scrub_all_cron ]; then
       mv $out/lib/${pname}/e2scrub_all_cron $bin/bin/
     fi
+
+    moveToOutput bin/mk_cmds "$scripts"
+    moveToOutput bin/compile_et "$scripts"
+    moveToOutput sbin/e2scrub "$scripts"
+    moveToOutput sbin/e2scrub_all "$scripts"
   ''
   + lib.optionalString withFuse ''
     mkdir -p $fuse2fs/bin
···
   '';
 
   enableParallelBuilding = true;
+
+  # non-glibc gettext has issues with this
+  outputChecks = lib.optionalAttrs stdenv.hostPlatform.isGnu {
+    bin.disallowedRequisites = [
+      bash
+      bashNonInteractive
+    ];
+    out.disallowedRequisites = [
+      bash
+      bashNonInteractive
+    ];
+  };
 
   passthru.tests = {
     simple-filesystem = runCommand "e2fsprogs-create-fs" { } ''

pkgs/by-name/es/espanso/package.nix

···
   extra-cmake-modules,
   dbus,
   libX11,
+  libxcb,
   libXi,
   libXtst,
   libnotify,
···
     libXi
     libXtst
     libX11
+    libxcb
     xclip
     xdotool
   ];

pkgs/by-name/fl/flac/package.nix

···
 {
   cmake,
   doxygen,
-  fetchFromGitHub,
+  fetchurl,
   graphviz,
   lib,
   libogg,
···
   pkg-config,
   stdenv,
   versionCheckHook,
-  enableManpages ? buildPackages.pandoc.compiler.bootstrapAvailable,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "flac";
   version = "1.5.0";
 
-  src = fetchFromGitHub {
-    owner = "xiph";
-    repo = "flac";
-    tag = finalAttrs.version;
-    hash = "sha256-B6XRai5UOAtY/7JXNbI3YuBgazi1Xd2ZOs6vvLq9LIs=";
+  # Building from tarball instead of GitHub to include pre-built manpages.
+  # This prevents huge numbers of rebuilds for pandoc / haskell-updates.
+  # It also enables manpages for platforms where pandoc is not available.
+  src = fetchurl {
+    url = "http://downloads.xiph.org/releases/flac/flac-${finalAttrs.version}.tar.xz";
+    hash = "sha256-8sHHZZKoL//4QTujxKEpm2x6sGxzTe4D/YhjBIXCuSA=";
   };
 
   hardeningDisable = [ "trivialautovarinit" ];
···
     doxygen
     graphviz
     pkg-config
-  ]
-  ++ lib.optional enableManpages buildPackages.pandoc;
+  ];
 
   buildInputs = [ libogg ];
 
-  cmakeFlags =
-    lib.optionals (!stdenv.hostPlatform.isStatic) [
-      "-DBUILD_SHARED_LIBS=ON"
-    ]
-    ++ lib.optionals (!enableManpages) [
-      "-DINSTALL_MANPAGES=OFF"
-    ];
+  cmakeFlags = lib.optionals (!stdenv.hostPlatform.isStatic) [
+    "-DBUILD_SHARED_LIBS=ON"
+  ];
 
   CFLAGS = [
     "-O3"
···
     "dev"
     "doc"
     "out"
-  ]
-  ++ lib.optionals enableManpages [
     "man"
   ];
 

pkgs/by-name/fl/fluidsynth/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.4.6";
+  version = "2.4.7";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hy2kWJmvvmItXl05Nw9gWEYpoDg+NtP2veO2vZ00QhI=";
+    hash = "sha256-z7DIX8KpPdtEHEMoxH7ewW32aXm27gfmWPZawwITyRQ=";
   };
 
   outputs = [

pkgs/by-name/fo/font-adobe-100dpi/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-100dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-tnr/RF4FYyjVP5cy05iE9V3Y0wP8Ja89u6M6i6NanM8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-100dpi";
+    license = lib.licenses.hpndSellVariant; # plus a trademark that doesn't change the license
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fo/font-adobe-75dpi/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-75dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-EoGmLb7e0WnklcrhpbSH4fM28rTZcdkpEcWcEDmZuRE=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-75dpi";
+    license = lib.licenses.hpndSellVariant; # plus a trademark that doesn't change the license
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fo/font-adobe-utopia-100dpi/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-utopia-100dpi";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-utopia-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-+4TsKXqQaXNUjKWbfG2uqtISRL7F0/sefJPfXvQ7Aks=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe Utopia 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-utopia-100dpi";
+    license = lib.licenses.adobeUtopia;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fo/font-adobe-utopia-75dpi/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-utopia-75dpi";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-utopia-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-pyYkWTLQck+gxTjJkoEdY9WX5fU5KPQEjpyvViN5d2A=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe Utopia 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-utopia-75dpi";
+    license = lib.licenses.adobeUtopia;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fo/font-adobe-utopia-type1/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-utopia-type1";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-utopia-type1-${finalAttrs.version}.tar.xz";
+    hash = "sha256-TLKAvEdpOwfF4A/Q5a1XIaq+vAVIw/BndOXMPLz3Vpc=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe Utopia PostScript Type 1 fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-utopia-type1";
+    license = lib.licenses.adobeUtopia;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fo/font-bh-ttf/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-ttf";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-ttf-${finalAttrs.version}.tar.xz";
+    hash = "sha256-haX5DQDEjCsG/RJeqK28i47pdCnjB1CByHEJJu/sOlY=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Luxi TrueType fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-ttf";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fo/font-bh-type1/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-type1";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-type1-${finalAttrs.version}.tar.xz";
+    hash = "sha256-Gd7D7Aar3mvt0QCUV56Si+Dw/DvbT76T9MaczkBtcqY=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Luxi PostScript Type 1 fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-type1";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fo/font-encodings/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-encodings";
+  version = "1.1.0";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/encodings-${finalAttrs.version}.tar.xz";
+    hash = "sha256-n/E8YhdWz6EulfMrpIpbI4Oej1d9AEi+2mbGfatN6XU=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname encodings \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Font encoding tables for libfontenc";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/encodings";
+    license = lib.licenses.publicDomain;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fo/font-mutt-misc/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-mutt-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-mutt-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-sSNZ9OEsI7z8tEi5GCl+l1+pG+9Sk9iNPCU0PMdouyQ=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "ClearU pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/mutt-misc";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/fr/froide/package.nix

···
   '';
 
   nativeCheckInputs = with python.pkgs; [
-    (postgresql.withPackages (p: [ p.postgis ])).out
+    (postgresql.withPackages (p: [ p.postgis ]))
     postgresqlTestHook
     pytest-django
     pytest-playwright

pkgs/by-name/ga/gamescope/package.nix

···
     pipewire
     hwdata
     xorg.libX11
+    xorg.libxcb
     wayland
     wayland-protocols
     vulkan-loader

pkgs/by-name/gl/glasskube/package.nix

···
 {
   lib,
-  buildGo124Module,
+  buildGoModule,
   buildNpmPackage,
   fetchFromGitHub,
   nix-update-script,
···
   };
 
 in
-buildGo124Module rec {
+buildGoModule rec {
   inherit version;
   pname = "glasskube";
 

pkgs/by-name/gl/glib/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.84.3";
+  version = "2.84.4";
 
   outputs = [
     "bin"
···
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-qk+HwyJb9XyoXzIIiPdISQGheTTKNwI8O9hDWnLbhj4=";
+    hash = "sha256-ip6hCUPDb8EX4lP4DJHkd7ZzUlrkV2KUKFiu9XYxu5A=";
   };
 
   patches =

pkgs/by-name/go/gossip/package.nix

···
   wayland-scanner,
   nix-update-script,
   libX11,
+  libxcb,
   libXcursor,
   libXi,
   libXrandr,
···
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     wayland
     libX11
+    libxcb
     libXcursor
     libXi
     libXrandr

pkgs/by-name/go/gotraceui/package.nix

···
   buildGoModule,
   libGL,
   libX11,
+  libxcb,
   libXcursor,
   libXfixes,
   libxkbcommon,
···
     libxkbcommon
     wayland
     libX11
+    libxcb
     libXcursor
     libXfixes
     libGL

pkgs/by-name/go/gowitness/package.nix

···
 {
   lib,
-  buildGo123Module,
+  buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
-buildGo123Module rec {
+buildGoModule rec {
   pname = "gowitness";
   version = "3.0.5";
 
···
     "-s"
     "-w"
   ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
 
   meta = with lib; {
     description = "Web screenshot utility";

pkgs/by-name/ic/ico/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libX11,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ico";
+  version = "1.0.6";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/ico-${finalAttrs.version}.tar.xz";
+    hash = "sha256-OPNp1DHnUygP3nD6SJzJTOIE+fjqvS9J/H0yr6afRAU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libX11
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Simple animation program that may be used for testing various X11 operations and extensions";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/ico";
+    license = with lib.licenses; [
+      x11
+      hpnd
+      hpndSellVariant
+    ];
+    mainProgram = "ico";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/im/imath/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "imath";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "imath";
     rev = "v${version}";
-    sha256 = "sha256-tdJh8aRVakdu2zDeGA/0JCCNzdv6s6x55eUpgNJtuI0=";
+    hash = "sha256-O8IpP2MQ7egDbHIiL5TNBygmQCiS6Q/0VSe0LypsM/g=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/in/inih/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "inih";
-  version = "60";
+  version = "61";
 
   src = fetchFromGitHub {
     owner = "benhoyt";
     repo = "inih";
     rev = "r${version}";
-    hash = "sha256-6U6/b7J4dGFwVPw31Vl+BEDrN2ygK43Hb344Uk8NdFs=";
+    hash = "sha256-tSmdd9uAXaRQtnqj0hKuT0wofcZcYjqgPbhtaR+cr84=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/in/installShellFiles/setup-hook.sh

···
 #
 # See comments on each function for more details.
 
-# installManPage <path> [...<path>]
+# installManPage [--name <path>] <path> [...<path>]
 #
 # Each argument is checked for its man section suffix and installed into the appropriate
 # share/man/man<n>/ directory. The function returns an error if any paths don't have the man
 # section suffix (with optional .gz compression).
+#
+# Optionally accepts pipes as input, which when provided require the `--name` argument to
+# name the output file.
+#
+# installManPage --name foobar.1 <($out/bin/foobar --manpage)
 installManPage() {
-    local path
-    for path in "$@"; do
-        if test -z "$path"; then
+    local arg name='' continueParsing=1
+    while { arg=$1; shift; }; do
+        if (( continueParsing )); then
+            case "$arg" in
+              --name)
+                  name=$1
+                  shift || {
+                      nixErrorLog "${FUNCNAME[0]}: --name flag expected an argument"
+                      return 1
+                  }
+                  continue;;
+              --name=*)
+                  # Treat `--name=foo` that same as `--name foo`
+                  name=${arg#--name=}
+                  continue;;
+              --)
+                  continueParsing=0
+                  continue;;
+            esac
+        fi
+
+        nixInfoLog "${FUNCNAME[0]}: installing $arg${name:+ as $name}"
+        local basename
+
+        # Check if path is empty
+        if test -z "$arg"; then
+            # It is an empty string
             nixErrorLog "${FUNCNAME[0]}: path cannot be empty"
             return 1
         fi
-        nixInfoLog "${FUNCNAME[0]}: installing $path"
-        local basename
-        basename=$(stripHash "$path") # use stripHash in case it's a nix store path
+
+        if test -n "$name"; then
+          # Provided name. Required for pipes, optional for paths
+          basename=$name
+        elif test -p "$arg"; then
+            # Named pipe requires a file name
+            nixErrorLog "${FUNCNAME[0]}: named pipe requires --name argument"
+        else
+            # Normal file without a name
+            basename=$(stripHash "$arg") # use stripHash in case it's a nix store path
+        fi
+
+        # Check that it is well-formed
         local trimmed=${basename%.gz} # don't get fooled by compressed manpages
         local suffix=${trimmed##*.}
         if test -z "$suffix" -o "$suffix" = "$trimmed"; then
-            nixErrorLog "${FUNCNAME[0]}: path missing manpage section suffix: $path"
+            nixErrorLog "${FUNCNAME[0]}: path missing manpage section suffix: $arg"
             return 1
         fi
+
+        # Create the out-path
         local outRoot
         if test "$suffix" = 3; then
             outRoot=${!outputDevman:?}
         else
             outRoot=${!outputMan:?}
         fi
-        local outPath="${outRoot}/share/man/man$suffix/$basename"
-        install -D --mode=644 --no-target-directory "$path" "$outPath"
+        local outPath="${outRoot}/share/man/man$suffix/"
+        nixInfoLog "${FUNCNAME[0]}: installing to $outPath"
+
+        # Install
+        if test -p "$arg"; then
+          # install doesn't work with pipes on Darwin
+          mkdir -p "$outPath" && cat "$arg" > "$outPath/$basename"
+        else
+          install -D --mode=644 --no-target-directory -- "$arg" "$outPath/$basename"
+        fi
+
+        # Reset the name for the next page
+        name=
     done
 }
 
 # installShellCompletion [--cmd <name>] ([--bash|--fish|--zsh] [--name <name>] <path>)...
 #
 # Each path is installed into the appropriate directory for shell completions for the given shell.
-# If one of `--bash`, `--fish`, or `--zsh` is given the path is assumed to belong to that shell.
-# Otherwise the file extension will be examined to pick a shell. If the shell is unknown a warning
-# will be logged and the command will return a non-zero status code after processing any remaining
-# paths. Any of the shell flags will affect all subsequent paths (unless another shell flag is
-# given).
+# If one of `--bash`, `--fish`, `--zsh`, or `--nushell` is given the path is assumed to belong to
+# that shell. Otherwise the file extension will be examined to pick a shell. If the shell is
+# unknown a warning will be logged and the command will return a non-zero status code after
+# processing any remaining paths. Any of the shell flags will affect all subsequent paths (unless
+# another shell flag is given).
 #
 # If the shell completion needs to be renamed before installing the optional `--name <name>` flag
 # may be given. Any name provided with this flag only applies to the next path.
···
 #
 #   installShellCompletion --bash --name foobar.bash share/completions.bash
 #   installShellCompletion --fish --name foobar.fish share/completions.fish
+#   installShellCompletion --nushell --name foobar share/completions.nu
 #   installShellCompletion --zsh --name _foobar share/completions.zsh
 #
 # Or to use shell newline escaping to split a single invocation across multiple lines:
···
 #   installShellCompletion --cmd foobar \
 #     --bash <($out/bin/foobar --bash-completion) \
 #     --fish <($out/bin/foobar --fish-completion) \
+#     --nushell <($out/bin/foobar --nushell-completion)
 #     --zsh <($out/bin/foobar --zsh-completion)
 #
 # If any argument is `--` the remaining arguments will be treated as paths.
···
         # Parse arguments
         if (( parseArgs )); then
             case "$arg" in
-            --bash|--fish|--zsh)
+            --bash|--fish|--zsh|--nushell)
                 shell=${arg#--}
                 continue;;
             --name)
···
         elif [[ -p "$arg" ]]; then
             # this is a named fd or fifo
             if [[ -z "$curShell" ]]; then
-                nixErrorLog "${FUNCNAME[0]}: named pipe requires one of --bash, --fish, or --zsh"
+                nixErrorLog "${FUNCNAME[0]}: named pipe requires one of --bash, --fish, --zsh, or --nushell"
                 return 1
             elif [[ -z "$name" && -z "$cmdname" ]]; then
                 nixErrorLog "${FUNCNAME[0]}: named pipe requires one of --cmd or --name"
···
                 case "$argbase" in
                 ?*.bash) curShell=bash;;
                 ?*.fish) curShell=fish;;
+                ?*.nu) curShell=nushell;;
                 ?*.zsh) curShell=zsh;;
                 *)
                     if [[ "$argbase" = _* && "$argbase" != *.* ]]; then
···
         elif [[ -n "$cmdname" ]]; then
             case "$curShell" in
             bash|fish) outName=$cmdname.$curShell;;
+            nushell) outName=$cmdname.nu;;
             zsh) outName=_$cmdname;;
             *)
                 # Our list of shells is out of sync with the flags we accept or extensions we detect.
···
         case "$curShell" in
         bash) sharePath=bash-completion/completions;;
         fish) sharePath=fish/vendor_completions.d;;
+        nushell) sharePath=nushell/vendor/autoload;;
         zsh)
             sharePath=zsh/site-functions
             # only apply automatic renaming if we didn't have a manual rename

pkgs/by-name/in/installShellFiles/tests/install-completion-cmd.nix

···
     echo bar > bar.zsh
     echo baz > baz.fish
     echo qux > qux.fish
+    echo buzz > buzz.nu
 
-    installShellCompletion --cmd foobar --bash foo.bash --zsh bar.zsh --fish baz.fish --name qux qux.fish
+    installShellCompletion \
+      --cmd foobar --bash foo.bash \
+      --zsh bar.zsh \
+      --fish baz.fish --name qux qux.fish \
+      --nushell --cmd buzzbar buzz.nu
 
     cmp foo.bash $out/share/bash-completion/completions/foobar.bash
     cmp bar.zsh $out/share/zsh/site-functions/_foobar
     cmp baz.fish $out/share/fish/vendor_completions.d/foobar.fish
     cmp qux.fish $out/share/fish/vendor_completions.d/qux
+    cmp buzz.nu $out/share/nushell/vendor/autoload/buzzbar.nu
   ''

pkgs/by-name/in/installShellFiles/tests/install-completion-fifo.nix

···
     installShellCompletion \
       --bash --name foo.bash <(echo foo) \
       --zsh --name _foo <(echo bar) \
-      --fish --name foo.fish <(echo baz)
+      --fish --name foo.fish <(echo baz) \
+      --nushell --name foo.nu <(echo bucks)
 
     [[ $(<$out/share/bash-completion/completions/foo.bash) == foo ]] || { echo "foo.bash comparison failed"; exit 1; }
     [[ $(<$out/share/zsh/site-functions/_foo) == bar ]] || { echo "_foo comparison failed"; exit 1; }
     [[ $(<$out/share/fish/vendor_completions.d/foo.fish) == baz ]] || { echo "foo.fish comparison failed"; exit 1; }
+    [[ $(<$out/share/nushell/vendor/autoload/foo.nu) == bucks ]] || { echo "foo.nu comparison failed"; exit 1; }
   ''

pkgs/by-name/in/installShellFiles/tests/install-completion-inference.nix

···
     echo foo > foo.bash
     echo bar > bar.zsh
     echo baz > baz.fish
+    echo buzz > buzz.nu
 
-    installShellCompletion foo.bash bar.zsh baz.fish
+    installShellCompletion foo.bash bar.zsh baz.fish buzz.nu
 
     cmp foo.bash $out/share/bash-completion/completions/foo.bash
     cmp bar.zsh $out/share/zsh/site-functions/_bar
     cmp baz.fish $out/share/fish/vendor_completions.d/baz.fish
+    cmp buzz.nu $out/share/nushell/vendor/autoload/buzz.nu
   ''

pkgs/by-name/in/installShellFiles/tests/install-completion-name.nix

···
     echo foo > foo
     echo bar > bar
     echo baz > baz
+    echo bucks > bucks
 
-    installShellCompletion --bash --name foobar.bash foo --zsh --name _foobar bar --fish baz
+    installShellCompletion \
+      --bash --name foobar.bash foo \
+      --zsh --name _foobar bar \
+      --fish baz \
+      --nushell --name foobar.nu bucks
 
     cmp foo $out/share/bash-completion/completions/foobar.bash
     cmp bar $out/share/zsh/site-functions/_foobar
     cmp baz $out/share/fish/vendor_completions.d/baz
+    cmp bucks $out/share/nushell/vendor/autoload/foobar.nu
   ''

pkgs/by-name/in/installShellFiles/tests/install-completion.nix

···
     echo baz > baz
     echo qux > qux.zsh
     echo quux > quux
+    echo quokka > quokka
 
-    installShellCompletion --bash foo bar --zsh baz qux.zsh --fish quux
+    installShellCompletion \
+      --bash foo bar \
+      --zsh baz qux.zsh \
+      --fish quux \
+      --nushell quokka
 
     cmp foo $out/share/bash-completion/completions/foo
     cmp bar $out/share/bash-completion/completions/bar
     cmp baz $out/share/zsh/site-functions/_baz
     cmp qux.zsh $out/share/zsh/site-functions/_qux
     cmp quux $out/share/fish/vendor_completions.d/quux
+    cmp quokka $out/share/nushell/vendor/autoload/quokka
   ''

pkgs/by-name/in/installShellFiles/tests/install-manpage-fifo.nix

···
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-manpage-fifo"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    installManPage doc/*
+
+    installManPage \
+      --name foo.1 <(echo foo) \
+      --name=bar.2 <(echo bar) \
+      --name baz.3 <(echo baz)
+
+    echo "foo" | cmp - $out/share/man/man1/foo.1
+    echo "bar" | cmp - $out/share/man/man2/bar.2
+    echo "baz" | cmp - $out/share/man/man3/baz.3
+  ''

pkgs/by-name/in/installShellFiles/tests/install-manpage-named.nix

···
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-manpage"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    echo foo > foo.1
+
+    installManPage --name bar.1 foo.1
+
+    cmp foo.1 $out/share/man/man1/bar.1
+  ''

pkgs/by-name/in/installShellFiles/tests/install-manpage.nix

···
     echo foo > doc/foo.1
     echo bar > doc/bar.2.gz
     echo baz > doc/baz.3
+    echo buzz > --name.1
 
     installManPage doc/*
+    installManPage -- --name.1
 
     cmp doc/foo.1 $out/share/man/man1/foo.1
     cmp doc/bar.2.gz $out/share/man/man2/bar.2.gz
     cmp doc/baz.3 $out/share/man/man3/baz.3
+    cmp -- --name.1 $out/share/man/man1/--name.1
   ''

pkgs/by-name/ip/iproute2/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.15.0";
+  version = "6.16.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-gEGFSoglg61SY0ZnNsnIxox0saNXVKt3DSM0P5R1KPs=";
+    hash = "sha256-WQDMwV+aw797fq6B3rWTcSPfNemTR6fxGiKBhILwqNA=";
   };
 
   patches = [

pkgs/by-name/ja/jasper/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jasper";
-  version = "4.2.5";
+  version = "4.2.6";
 
   src = fetchFromGitHub {
     owner = "jasper-software";
     repo = "jasper";
     rev = "version-${finalAttrs.version}";
-    hash = "sha256-PjgglP4mKW1eOJ7QgUmc4KNsp/d9ubJBWr4CLcQAyRA=";
+    hash = "sha256-tq27ANDDRdP224E12UeQnvE6BFZRk7KczH4Dq+yt0nY=";
   };
 
   outputs = [

pkgs/by-name/kb/kbd/package.nix

···
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchgit,
   nixosTests,
   autoreconfHook,
   pkg-config,
   flex,
+  perl,
+  bison,
+  autoPatchelfHook,
   check,
   pam,
   bash,
+  bashNonInteractive,
   coreutils,
-  gzip,
+  zlib,
   bzip2,
   xz,
   zstd,
   gitUpdater,
+  pkgsCross,
   withVlock ? true,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "kbd";
-  version = "2.8.0";
+  version = "2.8.0-unstable-2025-08-12";
 
-  src = fetchurl {
-    url = "mirror://kernel/linux/utils/kbd/${pname}-${version}.tar.xz";
-    hash = "sha256-AfWAbafR009ZS3sqauGrIyFTRM8QZOjtzTqQ/vl3ahE=";
+  __structuredAttrs = true;
+
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/legion/kbd.git";
+    rev = "46295167a55643e941c8cdcfd2cb76bd138c851c";
+    hash = "sha256-m1aVfsEme/BnyJogOPvGcOrSJfli8B/TrGxOm4POt0w=";
   };
 
   # vlock is moved into its own output, since it depends on pam. This
···
     "vlock"
   ];
 
-  configureFlags = [
-    "--enable-optional-progs"
-    "--enable-libkeymap"
-    "--disable-nls"
-    (lib.enableFeature withVlock "vlock")
-  ]
-  ++ lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [
-    "ac_cv_func_malloc_0_nonnull=yes"
-    "ac_cv_func_realloc_0_nonnull=yes"
-  ];
-
   patches = [
     ./search-paths.patch
   ];
···
     mv fgGIod/trf{,-fgGIod}.map
     mv colemak/{en-latin9,colemak}.map
     popd
+  '';
 
-    # Fix paths to decompressors. Trailing space to avoid replacing `xz` in `".xz"`.
-    substituteInPlace src/libkbdfile/kbdfile.c \
-      --replace-fail 'gzip '  '${gzip}/bin/gzip ' \
-      --replace-fail 'bzip2 ' '${bzip2.bin}/bin/bzip2 ' \
-      --replace-fail 'xz '    '${xz.bin}/bin/xz ' \
-      --replace-fail 'zstd '  '${zstd.bin}/bin/zstd '
+  preConfigure = ''
+    # Perl and Bash only used during build time
+    patchShebangs --build contrib/
+  '';
 
-    sed -i '
-      1i prefix:=$(vlock)
-      1i bindir := $(vlock)/bin' \
-      src/vlock/Makefile.in \
-      src/vlock/Makefile.am
-  '';
+  configureFlags = [
+    "--enable-optional-progs"
+    "--enable-libkeymap"
+    "--disable-nls"
+    (lib.enableFeature withVlock "vlock")
+  ]
+  ++ lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
 
+  strictDeps = true;
   enableParallelBuilding = true;
 
-  postInstall = ''
-    for s in unicode_{start,stop}; do
-      substituteInPlace ''${!outputBin}/bin/$s \
-        --replace-fail /usr/bin/tty ${coreutils}/bin/tty
-      moveToOutput "bin/$s" "$scripts"
-    done
-  '';
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    flex
+    perl
+    bison
+    autoPatchelfHook # for patching dlopen()
+  ];
 
-  buildInputs = [
+  nativeCheckInputs = [
     check
+  ];
+
+  buildInputs = [
+    zlib
+    bzip2
+    xz
+    zstd
     bash
   ]
   ++ lib.optionals withVlock [ pam ];
 
-  NIX_LDFLAGS = lib.optional stdenv.hostPlatform.isStatic "-laudit";
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-    flex
+  postInstall = ''
+    substituteInPlace $out/bin/unicode_{start,stop} \
+      --replace-fail /usr/bin/tty ${coreutils}/bin/tty
+
+    moveToOutput bin/unicode_start $scripts
+    moveToOutput bin/unicode_stop $scripts
+  ''
+  + lib.optionalString withVlock ''
+    moveToOutput bin/vlock $vlock
+    moveToOutput etc/pam.d/vlock $vlock
+  '';
+
+  outputChecks.out.disallowedRequisites = [
+    bash
+    bashNonInteractive
   ];
-  strictDeps = true;
 
-  passthru.tests = {
-    inherit (nixosTests) keymap kbd-setfont-decompress kbd-update-search-paths-patch;
-  };
   passthru = {
-    gzip = gzip;
     updateScript = gitUpdater {
       # No nicer place to find latest release.
       url = "https://github.com/legionus/kbd.git";
       rev-prefix = "v";
     };
+    tests = {
+      cross =
+        let
+          systemString = if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform";
+        in
+        pkgsCross.${systemString}.kbd;
+      inherit (nixosTests) keymap kbd-setfont-decompress kbd-update-search-paths-patch;
+    };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://kbd-project.org/";
     description = "Linux keyboard tools and keyboard maps";
-    platforms = platforms.linux;
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ davidak ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ davidak ];
   };
 }

pkgs/by-name/li/libadwaita/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.7.5";
+  version = "1.7.6";
 
   outputs = [
     "out"
···
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-KlaRwOWHvzm+VwMygiEh8wqJfEwwA+x7o9T72Qpqnmo=";
+    hash = "sha256-HpjP6VSkEAFeXIFXLbndQzEWJwVvHe6B3aSwCz6KiIM=";
   };
 
   depsBuildBuild = [

pkgs/by-name/li/libapplewm/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  pkg-config,
+  autoreconfHook,
+  util-macros,
+  xorgproto,
+  libX11,
+  libXext,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libapplewm";
+  version = "1.4.1-unstable-2021-01-04";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "xorg/lib";
+    repo = "libapplewm";
+    rev = "be972ebc3a97292e7d2b2350eff55ae12df99a42";
+    hash = "sha256-NH9YeOEtnEupqpnsMLC21I+LmCOzT7KnfdzNNWqba/Y=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+    util-macros
+  ];
+
+  buildInputs = [
+    xorgproto
+    libX11
+    libXext
+  ];
+
+  passthru = {
+    # updateScript = # no updatescript since we don't use a tagged release (last one was 14 years ago)
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Xlib-based library for the Apple-WM extension";
+    longDescription = ''
+      AppleWM is a simple library designed to interface with the Apple-WM extension.
+      This extension allows X window managers to better interact with the Mac OS X Aqua user
+      interface when running X11 in a rootless mode.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libapplewm";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    pkgConfigModules = [ "applewm" ];
+    platforms = lib.platforms.darwin;
+  };
+})

pkgs/by-name/li/libarchive/package.nix

···
         "libarchive/test/test_read_disk_directory_traversals.c"
         "cpio/test/test_option_a.c"
         "cpio/test/test_option_t.c"
-      ]
-      ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
-        # only on some aarch64-linux systems?
+        # fails tests on filesystems with 64-bit inode values:
+        # FAIL: bsdcpio_test
+        #   bsdcpio: linkfile: large inode number truncated: Numerical result out of range
         "cpio/test/test_basic.c"
         "cpio/test/test_format_newc.c"
       ];

pkgs/by-name/li/libdmx/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libdmx";
+  version = "1.1.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libdmx-${finalAttrs.version}.tar.xz";
+    hash = "sha256-NaTiaosLK0/jZEHcpGNkXD+lLSgqw1IFAaOOqULL908=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    # updateScript = # libdmx it deprecated and thus needs no updatescript
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Xlib-based library for the DMX (Distributed Multihead X) extension";
+    longDescription = ''
+      This library allows X11 clients to use the Distributed Multihead X (DMX) Extension,
+      as previously implemented in the Xdmx server.
+      X.Org removed support for the Xdmx server from the xorg-server releases in the version 21
+      release in 2021. This library is thus now considered deprecated and the version 1.1.5 release
+      is the last release X.Org plans to make of libdmx.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libdmx";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    pkgConfigModules = [ "dmx" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libfontenc/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  zlib,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libfontenc";
+  version = "1.1.8";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libfontenc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-ewLD1AUjbg2GgGsd6daGj+YMMTYos4NQsDKRSqT9FMY=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    zlib
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X font encoding library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libfontenc";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    pkgConfigModules = [ "fontenc" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libfs/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  xtrans,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libfs";
+  version = "1.0.10";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libFS-${finalAttrs.version}.tar.xz";
+    hash = "sha256-m6u9PIYGnJhWPaBEBF/cDs5OwMk9zdLGiqdOs0tPO3c=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    xtrans
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libFS \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Font Service client library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libfs";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpndSellVariant
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "libfs" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libice/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  xtrans,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libice";
+  version = "1.1.2";
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libICE-${finalAttrs.version}.tar.xz";
+    hash = "sha256-l05O1BQiXrPHFphd+XCfTajSKmeiiQBmvG38ia0phiU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    xtrans
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libICE \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Inter-Client Exchange Library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libice";
+    license = lib.licenses.mitOpenGroup;
+    maintainers = [ ];
+    pkgConfigModules = [ "ice" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libmbim/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.30.0";
+  version = "1.32.0";
 
   outputs = [
     "out"
···
     owner = "mobile-broadband";
     repo = "libmbim";
     rev = version;
-    hash = "sha256-sHTpu9WeMZroT+1I18ObEHWSzcyj/Relyz8UNe+WawI=";
+    hash = "sha256-+4INXuH2kbKs9C6t4bOJye7yyfYH/BLukmgDVvXo+u0=";
   };
 
   mesonFlags = [

pkgs/by-name/li/libpcap/package.nix

···
   fetchurl,
   flex,
   bison,
+  bash,
+  bashNonInteractive,
   bluez,
   libnl,
   libxcrypt,
···
   pname = "libpcap";
   version = "1.10.5";
 
+  __structuredAttrs = true;
+
   src = fetchurl {
     url = "https://www.tcpdump.org/release/${pname}-${version}.tar.gz";
     hash = "sha256-N87ZChmjAqfzLkWCJKAMNlwReQXCzTWsVEtogKgUiPA=";
   };
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ libnl ] ++ lib.optionals withRemote [ libxcrypt ];
+  outputs = [
+    "out"
+    "lib"
+  ];
+
+  strictDeps = true;
+
+  buildInputs = [
+    bash
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ libnl ]
+  ++ lib.optionals withRemote [ libxcrypt ];
 
   nativeBuildInputs = [
     flex
···
   '';
 
   enableParallelBuilding = true;
+
+  outputChecks.lib.disallowedRequisites = [
+    bash
+    bashNonInteractive
+  ];
 
   passthru.tests = {
     inherit

pkgs/by-name/li/libseccomp/oob-read.patch

···
-From 904e9dee373eca499e976dce131f0baee06db2d6 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <[e-mail]>
-Date: Thu, 13 Feb 2025 12:05:17 +0100
-Subject: [PATCH] api: fix seccomp_export_bpf_mem out-of-bounds read
-
-*len is the length of the destination buffer, but program->blks is
-probably not anywhere near that long.  It's already been checked above
-that BPF_PGM_SIZE(program) is less than or equal to *len, so that's
-the correct value to use here to avoid either reading or writing too
-much.
-
-I noticed this because tests/11-basic-basic_errors started failing on
-musl after e797591 ("all: add seccomp_precompute() functionality").
-
-Signed-off-by: Alyssa Ross <[e-mail]>
----
-Link: https://github.com/seccomp/libseccomp/pull/458
-
- src/api.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/api.c b/src/api.c
-index adccef3..65a277a 100644
---- a/src/api.c
-+++ b/src/api.c
-@@ -786,7 +786,7 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
- 		if (BPF_PGM_SIZE(program) > *len)
- 			rc = _rc_filter(-ERANGE);
- 		else
--			memcpy(buf, program->blks, *len);
-+			memcpy(buf, program->blks, BPF_PGM_SIZE(program));
- 	}
- 	*len = BPF_PGM_SIZE(program);
- 
--- 
-2.47.0
-

pkgs/by-name/li/libseccomp/package.nix

···
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   getopt,
   util-linuxMinimal,
   which,
···
   };
 
   patches = [
-    ./oob-read.patch
+    # Remove when version > 2.6.0
+    # Fixes test failures on big-endian archs
+    (fetchpatch {
+      name = "0001-libseccomp-remove-fuzzer-from-test-62-sim-arch_transactions.patch";
+      url = "https://github.com/seccomp/libseccomp/commit/2f0f3b0e9121720108431c5d054164016f476230.patch";
+      hash = "sha256-AKAQyALJlLgxnS23OEoqfyDswp0kU2vmja5ohgvFojw=";
+    })
+
+    # Remove when version > 2.6.0
+    # Fixes OOB reads & tests on musl
+    (fetchpatch {
+      name = "0002-libseccomp-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch";
+      url = "https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec.patch";
+      hash = "sha256-TdfQ5T8FrGE6+P24MIi9rKSC3fQu/Jlr4bsFiJd4yVY=";
+    })
   ];
 
   outputs = [

pkgs/by-name/li/libsm/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libice,
+  libuuid,
+  xorgproto,
+  xtrans,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libsm";
+  version = "1.2.6";
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libSM-${finalAttrs.version}.tar.xz";
+    hash = "sha256-vnwKvbFcv9KaxiVzwcguh3+dQEetFTIefql9HkPYNb4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libice
+    libuuid
+    xorgproto
+    xtrans
+  ];
+
+  propagatedBuildInputs = [
+    # needs to be propagated because of header file dependencies
+    libice
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libSM \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Session Management Library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libsm";
+    license = with lib.licenses; [
+      mit
+      mitOpenGroup
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "sm" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libtiff/package.nix

···
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
   nix-update-script,
 
   cmake,
···
   };
 
   patches = [
+    # Fix test_directory test on big-endian
+    # https://gitlab.com/libtiff/libtiff/-/issues/652
+    (fetchpatch {
+      name = "0001-Update-test_directory-not-to-fail-on-big-endian-machines";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/e8233c42f2e0a0ea7260c3cc7ebbaec8e5cb5e07.patch";
+      hash = "sha256-z5odG66j4U+WoUjTUuBIhcVUCGK1GYdvW/cVucawNZI=";
+    })
+
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2024-13978_1.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/7be20ccaab97455f192de0ac561ceda7cd9e12d1.patch";
+      hash = "sha256-cpsQyIvyP6LkGeQTlLX73iNd1AcPkvZ6Xqfns7G3JBc=";
+    })
+    (fetchpatch {
+      name = "CVE-2024-13978_2.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4.patch";
+      hash = "sha256-cZlLTeB7/nvylf5SLzKF7g91aBERhZxpV5fmWEJVrX4=";
+    })
+    (fetchpatch {
+      name = "CVE-2025-9165.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0.patch";
+      hash = "sha256-DIsk8trbHMMTrj6jP5Ae8ciRjHV4CPHdWCN+VbeFnFo=";
+    })
   ];
 
   postPatch = ''

pkgs/by-name/li/libuiohook/package.nix

···
   cmake,
   pkg-config,
   libX11,
+  libxcb,
   libxkbcommon,
   xinput,
   xorg,
···
   buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) (
     [
       libX11
+      libxcb
       libxkbcommon
       xinput
     ]

pkgs/by-name/li/liburing/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "liburing";
-  version = "2.11";
+  version = "2.12";
 
   src = fetchFromGitHub {
     owner = "axboe";
     repo = "liburing";
     tag = "liburing-${version}";
-    hash = "sha256-V73QP89WMrL2fkPRbo/TSkfO7GeDsCudlw2Ut5baDzA=";
+    hash = "sha256-sEMzkyjrCc49ogfUnzdgNtEXmW0Tz/PUKo99C965428=";
   };
 
   separateDebugInfo = true;

pkgs/by-name/li/libx11/package.nix

···
 
   propagatedBuildInputs = [
     xorgproto
-    libxcb
   ];
 
   configureFlags =

pkgs/by-name/li/libxaw/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxmu,
+  libxpm,
+  libxt,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxaw";
+  version = "1.0.16";
+
+  outputs = [
+    "out"
+    "dev"
+    "devdoc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXaw-${finalAttrs.version}.tar.xz";
+    hash = "sha256-cx1XK1THCPgeGXpq+oAWkY4uBt/TAl4GbKZCpbjDnI8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxmu
+    libxpm
+    libxt
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    libxt
+    # needs to be propagated because of header file dependencies
+    libxmu
+  ];
+
+  postInstall =
+    # remove dangling symlinks to .so files on static
+    lib.optionalString stdenv.hostPlatform.isStatic "rm $out/lib/*.so*";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXaw \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Athena Widget Set, based on the X Toolkit Intrinsics (Xt) Library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxaw";
+    license = with lib.licenses; [
+      mitOpenGroup
+      x11
+      hpndSellVariant
+      hpnd
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [
+      "xaw6"
+      "xaw7"
+    ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxcb-errors/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  m4,
+  python3,
+  xcbproto,
+  libxcb,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcb-errors";
+  version = "1.0.1";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/xcb/xcb-util-errors-${finalAttrs.version}.tar.xz";
+    hash = "sha256-VijIe5hCWa2Se6zYpClYMZw2vfSwZYh4A8nYIPuA81c=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    m4
+    python3
+  ];
+
+  buildInputs = [
+    xcbproto
+    libxcb
+  ];
+
+  propagatedBuildInputs = [ libxcb ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname xcb-util-errors \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "XCB utility library that gives human readable names to error, event & request codes";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcb-errors";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xcb-errors" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxcb-image/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  m4,
+  xorgproto,
+  libxcb,
+  libxcb-util,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcb-image";
+  version = "0.4.1";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/xcb/xcb-util-image-${finalAttrs.version}.tar.xz";
+    hash = "sha256-zK2O5drbEnH9RyetFNm9d6ZOUFYIdmxOmCZ9mu3kDT0=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    m4
+  ];
+
+  buildInputs = [
+    xorgproto
+    libxcb
+    libxcb-util
+  ];
+
+  propagatedBuildInputs = [ libxcb ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname xcb-util-image \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "XCB port of Xlib's XImage and XShmImage functions.";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcb-image";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xcb-image" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxcb-keysyms/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libxcb,
+  xorgproto,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcb-keysyms";
+  version = "0.4.1";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/xcb/xcb-util-keysyms-${finalAttrs.version}.tar.xz";
+    hash = "sha256-fCYKUpRBKu1CnfHaL4r9O9B7fLo/7HcvuhWmE6bVxjg=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libxcb
+    xorgproto
+  ];
+
+  propagatedBuildInputs = [ libxcb ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname xcb-util-keysyms \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Standard X key constants and conversion to/from keycodes";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcb-keysyms";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xcb-keysyms" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxcb-render-util/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libxcb,
+  xorgproto,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcb-render-util";
+  version = "0.3.10";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/xcb/xcb-util-renderutil-${finalAttrs.version}.tar.xz";
+    hash = "sha256-PhXU8OItjdv7ufXXfbQ+rNejBAKb8lphZsxjyqltBLo=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libxcb
+    xorgproto
+  ];
+
+  propagatedBuildInputs = [ libxcb ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname xcb-util-renderutil \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "XCB convenience functions for the Render extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcb-render-util";
+    license = with lib.licenses; [
+      hpndSellVariant
+      x11
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xcb-renderutil" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxcb-util/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libxcb,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcb-util";
+  version = "0.4.1";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/xcb/xcb-util-${finalAttrs.version}.tar.xz";
+    hash = "sha256-Wr47u9jlTw+j7JRSkbfo+oz9PMzENxj4dYQw+UEm5RI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libxcb ];
+  propagatedBuildInputs = [ libxcb ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname xcb-util \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "XCB utility libraries";
+    longDescription = ''
+      The XCB util modules provides a number of libraries which sit on top of libxcb, the core
+      X protocol library, and some of the extension libraries. These experimental libraries provid
+      convenience functions and interfaces which make the raw X protocol more usable. Some of the
+      libraries also provide client-side code which is not strictly part of the X protocol but which
+      have traditionally been provided by Xlib.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcb-util";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [
+      "xcb-atom"
+      "xcb-aux"
+      "xcb-event"
+      "xcb-util"
+    ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxcb-wm/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libxcb,
+  xorgproto,
+  m4,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcb-wm";
+  version = "0.4.2";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/xcb/xcb-util-wm-${finalAttrs.version}.tar.xz";
+    hash = "sha256-YsNOIdBiZGh/rqftv2NjLJ8E1V5yEUqkpXu5Xk+Iigs=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    m4
+  ];
+
+  buildInputs = [
+    libxcb
+    xorgproto
+  ];
+
+  propagatedBuildInputs = [ libxcb ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname xcb-util-wm \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "XCB client and window-manager helpers for ICCCM & EWMH.";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcb-wm";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [
+      "xcb-ewmh"
+      "xcb-icccm"
+    ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxcursor/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxfixes,
+  libxrender,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcursor";
+  version = "1.2.3";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXcursor-${finalAttrs.version}.tar.xz";
+    hash = "sha256-/elALdTP552nHi2Wu5gK/F5v9Pin10wVnhlmr7KywsA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxfixes
+    libxrender
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXcursor \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X11 Cursor management library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcursor";
+    license = lib.licenses.hpndSellVariant;
+    maintainers = [ ];
+    pkgConfigModules = [ "xcursor" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxfixes/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libX11,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxfixes";
+  version = "6.0.1";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXfixes-${finalAttrs.version}.tar.xz";
+    hash = "sha256-tpX5PNJJlCGrAtInREWOZQzMiMHUyBMNYCACE6vALVg=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libX11
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXfixes \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Xlib-based library for the XFIXES Extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxfixes";
+    license = with lib.licenses; [
+      hpndSellVariant
+      mit
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xfixes" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxkbcommon_8/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxkbcommon";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "xkbcommon";
     repo = "libxkbcommon";
     tag = "xkbcommon-${finalAttrs.version}";
-    hash = "sha256-rLh5BD9a0bI0nHtWX+n0LqmdIO5ykd98rNc5hAN3ndE=";
+    hash = "sha256-IV1dgGM8z44OQCQYQ5PiUUw/zAvG5IIxiBywYVw2ius=";
   };
 
   patches = [

pkgs/by-name/li/libxmlb/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libxmlb";
-  version = "0.3.22";
+  version = "0.3.23";
 
   outputs = [
     "out"
···
     owner = "hughsie";
     repo = "libxmlb";
     rev = version;
-    hash = "sha256-6S/4X6dYsVj9v98LoDJjir6Kmb5L8PloD23yvvkiD6o=";
+    hash = "sha256-hdF1yce9/ztXVV6BYocPGVAjoxJancID77rnHBJsKmM=";
   };
 
   patches = [

pkgs/by-name/li/libxmu/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxt,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxmu";
+  version = "1.2.1";
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXmu-${finalAttrs.version}.tar.xz";
+    hash = "sha256-/LJ3kySKOeX8xbnErsQMwHNLPKdqrD19HCZOf34U6LI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxt
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    libx11
+    libxt
+  ];
+
+  buildFlags = [ "BITMAP_DEFINES='-DBITMAPDIR=\"/no-such-path\"'" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXmu \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X miscellaneous utility routines library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxmu";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpnd
+      x11
+      isc
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [
+      "xmu"
+      "xmuu"
+    ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxpm/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  gettext,
+  xorgproto,
+  libx11,
+  libxext,
+  libxt,
+  ncompress,
+  gzip,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxpm";
+  version = "3.5.17";
+
+  outputs = [
+    "bin"
+    "dev"
+    "out"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXpm-${finalAttrs.version}.tar.xz";
+    hash = "sha256-ZLMfgQGefTiMgisLKK+NUcRiK4Px8Mtvo/yV4nEibkM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    gettext
+  ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxt
+  ];
+
+  propagatedBuildInputs = [
+    libx11
+  ];
+
+  env = {
+    XPM_PATH_COMPRESS = lib.makeBinPath [ ncompress ];
+    XPM_PATH_GZIP = lib.makeBinPath [ gzip ];
+    XPM_PATH_UNCOMPRESS = lib.makeBinPath [ gzip ];
+  };
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXpm \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Pixmap (XPM) image file format library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxpm";
+    license = with lib.licenses; [
+      x11
+      mit
+    ];
+    mainProgram = "sxpm";
+    maintainers = [ ];
+    pkgConfigModules = [ "xpm" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxrandr/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxrender,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxrandr";
+  version = "1.5.4";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXrandr-${finalAttrs.version}.tar.xz";
+    hash = "sha256-GtWwZTdfSoWRWqYGEcxkB8BgSSohTX+dryFL51LDtNM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxrender
+  ];
+
+  propagatedBuildInputs = [ libxrender ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXrandr \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Xlib Resize, Rotate and Reflection (RandR) extension library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxrandr";
+    license = lib.licenses.hpndSellVariant;
+    maintainers = [ ];
+    pkgConfigModules = [ "xrandr" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxrender/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxrender";
+  version = "0.9.12";
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXrender-${finalAttrs.version}.tar.xz";
+    hash = "sha256-uDISjaSLOcjWCCJEgXQ0A60Wkb9OVU5L6cF03xcdG5c=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    libx11
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXrender \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Xlib library for the Render Extension to the X11 protocol";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxrender";
+    license = lib.licenses.hpndSellVariant;
+    maintainers = [ ];
+    pkgConfigModules = [ "xrender" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxt/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  buildPackages,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libsm,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxt";
+  version = "1.3.1";
+
+  outputDoc = "devdoc";
+  outputs = [
+    "out"
+    "dev"
+    "devdoc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXt-${finalAttrs.version}.tar.xz";
+    hash = "sha256-4Kd0szMk9NTAWxmepFBQ+HIGWG2BZV+L7026Q02TEog=";
+  };
+
+  strictDeps = true;
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libsm
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    libx11
+    # needs to be propagated because of header file dependencies
+    libsm
+  ];
+
+  configureFlags =
+    lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--enable-malloc0returnsnull"
+    ++ lib.optional (stdenv.targetPlatform.useLLVM or false) "ac_cv_path_RAWCPP=cpp";
+
+  env = {
+    CPP = if stdenv.hostPlatform.isDarwin then "clang -E -" else "${stdenv.cc.targetPrefix}cc -E -";
+  };
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXt \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Toolkit Intrinsics library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxt";
+    license = with lib.licenses; [
+      mit
+      hpndSellVariant
+      hpnd
+      mitOpenGroup
+      x11
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xt" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxv/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libX11,
+  libXext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxv";
+  version = "1.0.13";
+
+  outputs = [
+    "out"
+    "dev"
+    "devdoc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXv-${finalAttrs.version}.tar.xz";
+    hash = "sha256-fTSRCVjhwfjRk9go/qG32hkilygKNUN68GkvADugN1U=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libX11
+    libXext
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXv \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Xlib-based library for the X Video (Xv) extension to the X Window System";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxv";
+    license = with lib.licenses; [
+      hpnd
+      hpndSellVariant
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xv" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxvmc/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libX11,
+  libXext,
+  libXv,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxvmc";
+  version = "1.0.14";
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXvMC-${finalAttrs.version}.tar.xz";
+    hash = "sha256-5L6etra6/bv4H0f3FjBHIVN25F4tx4bQ6mGByTByXtk=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libX11
+    libXext
+    libXv
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXvMC \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X-Video Motion Compensation API";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxvmc";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    pkgConfigModules = [
+      "xvmc"
+      "xvmc-wrapper"
+    ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxxf86dga/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libX11,
+  libXext,
+  xorgproto,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxxf86dga";
+  version = "1.1.6";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXxf86dga-${finalAttrs.version}.tar.xz";
+    hash = "sha256-vkRCdXmAj+OiF9WfUcrnVqJpE+tuTIc4zKtl/1bXmA8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libX11
+    libXext
+    xorgproto
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXxf86dga \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Client library for the XFree86-DGA extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxxf86dga";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xxf86dga" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxxf86misc/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxxf86misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXxf86misc-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-qJwD4rDxYjnWeiAxuQA/MbWmhhBrvbPHl/uIrkcq84A=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXxf86misc \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Extension library for the XFree86-Misc X extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxxf86misc";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xxf86misc" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/libxxf86vm/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libX11,
+  libXext,
+  xorgproto,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxxf86vm";
+  version = "1.1.6";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXxf86vm-${finalAttrs.version}.tar.xz";
+    hash = "sha256-lq9BTHPOHVRJrQS+f58n+oMw+ES23ahD7yLj4b77PuM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libX11
+    libXext
+    xorgproto
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXxf86vm \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Extension library for the XFree86-VidMode X extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxxf86vm";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xxf86vm" ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/li/linux-pam/package.nix

···
   audit,
   linuxHeaders,
   libxcrypt,
+  bash,
+  bashNonInteractive,
   nixosTests,
   meson,
   pkg-config,
···
     repo = "linux-pam";
     tag = "v${finalAttrs.version}";
     hash = "sha256-kANcwxifQz2tYPSrSBSFiYNTm51Gr10L/zroCqm8ZHQ=";
+
   };
+
+  __structuredAttrs = true;
 
   # patching unix_chkpwd is required as the nix store entry does not have the necessary bits
   postPatch = ''
···
     "out"
     "doc"
     "man"
+    "scripts"
     # "modules"
   ];
+
+  strictDeps = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [
···
   buildInputs = [
     db4
     libxcrypt
+    bash
   ]
   ++ lib.optionals withAudit [
     audit
···
     (lib.mesonBool "examples" false)
   ];
 
+  postInstall = ''
+    moveToOutput sbin/pam_namespace_helper $scripts
+    moveToOutput etc/security/namespace.init $scripts
+  '';
+
   doCheck = false; # fails
+
+  outputChecks.out.disallowedRequisites = [
+    bash
+    bashNonInteractive
+  ];
 
   passthru = {
     tests = {

pkgs/by-name/lo/local-ai/package.nix

···
   ffmpeg,
   cmake,
   pkg-config,
-  buildGo123Module,
+  buildGoModule,
   makeWrapper,
   ncurses,
   which,
···
       ${cp} ${stable-diffusion} sources/stablediffusion-ggml.cpp
     '';
 
-  self = buildGo123Module.override { stdenv = effectiveStdenv; } {
+  self = buildGoModule.override { stdenv = effectiveStdenv; } {
     inherit pname version src;
 
     vendorHash = "sha256-1OY/y1AeL0K+vOU4Jk/cj7rToVLC9EkkNhgifB+icDM=";
···
         ck3d
       ];
       platforms = platforms.linux;
+      # Doesn't build with >buildGo123Module.
+      # 'cp: cannot stat 'bin/rpc-server': No such file or directory'
+      broken = true;
     };
   };
 in

pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix

···
     hash = "sha256-qpgDErV1VVzaUHHQX4ReXCPihdrSKI/4HtbDeQIblR8=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools_rust>=1.3,<=1.11.1" "setuptools_rust<=1.12,>=1.3"
+  '';
+
   build-system = with python3Packages; [
     poetry-core
     setuptools-rust

pkgs/by-name/me/memcached/package.nix

···
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.38";
+  version = "1.6.39";
   pname = "memcached";
 
   src = fetchurl {
     url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-M015IpTjdzh5a1sDN1xHu22yg7EVLi6kzLcgFS3RfGY=";
+    sha256 = "sha256-I+VQfpM7FUYxYdTF05IbDF80C1Qtbt1/bF4Xw08Ro2M=";
   };
 
   configureFlags = [

pkgs/by-name/me/mesa-demos/package.nix

···
   libGL,
   libGLU,
   libX11,
+  libxcb,
   libXext,
   libgbm,
   mesa,
···
   buildInputs = [
     libglut
     libX11
+    libxcb
     libXext
     libGL
     libGLU

pkgs/by-name/me/meson/001-fix-rpath.patch

···
---- a/mesonbuild/backend/backends.py
-+++ b/mesonbuild/backend/backends.py
-@@ -723,6 +723,21 @@
-     @staticmethod
-     def get_rpath_dirs_from_link_args(args: T.List[str]) -> T.Set[str]:
+diff --git a/mesonbuild/build.py b/mesonbuild/build.py
+index 9014d09fb..4dda63a96 100644
+--- a/mesonbuild/build.py
++++ b/mesonbuild/build.py
+@@ -1888,6 +1888,20 @@ class BuildTarget(Target):
+     def get_rpath_dirs_from_link_args(cls, args: T.List[str]) -> T.Set[str]:
          dirs: T.Set[str] = set()
-+
+ 
 +        nix_ldflags = os.environ.get('NIX_LDFLAGS', '').split()
 +        next_is_path = False
 +        # Try to add rpaths set by user or ld-wrapper so that they are not removed.
···
 +                    dirs.add(flag)
 +                next_is_path = False
 +
-         # Match rpath formats:
-         # -Wl,-rpath=
-         # -Wl,-rpath,
+         for arg in args:
+             if not arg.startswith('-Wl,'):
+                 continue

pkgs/by-name/me/meson/package.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.8.3";
+  version = "1.9.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     tag = version;
-    hash = "sha256-Htjr/gZ4G53XY/kuGsbToZOo+ptDoNA737aaqDT1AUo=";
+    hash = "sha256-VMLcGtyJIH3jsTkHrIUhCpjwm6ljsRSyRECYhaafjD8=";
   };
 
   patches = [

pkgs/by-name/mk/mkfontscale/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libfontenc,
+  freetype,
+  xorgproto,
+  zlib,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mkfontscale";
+  version = "1.2.3";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/mkfontscale-${finalAttrs.version}.tar.xz";
+    hash = "sha256-KSHNw0TxrO4EvNbqHilWXBMIJjAG4TSp7jjPnJ1v514=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    libfontenc
+    freetype
+    xorgproto
+    zlib
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utilities to create the fonts.scale and fonts.dir index files used by the legacy X11 font system";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/mkfontscale";
+    license = with lib.licenses; [
+      mit
+      mitOpenGroup
+      hpndSellVariant
+    ];
+    maintainers = [ ];
+    mainProgram = "mkfontscale";
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/mo/modemmanager/no-dummy-dirs-in-sysconfdir.patch

···
  mkdir_cmd = 'mkdir -p ${DESTDIR}@0@'
 -meson.add_install_script('sh', '-c', mkdir_cmd.format(mm_prefix / mm_fccunlockdiruser))
  meson.add_install_script('sh', '-c', mkdir_cmd.format(mm_prefix / mm_fccunlockdirpackage))
+diff --git a/data/dispatcher-modem-setup/meson.build b/data/dispatcher-modem-setup/meson.build
+index 812152a3..7527022b 100644
+--- a/data/dispatcher-modem-setup/meson.build
++++ b/data/dispatcher-modem-setup/meson.build
+@@ -22,5 +22,4 @@ install_data(
+ )
+ 
+ mkdir_cmd = 'mkdir -p ${DESTDIR}@0@'
+-meson.add_install_script('sh', '-c', mkdir_cmd.format(mm_prefix / mm_modemsetupdiruser))
+ meson.add_install_script('sh', '-c', mkdir_cmd.format(mm_prefix / mm_modemsetupdirpackage))
+ 

pkgs/by-name/mo/modemmanager/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.22.0";
+  version = "1.24.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mobile-broadband";
     repo = "ModemManager";
     rev = version;
-    hash = "sha256-/D9b2rCCUhpDCUfSNAWR65+3EyUywzFdH1R17eSKRDo=";
+    hash = "sha256-3jI75aR2esmv5dkE4TrdCHIcCvtdOBKnBC5XLEKoVFs=";
   };
 
   patches = [
     # Since /etc is the domain of NixOS, not Nix, we cannot install files there.
     # But these are just placeholders so we do not need to install them at all.
     ./no-dummy-dirs-in-sysconfdir.patch
-
-    (fetchpatch {
-      name = "GI_TYPELIB_PATH.patch";
-      url = "https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/commit/daa829287894273879799a383ed4dc373c6111b0.patch";
-      hash = "sha256-tPQokiZO2SpTlX8xMlkWjP1AIXgoLHW3rJwnmG33z/k=";
-    })
   ];
 
   strictDeps = true;

pkgs/by-name/mo/moltenvk/package.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   gitUpdater,
   apple-sdk_15,
   cereal,
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.2.11";
+  version = "1.3.0";
 
   strictDeps = true;
 
···
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-24qQnJ0RnJP2M4zSlSlQ4c4dVZtHutNiCvjrsCDw6wY=";
+    hash = "sha256-V69P1t48XP/pAPgpVsnFeCBidhHk60XGHRkHF6AEke0=";
   };
-
-  patches = [
-    # Cherry-pick patch to fix build failure due to a hardcoded SPIRV-Cross namespace.
-    # This can be dropped for MoltenVK 1.2.12.
-    (fetchpatch2 {
-      url = "https://github.com/KhronosGroup/MoltenVK/commit/856c8237ac3b32178caae3408effc35bedfdffa1.patch?full_index=1";
-      hash = "sha256-dVTop8sU19Swdb3ajbI+6S715NaxTqd7d0yQ/FDqxqY=";
-    })
-  ];
 
   postPatch = ''
     # Move `mvkGitRevDerived.h` to a stable location

pkgs/by-name/ne/neon/package.nix

···
 in
 
 stdenv.mkDerivation rec {
-  version = "0.34.2";
+  version = "0.35.0";
   pname = "neon";
 
   src = fetchurl {
     url = "https://notroj.github.io/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-+Yzjx0MAvgXt3wXcy9ykmLFNQMKJ93MZXdGlWc/6WFY=";
+    sha256 = "sha256-FGevtz814/XQ6f1wYowUy6Jmpl4qH7bj+UXuM4XIWVs=";
   };
 
   patches = optionals stdenv.hostPlatform.isDarwin [ ./darwin-fix-configure.patch ];

pkgs/by-name/ne/netpbm/package.nix

···
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.11.0";
+  version = "11.11.1";
 
   outputs = [
     "bin"
···
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "5101";
-    sha256 = "sha256-/oS+h4VujaNM7AnMq6e5/8A0cVZysJzFSGgJ4p01oJU=";
+    rev = "5104";
+    sha256 = "sha256-zgA3EZPrXD8JOO9O2nuLt4ouPbbUJAlFKlX+2QOz8Uw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/re/re2/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "re2";
-  version = "2025-08-05";
+  version = "2025-08-12";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
     rev = finalAttrs.version;
-    hash = "sha256-Q4/xab6Jqhai/WIMND5YWOrPmNyDDf3HysKDqum3RgQ=";
+    hash = "sha256-3cWbw8Wlnl1OMPIcbNlc3HnCsuL4VT7psuHWtldsWoQ=";
   };
 
   outputs = [

pkgs/by-name/re/remctl/package.nix

···
   postPatch = ''
     patchShebangs tests
     sed -i '\,server/acl/localgroup,d' tests/TESTS
+    substituteInPlace configure.ac --replace "-Werror" ""
   '';
 
   nativeBuildInputs = [

pkgs/by-name/ru/ruff/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.12.8";
+  version = "0.12.10";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-ypYtAUQBFSf+cgly9K5eRMegtWrRmLmqrgfRmCJvXEk=";
+    hash = "sha256-pHwWYgU/PMkoKIADJsbU3ta+u7H4DR+kb3xZturqpgk=";
   };
 
-  # Patch out test that fails due to ANSI escape codes being written as-is,
-  # causing a snapshot test to fail. The output itself is correct.
-  #
-  # This is the relevant test's output as of 0.12.5
-  # >     0       │-/home/ferris/project/code.py:1:1: E902 Permission denied (os error 13)
-  # >     1       │-/home/ferris/project/notebook.ipynb:1:1: E902 Permission denied (os error 13)
-  # >     2       │-/home/ferris/project/pyproject.toml:1:1: E902 Permission denied (os error 13)
-  # >           0 │+␛[1m/home/ferris/project/code.py␛[0m␛[36m:␛[0m1␛[36m:␛[0m1␛[36m:␛[0m ␛[1m␛[31mE902␛[0m Permission denied (os error 13)
-  # >           1 │+␛[1m/home/ferris/project/notebook.ipynb␛[0m␛[36m:␛[0m1␛[36m:␛[0m1␛[36m:␛[0m ␛[1m␛[31mE902␛[0m Permission denied (os error 13)
-  # >           2 │+␛[1m/home/ferris/project/pyproject.toml␛[0m␛[36m:␛[0m1␛[36m:␛[0m1␛[36m:␛[0m ␛[1m␛[31mE902␛[0m Permission denied (os error 13)
-  # > ────────────┴───────────────────────────────────────────────────────────────────
-  postPatch = ''
-    substituteInPlace crates/ruff/src/commands/check.rs --replace-fail '
-        #[test]
-        fn unreadable_files() -> Result<()> {' \
-    '
-        #[test]
-        #[ignore = "ANSI Escape Codes trigger snapshot diff"]
-        fn unreadable_files() -> Result<()> {'
-  '';
-
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-0iYwS8Ssi4JDxwr0Q2+iKvYHb179L6BiiuXa2D4qiOA=";
+  cargoHash = "sha256-M4NyUvtoDK9MKacSMl+W4d+WF7LrINm9zowrTNwy9wk=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/s2/s2n-tls/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.5.23";
+  version = "1.5.24";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "s2n-tls";
     rev = "v${version}";
-    hash = "sha256-gg8JrkZ9W93sEQ4uEqCh+oaAqtUH+xAz4FdS0GD4F90=";
+    hash = "sha256-a5TJlxDj5B+fq8EUrlXtqGKtMC3S8PoIG2w12DTYVsc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/sc/screego/package.nix

···
 {
   lib,
-  buildGo123Module,
+  buildGoModule,
   fetchFromGitHub,
   fetchYarnDeps,
   yarnConfigHook,
···
 
 in
 
-buildGo123Module rec {
+buildGoModule rec {
   inherit src version;
 
   pname = "screego-server";

pkgs/by-name/sd/sdl3/package.nix

···
     ]
     ++ lib.optionals x11Support [
       xorg.libX11
+      xorg.libxcb
       xorg.libXScrnSaver
       xorg.libXcursor
       xorg.libXext

pkgs/by-name/se/searxng/package.nix

···
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
 
-    pythonRemoveDeps = [
-      "typer-slim" # we use typer instead
-    ];
-
     pythonRelaxDeps = [
       "certifi"
       "flask"
···
         python-dateutil
         pyyaml
         setproctitle
-        typer
+        typer-slim
         uvloop
         valkey
         whitenoise

pkgs/by-name/sh/shadow/package.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
-  runtimeShell,
   nixosTests,
   autoreconfHook,
   bison,
···
     "man"
   ];
 
-  RUNTIME_SHELL = runtimeShell;
-
   nativeBuildInputs = [
     autoreconfHook
     bison
···
     ./keep-path.patch
     # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
     ./respect-xml-catalog-files-var.patch
-    ./runtime-shell.patch
     ./fix-install-with-tcb.patch
   ];
 
-  # The nix daemon often forbids even creating set[ug]id files.
   postPatch = ''
+    # The nix daemon often forbids even creating set[ug]id files
     sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
+
+    # The default shell is not defined at build time of the package. It is
+    # decided at build time of the NixOS configration. Thus, don't decide this
+    # here but just point to the location of the shell on the system.
+    substituteInPlace configure.ac --replace-fail '$SHELL' /bin/sh
   '';
 
   # `AC_FUNC_SETPGRP' is not cross-compilation capable.

pkgs/by-name/sh/shadow/runtime-shell.patch

···
-diff --git a/configure.ac b/configure.ac
-index e4c6aaec..03883ad7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -682,7 +682,7 @@ if test "$enable_utmpx" = "yes"; then
- 	          [Define if utmpx should be used])
- fi
- 
--AC_DEFINE_UNQUOTED(SHELL, ["$SHELL"], [The default shell.])
-+AC_DEFINE_UNQUOTED(SHELL, ["$RUNTIME_SHELL"], [The runtime shell.])
- 
- AM_GNU_GETTEXT_VERSION(0.16)
- AM_GNU_GETTEXT([external], [need-ngettext])

pkgs/by-name/sl/slstatus/package.nix

···
   pkg-config,
   writeText,
   libX11,
+  libxcb,
   libXau,
   libXdmcp,
   config,
···
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libX11
+    libxcb
     libXau
     libXdmcp
   ]

pkgs/by-name/so/sointu/package.nix

···
 {
-  buildGo123Module,
+  buildGoModule,
   fetchFromGitHub,
   lib,
   pkg-config,
···
   xorg,
 }:
 
-buildGo123Module {
+buildGoModule {
   pname = "sointu";
   version = "0.4.1-unstable-2025-08-13";
 

pkgs/by-name/sp/spirv-llvm-translator/package.nix

···
 
 let
   llvmMajor = lib.versions.major llvm.version;
-  isROCm = lib.hasPrefix "rocm" llvm.pname;
 
-  # ROCm, if actively updated will always be at the latest version
   versions = {
+    "21" = rec {
+      version = "21.1.0";
+      rev = "v${version}";
+      hash = "sha256-kk8BbPl/UBW1gaO/cuOQ9OsiNTEk0TkvRDLKUAh6exk=";
+    };
+    "20" = rec {
+      version = "20.1.5";
+      rev = "v${version}";
+      hash = "sha256-GdlC/Vl61nTNdua2s+CW2YOvkSKK6MNOvBc/393iths=";
+    };
     "19" = rec {
-      version = "19.1.6";
+      version = "19.1.10";
       rev = "v${version}";
-      hash = "sha256-mUvDF5y+cBnqUaHjyiiE8cJGH5MfQMqGFy6bYv9vCVY=";
+      hash = "sha256-VgA47AGMnOKYNeW95nxJZzmKnYK8D/9okgssPnPqXXI=";
     };
     "18" = rec {
-      version = "18.1.11";
+      version = "18.1.15";
       rev = "v${version}";
-      hash = "sha256-VoALyFqShKL3bpeoOIdKoseNfDWiRE+j0ppHapXOmEU=";
+      hash = "sha256-rt3RTZut41uDEh0YmpOzH3sOezeEVWtAIGMKCHLSJBw=";
     };
     "17" = rec {
-      version = "17.0.11";
+      version = "17.0.15";
       rev = "v${version}";
-      hash = "sha256-Ba4GZS7Rc93Fphj2xaBZ3AqwXvxB9UU0gzPNoDEoaQM=";
+      hash = "sha256-ETpTQYMMApECDfuRY87HrO/PUxZ13x9dBRJ3ychslUI=";
     };
     "16" = rec {
-      version = "16.0.11";
+      version = "16.0.15";
       rev = "v${version}";
-      hash = "sha256-PI4cT/PGqpaF5SysOTrEE4D+OcIUsIOMzww4CRPtwBQ=";
+      hash = "sha256-30i73tGl+1KlP92XA0uxdMTydd9EtaQ4SZ0W1kdm1fQ=";
     };
     "15" = rec {
-      version = "15.0.14";
+      version = "15.0.15";
       rev = "v${version}";
-      hash = "sha256-6DiCO2VEEQFdKmnH5vzUZ2MQ7lducb5dKkpewwx9uE4=";
+      hash = "sha256-kFVDS+qwoG1AXrZ8LytoiLVbZkTGR9sO+Wrq3VGgWNQ=";
     };
-    "14" = {
-      version = "14.0.11+unstable-2025-01-28";
-      rev = "9df26b6af308cb834a4013deb8094f386f29accd";
-      hash = "sha256-8VRQwXFbLcYgHtWKs73yuTsy2kkCgYgPqD+W/GPy1BM=";
+    "14" = rec {
+      version = "14.0.14";
+      rev = "v${version}";
+      hash = "sha256-PW+5w93omLYPZXjRtU4BNY2ztZ86pcjgUQZkrktMq+4=";
     };
   };
 
-  branch =
-    versions."${if isROCm then "17" else llvmMajor}"
-      or (throw "Incompatible LLVM version ${llvmMajor}");
+  branch = versions."${llvmMajor}" or (throw "Incompatible LLVM version ${llvmMajor}");
 in
 stdenv.mkDerivation {
   pname = "SPIRV-LLVM-Translator";
···
   nativeBuildInputs = [
     pkg-config
     cmake
-  ]
-  ++ (if isROCm then [ llvm ] else [ llvm.dev ]);
+    llvm.dev
+  ];
 
   buildInputs = [
     spirv-headers
     spirv-tools
-  ]
-  ++ lib.optionals (!isROCm) [ llvm ];
+    llvm
+  ];
 
   nativeCheckInputs = [ lit ];
 
   cmakeFlags = [
     "-DLLVM_INCLUDE_TESTS=ON"
-    "-DLLVM_DIR=${(if isROCm then llvm else llvm.dev)}"
+    "-DLLVM_DIR=${llvm.dev}"
     "-DBUILD_SHARED_LIBS=YES"
     "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
     # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
     "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}"
   ]
-  ++ lib.optional (llvmMajor == "19") "-DBASE_LLVM_VERSION=${lib.versions.majorMinor llvm.version}.0";
+  ++ lib.optional (
+    lib.toInt llvmMajor >= 19
+  ) "-DBASE_LLVM_VERSION=${lib.versions.majorMinor llvm.version}.0";
 
   # FIXME: CMake tries to run "/llvm-lit" which of course doesn't exist
   doCheck = false;
···
     license = licenses.ncsa;
     platforms = platforms.unix;
     maintainers = with maintainers; [ gloaming ];
+
+    # For the LLVM 21 build some commits to spirv-headers
+    # are required that didn't make it into the final release of 1.4.321
+    # For example: 9e3836d Add SPV_INTEL_function_variants
+    # Once spirv-headers are released again and updated on nixpkgs,
+    # this will switch over to the nixpkgs version and should no
+    # longer be broken.
+    broken = llvmMajor == "21" && lib.versionOlder spirv-headers.version "1.4.322";
   };
 }

pkgs/by-name/st/stash/package.nix

···
 {
-  buildGo123Module,
+  buildGoModule,
   fetchFromGitHub,
   fetchYarnDeps,
   lib,
···
     dontFixup = true;
   });
 in
-buildGo123Module {
+buildGoModule {
   inherit
     pname
     src

pkgs/by-name/ta/taglib/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "taglib";
-  version = "2.1";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "taglib";
     repo = "taglib";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1eIx4Lp/GZEBdHJcMN1zvctxJK2OAywuPzBwgtZgbmE=";
+    hash = "sha256-pzsjZgtr9icfXWxsZoA5GXf9k3gh92DzJRcp87T0PVQ=";
   };
 
   strictDeps = true;

pkgs/by-name/te/teleport_16/package.nix

···
 {
   buildTeleport,
-  buildGo124Module,
+  buildGoModule,
   wasm-bindgen-cli_0_2_95,
 }:
 buildTeleport rec {
···
   cargoHash = "sha256-04zykCcVTptEPGy35MIWG+tROKFzEepLBmn04mSbt7I=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_95;
-  buildGoModule = buildGo124Module;
+  inherit buildGoModule;
 }

pkgs/by-name/te/teleport_17/package.nix

···
 {
   buildTeleport,
-  buildGo124Module,
+  buildGoModule,
   wasm-bindgen-cli_0_2_95,
 }:
 
···
   pnpmHash = "sha256-ZONs8z8mgBBQBmqaDGJKqhmtUKBrxE8BGYppbAqpQmg=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_95;
-  buildGoModule = buildGo124Module;
+  inherit buildGoModule;
 }

pkgs/by-name/tr/transset/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libx11,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "transset";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/transset-${finalAttrs.version}.tar.xz";
+    hash = "sha256-gamrdK8TdzOqjLajf4KSlIUm/n7wa4WfwP8nLEN8Czg=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libx11
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility for setting opacity/transparency property on a window";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/transset";
+    license = with lib.licenses; [
+      mit
+      mitOpenGroup
+      hpndSellVariant
+    ];
+    mainProgram = "transset";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/um/umockdev/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "umockdev";
-  version = "0.19.2";
+  version = "0.19.3";
 
   outputs = [
     "bin"
···
 
   src = fetchurl {
     url = "https://github.com/martinpitt/umockdev/releases/download/${finalAttrs.version}/umockdev-${finalAttrs.version}.tar.xz";
-    hash = "sha256-b92mdUTzZslfFVbeDR+C2xPyMbwDYsffA8w0uiaykmg=";
+    hash = "sha256-RuReq29la/wJJDjX4OXfTF9R0Y46gzYMK+aAsgehoLc=";
   };
 
   patches = [

pkgs/by-name/ut/util-linux/package.nix

···
     patchShebangs tests/run.sh tools/all_syscalls tools/all_errnos
 
     substituteInPlace sys-utils/eject.c \
-      --replace "/bin/umount" "$bin/bin/umount"
+      --replace-fail "/bin/umount" "$bin/bin/umount"
+
+    # fix `mount -t` tab completion
+    substituteInPlace bash-completion/{blkid,mount,umount} \
+      --replace-fail "/lib/modules" "/run/booted-system/kernel-modules/lib/modules"
   ''
   + lib.optionalString shadowSupport ''
     substituteInPlace include/pathnames.h \
-      --replace "/bin/login" "${shadow}/bin/login"
+      --replace-fail "/bin/login" "${shadow}/bin/login"
   ''
   + lib.optionalString stdenv.hostPlatform.isFreeBSD ''
     substituteInPlace lib/c_strtod.c --replace-fail __APPLE__ __FreeBSD__
···
       ${lib.optionalString (!stdenv.hostPlatform.isStatic) ''moveToOutput "lib/security" "$lastlog"''}
       moveToOutput "lib/tmpfiles.d/lastlog2-tmpfiles.conf" "$lastlog"
 
+      moveToOutput "bin/lastlog2" "$lastlog"
+      ln -svf "$lastlog/bin/"* $bin/bin/
+    ''
+    + lib.optionalString (withLastlog && systemdSupport) ''
       moveToOutput "lib/systemd/system/lastlog2-import.service" "$lastlog"
       substituteInPlace $lastlog/lib/systemd/system/lastlog2-import.service \
         --replace-fail "$bin/bin/lastlog2" "$lastlog/bin/lastlog2"
-
-      moveToOutput "bin/lastlog2" "$lastlog"
-      ln -svf "$lastlog/bin/"* $bin/bin/
     ''
     + lib.optionalString stdenv.hostPlatform.isLinux ''
 

pkgs/by-name/ut/util-macros/package.nix

···
 {
   lib,
   stdenv,
-  fetchurl,
-  pkg-config,
-  automake,
-  autoconf,
-  libtool,
+  fetchFromGitLab,
   testers,
-  writeScript,
+  gitUpdater,
+  autoreconfHook,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "util-macros";
   version = "1.20.2";
 
-  src = fetchurl {
-    url = "mirror://xorg/individual/util/util-macros-${finalAttrs.version}.tar.xz";
-    hash = "sha256-msJp66JPZy19ezV05L5fMz0T8Ep3EjA7GCGypRrILo4=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    group = "xorg";
+    owner = "util";
+    repo = "macros";
+    tag = "util-macros-${finalAttrs.version}";
+    hash = "sha256-COIWe7GMfbk76/QUIRsN5yvjd6MEarI0j0M+Xa0WoKQ=";
   };
 
   strictDeps = true;
 
-  nativeBuildInputs = [ pkg-config ];
-
-  # not needed for releases, we propagate the needed tools
-  propagatedNativeBuildInputs = [
-    automake
-    autoconf
-    libtool
-  ];
+  nativeBuildInputs = [ autoreconfHook ];
 
   passthru = {
     tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-    updateScript = writeScript "update-${finalAttrs.pname}" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p common-updater-scripts
-      version="$(list-directory-versions --pname ${finalAttrs.pname} \
-        --url https://xorg.freedesktop.org/releases/individual/util/ \
-        | sort -V | tail -n1)"
-      update-source-version ${finalAttrs.pname} "$version"
-    '';
+    updateScript = gitUpdater {
+      rev-prefix = "util-macros-";
+      ignoredVersions = "1_0_2";
+    };
   };
 
   meta = {
···
       hpndSellVariant
       mit
     ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      raboof
+      jopejoe1
+    ];
     pkgConfigModules = [ "xorg-macros" ];
     platforms = lib.platforms.unix;
   };

pkgs/by-name/uv/uv/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.8.6";
+  version = "0.8.14";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-82KKnz42Nn2Ef8DHBWBMPTrQVsM+klIOV8hqSKnXqEY=";
+    hash = "sha256-KG6WNaHbrPBasHdSdtWrnvzwMRrvpwukVSIZe3COrUA=";
   };
 
-  cargoHash = "sha256-l2/PMPiSPE6WpXOuU21NsMx0vsz9cuy/QeCiSTkbvVw=";
+  cargoHash = "sha256-Ow39kxnACXVbEtCPGJJ7SKdTFhYwd9IDPbYAsvNPOKw=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/by-name/w3/w3m/package.nix

···
 {
   lib,
   stdenv,
-  fetchFromGitHub,
+  fetchFromSourcehut,
   fetchpatch,
   ncurses,
   boehmgc,
···
     '';
   };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "w3m";
-  version = "0.5.3+git20230121";
+  version = "0.5.5";
 
-  src = fetchFromGitHub {
-    owner = "tats";
+  src = fetchFromSourcehut {
+    owner = "~rkta";
     repo = "w3m";
-    rev = "v${version}";
-    hash = "sha256-upb5lWqhC1jRegzTncIz5e21v4Pw912FyVn217HucFs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rz9tNkMg5xUqMpMdK2AQlKjCJlCjgLQOkj4A/eyPm0M=";
   };
 
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isSunOS "-lsocket -lnsl";
+  env = {
+    NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isSunOS "-lsocket -lnsl";
+
+    # we must set these so that the generated files (e.g. w3mhelp.cgi) contain
+    # the correct paths.
+    PERL = "${perl}/bin/perl";
+    MAN = "${man}/bin/man";
 
-  # we must set these so that the generated files (e.g. w3mhelp.cgi) contain
-  # the correct paths.
-  PERL = "${perl}/bin/perl";
-  MAN = "${man}/bin/man";
+    # for w3mimgdisplay
+    # see: https://bbs.archlinux.org/viewtopic.php?id=196093
+    LIBS = lib.optionalString x11Support "-lX11";
+  };
 
   makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
 
···
 
   enableParallelBuilding = false;
 
-  # for w3mimgdisplay
-  # see: https://bbs.archlinux.org/viewtopic.php?id=196093
-  LIBS = lib.optionalString x11Support "-lX11";
-
   passthru.tests.version = testers.testVersion {
-    inherit version;
+    inherit (finalAttrs) version;
     package = w3m;
     command = "w3m -version";
   };
 
   meta = {
-    homepage = "https://w3m.sourceforge.net/";
-    changelog = "https://github.com/tats/w3m/blob/v${version}/ChangeLog";
+    homepage = "https://git.sr.ht/~rkta/w3m";
+    changelog = "https://git.sr.ht/~rkta/w3m/tree/v${finalAttrs.version}/item/NEWS";
     description = "Text-mode web browser";
-    maintainers = with lib.maintainers; [ anthonyroussel ];
+    maintainers = with lib.maintainers; [
+      anthonyroussel
+      toastal
+    ];
     platforms = lib.platforms.unix;
     license = lib.licenses.mit;
     mainProgram = "w3m";
   };
-}
+})

pkgs/by-name/wl/wlx-overlay-s/package.nix

···
   lib,
   libGL,
   libX11,
+  libxcb,
   libXext,
   libXrandr,
   libxkbcommon,
···
     fontconfig
     libGL
     libX11
+    libxcb
     libXext
     libXrandr
     libxkbcommon

pkgs/by-name/xc/xcmsdb/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libx11,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xcmsdb";
+  version = "1.0.7";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xcmsdb-${finalAttrs.version}.tar.xz";
+    hash = "sha256-XsQGjkiBh7BeqS7hNiyWt4qQ8ZzMehhExZIdcGJrvDg=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libx11 ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Device Color Characterization utility for X Color Management System";
+    longDescription = ''
+      xcmsdb is used to load, query, or remove Device Color Characterization data stored in
+      properties on the root window of the screen as specified in section 7, Device Color
+      Characterization, of the X11 Inter-Client Communication Conventions Manual (ICCCM).
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xcmsdb";
+    license = with lib.licenses; [
+      hpnd
+      mitOpenGroup
+    ];
+    mainProgram = "xcmsdb";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xc/xcursor-themes/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xcursorgen,
+  xorgproto,
+  libxcursor,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xcursor-themes";
+  version = "1.0.7";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/data/xcursor-themes-${finalAttrs.version}.tar.xz";
+    hash = "sha256-lbro9Igj2JSgW/Qt+/RTZ0q3296xHivAeehSWtRzeMg=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    pkg-config
+    xcursorgen
+  ];
+  buildInputs = [
+    xorgproto
+    libxcursor
+  ];
+
+  configureFlags = [ "--with-cursordir=$(out)/share/icons" ];
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/data/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Default set of cursor themes for use with libXcursor.";
+    homepage = "https://gitlab.freedesktop.org/xorg/data/cursors";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xc/xcursorgen/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libpng,
+  libx11,
+  libxcursor,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xcursorgen";
+  version = "1.0.9";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xcursorgen-${finalAttrs.version}.tar.xz";
+    hash = "sha256-DMnhVqyEyhbqkCcQrzXg+v+lHRN5cHHjtLbMfL1JO7w=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libpng
+    libx11
+    libxcursor
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "prepares X11 cursor sets for use with libXcursor";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xcursorgen";
+    license = lib.licenses.hpndSellVariant;
+    mainProgram = "xcursorgen";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xd/xdriinfo/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libGL,
+  xorgproto,
+  libx11,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xdriinfo";
+  version = "1.0.8";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xdriinfo-${finalAttrs.version}.tar.xz";
+    hash = "sha256-AEYwVkNbgiYcInrQ3hhz/UU2EBYH+8V1QOKOSgqbcfc=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libGL
+    xorgproto
+    libx11
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to query configuration information of X11 DRI drivers";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xdriinfo";
+    license = lib.licenses.mit;
+    mainProgram = "xdriinfo";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xd/xdummy/package.nix

···
       ModulePath "${xorg.xorgserver.out}/lib/xorg/modules"
       ModulePath "${xorg.xf86videodummy}/lib/xorg/modules"
       XkbDir "${xkeyboard_config}/share/X11/xkb"
-      FontPath "${xorg.fontadobe75dpi}/lib/X11/fonts/75dpi"
-      FontPath "${xorg.fontadobe100dpi}/lib/X11/fonts/100dpi"
+      FontPath "${xorg.fontadobe75dpi}/share/fonts/X11/75dpi"
+      FontPath "${xorg.fontadobe100dpi}/share/fonts/X11/100dpi"
       FontPath "${xorg.fontmiscmisc}/lib/X11/fonts/misc"
       FontPath "${xorg.fontcursormisc}/lib/X11/fonts/misc"
     ${lib.optionalString unfreeFonts ''

pkgs/by-name/xe/xev/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxrandr,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xev";
+  version = "1.2.6";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xev-${finalAttrs.version}.tar.xz";
+    hash = "sha256-YeHF4AismXOsp83d826d90EOdwg7Aw6wT03HN8UYB9c=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    xorgproto
+    libx11
+    libxrandr
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "X event monitor";
+    longDescription = ''
+      xev creates a window and then asks the X server to send it X11 events whenever anything
+      happens to the window (such as it being moved, resized, typed in, clicked in, etc.).
+      You can also attach it to an existing window. It is useful for seeing what causes events to
+      occur and to display the information that they contain; it is essentially a debugging and
+      development tool, and should not be needed in normal usage.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xev";
+    license = lib.licenses.x11;
+    mainProgram = "xev";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xf/xfsinfo/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libfs,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xfsinfo";
+  version = "1.0.8";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xfsinfo-${finalAttrs.version}.tar.xz";
+    hash = "sha256-roBZK2Bj2pKOPQyBAjcJsvopoE/NpJ9sNjrFedl/I6I=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libfs
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "X font server information utility";
+    longDescription = ''
+      xfsinfo is a utility for displaying information about an X font server.
+      It is used to examine the capabilities of a server, the predefined values for various
+      parameters used in communicating between clients and the server, and the font catalogues and
+      alternate servers that are available.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xfsinfo";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpndSellVariant
+    ];
+    mainProgram = "xfsinfo";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xg/xgamma/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxxf86vm,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xgamma";
+  version = "1.0.8";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xgamma-${finalAttrs.version}.tar.xz";
+    hash = "sha256-mPn2nlOhHDVKZjfqXD12mc61xbH4rW8KFNmTHloQ0Hk=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxxf86vm
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to query and alter the gamma correction of a X monitor";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xgamma";
+    license = with lib.licenses; [
+      x11
+      hpndSellVariant
+    ];
+    mainProgram = "xgamma";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xg/xgc/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libxaw,
+  libxt,
+  wrapWithXFileSearchPathHook,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xgc";
+  version = "1.0.7";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xgc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-2FgljAXqrC0fSLtEgg3C3OCmhgGhT/+XhTxytI0bfQg=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapWithXFileSearchPathHook
+  ];
+
+  buildInputs = [
+    libxaw
+    libxt
+  ];
+
+  installFlags = [ "appdefaultdir=$(out)/share/X11/app-defaults" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Demo to show various features of the X11 core protocol graphics primitives";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xgc";
+    license = with lib.licenses; [
+      x11
+      mit
+    ];
+    mainProgram = "xgc";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xh/xhost/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  gettext,
+  xorgproto,
+  libx11,
+  libxau,
+  libxmu,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xhost";
+  version = "1.0.10";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xhost-${finalAttrs.version}.tar.xz";
+    hash = "sha256-qK/XAFlHnHEpSLiV5Bw1pKi/zt47otWkuFXIi7tyW+E=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    gettext
+  ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxau
+    libxmu
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "X server access control program";
+    longDescription = ''
+      xhost is used to manage the list of host names or user names allowed to make connections to
+      the X server.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xhost";
+    license = with lib.licenses; [
+      mit
+      icu
+    ];
+    mainProgram = "xhost";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xi/xidlehook/package.nix

···
 
   buildInputs = [
     xorg.libX11
+    xorg.libxcb
     xorg.libXScrnSaver
     libpulseaudio
   ];

pkgs/by-name/xk/xkbmon/package.nix

···
   stdenv,
   fetchFromGitHub,
   libX11,
+  libxcb,
 }:
 
 stdenv.mkDerivation rec {
···
     sha256 = "sha256-EWW6L6NojzXodDOET01LMcQT8/1JIMpOD++MCiM3j1Y=";
   };
 
-  buildInputs = [ libX11 ];
+  buildInputs = [
+    libX11
+    libxcb
+  ];
 
   installPhase = "install -D -t $out/bin xkbmon";
 

pkgs/by-name/xk/xkbutils/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxaw,
+  libxt,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xkbutils";
+  version = "1.0.6";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xkbutils-${finalAttrs.version}.tar.xz";
+    hash = "sha256-MaK77h4JzLoB3pKJe49UC1Rd6BLzGNMd4HvTpade4l4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxaw
+    libxt
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Collection of small XKB utilities";
+    longDescription = ''
+      xkbutils is a collection of small utilities using the X Keyboard extenison:
+      - xkbbell: generate X Keyboard Extension bell events
+      - xkbvleds: display X Keyboard Extension LED state in a window
+      - xkbwatch: report state changes using the X Keyboard Extension
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xkbutils";
+    license = with lib.licenses; [
+      hpnd
+      hpndDec
+      mit
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xk/xkill/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxmu,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xkill";
+  version = "1.0.6";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xkill-${finalAttrs.version}.tar.xz";
+    hash = "sha256-5aiqeMR1Z3sRUEZG2o2T2swwdEJYB2ospBiiRDiuuQc=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxmu
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to forcibly terminate X11 clients";
+    longDescription = ''
+      xkill is a utility for forcing the X server to close connections to clients.
+      This program is very dangerous, but is useful for aborting programs that have displayed
+      undesired windows on a user's screen.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xkill";
+    license = lib.licenses.mitOpenGroup;
+    mainProgram = "xkill";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xl/xlogo/package.nix

···
   xorg,
   autoreconfHook,
   pkg-config,
-  xorg-autoconf,
+  util-macros,
 }:
 
 stdenv.mkDerivation rec {
···
   };
 
   nativeBuildInputs = [
-    xorg-autoconf
+    util-macros
     autoreconfHook
     pkg-config
   ];

pkgs/by-name/xl/xlsatoms/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libxcb,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xlsatoms";
+  version = "1.1.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xlsatoms-${finalAttrs.version}.tar.xz";
+    hash = "sha256-9L+hX1bAZtMmpdWykmRnCPJbkkdQaEC5BHzSaH3Mcbc=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libxcb ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to list interned atoms defined on X server";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xlsatoms";
+    license = lib.licenses.mitOpenGroup;
+    mainProgram = "xlsatoms";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xl/xlsclients/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libxcb,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xlsclients";
+  version = "1.1.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xlsclients-${finalAttrs.version}.tar.xz";
+    hash = "sha256-aLruV+cCUKxKd1n7eCIYMfl9iLyOUdzC5k6z+MpWuuM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libxcb ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to list client applications running on a X11 display";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xlsclients";
+    license = with lib.licenses; [
+      mitOpenGroup
+      mit
+    ];
+    mainProgram = "xlsclients";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xl/xlsfonts/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libx11,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xlsfonts";
+  version = "1.0.8";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xlsfonts-${finalAttrs.version}.tar.xz";
+    hash = "sha256-gH+QnqzmhLhm/GOz6WJynBIIIqbJbgUf9RzzULP/ts0=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libx11
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to list core protocol fonts on an X server";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xlsfonts";
+    license = lib.licenses.mitOpenGroup;
+    mainProgram = "xlsfonts";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xm/xmodmap/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libx11,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xmodmap";
+  version = "1.0.11";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xmodmap-${finalAttrs.version}.tar.xz";
+    hash = "sha256-mi+BaPewvDgoKIR0A5Astr8XXhdlizYYnqyH7dqHfoE=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libx11
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility for modifying keymaps and pointer button mappings in X";
+    longDescription = ''
+      The xmodmap program is used to edit and display the keyboard modifier map and keymap table
+      that are used by client applications to convert event keycodes into keysyms. It is usually run
+      from the user's session startup script to configure the keyboard according to personal tastes.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xmodmap";
+    license = with lib.licenses; [
+      mit
+      mitOpenGroup
+    ];
+    mainProgram = "xmodmap";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xo/xorg-autoconf/package.nix

···
-{
-  lib,
-  stdenv,
-  autoreconfHook,
-  fetchFromGitLab,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "xorg-autoconf";
-  version = "1.19.3";
-
-  src = fetchFromGitLab {
-    domain = "gitlab.freedesktop.org";
-    group = "xorg";
-    owner = "util";
-    repo = "macros";
-    rev = "util-macros-${version}";
-    sha256 = "sha256-+yEMCjLztdY5LKTNjfhudDS0fdaOj4LKZ3YL5witFR4=";
-  };
-
-  nativeBuildInputs = [ autoreconfHook ];
-
-  meta = with lib; {
-    description = "GNU autoconf macros shared across X.Org projects";
-    homepage = "https://gitlab.freedesktop.org/xorg/util/macros";
-    maintainers = with maintainers; [ raboof ];
-    license = licenses.mit;
-    platforms = platforms.unix;
-  };
-}

pkgs/by-name/xp/xprop/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libx11,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xprop";
+  version = "1.2.8";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xprop-${finalAttrs.version}.tar.xz";
+    hash = "sha256-1onirbfve0OfZGm1HNqKfa78gyQ4VMKjuPhNDwKdZ+4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libx11
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Command line tool to display and/or set window and font properties of an X server";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xprop";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpndSellVariant
+      mit
+    ];
+    mainProgram = "xprop";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xr/xrandr/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxrandr,
+  libxrender,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xrandr";
+  version = "1.5.3";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xrandr-${finalAttrs.version}.tar.xz";
+    hash = "sha256-+N11Zq23QUf6uZZGgLa7re6Hz0Bqf8/1Fxil5pSbhBw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxrandr
+    libxrender
+  ];
+
+  postInstall = ''
+    # remove useless xkeystone script
+    # it is written in a language not packaged in nixpkgs
+    rm $out/bin/xkeystone
+  '';
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Command line interface to X11 Resize, Rotate, and Reflect (RandR) extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xrandr";
+    license = lib.licenses.hpndSellVariant;
+    mainProgram = "xrandr";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xr/xrefresh/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libx11,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xrefresh";
+  version = "1.1.0";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xrefresh-${finalAttrs.version}.tar.xz";
+    hash = "sha256-Ke1ZLV7ONaMCkATYxG8wAvkpcIcKlsEeOLr38RIri18=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libx11
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to refresh all or part of an X screen";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xrefresh";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpnd
+    ];
+    mainProgram = "xrefresh";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xs/xscope/package.nix

···
   fetchFromGitLab,
   pkg-config,
   autoreconfHook,
-  xorg-autoconf,
+  util-macros,
   xorg,
 }:
 
···
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
-    xorg-autoconf
+    util-macros
   ];
 
   buildInputs = [

pkgs/by-name/xt/xterm/package.nix

···
     maintainers = with lib.maintainers; [ nequissimus ];
     platforms = with lib.platforms; linux ++ darwin;
     changelog = "https://invisible-island.net/xterm/xterm.log.html";
+    mainProgram = "xterm";
   };
 }

pkgs/by-name/xv/xvinfo/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxv,
+  libxext,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xvinfo";
+  version = "1.1.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xvinfo-${finalAttrs.version}.tar.xz";
+    hash = "sha256-Pt5x7LJtlhTMvGkWcgKF6VosfgxeGbhXDqr3KtfFxAQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxv
+    libxext
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to print out X-Video extension adaptor information";
+    longDescription = ''
+      xvinfo prints out the capabilities of any video adaptors associated with the display that are
+      accessible through the X-Video extension.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xvinfo";
+    license = lib.licenses.x11;
+    mainProgram = "xvinfo";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xw/xwininfo/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libx11,
+  libxcb,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xwininfo";
+  version = "1.1.6";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xwininfo-${finalAttrs.version}.tar.xz";
+    hash = "sha256-NRiJfBdEjfm6ma1tm7HKDxe8DtfA/WEoGzTO7SmpJT8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libx11
+    libxcb
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to print information about windows on an X server";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xwininfo";
+    license = with lib.licenses; [
+      mit
+      # mit-open-group with icu disclaimer ?!
+      # close enough to mit-open-group
+      mitOpenGroup
+      hpndSellVariant
+    ];
+    mainProgram = "xwininfo";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/xw/xwud/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libx11,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xwud";
+  version = "1.0.7";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xwud-${finalAttrs.version}.tar.xz";
+    hash = "sha256-5Vy+2rNtel9nGr+OWUiIr8SMqhFtUdQp6lPqMX7Axh4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libx11
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to display an image in XWD (X Window Dump) format";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xwud";
+    license = lib.licenses.mitOpenGroup;
+    mainProgram = "xwud";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/zi/zimg/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "zimg";
-  version = "3.0.5";
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     owner = "sekrit-twc";
     repo = "zimg";
     rev = "release-${version}";
-    sha256 = "sha256-DCSqHCnOyIvKtIAfprb8tgtzLn67Ix6BWyeIliu0HO4=";
+    sha256 = "sha256-T+/wuTxPK+PLofqJm3dujGqGGXhpdGQLjAttTQPsgOI=";
   };
 
   outputs = [

pkgs/by-name/zl/zlib-ng/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "zlib-ng";
-  version = "2.2.4";
+  version = "2.2.5";
 
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = "zlib-ng";
     rev = version;
-    hash = "sha256-Khmrhp5qy4vvoQe4WgoogpjWrgcUB/q8zZeqIydthYg=";
+    hash = "sha256-c2RYqHi3hj/ViBzJcYWoNib27GAbq/B1SJUfvG7CPG4=";
   };
 
   outputs = [

pkgs/development/compilers/go/1.23.nix

···
-{
-  lib,
-  stdenv,
-  fetchurl,
-  tzdata,
-  replaceVars,
-  iana-etc,
-  mailcap,
-  buildPackages,
-  pkgsBuildTarget,
-  targetPackages,
-  testers,
-  skopeo,
-  buildGo123Module,
-}:
-
-let
-  goBootstrap = buildPackages.callPackage ./bootstrap121.nix { };
-
-  skopeoTest = skopeo.override { buildGoModule = buildGo123Module; };
-
-  # We need a target compiler which is still runnable at build time,
-  # to handle the cross-building case where build != host == target
-  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
-
-  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "go";
-  version = "1.23.12";
-
-  src = fetchurl {
-    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-4czpN5ok6JVxSkEsfd0VfSYU2e2+g6hESbbhhAtPEiY=";
-  };
-
-  strictDeps = true;
-  buildInputs =
-    [ ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.libc.out ]
-    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
-
-  depsBuildTarget = lib.optional isCross targetCC;
-
-  depsTargetTarget = lib.optional stdenv.targetPlatform.isMinGW targetPackages.threads.package;
-
-  postPatch = ''
-    patchShebangs .
-  '';
-
-  patches = [
-    (replaceVars ./iana-etc-1.17.patch {
-      iana = iana-etc;
-    })
-    # Patch the mimetype database location which is missing on NixOS.
-    # but also allow static binaries built with NixOS to run outside nix
-    (replaceVars ./mailcap-1.17.patch {
-      inherit mailcap;
-    })
-    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
-    # that run outside a nix server
-    (replaceVars ./tzdata-1.19.patch {
-      inherit tzdata;
-    })
-    ./remove-tools-1.11.patch
-    ./go_no_vendor_checks-1.23.patch
-  ];
-
-  inherit (stdenv.targetPlatform.go) GOOS GOARCH GOARM;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.go.GOOS;
-  GOHOSTARCH = stdenv.buildPlatform.go.GOARCH;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET = if isCross then "${targetCC}/bin/${targetCC.targetPrefix}cc" else null;
-  CXX_FOR_TARGET = if isCross then "${targetCC}/bin/${targetCC.targetPrefix}c++" else null;
-
-  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
-  # Wasi does not support CGO
-  CGO_ENABLED = if stdenv.targetPlatform.isWasi then 0 else 1;
-
-  GOROOT_BOOTSTRAP = "${goBootstrap}/share/go";
-
-  buildPhase = ''
-    runHook preBuild
-    export GOCACHE=$TMPDIR/go-cache
-
-    export PATH=$(pwd)/bin:$PATH
-
-    ${lib.optionalString isCross ''
-      # Independent from host/target, CC should produce code for the building system.
-      # We only set it when cross-compiling.
-      export CC=${buildPackages.stdenv.cc}/bin/cc
-    ''}
-    ulimit -a
-
-    pushd src
-    ./make.bash
-    popd
-    runHook postBuild
-  '';
-
-  preInstall = ''
-    # Contains the wrong perl shebang when cross compiling,
-    # since it is not used for anything we can deleted as well.
-    rm src/regexp/syntax/make_perl_groups.pl
-  ''
-  + (
-    if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then
-      ''
-        mv bin/*_*/* bin
-        rmdir bin/*_*
-        ${lib.optionalString
-          (!(finalAttrs.GOHOSTARCH == finalAttrs.GOARCH && finalAttrs.GOOS == finalAttrs.GOHOSTOS))
-          ''
-            rm -rf pkg/${finalAttrs.GOHOSTOS}_${finalAttrs.GOHOSTARCH} pkg/tool/${finalAttrs.GOHOSTOS}_${finalAttrs.GOHOSTARCH}
-          ''
-        }
-      ''
-    else
-      lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
-        rm -rf bin/*_*
-        ${lib.optionalString
-          (!(finalAttrs.GOHOSTARCH == finalAttrs.GOARCH && finalAttrs.GOOS == finalAttrs.GOHOSTOS))
-          ''
-            rm -rf pkg/${finalAttrs.GOOS}_${finalAttrs.GOARCH} pkg/tool/${finalAttrs.GOOS}_${finalAttrs.GOARCH}
-          ''
-        }
-      ''
-  );
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/share/go
-    cp -a bin pkg src lib misc api doc go.env VERSION $out/share/go
-    mkdir -p $out/bin
-    ln -s $out/share/go/bin/* $out/bin
-    runHook postInstall
-  '';
-
-  disallowedReferences = [ goBootstrap ];
-
-  passthru = {
-    inherit goBootstrap skopeoTest;
-    tests = {
-      skopeo = testers.testVersion { package = skopeoTest; };
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-        command = "go version";
-        version = "go${finalAttrs.version}";
-      };
-    };
-  };
-
-  meta = with lib; {
-    changelog = "https://go.dev/doc/devel/release#go${finalAttrs.version}";
-    description = "Go Programming language";
-    homepage = "https://go.dev/";
-    license = licenses.bsd3;
-    teams = [ teams.golang ];
-    platforms = platforms.darwin ++ platforms.linux ++ platforms.wasi ++ platforms.freebsd;
-    badPlatforms = [
-      # Support for big-endian POWER < 8 was dropped in 1.9, but POWER8 users have less of a reason to run in big-endian mode than pre-POWER8 ones
-      # So non-LE ppc64 is effectively unsupported, and Go SIGILLs on affordable ppc64 hardware
-      # https://github.com/golang/go/issues/19074 - Dropped support for big-endian POWER < 8, with community pushback
-      # https://github.com/golang/go/issues/73349 - upstream will not accept submissions to fix this
-      "powerpc64-linux"
-    ];
-    mainProgram = "go";
-  };
-})

pkgs/development/compilers/go/1.24.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.24.6";
+  version = "1.24.7";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-4ctVgqq1iGaLwEwH3hhogHD2uMmyqvNh+CHhm9R8/b0=";
+    hash = "sha256-Ko9Q2w+IgDYHxQ1+qINNy3vUg8a0KKkeNg/fhiS0ZGQ=";
   };
 
   strictDeps = true;

pkgs/development/compilers/go/1.25.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.1";
+  version = "1.25.0";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-0BDBCc7pTYDv5oHqtGvepJGskGv0ZYPDLp8NuwvRpZQ=";
+    hash = "sha256-S9AekSlyB7+kUOpA1NWpOxtTGl5DhHOyoG4Y4HciciU=";
   };
 
   strictDeps = true;

pkgs/development/compilers/llvm/20/libclc/use-default-paths.patch

···
+From e8b910246d0c7c3d9fff994f71c6f8a48ec09a50 Mon Sep 17 00:00:00 2001
+From: Tristan Ross <[e-mail]>
+Date: Sat, 24 Aug 2024 19:56:24 -0700
+Subject: [PATCH] [libclc] use default paths with find_program when possible
+
+---
+ libclc/CMakeLists.txt | 4 ++--
+ 1 file changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 02bb859ae8590b..6bcd8ae52a5794 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -55,7 +55,7 @@ if( LIBCLC_STANDALONE_BUILD OR CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DI
+   # Import required tools
+   if( NOT EXISTS ${LIBCLC_CUSTOM_LLVM_TOOLS_BINARY_DIR} )
+     foreach( tool IN ITEMS clang llvm-as llvm-link opt )
+-      find_program( LLVM_TOOL_${tool} ${tool} PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )
++      find_program( LLVM_TOOL_${tool} ${tool} PATHS ${LLVM_TOOLS_BINARY_DIR} )
+       set( ${tool}_exe ${LLVM_TOOL_${tool}} )
+       set( ${tool}_target )
+     endforeach()

pkgs/development/compilers/llvm/21/libclc/gnu-install-dirs.patch

···
+--- a/libclc.pc.in
++++ b/libclc.pc.in
+@@ -1,4 +1,4 @@
+-libexecdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_DATADIR@/clc
++libexecdir=@CMAKE_INSTALL_FULL_DATADIR@/clc
+ 
+ Name: libclc
+ Description: Library requirements of the OpenCL C programming language

pkgs/development/compilers/llvm/common/default.nix

···
     }
     //
       lib.optionalAttrs
-        (lib.versionAtLeast metadata.release_version "16" && lib.versionOlder metadata.release_version "20")
+        (lib.versionAtLeast metadata.release_version "16" && lib.versionOlder metadata.release_version "22")
         {
           libclc = callPackage ./libclc { };
         }

pkgs/development/compilers/llvm/common/libclc/default.nix

···
   ];
 
   patches = [
-    ./libclc-gnu-install-dirs.patch
+    (getVersionFile "libclc/gnu-install-dirs.patch")
   ]
   # LLVM 19 changes how host tools are looked up.
   # Need to remove NO_DEFAULT_PATH and the PATHS arguments for find_program
···
     ninja
     python3
   ]
-  ++ lib.optional (lib.versionAtLeast release_version "19") [
+  ++ lib.optionals (lib.versionAtLeast release_version "19") [
     clang-only
     buildLlvmTools.llvm
     spirv-llvm-translator

pkgs/development/compilers/llvm/common/patches.nix

···
   "libclc/use-default-paths.patch" = [
     {
       after = "19";
+      before = "20";
       path = ../19;
+    }
+    {
+      after = "20";
+      path = ../20;
+    }
+  ];
+  "libclc/gnu-install-dirs.patch" = [
+    {
+      after = "16";
+      before = "21";
+      path = ../16;
+    }
+    {
+      after = "21";
+      path = ../21;
     }
   ];
 }

pkgs/development/compilers/llvm/common/tblgen.nix

···
     else
       src;
 
+  # List of tablegen targets.
+  targets = [
+    "clang-tblgen"
+    "llvm-tblgen"
+  ]
+  ++ lib.optionals (lib.versionAtLeast release_version "15") [
+    "clang-tidy-confusable-chars-gen"
+  ]
+  ++ lib.optionals (lib.versionAtLeast release_version "16") [
+    "mlir-tblgen"
+  ]
+  ++
+    lib.optionals ((lib.versionAtLeast release_version "15") && (lib.versionOlder release_version "20"))
+      [
+        "clang-pseudo-gen" # Removed in LLVM 20 @ ed8f78827895050442f544edef2933a60d4a7935.
+      ];
+
   self = stdenv.mkDerivation (finalAttrs: {
     inherit pname version patches;
 
     src = src';
     sourceRoot = "${finalAttrs.src.name}/llvm";
+
+    __structuredAttrs = true;
 
     postPatch = ''
       (
···
     ]
     ++ devExtraCmakeFlags;
 
-    # List of tablegen targets.
-    ninjaFlags = [
-      "clang-tblgen"
-      "llvm-tblgen"
-    ]
-    ++ lib.optionals (lib.versionAtLeast release_version "15") [
-      "clang-tidy-confusable-chars-gen"
-    ]
-    ++ lib.optionals (lib.versionAtLeast release_version "16") [
-      "mlir-tblgen"
-    ]
-    ++
-      lib.optionals ((lib.versionAtLeast release_version "15") && (lib.versionOlder release_version "20"))
-        [
-          "clang-pseudo-gen" # Removed in LLVM 20 @ ed8f78827895050442f544edef2933a60d4a7935.
-        ];
+    ninjaFlags = targets;
+
+    inherit targets;
 
     installPhase = ''
-      mkdir -p $out
-      cp -ar bin $out/bin
+      mkdir -p $out/bin
+      cp "''${targets[@]/#/bin/}" $out/bin
     '';
   });
 in

pkgs/development/compilers/openjdk/21/source.json

···
 {
-  "hash": "sha256-H2ed09+1qafIDsHYDYRIcE9nyWwQagVyE563ROlNTtk=",
+  "hash": "sha256-8wUwxjhAGIp1bzny2e86vPH9q4vw1kLDoTjO7FrJbx4=",
   "owner": "openjdk",
   "repo": "jdk21u",
-  "rev": "refs/tags/jdk-21.0.7+6"
+  "rev": "refs/tags/jdk-21.0.8+9"
 }

pkgs/development/compilers/rust/rustc.nix

···
         stdenv: "${prefixForStdenv stdenv}${if (stdenv.cc.isClang or false) then "clang" else "cc"}";
       cxxPrefixForStdenv =
         stdenv: "${prefixForStdenv stdenv}${if (stdenv.cc.isClang or false) then "clang++" else "c++"}";
-      setBuild = "--set=target.\"${stdenv.buildPlatform.rust.rustcTarget}\"";
-      setHost = "--set=target.\"${stdenv.hostPlatform.rust.rustcTarget}\"";
-      setTarget = "--set=target.\"${stdenv.targetPlatform.rust.rustcTarget}\"";
+      setBuild = "--set=target.\"${stdenv.buildPlatform.rust.rustcTargetSpec}\"";
+      setHost = "--set=target.\"${stdenv.hostPlatform.rust.rustcTargetSpec}\"";
+      setTarget = "--set=target.\"${stdenv.targetPlatform.rust.rustcTargetSpec}\"";
       ccForBuild = ccPrefixForStdenv pkgsBuildBuild.targetPackages.stdenv;
       cxxForBuild = cxxPrefixForStdenv pkgsBuildBuild.targetPackages.stdenv;
       ccForHost = ccPrefixForStdenv pkgsBuildHost.targetPackages.stdenv;

pkgs/development/compilers/sbcl/default.nix

···
     "2.4.10".sha256 = "sha256-zus5a2nSkT7uBIQcKva+ylw0LOFGTD/j5FPy3hDF4vg=";
     # By unofficial and very loose convention we keep the latest version of
     # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.5.4".sha256 = "sha256-XxS07ZKUKp44dZT6wAC5bbdGfpzlYTBn/8CSPfPsIHI=";
     "2.5.5".sha256 = "sha256-ZQJnCvs2G6m+RKL6/pr5tZ57JK5QmnkaZrVIHylVlQs=";
+    "2.5.7".sha256 = "sha256-xPr+t5VpnVvP+QhQkazHYtz15V+FI1Yl89eu8SyJ0dM=";
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other

pkgs/development/compilers/zulu/21.nix

···
   ...
 }@args:
 
+let
+  # JDK FX can potentially be different version than regular JDK
+  zuluVersion = if enableJavaFX then "21.44.17" else "21.44.17";
+  jdkVersion = "21.0.8";
+in
 callPackage ./common.nix (
   {
     # Details from https://www.azul.com/downloads/?version=java-21-lts&package=jdk
     # Note that the latest build may differ by platform
     dists = {
       x86_64-linux = {
-        zuluVersion = "21.36.17";
-        jdkVersion = "21.0.4";
+        inherit zuluVersion jdkVersion;
         hash =
           if enableJavaFX then
-            "sha256-Q2bdM0/a2t5aBRCIzXBlhXamf8N7wdSUsK5VhaU9DcY="
+            "sha256-T+bGfe0IoYwX1Odh66CdRL1fzbvA63NqM9e2hLCbx2Y="
           else
-            "sha256-MY0MLtPIdvt+oslSlFzc997PtSZMpRrs4VnmNaxT1UQ=";
+            "sha256-Y/Vru0aVjPVzUvugjydV4JU3mRleVUWswMipKSC+/x4=";
       };
 
       aarch64-linux = {
-        zuluVersion = "21.36.17";
-        jdkVersion = "21.0.4";
+        inherit zuluVersion jdkVersion;
         hash =
           if enableJavaFX then
-            "sha256-BzNEcDrQo5yOWnEsJxw9JfXYdZGN6/wxnTDB0qC1i/0="
+            "sha256-6qFwo2rBV+mbEFDZNoqEs3z+2saj31fsOHG9jToST2Q="
           else
-            "sha256-2jwtfbM2cLz2ZTJEGut/M9zw0ifI2v5841zuZ/aCnEw=";
+            "sha256-/38u3R1cFTy2y0k6OqNSNFPimgXsUTslwkqhR37AxyI=";
       };
 
       x86_64-darwin = {
-        zuluVersion = "21.36.17";
-        jdkVersion = "21.0.4";
+        inherit zuluVersion jdkVersion;
         hash =
           if enableJavaFX then
-            "sha256-H3gM2XCCcuUxlAEzX6IO7Cp6NtH85PYHlH54k5XvNAc="
+            "sha256-PGnYq+9MskgczsEjx4aH5yDYjZLw8Tk8IZSMOXw03aw="
           else
-            "sha256-XOdaaiR8cCm3TEynz29g/SstaM4eiVb7RI0phDFrX+o=";
+            "sha256-KvCAUAtcwoamNTGHx8WbWq/LPtwpwch9H9cbotalI/E=";
       };
 
       aarch64-darwin = {
-        zuluVersion = "21.36.17";
-        jdkVersion = "21.0.4";
+        inherit zuluVersion jdkVersion;
         hash =
           if enableJavaFX then
-            "sha256-lLAb8MABo95A5WcayBLNvsBSdVFptnO4EmhX2gjo6r8="
+            "sha256-Bj1cYFfm3dq+HB9tdnFwT7onVQ9Slf0zRFBK4z9LUoY="
           else
-            "sha256-vCdQ+BoWbMbpwwroqrpU8lOoyOydjPwEpVX+IHEse/8=";
+            "sha256-0izgX+o+PyjIxZ8sNIvHjulnvxKJpPsoeWzAF3/2yNs=";
       };
     };
   }

pkgs/development/interpreters/php/generic.nix

···
       libargon2,
       libxml2,
       pcre2,
-      systemd,
+      systemdLibs,
       system-sendmail,
       valgrind,
       xcbuild,
···
       ipv6Support ? true,
       zendSignalsSupport ? true,
       zendMaxExecutionTimersSupport ? false,
-      systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+      systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
       valgrindSupport ?
         !stdenv.hostPlatform.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind,
       ztsSupport ? apxs2Support,
···
             # Misc deps
             ++ lib.optional apxs2Support apacheHttpd
             ++ lib.optional argon2Support libargon2
-            ++ lib.optional systemdSupport systemd
+            ++ lib.optional systemdSupport systemdLibs
             ++ lib.optional valgrindSupport valgrind;
 
           CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";

pkgs/development/interpreters/python/cpython/3.13/revert-gh134724.patch

···
-commit 4a37dd6cef1556c64c2665061b5e01bbd2bb3a82
-Author: Gregory P. Smith <[e-mail]>
-Date:   Sun Jul 27 08:30:25 2025 -0700
-
-    [3.13] gh-134698: Hold a lock when the thread state is detached in ssl (GH-134724) (#137126)
-    
-    Lock when the thread state is detached.
-    (cherry picked from commit e047a35b23c1aa69ab8d5da56f36319cec4d36b8) or really from the 3.14 backport fd565fdfc9c0001900d03d627e2fda83f1bcca90
-    
-    Co-authored-by: Peter Bierma <[e-mail]>
-
-diff --git b/Modules/_ssl.c a/Modules/_ssl.c
-index 981c3d6a936..aa846f68641 100644
---- b/Modules/_ssl.c
-+++ a/Modules/_ssl.c
-@@ -42,14 +42,14 @@
- /* Redefined below for Windows debug builds after important #includes */
- #define _PySSL_FIX_ERRNO
- 
--#define PySSL_BEGIN_ALLOW_THREADS_S(save, mutex) \
--    do { (save) = PyEval_SaveThread(); PyMutex_Lock(mutex); } while(0)
--#define PySSL_END_ALLOW_THREADS_S(save, mutex) \
--    do { PyMutex_Unlock(mutex); PyEval_RestoreThread(save); _PySSL_FIX_ERRNO; } while(0)
--#define PySSL_BEGIN_ALLOW_THREADS(self) { \
-+#define PySSL_BEGIN_ALLOW_THREADS_S(save) \
-+    do { (save) = PyEval_SaveThread(); } while(0)
-+#define PySSL_END_ALLOW_THREADS_S(save) \
-+    do { PyEval_RestoreThread(save); _PySSL_FIX_ERRNO; } while(0)
-+#define PySSL_BEGIN_ALLOW_THREADS { \
-             PyThreadState *_save = NULL;  \
--            PySSL_BEGIN_ALLOW_THREADS_S(_save, &self->tstate_mutex);
--#define PySSL_END_ALLOW_THREADS(self) PySSL_END_ALLOW_THREADS_S(_save, &self->tstate_mutex); }
-+            PySSL_BEGIN_ALLOW_THREADS_S(_save);
-+#define PySSL_END_ALLOW_THREADS PySSL_END_ALLOW_THREADS_S(_save); }
- 
- #if defined(HAVE_POLL_H)
- #include <poll.h>
-@@ -304,9 +304,6 @@ typedef struct {
-     PyObject *psk_client_callback;
-     PyObject *psk_server_callback;
- #endif
--    /* Lock to synchronize calls when the thread state is detached.
--       See also gh-134698. */
--    PyMutex tstate_mutex;
- } PySSLContext;
- 
- typedef struct {
-@@ -332,9 +329,6 @@ typedef struct {
-      * and shutdown methods check for chained exceptions.
-      */
-     PyObject *exc;
--    /* Lock to synchronize calls when the thread state is detached.
--       See also gh-134698. */
--    PyMutex tstate_mutex;
- } PySSLSocket;
- 
- typedef struct {
-@@ -846,14 +840,13 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
-     self->server_hostname = NULL;
-     self->err = err;
-     self->exc = NULL;
--    self->tstate_mutex = (PyMutex){0};
- 
-     /* Make sure the SSL error state is initialized */
-     ERR_clear_error();
- 
--    PySSL_BEGIN_ALLOW_THREADS(sslctx)
-+    PySSL_BEGIN_ALLOW_THREADS
-     self->ssl = SSL_new(ctx);
--    PySSL_END_ALLOW_THREADS(sslctx)
-+    PySSL_END_ALLOW_THREADS
-     if (self->ssl == NULL) {
-         Py_DECREF(self);
-         _setSSLError(get_state_ctx(self), NULL, 0, __FILE__, __LINE__);
-@@ -919,12 +912,12 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
-         BIO_set_nbio(SSL_get_wbio(self->ssl), 1);
-     }
- 
--    PySSL_BEGIN_ALLOW_THREADS(self)
-+    PySSL_BEGIN_ALLOW_THREADS
-     if (socket_type == PY_SSL_CLIENT)
-         SSL_set_connect_state(self->ssl);
-     else
-         SSL_set_accept_state(self->ssl);
--    PySSL_END_ALLOW_THREADS(self)
-+    PySSL_END_ALLOW_THREADS
- 
-     self->socket_type = socket_type;
-     if (sock != NULL) {
-@@ -993,10 +986,10 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)
-     /* Actually negotiate SSL connection */
-     /* XXX If SSL_do_handshake() returns 0, it's also a failure. */
-     do {
--        PySSL_BEGIN_ALLOW_THREADS(self)
-+        PySSL_BEGIN_ALLOW_THREADS
-         ret = SSL_do_handshake(self->ssl);
-         err = _PySSL_errno(ret < 1, self->ssl, ret);
--        PySSL_END_ALLOW_THREADS(self)
-+        PySSL_END_ALLOW_THREADS
-         self->err = err;
- 
-         if (PyErr_CheckSignals())
-@@ -2369,10 +2362,9 @@ PySSL_select(PySocketSockObject *s, int writing, PyTime_t timeout)
-     ms = (int)_PyTime_AsMilliseconds(timeout, _PyTime_ROUND_CEILING);
-     assert(ms <= INT_MAX);
- 
--    Py_BEGIN_ALLOW_THREADS
-+    PySSL_BEGIN_ALLOW_THREADS
-     rc = poll(&pollfd, 1, (int)ms);
--    Py_END_ALLOW_THREADS
--    _PySSL_FIX_ERRNO;
-+    PySSL_END_ALLOW_THREADS
- #else
-     /* Guard against socket too large for select*/
-     if (!_PyIsSelectable_fd(s->sock_fd))
-@@ -2384,14 +2376,13 @@ PySSL_select(PySocketSockObject *s, int writing, PyTime_t timeout)
-     FD_SET(s->sock_fd, &fds);
- 
-     /* Wait until the socket becomes ready */
--    Py_BEGIN_ALLOW_THREADS
-+    PySSL_BEGIN_ALLOW_THREADS
-     nfds = Py_SAFE_DOWNCAST(s->sock_fd+1, SOCKET_T, int);
-     if (writing)
-         rc = select(nfds, NULL, &fds, NULL, &tv);
-     else
-         rc = select(nfds, &fds, NULL, NULL, &tv);
--    Py_END_ALLOW_THREADS
--    _PySSL_FIX_ERRNO;
-+    PySSL_END_ALLOW_THREADS
- #endif
- 
-     /* Return SOCKET_TIMED_OUT on timeout, SOCKET_OPERATION_OK otherwise
-@@ -2462,10 +2453,10 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
-     }
- 
-     do {
--        PySSL_BEGIN_ALLOW_THREADS(self)
-+        PySSL_BEGIN_ALLOW_THREADS
-         retval = SSL_write_ex(self->ssl, b->buf, (size_t)b->len, &count);
-         err = _PySSL_errno(retval == 0, self->ssl, retval);
--        PySSL_END_ALLOW_THREADS(self)
-+        PySSL_END_ALLOW_THREADS
-         self->err = err;
- 
-         if (PyErr_CheckSignals())
-@@ -2523,10 +2514,10 @@ _ssl__SSLSocket_pending_impl(PySSLSocket *self)
-     int count = 0;
-     _PySSLError err;
- 
--    PySSL_BEGIN_ALLOW_THREADS(self)
-+    PySSL_BEGIN_ALLOW_THREADS
-     count = SSL_pending(self->ssl);
-     err = _PySSL_errno(count < 0, self->ssl, count);
--    PySSL_END_ALLOW_THREADS(self)
-+    PySSL_END_ALLOW_THREADS
-     self->err = err;
- 
-     if (count < 0)
-@@ -2617,10 +2608,10 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
-         deadline = _PyDeadline_Init(timeout);
- 
-     do {
--        PySSL_BEGIN_ALLOW_THREADS(self)
-+        PySSL_BEGIN_ALLOW_THREADS
-         retval = SSL_read_ex(self->ssl, mem, (size_t)len, &count);
-         err = _PySSL_errno(retval == 0, self->ssl, retval);
--        PySSL_END_ALLOW_THREADS(self)
-+        PySSL_END_ALLOW_THREADS
-         self->err = err;
- 
-         if (PyErr_CheckSignals())
-@@ -2719,7 +2710,7 @@ _ssl__SSLSocket_shutdown_impl(PySSLSocket *self)
-     }
- 
-     while (1) {
--        PySSL_BEGIN_ALLOW_THREADS(self)
-+        PySSL_BEGIN_ALLOW_THREADS
-         /* Disable read-ahead so that unwrap can work correctly.
-          * Otherwise OpenSSL might read in too much data,
-          * eating clear text data that happens to be
-@@ -2732,7 +2723,7 @@ _ssl__SSLSocket_shutdown_impl(PySSLSocket *self)
-             SSL_set_read_ahead(self->ssl, 0);
-         ret = SSL_shutdown(self->ssl);
-         err = _PySSL_errno(ret < 0, self->ssl, ret);
--        PySSL_END_ALLOW_THREADS(self)
-+        PySSL_END_ALLOW_THREADS
-         self->err = err;
- 
-         /* If err == 1, a secure shutdown with SSL_shutdown() is complete */
-@@ -3124,10 +3115,9 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
-     // no other thread can be touching this object yet.
-     // (Technically, we can't even lock if we wanted to, as the
-     // lock hasn't been initialized yet.)
--    Py_BEGIN_ALLOW_THREADS
-+    PySSL_BEGIN_ALLOW_THREADS
-     ctx = SSL_CTX_new(method);
--    Py_END_ALLOW_THREADS
--    _PySSL_FIX_ERRNO;
-+    PySSL_END_ALLOW_THREADS
- 
-     if (ctx == NULL) {
-         _setSSLError(get_ssl_state(module), NULL, 0, __FILE__, __LINE__);
-@@ -3153,7 +3143,6 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
-     self->psk_client_callback = NULL;
-     self->psk_server_callback = NULL;
- #endif
--    self->tstate_mutex = (PyMutex){0};
- 
-     /* Don't check host name by default */
-     if (proto_version == PY_SSL_VERSION_TLS_CLIENT) {
-@@ -3270,10 +3259,9 @@ context_clear(PySSLContext *self)
-     Py_CLEAR(self->psk_server_callback);
- #endif
-     if (self->keylog_bio != NULL) {
--        Py_BEGIN_ALLOW_THREADS
-+        PySSL_BEGIN_ALLOW_THREADS
-         BIO_free_all(self->keylog_bio);
--        Py_END_ALLOW_THREADS
--        _PySSL_FIX_ERRNO;
-+        PySSL_END_ALLOW_THREADS
-         self->keylog_bio = NULL;
-     }
-     return 0;
-@@ -3992,8 +3980,7 @@ _password_callback(char *buf, int size, int rwflag, void *userdata)
-     _PySSLPasswordInfo *pw_info = (_PySSLPasswordInfo*) userdata;
-     PyObject *fn_ret = NULL;
- 
--    pw_info->thread_state = PyThreadState_Swap(pw_info->thread_state);
--    _PySSL_FIX_ERRNO;
-+    PySSL_END_ALLOW_THREADS_S(pw_info->thread_state);
- 
-     if (pw_info->error) {
-         /* already failed previously. OpenSSL 3.0.0-alpha14 invokes the
-@@ -4023,13 +4010,13 @@ _password_callback(char *buf, int size, int rwflag, void *userdata)
-         goto error;
-     }
- 
--    pw_info->thread_state = PyThreadState_Swap(pw_info->thread_state);
-+    PySSL_BEGIN_ALLOW_THREADS_S(pw_info->thread_state);
-     memcpy(buf, pw_info->password, pw_info->size);
-     return pw_info->size;
- 
- error:
-     Py_XDECREF(fn_ret);
--    pw_info->thread_state = PyThreadState_Swap(pw_info->thread_state);
-+    PySSL_BEGIN_ALLOW_THREADS_S(pw_info->thread_state);
-     pw_info->error = 1;
-     return -1;
- }
-@@ -4082,10 +4069,10 @@ _ssl__SSLContext_load_cert_chain_impl(PySSLContext *self, PyObject *certfile,
-         SSL_CTX_set_default_passwd_cb(self->ctx, _password_callback);
-         SSL_CTX_set_default_passwd_cb_userdata(self->ctx, &pw_info);
-     }
--    PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state, &self->tstate_mutex);
-+    PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state);
-     r = SSL_CTX_use_certificate_chain_file(self->ctx,
-         PyBytes_AS_STRING(certfile_bytes));
--    PySSL_END_ALLOW_THREADS_S(pw_info.thread_state, &self->tstate_mutex);
-+    PySSL_END_ALLOW_THREADS_S(pw_info.thread_state);
-     if (r != 1) {
-         if (pw_info.error) {
-             ERR_clear_error();
-@@ -4100,11 +4087,11 @@ _ssl__SSLContext_load_cert_chain_impl(PySSLContext *self, PyObject *certfile,
-         }
-         goto error;
-     }
--    PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state, &self->tstate_mutex);
-+    PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state);
-     r = SSL_CTX_use_PrivateKey_file(self->ctx,
-         PyBytes_AS_STRING(keyfile ? keyfile_bytes : certfile_bytes),
-         SSL_FILETYPE_PEM);
--    PySSL_END_ALLOW_THREADS_S(pw_info.thread_state, &self->tstate_mutex);
-+    PySSL_END_ALLOW_THREADS_S(pw_info.thread_state);
-     Py_CLEAR(keyfile_bytes);
-     Py_CLEAR(certfile_bytes);
-     if (r != 1) {
-@@ -4121,9 +4108,9 @@ _ssl__SSLContext_load_cert_chain_impl(PySSLContext *self, PyObject *certfile,
-         }
-         goto error;
-     }
--    PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state, &self->tstate_mutex);
-+    PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state);
-     r = SSL_CTX_check_private_key(self->ctx);
--    PySSL_END_ALLOW_THREADS_S(pw_info.thread_state, &self->tstate_mutex);
-+    PySSL_END_ALLOW_THREADS_S(pw_info.thread_state);
-     if (r != 1) {
-         _setSSLError(get_state_ctx(self), NULL, 0, __FILE__, __LINE__);
-         goto error;
-@@ -4340,9 +4327,9 @@ _ssl__SSLContext_load_verify_locations_impl(PySSLContext *self,
-             cafile_buf = PyBytes_AS_STRING(cafile_bytes);
-         if (capath)
-             capath_buf = PyBytes_AS_STRING(capath_bytes);
--        PySSL_BEGIN_ALLOW_THREADS(self)
-+        PySSL_BEGIN_ALLOW_THREADS
-         r = SSL_CTX_load_verify_locations(self->ctx, cafile_buf, capath_buf);
--        PySSL_END_ALLOW_THREADS(self)
-+        PySSL_END_ALLOW_THREADS
-         if (r != 1) {
-             if (errno != 0) {
-                 PyErr_SetFromErrno(PyExc_OSError);
-@@ -4394,11 +4381,10 @@ _ssl__SSLContext_load_dh_params_impl(PySSLContext *self, PyObject *filepath)
-         return NULL;
- 
-     errno = 0;
--    Py_BEGIN_ALLOW_THREADS
-+    PySSL_BEGIN_ALLOW_THREADS
-     dh = PEM_read_DHparams(f, NULL, NULL, NULL);
-     fclose(f);
--    Py_END_ALLOW_THREADS
--    _PySSL_FIX_ERRNO;
-+    PySSL_END_ALLOW_THREADS
-     if (dh == NULL) {
-         if (errno != 0) {
-             PyErr_SetFromErrnoWithFilenameObject(PyExc_OSError, filepath);
-@@ -4550,7 +4536,6 @@ _ssl__SSLContext_set_default_verify_paths_impl(PySSLContext *self)
-     Py_BEGIN_ALLOW_THREADS
-     rc = SSL_CTX_set_default_verify_paths(self->ctx);
-     Py_END_ALLOW_THREADS
--    _PySSL_FIX_ERRNO;
-     if (!rc) {
-         _setSSLError(get_state_ctx(self), NULL, 0, __FILE__, __LINE__);
-         return NULL;
-diff --git b/Modules/_ssl/debughelpers.c a/Modules/_ssl/debughelpers.c
-index fb8ae7c4e0b..5fc69a07184 100644
---- b/Modules/_ssl/debughelpers.c
-+++ a/Modules/_ssl/debughelpers.c
-@@ -135,15 +135,13 @@ _PySSL_keylog_callback(const SSL *ssl, const char *line)
-      * critical debug helper.
-      */
- 
--    assert(PyMutex_IsLocked(&ssl_obj->tstate_mutex));
--    Py_BEGIN_ALLOW_THREADS
-+    PySSL_BEGIN_ALLOW_THREADS
-     PyThread_acquire_lock(lock, 1);
-     res = BIO_printf(ssl_obj->ctx->keylog_bio, "%s\n", line);
-     e = errno;
-     (void)BIO_flush(ssl_obj->ctx->keylog_bio);
-     PyThread_release_lock(lock);
--    Py_END_ALLOW_THREADS
--    _PySSL_FIX_ERRNO;
-+    PySSL_END_ALLOW_THREADS
- 
-     if (res == -1) {
-         errno = e;
-@@ -179,10 +177,9 @@ _PySSLContext_set_keylog_filename(PySSLContext *self, PyObject *arg, void *c) {
-     if (self->keylog_bio != NULL) {
-         BIO *bio = self->keylog_bio;
-         self->keylog_bio = NULL;
--        Py_BEGIN_ALLOW_THREADS
-+        PySSL_BEGIN_ALLOW_THREADS
-         BIO_free_all(bio);
--        Py_END_ALLOW_THREADS
--        _PySSL_FIX_ERRNO;
-+        PySSL_END_ALLOW_THREADS
-     }
- 
-     if (arg == Py_None) {
-@@ -204,13 +201,13 @@ _PySSLContext_set_keylog_filename(PySSLContext *self, PyObject *arg, void *c) {
-     self->keylog_filename = Py_NewRef(arg);
- 
-     /* Write a header for seekable, empty files (this excludes pipes). */
--    PySSL_BEGIN_ALLOW_THREADS(self)
-+    PySSL_BEGIN_ALLOW_THREADS
-     if (BIO_tell(self->keylog_bio) == 0) {
-         BIO_puts(self->keylog_bio,
-                  "# TLS secrets log file, generated by OpenSSL / Python\n");
-         (void)BIO_flush(self->keylog_bio);
-     }
--    PySSL_END_ALLOW_THREADS(self)
-+    PySSL_END_ALLOW_THREADS
-     SSL_CTX_set_keylog_callback(self->ctx, _PySSL_keylog_callback);
-     return 0;
- }

pkgs/development/interpreters/python/cpython/default.nix

···
   expat,
   libffi,
   libuuid,
-  withLibxcrypt ? !withMinimalDeps,
   libxcrypt,
   withMpdecimal ? !withMinimalDeps,
   mpdecimal,
···
   windows,
 
   # optional dependencies
-  bluezSupport ? false,
-  bluez,
+  bluezSupport ? !withMinimalDeps && stdenv.hostPlatform.isLinux,
+  bluez-headers,
   mimetypesSupport ? !withMinimalDeps,
   mailcap,
   tzdata,
···
   gdbm,
   withReadline ? !withMinimalDeps && !stdenv.hostPlatform.isWindows,
   readline,
-  x11Support ? false,
-  tcl,
-  tk,
-  tclPackages,
-  libX11,
-  xorgproto,
 
   # splicing/cross
   pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}",
···
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-assert x11Support -> tcl != null && tk != null && xorgproto != null && libX11 != null;
-
-assert bluezSupport -> bluez != null;
-
 assert lib.assertMsg (
   enableFramework -> stdenv.hostPlatform.isDarwin
 ) "Framework builds are only supported on Darwin.";
···
     optionals
     optionalString
     replaceStrings
-    versionOlder
     ;
 
-  # mixes libc and libxcrypt headers and libs and causes segfaults on importing crypt
-  libxcrypt = if stdenv.hostPlatform.isFreeBSD && withMinimalDeps then null else inputs.libxcrypt;
+  withLibxcrypt =
+    (!withMinimalDeps)
+    &&
+      # mixes libc and libxcrypt headers and libs and causes segfaults on importing crypt
+      (!stdenv.hostPlatform.isFreeBSD)
+    &&
+      # crypt module was removed in 3.13
+      passthru.pythonOlder "3.13";
 
   buildPackages = pkgsBuildHost;
   inherit (passthru) pythonOnBuildForHost;
···
   passthru =
     let
       # When we override the interpreter we also need to override the spliced versions of the interpreter
-      # bluez is excluded manually to break an infinite recursion.
-      inputs' = lib.filterAttrs (n: v: n != "bluez" && n != "passthruFun" && !lib.isDerivation v) inputs;
+      inputs' = lib.filterAttrs (n: v: n != "passthruFun" && !lib.isDerivation v) inputs;
       # Memoization of the splices to avoid re-evaluating this function for all combinations of splices e.g.
       # python3.pythonOnBuildForHost.pythonOnBuildForTarget == python3.pythonOnBuildForTarget by consuming
       # __splices as an arg and using the cache if populated.
···
       zstd
     ]
     ++ optionals bluezSupport [
-      bluez
+      bluez-headers
     ]
     ++ optionals stdenv.hostPlatform.isMinGW [
       windows.dlfcn
···
     ++ optionals withReadline [
       readline
     ]
-    ++ optionals x11Support [
-      libX11
-      tcl
-      tk
-      xorgproto
-    ]
   );
 
   hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
···
   ++ optionals (pythonAtLeast "3.13") [
     ./3.13/virtualenv-permissions.patch
   ]
-  ++ optionals isPy313 [
-    # https://github.com/python/cpython/issues/137583
-    ./3.13/revert-gh134724.patch
-  ]
   ++ optionals mimetypesSupport [
     # Make the mimetypes module refer to the right file
     ./mimetypes.patch
···
     + optionalString mimetypesSupport ''
       substituteInPlace Lib/mimetypes.py \
         --replace-fail "@mime-types@" "${mailcap}"
-    ''
-    + optionalString (pythonOlder "3.13" && x11Support && ((tclPackages.tix or null) != null)) ''
-      substituteInPlace "Lib/tkinter/tix.py" --replace-fail \
-        "os.environ.get('TIX_LIBRARY')" \
-        "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
     '';
 
   env = {
···
         if stdenv.hostPlatform.isAarch64 then "uint128" else "x64"
       }'
   ''
-  + optionalString (stdenv.hostPlatform.isDarwin && x11Support && pythonAtLeast "3.11") ''
-    export TCLTK_LIBS="-L${tcl}/lib -L${tk}/lib -l${tcl.libPrefix} -l${tk.libPrefix}"
-    export TCLTK_CFLAGS="-I${tcl}/include -I${tk}/include"
-  ''
   + optionalString stdenv.hostPlatform.isWindows ''
     export NIX_CFLAGS_COMPILE+=" -Wno-error=incompatible-pointer-types"
   ''
···
     optionalString enableNoSemanticInterposition ''
       export CFLAGS_NODIST="-fno-semantic-interposition"
     '';
+
+  # Our aarch64-linux bootstrap files lack Scrt1.o, which fails the config test
+  hardeningEnable = lib.optionals (!withMinimalDeps && !stdenv.hostPlatform.isAarch64) [ "pie" ];
 
   setupHook = python-setup-hook sitePackages;
 

pkgs/development/interpreters/python/default.nix

···
         sourceVersion = {
           major = "3";
           minor = "13";
-          patch = "6";
+          patch = "7";
           suffix = "";
         };
-        hash = "sha256-F7pVCIGdhzahT7/EfTbhhJRqh3hRsunEtsQ6y0SjsQQ=";
+        hash = "sha256-VGL5CZ39MOI43vg8cdkYl9jKpf9uvHpQ8U1IAs2qp5o=";
       };
     };
 

pkgs/development/interpreters/ruby/config.nix

···
-# Ruby >= 2.1.0 tries to download config.{guess,sub}
-{ fetchFromSavannah }:
-
-fetchFromSavannah {
-  repo = "config";
-  rev = "576c839acca0e082e536fd27568b90a446ce5b96";
-  sha256 = "11bjngchjhj0qq0ppp8c37rfw0yhp230nvhs2jvlx15i9qbf56a0";
-}

pkgs/development/interpreters/ruby/default.nix

···
   lib,
   fetchurl,
   fetchpatch,
-  fetchFromSavannah,
   zlib,
   gdbm,
   ncurses,
···
   op = lib.optional;
   ops = lib.optionals;
   opString = lib.optionalString;
-  config = import ./config.nix { inherit fetchFromSavannah; };
   rubygems = import ./rubygems {
     inherit
       stdenv
···
           lib,
           fetchurl,
           fetchpatch,
-          fetchFromSavannah,
           rubygemsSupport ? true,
           zlib,
           zlibSupport ? true,
···
             cp -r ${rubygems}/lib/rubygems* $sourceRoot/lib
           '';
 
+          # Ruby >= 2.1.0 tries to download config.{guess,sub}; copy it from autoconf instead.
           postPatch = ''
             sed -i configure.ac -e '/config.guess/d'
-            cp --remove-destination ${config}/config.guess tool/
-            cp --remove-destination ${config}/config.sub tool/
+            cp --remove-destination ${autoconf}/share/autoconf/build-aux/config.{guess,sub} tool/
           '';
 
           configureFlags = [
···
   };
 
   ruby_3_3 = generic {
-    version = rubyVersion "3" "3" "8" "";
-    hash = "sha256-WuKKh6WaPkrWa8KTHSMturlT0KqPa687xPj4CXfInKs=";
+    version = rubyVersion "3" "3" "9" "";
+    hash = "sha256-0ZkWkKThcjPsazx4RMHhJFwK3OPgDXE1UdBFhGe3J7E=";
     cargoHash = "sha256-xE7Cv+NVmOHOlXa/Mg72CTSaZRb72lOja98JBvxPvSs=";
   };
 

pkgs/development/interpreters/spidermonkey/128.nix

···
 import ./common.nix {
-  version = "128.5.0";
-  hash = "sha512-/yDxj5LF6c0dnq98OM7GG8qy3KjdKBdRm3ErwfdgtcbikCEqzzKJFSdk5RMOAWJpULfs2TJ7LFh7JKJGWRr9Zw==";
+  version = "128.14.0";
+  hash = "sha512-o88mfoK29auLZJemKxL4Wvt4/K72sSxD73lWTOgnDTMnqHM2jOSPwBjkb+9eBzOcB7mklKX/bCKoQJn5Ofap3g==";
 }

pkgs/development/interpreters/spidermonkey/140-relax-apple-sdk.patch

···
+diff --git a/build/moz.configure/toolchain.configure b/build/moz.configure/toolchain.configure
+index 37c00230c853..dd89bea24392 100644
+--- a/build/moz.configure/toolchain.configure
++++ b/build/moz.configure/toolchain.configure
+@@ -233,7 +233,7 @@ with only_when(host_is_osx | target_is_osx):
+     )
+ 
+     def mac_sdk_min_version():
+-        return "15.5"
++        return "15.2"
+ 
+     @depends(
+         "--with-macos-sdk",

pkgs/development/interpreters/spidermonkey/91.nix

···
-import ./common.nix {
-  version = "91.13.0";
-  hash = "sha512-OLTMUt4h521gYea6F14cv9iIoWBwqpUfWkQoPy251+lPJQRiHw2nj+rG5xSRptDnA49j3QrhEtytcA6wLpqlFg==";
-}

pkgs/development/interpreters/spidermonkey/common.nix

···
   fetchpatch,
 
   # build time
+  apple-sdk_14,
+  apple-sdk_15,
   buildPackages,
   cargo,
   m4,
   perl,
   pkg-config,
   python3,
-  python311,
   rust-cbindgen,
   rustPlatform,
   rustc,
···
   };
 
   patches =
-    lib.optionals (lib.versionAtLeast version "102" && lib.versionOlder version "128") [
+    lib.optionals (lib.versionOlder version "128") [
       # use pkg-config at all systems
       ./always-check-for-pkg-config.patch
       ./allow-system-s-nspr-and-icu-on-bootstrapped-sysroot.patch
···
       ./always-check-for-pkg-config-128.patch
       ./allow-system-s-nspr-and-icu-on-bootstrapped-sysroot-128.patch
     ]
-    ++ lib.optionals (lib.versionAtLeast version "91" && stdenv.hostPlatform.system == "i686-linux") [
+    ++ lib.optionals (stdenv.hostPlatform.system == "i686-linux") [
       # Fixes i686 build, https://bugzilla.mozilla.org/show_bug.cgi?id=1729459
       ./fix-float-i686.patch
     ]
-    ++ lib.optionals (lib.versionAtLeast version "91" && lib.versionOlder version "102") [
-      # Fix 91 compatibility with python311
-      (fetchpatch {
-        url = "https://src.fedoraproject.org/rpms/mozjs91/raw/e3729167646775e60a3d8c602c0412e04f206baf/f/0001-Python-Build-Use-r-instead-of-rU-file-read-modes.patch";
-        hash = "sha256-WgDIBidB9XNQ/+HacK7jxWnjOF8PEUt5eB0+Aubtl48=";
-      })
-    ]
     ++ lib.optionals (lib.versionAtLeast version "140") [
       # mozjs-140.pc does not contain -DXP_UNIX on Linux
       # https://bugzilla.mozilla.org/show_bug.cgi?id=1973994
···
         url = "https://src.fedoraproject.org/rpms/mozjs140/raw/49492baa47bc1d7b7d5bc738c4c81b4661302f27/f/9aa8b4b051dd539e0fbd5e08040870b3c712a846.patch";
         hash = "sha256-SsyO5g7wlrxE7y2+VTHfmUDamofeZVqge8fv2y0ZhuU=";
       })
+      # SDK 15.5 is not available in nixpkgs yet
+      ./140-relax-apple-sdk.patch
     ];
 
   nativeBuildInputs = [
···
     m4
     perl
     pkg-config
-    # 91 does not build with python 3.12: ModuleNotFoundError: No module named 'six.moves'
-    # 102 does not build with python 3.12: ModuleNotFoundError: No module named 'distutils'
-    (if lib.versionOlder version "115" then python311 else python3)
+    python3
     rustc
     rustc.llvmPackages.llvm # for llvm-objdump
     which
···
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
+    (if (lib.versionAtLeast version "140") then apple-sdk_15 else apple-sdk_14)
   ];
 
   depsBuildBuild = [
···
     "--enable-readline"
     "--enable-release"
     "--enable-shared-js"
-  ]
-  ++ lib.optionals (lib.versionAtLeast version "91") [
     "--disable-debug"
   ]
   ++ lib.optionals (lib.versionAtLeast version "140") [
···
 
   enableParallelBuilding = true;
 
-  postPatch = lib.optionalString (lib.versionOlder version "102") ''
-    # This patch is a manually applied fix of
-    #   https://bugzilla.mozilla.org/show_bug.cgi?id=1644600
-    # Once that bug is fixed, this can be removed.
-    # This is needed in, for example, `zeroad`.
-    substituteInPlace js/public/StructuredClone.h \
-         --replace "class SharedArrayRawBufferRefs {" \
-                   "class JS_PUBLIC_API SharedArrayRawBufferRefs {"
-  '';
-
   preConfigure =
     lib.optionalString (lib.versionAtLeast version "128") ''
       export MOZBUILD_STATE_PATH=$TMPDIR/mozbuild
···
     + ''
       export LIBXUL_DIST=$out
       export PYTHON="${buildPackages.python3.interpreter}"
-    ''
-    + lib.optionalString (lib.versionAtLeast version "91") ''
       export M4=m4
       export AWK=awk
       export AS=$CC
       export AC_MACRODIR=$PWD/build/autoconf/
-
-    ''
-    + lib.optionalString (lib.versionAtLeast version "91" && lib.versionOlder version "115") ''
-      pushd js/src
-      sh ../../build/autoconf/autoconf.sh --localdir=$PWD configure.in > configure
-      chmod +x configure
-      popd
-    ''
-    + lib.optionalString (lib.versionAtLeast version "115") ''
       patchShebangs build/cargo-linker
-    ''
-    + ''
       # We can't build in js/src/, so create a build dir
       mkdir obj
       cd obj/
···
       catap
       bobby285271
     ];
-    broken = stdenv.hostPlatform.isDarwin; # 91 is broken, >=115 requires SDK 13.3 (see #242666).
+    # ERROR: Failed to find an adequate linker
+    broken = lib.versionOlder version "128" && stdenv.hostPlatform.isDarwin;
     platforms = platforms.unix;
   };
 })

pkgs/development/libraries/ffmpeg/generic.nix

···
   withFrei0r ? withFullDeps && withGPL, # frei0r video filtering
   withFribidi ? withHeadlessDeps, # Needed for drawtext filter
   withGme ? withFullDeps, # Game Music Emulator
+  withGmp ? withHeadlessDeps && withVersion3, # rtmp(t)e support
   withGnutls ? withHeadlessDeps,
   withGsm ? withFullDeps, # GSM de/encoder
   withHarfbuzz ? withHeadlessDeps && lib.versionAtLeast version "6.1", # Needed for drawtext filter
···
   withQuirc ? withFullDeps && lib.versionAtLeast version "7", # QR decoding
   withRav1e ? withFullDeps, # AV1 encoder (focused on speed and safety)
   withRist ? withHeadlessDeps, # Reliable Internet Stream Transport (RIST) protocol
-  withRtmp ? withFullDeps, # RTMP[E] support
+  withRtmp ? false, # RTMP[E] support via librtmp
   withRubberband ? withFullDeps && withGPL && !stdenv.hostPlatform.isFreeBSD, # Rubberband filter
   withSamba ? withFullDeps && !stdenv.hostPlatform.isDarwin && withGPLv3, # Samba protocol
   withSdl2 ? withSmallDeps,
···
   frei0r,
   fribidi,
   game-music-emu,
+  gmp,
   gnutls,
   gsm,
   harfbuzz,
···
       (enableFeature withFrei0r "frei0r")
       (enableFeature withFribidi "libfribidi")
       (enableFeature withGme "libgme")
+      (enableFeature withGmp "gmp")
       (enableFeature withGnutls "gnutls")
       (enableFeature withGsm "libgsm")
     ]
···
       ++ optionals withFrei0r [ frei0r ]
       ++ optionals withFribidi [ fribidi ]
       ++ optionals withGme [ game-music-emu ]
+      ++ optionals withGmp [ gmp ]
       ++ optionals withGnutls [ gnutls ]
       ++ optionals withGsm [ gsm ]
       ++ optionals withHarfbuzz [ harfbuzz ]

pkgs/development/libraries/gssdp/1.6.nix

···
   pkg-config,
   gobject-introspection,
   vala,
-  buildPackages,
-  enableManpages ? buildPackages.pandoc.compiler.bootstrapAvailable,
   gi-docgen,
   python3,
   libsoup_3,
···
     vala
     gi-docgen
     python3
-  ]
-  ++ lib.optionals enableManpages [ buildPackages.pandoc ];
+  ];
 
   buildInputs = [
     libsoup_3
···
   mesonFlags = [
     "-Dgtk_doc=true"
     "-Dsniffer=false"
-    (lib.mesonBool "manpages" enableManpages)
+    # This packages only has manpages for gssdp-device-sniffer, which we disabled above.
+    "-Dmanpages=false"
   ];
 
   # On Darwin: Failed to bind socket, Operation not permitted

pkgs/development/libraries/gstreamer/bad/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-bad";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lcSNrK8UJ29OWV9MvKlLPP6/wiKF52XiqlbQpydddWE=";
+    hash = "sha256-mJDyYvOyqVZNy2KenraX13uT0fcYl+2hqBcLfc/nMpQ=";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/base/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Tvn57wkCUwjOIg4t0iqJ5MmS2MpxuWjjxwrwY07CeTM=";
+    hash = "sha256-8MDibL7apXcyy2pXjozBOhFkvxjXN9VcMzBhxS8MSNc=";
   };
 
   strictDeps = true;

pkgs/development/libraries/gstreamer/core/default.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "bin"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3GYWAyISk9zMdAhiQl61T7vtYPsp0IyAHUQKaj/4JoA=";
+    hash = "sha256-Cn7bDntC2+a1dfzmGkgIo/ayDghaHq7LwCXQ7CHx53Q=";
   };
 
   depsBuildBuild = [

pkgs/development/libraries/gstreamer/devtools/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-devtools";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${finalAttrs.version}.tar.xz";
-    hash = "sha256-T94Zw8FEg0+MsFwso/FLOlDTlbrSA9F/mKbnDBZy8ro=";
+    hash = "sha256-Y9Rqjv+ooiXiWkZLp1OKzoU/4NwecDZrJ8IIE15UAc4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
···
       cargoRoot
       ;
     name = "gst-devtools-${finalAttrs.version}";
-    hash = "sha256-AgxvFMq37a8NuOHY1QIUGOAo8aSBt4HVeSCHNUYa1tQ=";
+    hash = "sha256-gU+SBvxwmrGiyeKXF3SA2ohIHNTS4ZBC+elB0u1QKRE=";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/ges/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-editing-services";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-editing-services/gst-editing-services-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3SCpPSw0aLahAk/wySeIayGTe9E7jLjxdfhjc2DRb9I=";
+    hash = "sha256-c0kAlE+Q7OXi85g8M1F4/aUAI/40KqdezZ2KnDi2TZ4=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/good/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-good";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/k7JZw7f5rseXycWmuFFtawt0hismL2CUcj7pBrTPFM=";
+    hash = "sha256-6whi6TQEsHPpjsUDUOzn5mheopNsq4EYwrjpOOLL6os=";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/libav/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-libav";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Otp+UKO5uLo+QFsUxAIeJfuxA3n3fSzkkKoWUj7Sck0=";
+    hash = "sha256-1t4FiE70I3bdjN6JlA97UM7Zb09vUoiOdkzYIz508FI=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/rs/default.nix

···
       ) (lib.attrNames validPlugins);
 
   invalidPlugins = lib.subtractLists (lib.attrNames validPlugins) selectedPlugins;
-
-  # TODO: figure out what must be done about this upstream - related lu-zero/cargo-c#323 lu-zero/cargo-c#138
-  cargo-c' = (cargo-c.__spliced.buildHost or cargo-c).overrideAttrs (oldAttrs: {
-    patches = (oldAttrs.patches or [ ]) ++ [
-      (fetchpatch {
-        name = "cargo-c-test-rlib-fix.patch";
-        url = "https://github.com/lu-zero/cargo-c/commit/dd02009d965cbd664785149a90d702251de747b3.diff";
-        hash = "sha256-Az0WFF9fc5+igcV8C/QFhq5GE4PAyGEO84D9ECxx3v0=";
-      })
-    ];
-  });
 in
 assert lib.assertMsg (invalidPlugins == [ ])
   "Invalid gst-plugins-rs plugin${
···
     pkg-config
     rustc
     cargo
-    cargo-c'
+    cargo-c
     nasm
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [

pkgs/development/libraries/gstreamer/rtsp-server/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-rtsp-server";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-rtsp-server/gst-rtsp-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-QV6KU6mER4l3DdTxFqwuOkoz3kJnPFeswlxboPRAb8U=";
+    hash = "sha256-Mo3/JFdBloPypPBsoRnP0ivrYyzuGtaDBZEhMyU1PEQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/ugly/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-ugly";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${finalAttrs.version}.tar.xz";
-    hash = "sha256-QX9e6JX3NKwDQbNxnBdf/xa0yOrogG4p4XCzvLPZ26U=";
+    hash = "sha256-PfxDQ1vpfhEIFrrG1gKw8gagOFRieWg9nSU3L/En21I=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/vaapi/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer-vaapi";
-  version = "1.26.3";
+  version = "1.26.5";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer-vaapi/gstreamer-vaapi-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LWQ/vRQgKX2lpNaUXRHwpbT4L+6lTqauyTaNQpldiwM=";
+    hash = "sha256-tC1E22PzGVpvMyluHq0ywU0B7ydFK3Bo8aLYZiT1Xqk=";
   };
 
   nativeBuildInputs = [
···
     libdrm
     udev
     xorg.libX11
+    xorg.libxcb
     xorg.libXext
     xorg.libXv
     xorg.libXrandr

pkgs/development/libraries/kerberos/krb5.nix

···
   byacc, # can also use bison, but byacc has fewer dependencies
   keyutils,
   openssl,
+  bashNonInteractive,
   perl,
   pkg-config,
 
···
 
 stdenv.mkDerivation rec {
   pname = "krb5";
-  version = "1.21.3";
+  version = "1.22.1";
+
+  __structuredAttrs = true;
 
   src = fetchurl {
     url = "https://kerberos.org/dist/krb5/${lib.versions.majorMinor version}/krb5-${version}.tar.gz";
-    hash = "sha256-t6TNXq1n+wi5gLIavRUP9yF+heoyDJ7QxtrdMEhArTU=";
+    hash = "sha256-GogyuMrZI+u/E5T2fi789B46SfRgKFpm41reyPoAU68=";
   };
 
   outputs = [
···
     "ac_cv_func_regcomp=yes"
     "ac_cv_printf_positional=yes"
   ];
+
+  strictDeps = true;
 
   nativeBuildInputs = [
     byacc
···
 
   buildInputs = [
     openssl
+    bashNonInteractive # cannot use bashInteractive because of a dependency cycle
   ]
   ++ lib.optionals (
     stdenv.hostPlatform.isLinux
···
   # options don't give us enough granularity to specify that, so we have to override the generated
   # Makefiles manually.
   postConfigure = ''
-    find $libFolders -type f -name Makefile -print0 | while IFS= read -rd "" f; do
+    find "''${libFolders[@]}" -type f -name Makefile -print0 | while IFS= read -rd "" f; do
       substituteInPlace "$f" --replace-fail "$out" "$lib"
     done
   '';
···
     mkdir -p "$lib"/{bin,sbin,lib/pkgconfig,share/{et,man/man1}}
   '';
 
-  # not via outputBin, due to reference from libkrb5.so
   postInstall = ''
+    # not via outputBin, due to reference from libkrb5.so
     moveToOutput bin/krb5-config "$dev"
+    moveToOutput sbin/krb5-send-pr "$out"
+    moveToOutput bin/compile_et "$out"
   '';
 
   # Disable _multioutDocs in stdenv by overriding it to be a no-op.
···
 
   enableParallelBuilding = true;
   doCheck = false; # fails with "No suitable file for testing purposes"
+
+  outputChecks.lib.disallowedRequisites = [
+    # bash cannot be here because of a dependency cycle
+    bashNonInteractive
+  ];
 
   meta = with lib; {
     description = "MIT Kerberos 5";

pkgs/development/libraries/libva/default.nix

···
   libdrm,
   minimal ? false,
   libX11,
+  libxcb,
   libXext,
   libXfixes,
   wayland,
···
   ]
   ++ lib.optionals (!minimal) [
     libX11
+    libxcb
     libXext
     libXfixes
     wayland

pkgs/development/libraries/libxmlxx/v3.nix

···
   glibmm,
   perl,
   gnome,
+  meson,
+  ninja,
+  docbook5,
+  docbook-xsl-ns,
+  doxygen,
+  libxslt,
+  fop,
+  dblatex,
+  graphviz,
+
+  withDocumentation ? false,
+  withManual ? false, # Broken due to not being allowed to fetch file from web
+  withPDF ? false,
+  withExamples ? false,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libxml++";
-  version = "3.0.1";
+  version = "3.2.5";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/libxml++/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "19kik79fmg61nv0by0a5f9wchrcfjwzvih4v2waw01hqflhqvp0r";
+    url = "mirror://gnome/sources/libxml++/${lib.versions.majorMinor version}/libxml++-${version}.tar.xz";
+    hash = "sha256-DJs4G1qD1rOrSwuGXXJW2rJ9V1mBtjvi+Fnty5TaWcc=";
   };
 
   outputs = [
     "out"
     "dev"
+  ]
+  ++ lib.lists.optionals withDocumentation [
     "doc"
     "devdoc"
   ];
 
   nativeBuildInputs = [
+    ninja
+    meson
     pkg-config
+  ]
+  ++ lib.lists.optionals withDocumentation [
     perl
+    doxygen
+    libxslt
+    graphviz
+  ]
+  ++ lib.lists.optionals withManual [
+    docbook5
+    docbook-xsl-ns
+  ]
+  ++ lib.lists.optional withPDF [
+    fop
+    dblatex
   ];
 
   buildInputs = [ glibmm ];
 
   propagatedBuildInputs = [ libxml2 ];
 
+  mesonFlags = [
+    (lib.mesonBool "maintainer-mode" false)
+    (lib.mesonBool "build-documentation" withDocumentation)
+    (lib.mesonBool "build-manual" withManual)
+    (lib.mesonBool "build-pdf" withPDF)
+    (lib.mesonBool "build-examples" withExamples)
+    (lib.mesonBool "build-tests" doCheck)
+  ];
+
+  preBuild = lib.strings.optionalString withDocumentation ''
+    doxygen -u docs/reference/Doxyfile
+  '';
+
   postFixup = ''
     substituteInPlace $dev/lib/pkgconfig/libxml++-3.0.pc \
-      --replace 'docdir=''${datarootdir}' "docdir=$doc/share"
+      --replace-fail 'docdir=''${datarootdir}' "docdir=$doc/share"
   '';
 
   passthru = {
···
     };
   };
 
+  doCheck = true;
+
   meta = with lib; {
     homepage = "https://libxmlplusplus.sourceforge.net/";
     description = "C++ wrapper for the libxml2 XML parser library, version 3";
     license = licenses.lgpl2Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ loskutov ];
+    maintainers = with maintainers; [ willow ];
   };
 }

pkgs/development/libraries/mesa/darwin.nix

···
     xorg.libX11
     xorg.libXext
     xorg.libXfixes
+    xorg.libxcb
     zlib
   ];
 

pkgs/development/libraries/nss/esr.nix

···
 import ./generic.nix {
-  version = "3.101.2";
-  hash = "sha256-i5K47pzQYOiD4vFHBN6VeqXEdPBOM7U1oSK0qSi2M2Y=";
+  version = "3.112.1";
+  hash = "sha256-NpvE/WH+oY231uDKxXJptDojfU4rNsXySpOduWszzjQ=";
   filename = "esr.nix";
-  versionRegex = "NSS_(3)_(101)(?:_(\\d+))?_RTM";
+  versionRegex = "NSS_(3)_(112)(?:_(\\d+))?_RTM";
 }

pkgs/development/libraries/openexr/3.nix

···
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.3.4";
+  version = "3.3.5";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-dPPL9ML5O/u0FXuLxE3bkkgetOzNU3qni3n0pq25bT0=";
+    hash = "sha256-J1SButHDPy0gGkVOZKfemaMF0MY/lifB5n39+3GRKR8=";
   };
 
   outputs = [

pkgs/development/libraries/pipewire/default.nix

···
   ++ lib.optionals x11Support [
     libcanberra
     xorg.libX11
+    xorg.libxcb
     xorg.libXfixes
   ]
   ++ lib.optionals bluezSupport [

pkgs/development/libraries/qt-6/fetch.sh

···
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.9/6.9.1/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.9/6.9.2/submodules/ -A '*.tar.xz' )

pkgs/development/libraries/qt-6/modules/qtbase/default.nix

···
   libinput,
   # options
   qttranslations ? null,
-  fetchpatch,
 }:
 
 let
···
     ./qmlimportscanner-import-path.patch
     # don't pass qtbase's QML directory to qmlimportscanner if it's empty
     ./skip-missing-qml-directory.patch
-
-    # Backport patch recommended by KDE to fix HTTP2 stream corruption issues
-    # FIXME: remove in 6.9.2
-    (fetchpatch {
-      url = "https://invent.kde.org/qt/qt/qtbase/-/commit/904aec2f372e2981af19bf762583a0ef42ec6bb9.diff";
-      hash = "sha256-bSf4TgYUk7Ariu37NHGQKv6wFArVpQLlnHCTbCFzAfI=";
-    })
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''

pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix

···
   lib,
   pkgsBuildBuild,
   replaceVars,
-  fetchpatch,
 }:
 
 qtModule {
···
     })
     # add version specific QML import path
     ./use-versioned-import-path.patch
-    # This should make it into the 6.9.2 release.
-    (fetchpatch {
-      url = "https://invent.kde.org/qt/qt/qtdeclarative/-/commit/672e6777e8e6a8fd.diff";
-      hash = "sha256-nPczX6SHZPcdg7AqpRIwPCrcS3PId+Ibb0iPSiHUdaw=";
-    })
   ];
 
   preConfigure =

pkgs/development/libraries/qt-6/modules/qtmqtt.nix

···
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.9.1";
+  version = "6.9.2";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-nyMsl07pL6mNpg1p7W3cn2NXGmEbm+y9tgMexp6+xYI=";
+    hash = "sha256-/qz93JmMkJW3+lzT+QKvb/VL+xmbg5H8kKaXK+XN2nE=";
   };
 
   propagatedBuildInputs = [ qtbase ];

pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix

···
   buildPackages,
   bison,
   coreutils,
-  fetchpatch2,
   flex,
   gperf,
   ninja,
···
   bootstrap_cmds,
   cctools,
   xcbuild,
+
+  fetchpatch,
 }:
 
 qtModule {
···
     # Reproducibility QTBUG-136068
     ./gn-object-sorted.patch
 
-    # https://chromium-review.googlesource.com/c/chromium/src/+/6445471
-    (fetchpatch2 {
-      url = "https://github.com/chromium/chromium/commit/f8f21fb4aa01f75acbb12abf5ea8c263c6817141.patch?full_index=1";
-      stripLen = 1;
-      extraPrefix = "src/3rdparty/chromium/";
-      hash = "sha256-wcby9uD8xb4re9+s+rdl1hcpxDcHxuI68vUNAC7Baas=";
+    # Revert "Create EGLImage with eglCreateDRMImageMESA() for exporting dma_buf"
+    # Mesa 25.2 dropped eglCreateDRMImageMESA, so this no longer works.
+    # There are better ways to do this, but this is the easy fix for now.
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtwebengine/-/commit/ddcd30454aa6338d898c9d20c8feb48f36632e16.diff";
+      revert = true;
+      hash = "sha256-ht7C3GIEaPtmMGLzQKOtMqE9sLKdqqYCgi/W6b430YU=";
     })
   ];
 

pkgs/development/libraries/qt-6/srcs.nix

···
 
 {
   qt3d = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qt3d-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1127kkbrds6xsd28p47drs51py5x8gsv2rwbllkb6yqlc1x4jilw";
-      name = "qt3d-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qt3d-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0ndn5fbsfj2vbcq3siq1gnk2rgblicd6ri2jrh9g41anicxh4vma";
+      name = "qt3d-everywhere-src-6.9.2.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qt5compat-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0yli7mbsdhksx57n05axr3kkspf9nm56w6bm1rbl0p0d7yn2diwn";
-      name = "qt5compat-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qt5compat-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0q2vly836wgs462czw7lg0ysf2h48iwbdy43wwf2gz49qq2rja6b";
+      name = "qt5compat-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtactiveqt-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0lvd6566yycfid6nq66m5cl3aw5bfzfifbhcpnqangvq1vla2zpx";
-      name = "qtactiveqt-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtactiveqt-everywhere-src-6.9.2.tar.xz";
+      sha256 = "003vgfxswi6cpdp9i8kdzm1n34cbrbzlap4sg9h1ap0i9is51s1w";
+      name = "qtactiveqt-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtbase = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtbase-everywhere-src-6.9.1.tar.xz";
-      sha256 = "13pjmha1jpalpy5qc5gijny7i648clsmcc08c5cik6nchfzyvjj0";
-      name = "qtbase-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtbase-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0h149x8l2ywfr5m034n20z6cjxnldary39x0vv22jhg0ryg9rgj4";
+      name = "qtbase-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtcharts-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1ly3mq4hgl4b20grajqy9bw16cx50d4drjxr3ljfj5n8gbmip1xq";
-      name = "qtcharts-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtcharts-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0jzzlh0jq5fidgs9r4aqpilyj0nan30r1d0pigp1hgz7cigz20cz";
+      name = "qtcharts-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtconnectivity-everywhere-src-6.9.1.tar.xz";
-      sha256 = "05qabslwr7dc7mfkgkr2ikqlb93c0dkfyg2vbvc5lk8h280yb229";
-      name = "qtconnectivity-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtconnectivity-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0qq4d8hn6s8bb9r2gglb6gzq6isbb13knqh7n2s2wsnx8rqwdzwa";
+      name = "qtconnectivity-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtdatavis3d-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1irjbdm8ypm01zx18rwq8sp161fq9yjhbx01pcgfdix7y9sqnyac";
-      name = "qtdatavis3d-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtdatavis3d-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0p6bvia085hx3jb1la06c2q48m9i897r1a1mf6bi2hbmm2hirzsx";
+      name = "qtdatavis3d-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtdeclarative-everywhere-src-6.9.1.tar.xz";
-      sha256 = "15zc9i9d3c9r2bqbcavqn77qk2vwcwlmp5kv73pdg681vxjldffc";
-      name = "qtdeclarative-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtdeclarative-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0r16qima008y2999r1djvwry01l295nmwwhqg081d2fr1cn2szs7";
+      name = "qtdeclarative-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtdoc-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1d8sdnwimvy8fi7cihkxzjllri5gsldy39rzqwyxv4nfwnxbw33f";
-      name = "qtdoc-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtdoc-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0qng2lsqmrrj8n85aqh8vl4nlzc23va9hynvvf6gqr35anvbpniz";
+      name = "qtdoc-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtgraphs-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0i1lb7zdvhxyv51g9h667g7wq50h6x11w88v68x5mfyda98dqbgm";
-      name = "qtgraphs-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtgraphs-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0wsa4iar52dhiilyl053j7lmsw3xdn47b0pjrylb5a0ij1izp057";
+      name = "qtgraphs-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtgrpc-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0l574fwlqszk3zny2mcbka8ipi8bhj8m67jsd7yv129j42g8ck63";
-      name = "qtgrpc-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtgrpc-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0r1z6lbjcsgxhvzylpr8z8wl44ql14ajf99n1hfvf4gy4f43qgd4";
+      name = "qtgrpc-everywhere-src-6.9.2.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qthttpserver-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0lrby1ii7ic0m3wnv1hvb5izzwrk5ryqvbi723qnbhxvw88vbixz";
-      name = "qthttpserver-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qthttpserver-everywhere-src-6.9.2.tar.xz";
+      sha256 = "06a0f7j1b309xffw3rwydz8lpzxnf5jg67savswskzbd3lfzlhqk";
+      name = "qthttpserver-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtimageformats-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0z2py4x0shdn29l9656r63xc8gzk9bgxlgi3qx9bg6xgv8wg5sgb";
-      name = "qtimageformats-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtimageformats-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0fciahs4i0nn5z0j624gkfncqg6byxswj45bw81drpjp5xz3y0la";
+      name = "qtimageformats-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtlanguageserver-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1v486kb11mg65bvg88mm306nvq55kg6glnqiwfv9n2vn28v3a5ya";
-      name = "qtlanguageserver-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtlanguageserver-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1vlb0qn53y1b4zf7zkpxdvdh5ikr1cidq5gv8blvf6pyw6pnw6vq";
+      name = "qtlanguageserver-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtlocation-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0mzg4z0zra13czgygaxim8wn4a2lzndly3w0ymcxwzh4gs8fis60";
-      name = "qtlocation-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtlocation-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1ybk3ig69p6zyrxabcfkb4pcyc251gy1m2brkf4q52cmcwcysias";
+      name = "qtlocation-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtlottie-everywhere-src-6.9.1.tar.xz";
-      sha256 = "18lbl6pxvfiwl84y92xwnm4cayxs8rdfgmvrq44n3jbk0wp8rs4f";
-      name = "qtlottie-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtlottie-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1iiigsb4p1zwkxm1x9c4pbx5rgwz35krdqi3vkql4nawvp997px4";
+      name = "qtlottie-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtmultimedia-everywhere-src-6.9.1.tar.xz";
-      sha256 = "079r0wp4nwyp4a5cannz3vf99aj4dvydwydvwbw5bvhqjm2kcplm";
-      name = "qtmultimedia-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtmultimedia-everywhere-src-6.9.2.tar.xz";
+      sha256 = "04mbwl1mg4rjgai027chldslpjnqrx52c3jxn20j2hx7ayda3y3v";
+      name = "qtmultimedia-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtnetworkauth-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1jrrfcw3aa93xaq95xhy0iyigldmvgamy5452mpm8d926xdv3bbz";
-      name = "qtnetworkauth-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtnetworkauth-everywhere-src-6.9.2.tar.xz";
+      sha256 = "114c65gyg56v70byyl3if1q7mzhp5kkv1g8sp4y9zaxqirbdjr91";
+      name = "qtnetworkauth-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtpositioning-everywhere-src-6.9.1.tar.xz";
-      sha256 = "09pz0sbzcvhcaag7g7pidcnyvrx2kaxsxr73y2iqq949955p6qkh";
-      name = "qtpositioning-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtpositioning-everywhere-src-6.9.2.tar.xz";
+      sha256 = "06mwzlyprwz11ks6fsvzh03ilk5fxy3scr1gqqb4p85xzw0ri6j8";
+      name = "qtpositioning-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtquick3d-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0xwr5kdz1yn0arby4jipbh0j8z1x8ppiqhswddyipmdzizd005pn";
-      name = "qtquick3d-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquick3d-everywhere-src-6.9.2.tar.xz";
+      sha256 = "002888xfnkxmvn8413fllidl3mm2fcwc4gbzdnbvpjlysaq9f3ig";
+      name = "qtquick3d-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtquick3dphysics-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0kx2vj6qwwp05iizfnsmbn2337w70crah4zcdm1ah2f4p1g3ds36";
-      name = "qtquick3dphysics-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquick3dphysics-everywhere-src-6.9.2.tar.xz";
+      sha256 = "12yc0lswcmyaw19yyxzy73j95ncgqw8mlx8svhrwsllgcf2n9z47";
+      name = "qtquick3dphysics-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtquickeffectmaker-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0caxs6xcm5c7g85xyln5jjvz4b4g6flww7kq9vsl9fs20v21gdir";
-      name = "qtquickeffectmaker-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquickeffectmaker-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1yfq1pp0k2d6438x8pn2y73y29bqwg45bjh6msiy64fldr4z31br";
+      name = "qtquickeffectmaker-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtquicktimeline-everywhere-src-6.9.1.tar.xz";
-      sha256 = "153ji60xg55m85zg0px5nq1wbpkn61xf0whkjghf8y41rbkxpgvq";
-      name = "qtquicktimeline-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquicktimeline-everywhere-src-6.9.2.tar.xz";
+      sha256 = "09n51qw0y8v1q83xs1ybwwm4a49j2qhshqrasdkzz25mij6nhrdw";
+      name = "qtquicktimeline-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtremoteobjects-everywhere-src-6.9.1.tar.xz";
-      sha256 = "040a5s6sx5y0vpxjdmvici63yxr4rn9qisigpbjc4wlggfg0fgr7";
-      name = "qtremoteobjects-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtremoteobjects-everywhere-src-6.9.2.tar.xz";
+      sha256 = "09lby6dqc2sfig1krcszg6fkypgxlz2r7hgjjfi95g7g9gqlwqnz";
+      name = "qtremoteobjects-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtscxml-everywhere-src-6.9.1.tar.xz";
-      sha256 = "10274n4gslgh59sagyijllnskp204i16zm7bdpx58fmk4chdwcqc";
-      name = "qtscxml-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtscxml-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1dpb687zbw4akx42kfpbb5cpdlq3hcqn8l3l0x7sd5i9061z2sp0";
+      name = "qtscxml-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtsensors-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0v4w815698zgxhmk681ygfsjlbp1y4gqdmbb0pz2vm6gr8d16jzh";
-      name = "qtsensors-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtsensors-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0qj4674vim2p34mq3kp99spjyf82qvs75w625namzqp274pshk4n";
+      name = "qtsensors-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtserialbus-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1mq4mghn19m7m0mkbn6llwiprabr4ym8rpd9ks05spsnhd2ww7j9";
-      name = "qtserialbus-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtserialbus-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0xia9xcz7sjrbf1c4m63qnhz3ggdxr06pycslmsnqizlzb10f7lm";
+      name = "qtserialbus-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtserialport-everywhere-src-6.9.1.tar.xz";
-      sha256 = "047z7vchc01rki445i7qh5mqy3xh0i6ww1l34s4swx0c719fv3w0";
-      name = "qtserialport-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtserialport-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0sz2dkas4qjdd6lkfb9g89vi94q18aiq9xdchlqb2yn0qbqb544b";
+      name = "qtserialport-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtshadertools-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0x2b7dpkgdngpbv1g5qc6ffa4lwq4d8g3r3vdi5zp1q8rr6d47jf";
-      name = "qtshadertools-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtshadertools-everywhere-src-6.9.2.tar.xz";
+      sha256 = "158lpzb1nqspwm0n48d3nfr81q85zka1igrjp6xj8cjlv7wqlrqp";
+      name = "qtshadertools-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtspeech-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0a0lgjxkdfisczkaw7njs87a9qffigygn311chgqzvz2ragza1v8";
-      name = "qtspeech-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtspeech-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1cc8l2h1frlraay0m40r5a91nsc7b53n6vksa52pwqqia4vngdmj";
+      name = "qtspeech-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtsvg-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1mdvk8y7dfi8ibv36ccvfbmnsvm2y6dm27l6v6pz47w9zpjmvz1d";
-      name = "qtsvg-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtsvg-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1985asvnkd2ar30nh2zyi490qz0vkz6z1f752lfald33yawcm16r";
+      name = "qtsvg-everywhere-src-6.9.2.tar.xz";
     };
   };
   qttools = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qttools-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0k2b7z7g41pkq0bccvmwpalmn2ryhl0ccd4zv4zh9zfcyiiabi4h";
-      name = "qttools-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qttools-everywhere-src-6.9.2.tar.xz";
+      sha256 = "12d4czfwvh9rfjwnkpsiwzrpx4ga69c6vz85aabhpk3hx7lggdyq";
+      name = "qttools-everywhere-src-6.9.2.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qttranslations-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0hd707fpsij9bzl143615a4ags6y0nkwdplzlzmwsizlanjs2qcp";
-      name = "qttranslations-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qttranslations-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1mky3xj2yhcsrmpz8m28v7pky6ryn7hvdcglakww0rfk3qlbcfy7";
+      name = "qttranslations-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtvirtualkeyboard-everywhere-src-6.9.1.tar.xz";
-      sha256 = "07r87pg50drrv2z3b6ldlrvz8261xmq6jfcja9wg0dmqplw9l1c0";
-      name = "qtvirtualkeyboard-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtvirtualkeyboard-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1qqizh7kyqbqqnrm1mmlf2709rm1rnflbqdl1bi75yms07d00hbv";
+      name = "qtvirtualkeyboard-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtwayland-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0gifjc4l85ilr1gb0p9dy2s2aypskjp8c7wskfqyp03id07fl8bx";
-      name = "qtwayland-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwayland-everywhere-src-6.9.2.tar.xz";
+      sha256 = "10bpxwpam56gvymz9vjxkppbqsj1369ddzl3k4pz2s2maq39imya";
+      name = "qtwayland-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtwebchannel-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1h7rzjsim2rxdw25sks4yz8r03llr6q8kcc081n43z0a47ch3d0r";
-      name = "qtwebchannel-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebchannel-everywhere-src-6.9.2.tar.xz";
+      sha256 = "0rcf7i1wamdf1qynq3yi88r77ch5dg1jinxywlfjlb2dmlvn72l7";
+      name = "qtwebchannel-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtwebengine-everywhere-src-6.9.1.tar.xz";
-      sha256 = "0v62j4zzya6yf91630ii6y4m62md69zfs1r21xi6v3rl5gigszbq";
-      name = "qtwebengine-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebengine-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1aq35nkgbvhlsmglnjizbkavr7kb0ymf5n3kkllrpqy2mf90gjwr";
+      name = "qtwebengine-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtwebsockets-everywhere-src-6.9.1.tar.xz";
-      sha256 = "1xa8yx1v5xk1zn2wc4gssali0k2l0yn6w2ywxsccq0kz7f38rglq";
-      name = "qtwebsockets-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebsockets-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1vh82w96436pqrp4daf324mqs2zjvn51z78b3ksc5mnqgrk3z0xy";
+      name = "qtwebsockets-everywhere-src-6.9.2.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.9.1";
+    version = "6.9.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.1/submodules/qtwebview-everywhere-src-6.9.1.tar.xz";
-      sha256 = "19ar1pmf9q39mqvnjkfrxrblgl1vn65zigj194n098ppp3xx96n2";
-      name = "qtwebview-everywhere-src-6.9.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebview-everywhere-src-6.9.2.tar.xz";
+      sha256 = "1w8z3d7w7z2xjfb5l15gb37v9w6pa7d71jalkrqda8l2wr5d3ksc";
+      name = "qtwebview-everywhere-src-6.9.2.tar.xz";
     };
   };
 }

pkgs/development/perl-modules/generic/default.nix

···
 
   env ? { },
 
+  postPatch ? "patchShebangs .",
+
   ...
 }@attrs:
 
···
             doCheck
             checkTarget
             enableParallelBuilding
+            postPatch
             ;
           env = {
             inherit PERL_AUTOINSTALL AUTOMATED_TESTING PERL_USE_UNSAFE_INC;

pkgs/development/python-modules/aiohttp/default.nix

···
   pytest-mock,
   pytest-xdist,
   pytestCheckHook,
-  python-on-whales,
   re-assert,
   trustme,
   zlib-ng,
···
     pytest-mock
     pytest-xdist
     pytestCheckHook
-    python-on-whales
     re-assert
     trustme
     zlib-ng

pkgs/development/python-modules/cfn-lint/default.nix

···
 
 buildPythonPackage rec {
   pname = "cfn-lint";
-  version = "1.38.2";
+  version = "1.38.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "aws-cloudformation";
     repo = "cfn-lint";
     tag = "v${version}";
-    hash = "sha256-oHbTB4XOyYSazyhO6No2+Z9QRR8tnuB3E4kGzG1HwTk=";
+    hash = "sha256-n3NHmbo3qRhP7oqUOokw8oGnNXo4rhRhuAgL66hvfog=";
   };
 
   build-system = [ setuptools ];
···
   disabledTests = [
     # Requires git directory
     "test_update_docs"
-    # Tests depend on network access (fails in getaddrinfo)
-    "test_update_resource_specs_python_2"
-    "test_update_resource_specs_python_3"
-    "test_sarif_formatter"
-    # Some CLI tests fails
-    "test_bad_config"
-    "test_override_parameters"
-    "test_positional_template_parameters"
-    "test_template_config"
-    # Assertion error
-    "test_build_graph"
   ];
 
   pythonImportsCheck = [ "cfnlint" ];

pkgs/development/python-modules/charset-normalizer/default.nix

···
   fetchFromGitHub,
   mypy,
   pytestCheckHook,
-  pythonOlder,
   requests,
   setuptools,
   setuptools-scm,
···
 
 buildPythonPackage rec {
   pname = "charset-normalizer";
-  version = "3.4.2";
+  version = "3.4.3";
   pyproject = true;
-
-  disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
-    owner = "Ousret";
+    owner = "jawah";
     repo = "charset_normalizer";
     tag = version;
-    hash = "sha256-PkFmNEMdp9duDCqMTKooOLAOCqHf3IjrGlr8jKYT2WE=";
+    hash = "sha256-ZEHxBErjjvofqe3rkkgiEuEJcoluwo+2nZrLfrsHn5Q=";
   };
 
   build-system = [
···
     description = "Python module for encoding and language detection";
     mainProgram = "normalizer";
     homepage = "https://charset-normalizer.readthedocs.io/";
-    changelog = "https://github.com/Ousret/charset_normalizer/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/jawah/charset_normalizer/blob/${src.tag}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/coverage/default.nix

···
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "7.10.2";
+  version = "7.10.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nedbat";
     repo = "coveragepy";
     tag = version;
-    hash = "sha256-OXi5FCLcfhseNDerwHdsVHF31Jy+ZSz2RU05vqPxQis=";
+    hash = "sha256-jsocpziOu0fSmFn075vj2u1SCZkG7M/kuRujaJ1OeH4=";
   };
 
   build-system = [ setuptools ];
···
   '';
 
   disabledTests = [
-    "test_all_our_source_files"
     "test_doctest"
     "test_files_up_one_level"
     "test_get_encoded_zip_files"
-    "test_metadata"
-    "test_more_metadata"
     "test_multi"
     "test_no_duplicate_packages"
-    "test_xdist_sys_path_nuttiness_is_fixed"
     "test_zipfile"
-  ]
-  ++ lib.optionals (isPy312 && stdenv.hostPlatform.system == "x86_64-darwin") [
-    # substring that may not be in string is part of the pytest output hash, which appears in the string
-    "test_nothing_specified"
-    "test_omit"
-    "test_omit_2"
-    "test_omit_as_string"
+    # tests expect coverage source to be there
+    "test_all_our_source_files"
+    "test_metadata"
+    "test_more_metadata"
+    "test_real_code_regions"
   ];
 
   disabledTestPaths = [

pkgs/development/python-modules/dash/default.nix

···
 
 buildPythonPackage rec {
   pname = "dash";
-  version = "3.2.0";
+  version = "3.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "dash";
     tag = "v${version}";
-    hash = "sha256-7wSUPAcPvY5Q5Ws2mLjiY599oZlo5SA6Pa8QnS7pgvg=";
+    hash = "sha256-KCGVdD1L+U2KbktU2GU19BQ6wRcmEeYtC/v8UrFTyto=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/django/3.13.6-html-parser.patch

···
-From e0a1e8d549e7be25960b8ad060c63def3dc35d1d Mon Sep 17 00:00:00 2001
-From: Natalia <[e-mail]>
-Date: Mon, 21 Jul 2025 15:23:32 -0300
-Subject: [PATCH 1/2] Fixed test_utils.tests.HTMLEqualTests.test_parsing_errors
- following Python's HTMLParser fixed parsing.
-
-Further details about Python changes can be found in:
-https://github.com/python/cpython/commit/0243f97cbadec8d985e63b1daec5d1cbc850cae3.
-
-Thank you Clifford Gama for the thorough review!
----
- tests/test_utils/tests.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tests/test_utils/tests.py b/tests/test_utils/tests.py
-index 37e87aa1022c..9c22b61b4ff2 100644
---- a/tests/test_utils/tests.py
-+++ b/tests/test_utils/tests.py
-@@ -962,7 +962,7 @@ def test_parsing_errors(self):
-             "('Unexpected end tag `div` (Line 1, Column 6)', (1, 6))"
-         )
-         with self.assertRaisesMessage(AssertionError, error_msg):
--            self.assertHTMLEqual("< div></ div>", "<div></div>")
-+            self.assertHTMLEqual("< div></div>", "<div></div>")
-         with self.assertRaises(HTMLParseError):
-             parse_html("</p>")
- 
-
-From e8afcf0e644553bcba3e5f931266963bffc46748 Mon Sep 17 00:00:00 2001
-From: Natalia <[e-mail]>
-Date: Mon, 14 Jul 2025 14:45:03 -0300
-Subject: [PATCH 2/2] Fixed #36499 -- Adjusted
- utils_tests.test_html.TestUtilsHtml.test_strip_tags following Python's
- HTMLParser new behavior.
-
-Python fixed a quadratic complexity processing for HTMLParser in:
-https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41.
----
- tests/utils_tests/test_html.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
-index 284f33aedcfb..51573b81eb9d 100644
---- a/tests/utils_tests/test_html.py
-+++ b/tests/utils_tests/test_html.py
-@@ -142,10 +142,10 @@ def test_strip_tags(self):
-             ("&gotcha&#;<>", "&gotcha&#;<>"),
-             ("<sc<!-- -->ript>test<<!-- -->/script>", "ript>test"),
-             ("<script>alert()</script>&h", "alert()h"),
--            ("><!" + ("&" * 16000) + "D", "><!" + ("&" * 16000) + "D"),
-+            ("><!" + ("&" * 16000) + "D", ">"),
-             ("X<<<<br>br>br>br>X", "XX"),
-             ("<" * 50 + "a>" * 50, ""),
--            (">" + "<a" * 500 + "a", ">" + "<a" * 500 + "a"),
-+            (">" + "<a" * 500 + "a", ">"),
-             ("<a" * 49 + "a" * 951, "<a" * 49 + "a" * 951),
-             ("<" + "a" * 1_002, "<" + "a" * 1_002),
-         )

pkgs/development/python-modules/django/4.nix

···
 
 buildPythonPackage rec {
   pname = "django";
-  version = "4.2.23";
+  version = "4.2.24";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
···
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-h6VkMLg2XAVC0p+ItTs/2EqpYdZn9uNvv6ZwQHXP0bI=";
+    hash = "sha256-zDPK30u2QFbHCqnlTMqF1w9iN2sPDphhyKU1u+Mp5ho=";
   };
 
   patches = [
···
       hash = "sha256-8YwdOBNJq6+GNoxzdLyN9HEEIWRXGQk9YbyfPwYVkwU=";
     })
 
-  ]
-  ++ lib.optionals (pythonAtLeast "3.13") [
-    # https://code.djangoproject.com/ticket/36499
-    # https://github.com/django/django/pull/19639
-    ./3.13.6-html-parser.patch
   ]
   ++ lib.optionals withGdal [
     (replaceVars ./django_4_set_geos_gdal_lib.patch {

pkgs/development/python-modules/docformatter/default.nix

···
     pytestCheckHook
   ];
 
-  # Disable failing tests until https://github.com/PyCQA/docformatter/issues/274 is fixed upstream
   disabledTests = [
+    # Disable failing tests until https://github.com/PyCQA/docformatter/issues/274 is fixed upstream
     "test_do_format_code.py"
     "test_docformatter.py"
+    # some different issue
+    "test_detect_encoding_with_undetectable_encoding"
   ];
 
   pythonImportsCheck = [ "docformatter" ];

pkgs/development/python-modules/fenics-basix/default.nix

···
     lapack
   ];
 
-  # Prefer finding BLAS and LAPACK via pkg-config.
-  # Avoid using the Accelerate.framework from the Darwin SDK.
-  # Also, avoid mistaking BLAS for LAPACK.
-  env.CMAKE_ARGS = lib.cmakeBool "BLA_PREFER_PKGCONFIG" true;
+  cmakeFlags = [
+    # Prefer finding BLAS and LAPACK via pkg-config.
+    # Avoid using the Accelerate.framework from the Darwin SDK.
+    # Also, avoid mistaking BLAS for LAPACK.
+    (lib.cmakeBool "BLA_PREFER_PKGCONFIG" true)
+  ];
 
   pythonImportsCheck = [
     "basix"

pkgs/development/python-modules/flasgger/default.nix

···
     owner = "flasgger";
     repo = "flasgger";
     rev = "v${version}";
-    hash = "sha256-cYFMKZxpi69gVWqyZUltCL0ZwcfIABNsJKqAhN2TTSg=";
+    hash = "sha256-ULEf9DJiz/S2wKlb/vjGto8VCI0QDcm0pkU5rlOwtiE=";
   };
-
-  patches = [
-    (fetchpatch {
-      # flask 2.3 compat
-      url = "https://github.com/flasgger/flasgger/commit/ab77be7c6de1d4b361f0eacfa37290239963f890.patch";
-      hash = "sha256-ZbE5pPUP23nZAP/qcdeWkwzrZgqJSRES7oFta8U1uVQ=";
-    })
-    (fetchpatch {
-      # python 3.12 compat
-      url = "https://github.com/flasgger/flasgger/commit/6f5fcf24c1d816cf7ab529b3a8a764f86df4458d.patch";
-      hash = "sha256-37Es1sgBQ9qX3YHQYub4HJkSNTSt3MbtCfV+XdTQZyY=";
-    })
-  ];
 
   propagatedBuildInputs = [
     flask

pkgs/development/python-modules/flask/default.nix

···
 
 buildPythonPackage rec {
   pname = "flask";
-  version = "3.1.1";
+  version = "3.1.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KEx7jy9Yy3N/DPHDD9fq8Mz83hlgmdJOzt4/wgBapZ4=";
+    hash = "sha256-v2VsFcgBkO1iitCM39Oqo1vrCHhV4vSUkQqjd0zE/Yc=";
   };
 
   build-system = [ flit-core ];

pkgs/development/python-modules/google-api-core/default.nix

···
   version = "2.25.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-api-core";
···
 
   pythonImportsCheck = [ "google.api_core" ];
 
-  meta = with lib; {
+  meta = {
     description = "Core Library for Google Client Libraries";
     longDescription = ''
       This library is not meant to stand-alone. Instead it defines common
···
     '';
     homepage = "https://github.com/googleapis/python-api-core";
     changelog = "https://github.com/googleapis/python-api-core/blob/${src.tag}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = [ ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      sarahec
+    ];
   };
 }

pkgs/development/python-modules/google-cloud-storage/default.nix

···
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   google-auth,
   google-cloud-core,
   google-cloud-iam,
···
   mock,
   protobuf,
   pytestCheckHook,
+  pytest-asyncio,
   pythonOlder,
   requests,
   setuptools,
···
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "3.2.0";
+  version = "3.3.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    pname = "google_cloud_storage";
-    inherit version;
-    hash = "sha256-3syoQwdgNvRWMxmMEl0YYf+/R+v1wOO5jcubLbFViWw=";
+  src = fetchFromGitHub {
+    owner = "googleapis";
+    repo = "python-storage";
+    tag = "v${version}";
+    hash = "sha256-I0wC/BV8fJr3JW1nyq2TPJZlZaT4+h2lJBdGTttSzRo=";
   };
 
   pythonRelaxDeps = [ "google-auth" ];
···
     google-cloud-testutils
     mock
     pytestCheckHook
+    pytest-asyncio
+  ];
+
+  enabledTestPaths = [
+    "tests/unit/"
+    "tests/system/"
   ];
 
   disabledTests = [
···
 
   pythonImportsCheck = [ "google.cloud.storage" ];
 
-  meta = with lib; {
+  meta = {
     description = "Google Cloud Storage API client library";
     homepage = "https://github.com/googleapis/python-storage";
     changelog = "https://github.com/googleapis/python-storage/blob/v${version}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = [ ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sarahec ];
   };
 }

pkgs/development/python-modules/islpy/default.nix

···
 
   dontUseCmakeConfigure = true;
 
-  pypaBuildFlags = [
-    "--config-setting=cmake.define.USE_SHIPPED_ISL=OFF"
-    "--config-setting=cmake.define.USE_SHIPPED_IMATH=OFF"
-    "--config-setting=cmake.define.USE_BARVINOK=OFF"
-    "--config-setting=cmake.define.ISL_INC_DIRS:LIST='${lib.getDev isl}/include'"
-    "--config-setting=cmake.define.ISL_LIB_DIRS:LIST='${lib.getLib isl}/lib'"
+  cmakeFlags = [
+    "-DUSE_SHIPPED_ISL=OFF"
+    "-DUSE_SHIPPED_IMATH=OFF"
+    "-DUSE_BARVINOK=OFF"
+    "-DISL_INC_DIRS:LIST='${lib.getDev isl}/include'"
+    "-DISL_LIB_DIRS:LIST='${lib.getLib isl}/lib'"
   ];
 
   # Force resolving the package from $out to make generated ext files usable by tests

pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix

···
     "psycopg-pool"
   ];
 
-  # Temporarily disabled until the following is solved:
-  # https://github.com/NixOS/nixpkgs/pull/425384
-  doCheck = false;
-  # doCheck = !(stdenvNoCC.hostPlatform.isDarwin);
+  doCheck = !(stdenvNoCC.hostPlatform.isDarwin);
 
   nativeCheckInputs = [
     pytest-asyncio

pkgs/development/python-modules/lightgbm/default.nix

···
     scipy
   ];
 
-  pypaBuildFlags =
-    lib.optionals gpuSupport [ "--config-setting=cmake.define.USE_GPU=ON" ]
-    ++ lib.optionals cudaSupport [ "--config-setting=cmake.define.USE_CUDA=ON" ];
+  cmakeFlags = [
+    (lib.cmakeBool "USE_GPU" gpuSupport)
+    (lib.cmakeBool "USE_CUDA" cudaSupport)
+  ];
 
   optional-dependencies = {
     arrow = [

pkgs/development/python-modules/llama-cpp-python/default.nix

···
   ];
 
   dontUseCmakeConfigure = true;
-  SKBUILD_CMAKE_ARGS = lib.strings.concatStringsSep ";" (
+  cmakeFlags = [
     # Set GGML_NATIVE=off. Otherwise, cmake attempts to build with
     # -march=native* which is either a no-op (if cc-wrapper is able to ignore
     # it), or an attempt to build a non-reproducible binary.
···
     # -mcpu, breaking linux build as follows:
     #
     # cc1: error: unknown value ‘native+nodotprod+noi8mm+nosve’ for ‘-mcpu’
-    [
-      "-DGGML_NATIVE=off"
-      "-DGGML_BUILD_NUMBER=1"
-    ]
-    ++ lib.optionals cudaSupport [
-      "-DGGML_CUDA=on"
-      "-DCUDAToolkit_ROOT=${lib.getDev cudaPackages.cuda_nvcc}"
-      "-DCMAKE_CUDA_COMPILER=${lib.getExe cudaPackages.cuda_nvcc}"
-    ]
-  );
+    "-DGGML_NATIVE=off"
+    "-DGGML_BUILD_NUMBER=1"
+  ]
+  ++ lib.optionals cudaSupport [
+    "-DGGML_CUDA=on"
+    "-DCUDAToolkit_ROOT=${lib.getDev cudaPackages.cuda_nvcc}"
+    "-DCMAKE_CUDA_COMPILER=${lib.getExe cudaPackages.cuda_nvcc}"
+  ];
 
   enableParallelBuilding = true;
 

pkgs/development/python-modules/loguru/default.nix

···
     "test_file_buffering"
     # Slow test
     "test_time_rotation"
+    # broken on latest mypy, fixed upstream, but does not apply cleanly
+    # https://github.com/Delgan/loguru/commit/7608a014df0fa5c3322dec032345482aa5305a56
+    # FIXME: remove in next update
+    "typesafety"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "test_rotation_and_retention"

pkgs/development/python-modules/multidict/default.nix

···
   fetchFromGitHub,
   buildPythonPackage,
   objgraph,
+  psutil,
   pytestCheckHook,
   pytest-codspeed,
   pytest-cov-stub,
···
 
 buildPythonPackage rec {
   pname = "multidict";
-  version = "6.6.3";
+  version = "6.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "multidict";
     tag = "v${version}";
-    hash = "sha256-AB35kVgKizzPi3r4tDVQ7vI50Xsb2BeBp3rFh+UOXQc=";
+    hash = "sha256-Ewxwz+0Y8pXJpHobLxrV7cuA9fsAaawWmW9XoEg7dxU=";
   };
 
   postPatch = ''
···
 
   nativeCheckInputs = [
     objgraph
+    psutil
     pytestCheckHook
     pytest-codspeed
     pytest-cov-stub

pkgs/development/python-modules/mypy/default.nix

···
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   gitUpdater,
   pythonAtLeast,
   pythonOlder,
   isPyPy,
 
   # build-system
+  pathspec,
   setuptools,
   types-psutil,
   types-setuptools,
-  wheel,
 
   # propagates
   mypy-extensions,
···
 
 buildPythonPackage rec {
   pname = "mypy";
-  version = "1.15.0";
+  version = "1.17.1";
   pyproject = true;
 
   # relies on several CPython internals
-  disabled = pythonOlder "3.8" || isPyPy;
+  disabled = isPyPy;
 
   src = fetchFromGitHub {
     owner = "python";
     repo = "mypy";
     tag = "v${version}";
-    hash = "sha256-y67kt5i8mT9TcSbUGwnNuTAeqjy9apvWIbA2QD96LS4=";
+    hash = "sha256-FfONUCCMU1bJXHx3GHH46Tu+wYU5FLPOqeCSCi1bRSs=";
   };
 
+  patches = [
+    # Fix the build on Darwin with a case‐sensitive store.
+    # Remove on next release.
+    (fetchpatch {
+      url = "https://github.com/python/mypy/commit/7534898319cb7f16738c11e4bc1bdcef0eb13c38.patch";
+      hash = "sha256-5jD0JBRnirmoMlUz9+n8G4AqHqCi8BaUX5rEl9NnLts=";
+    })
+  ];
+
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
   };
 
   build-system = [
     mypy-extensions
+    pathspec
     setuptools
     types-psutil
     types-setuptools
     typing-extensions
-    wheel
-  ]
-  ++ lib.optionals (pythonOlder "3.11") [ tomli ];
+  ];
 
   dependencies = [
     mypy-extensions
+    pathspec
     typing-extensions
   ]
   ++ lib.optionals (pythonOlder "3.11") [ tomli ];
···
     description = "Optional static typing for Python";
     homepage = "https://www.mypy-lang.org";
     changelog = "https://github.com/python/mypy/blob/${src.rev}/CHANGELOG.md";
+    downloadPage = "https://github.com/python/mypy";
     license = lib.licenses.mit;
     mainProgram = "mypy";
     maintainers = with lib.maintainers; [ lnl7 ];

pkgs/development/python-modules/pgvector/default.nix

···
 
   dependencies = [ numpy ];
 
-  # Temporarily disabled until the following is solved:
-  # https://github.com/NixOS/nixpkgs/pull/425384
-  doCheck = false;
-
   nativeCheckInputs = [
     asyncpg
     django

pkgs/development/python-modules/pillow-jpls/default.nix

···
     pyproject-metadata
   ];
 
-  pypaBuildFlags = [
-    "-C"
-    "cmake.args=--preset=sysdeps"
+  cmakeFlags = [
+    "--preset=sysdeps"
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];

pkgs/development/python-modules/proto-plus/default.nix

···
   pytestFlags = [
     # pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
     "-Wignore::DeprecationWarning"
+    # float_precision option is deprecated for json_format error with latest protobuf
+    "-Wignore:float_precision:UserWarning"
   ];
 
   pythonImportsCheck = [ "proto" ];

pkgs/development/python-modules/protobuf/6.nix

···
 
 buildPythonPackage rec {
   pname = "protobuf";
-  version = "6.31.1";
+  version = "6.32.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2MrEyYLwuVek3HOoDi6iT6sI5nnA3p3rg19KEtaaypo=";
+    hash = "sha256-qBQ5BJEnBn/EnsHTbiXG7h0aK3vpMGdfkZJY0DwE59I=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyside6/default.nix

···
     qtsvg
     qtwebchannel
     qtwebsockets
+    qtwebview
     qtpositioning
     qtlocation
     qtshadertools

pkgs/development/python-modules/pytest-examples/default.nix

···
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   hatchling,
   pytest,
   black,
···
     tag = "v${version}";
     hash = "sha256-ZnDl0B7/oLX6PANrqsWtVJwe4E/+7inCgOpo7oSeZlw=";
   };
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/pydantic/pytest-examples/pull/65/commits/60ae70d05ee345b38c2d2048d36b4a4545c98b6b.diff";
+      hash = "sha256-Rhrg0zVChwwa7Gk+WYrCu44VgUQmxLBeq8pWSF6Nzdo=";
+    })
+  ];
 
   build-system = [
     hatchling

pkgs/development/python-modules/python-on-whales/default.nix

···
 
   # dependencies
   pydantic,
-  requests,
-  tqdm,
-  typer,
 }:
 
 buildPythonPackage rec {
···
 
   dependencies = [
     pydantic
-    requests
-    tqdm
-    typer
   ];
 
   doCheck = false; # majority of tests require Docker and/or network access

pkgs/development/python-modules/scikit-build-core/append-cmakeFlags.sh

···
+scikitBuildFlagsHook() {
+  OLD_IFS="$IFS"
+  IFS=';'
+
+  local args=()
+  if [[ -n "$SKBUILD_CMAKE_ARGS" ]]; then
+    read -ra existing_args <<< "$SKBUILD_CMAKE_ARGS"
+    args+=("${existing_args[@]}")
+  fi
+  args+=($cmakeFlags)
+  args+=("${cmakeFlagsArray[@]}")
+  export SKBUILD_CMAKE_ARGS="${args[*]}"
+
+  IFS="$OLD_IFS"
+  unset OLD_IFS
+}
+
+preConfigureHooks+=(scikitBuildFlagsHook)

pkgs/development/python-modules/scikit-build-core/default.nix

···
 
   # cmake is only used for tests
   dontUseCmakeConfigure = true;
+  setupHooks = [
+    ./append-cmakeFlags.sh
+  ];
 
   disabledTestMarks = [
     "isolated"

pkgs/development/python-modules/setuptools-rust/default.nix

···
   setuptools,
   setuptools-rust,
   setuptools-scm,
-  tomli,
-  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.11.1";
+  version = "1.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
···
   src = fetchPypi {
     pname = "setuptools_rust";
     inherit version;
-    hash = "sha256-favEOSJSztMUuAUNYyduBf3F0yOY/H08zh9qasNbdsA=";
+    hash = "sha256-2UqT8Ml3UcFwFFZfB73DJL7kXTls0buoPY56+SuUXww=";
   };
 
   build-system = [

pkgs/development/python-modules/shiboken6/default.nix

···
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "shiboken6";
-  version = "6.9.1";
+  version = "6.9.2";
 
   src = fetchurl {
     url = "mirror://qt/official_releases/QtForPython/pyside6/PySide6-${finalAttrs.version}-src/pyside-setup-everywhere-src-${finalAttrs.version}.tar.xz";
-    hash = "sha256-BMcSxbkjSt0Nm1qjwBoMrt5kpVtJYSd1H11SojDP90g=";
+    hash = "sha256-nsCHRlNCvcnb5JKjDlj9u8VEhlXerPWYKg/nEj9ZIi0=";
   };
 
   sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/shiboken6";

pkgs/development/python-modules/soxr/default.nix

···
 
   dontUseCmakeConfigure = true;
 
-  pypaBuildFlags = [
-    "--config-setting=cmake.define.USE_SYSTEM_LIBSOXR=ON"
+  cmakeFlags = [
+    (lib.cmakeBool "USE_SYSTEM_LIBSOXR" true)
   ];
 
   build-system = [

pkgs/development/python-modules/sphinx/default.nix

···
     # Racy tex file creation
     "test_literalinclude_namedlink_latex"
     "test_literalinclude_caption_latex"
+    # Racy local networking
+    "test_load_mappings_cache"
+    "test_load_mappings_cache_update"
   ]
   ++ lib.optionals (pythonAtLeast "3.12") [
     # https://github.com/sphinx-doc/sphinx/issues/12430

pkgs/development/python-modules/tkinter/default.nix

···
 {
   lib,
-  stdenv,
   buildPythonPackage,
+  replaceVars,
+  setuptools,
   python,
-  py,
-  isPyPy,
+  pythonOlder,
+  tcl,
+  tclPackages,
+  tk,
+  tkinter,
+  xvfb-run,
 }:
 
 buildPythonPackage {
   pname = "tkinter";
   version = python.version;
-  src = py;
-  format = "other";
+  pyproject = true;
+
+  src = python.src;
+
+  prePatch = ''
+    mkdir $NIX_BUILD_TOP/tkinter
+
+    # copy the module bits and pieces from the python source
+    cp -v  Modules/{_tkinter.c,tkinter.h} ../tkinter/
+    cp -rv Modules/clinic ../tkinter/
+    cp -rv Lib/tkinter ../tkinter/
+
+    pushd $NIX_BUILD_TOP/tkinter
 
-  # tkinter is included in PyPy, making this package a no-op.
-  installPhase = lib.optionalString (!isPyPy) (
-    ''
-      # Move the tkinter module
-      mkdir -p $out/${py.sitePackages}
-      mv lib/${py.libPrefix}/lib-dynload/_tkinter* $out/${py.sitePackages}/
-    ''
-    + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-      # Update the rpath to point to python without x11Support
-      old_rpath=$(patchelf --print-rpath $out/${py.sitePackages}/_tkinter*)
-      new_rpath=$(sed "s#${py}#${python}#g" <<< "$old_rpath" )
-      patchelf --set-rpath $new_rpath $out/${py.sitePackages}/_tkinter*
-    ''
-  );
+    # install our custom pyproject.toml
+    cp ${
+      replaceVars ./pyproject.toml {
+        python_version = python.version;
+        python_internal_dir = "${python}/include/${python.libPrefix}/internal";
+      }
+    } ./pyproject.toml
 
-  meta = py.meta // {
+  ''
+  + lib.optionalString (pythonOlder "3.13") ''
+    substituteInPlace "tkinter/tix.py" --replace-fail \
+      "os.environ.get('TIX_LIBRARY')" \
+      "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
+  '';
+
+  build-system = [ setuptools ];
+
+  buildInputs = [
+    tcl
+    tk
+  ];
+
+  env = {
+    TCLTK_LIBS = toString [
+      "-L${lib.getLib tcl}/lib"
+      "-L${lib.getLib tk}/lib"
+      "-l${tcl.libPrefix}"
+      "-l${tk.libPrefix}"
+    ];
+    TCLTK_CFLAGS = toString [
+      "-I${lib.getDev tcl}/include"
+      "-I${lib.getDev tk}/include"
+    ];
+  };
+
+  doCheck = false;
+
+  nativeCheckInputs = [ xvfb-run ];
+
+  preCheck = ''
+    cd $NIX_BUILD_TOP/Python-*/Lib
+    export HOME=$TMPDIR
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    xvfb-run -w 10 -s "-screen 0 1920x1080x24" \
+      python -m unittest test.test_tkinter
+
+    runHook postCheck
+  '';
+
+  passthru.tests.unittests = tkinter.overridePythonAttrs { doCheck = true; };
+
+  pythonImportsCheck = [ "tkinter" ];
+
+  meta = {
     # Based on first sentence from https://docs.python.org/3/library/tkinter.html
     description = "Standard Python interface to the Tcl/Tk GUI toolkit";
     longDescription = ''
···
       these additions and changes, and refer to the official Tcl/Tk
       documentation for details that are unchanged.
     '';
+    homepage = "https://docs.python.org/3/library/tkinter.html";
+    inherit (python.meta)
+      license
+      maintainers
+      ;
   };
 }

pkgs/development/python-modules/tkinter/pyproject.toml

···
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "tkinter"
+version = "@python_version@"
+description = "Tkinter."
+requires-python = ">=@python_version@"
+
+[tool.setuptools]
+packages = ["tkinter"]
+ext-modules = [
+  { name = "_tkinter", sources = ["_tkinter.c"], libraries = ["tcl9.0", "tcl9tk9.0"], include-dirs = ["@python_internal_dir@/"] }
+]
+

pkgs/development/python-modules/trove-classifiers/default.nix

···
   fetchPypi,
   calver,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2025.5.9.12";
+    version = "2025.8.26.11";
     pyproject = true;
 
-    disabled = pythonOlder "3.7";
-
     src = fetchPypi {
       pname = "trove_classifiers";
       inherit version;
-      hash = "sha256-fKfIp6duLNMURoxnfGnRLMI1dxH8q0pg+HmUwVieXLU=";
+      hash = "sha256-5z7/8xfEkqeZAJL5wSZ2xwW/bP5AolipP2P0tMmUFDI=";
     };
 
+    postPatch = ''
+      substituteInPlace tests/test_cli.py \
+        --replace-fail "BINDIR = Path(sys.executable).parent" "BINDIR = '$out/bin'"
+    '';
+
     build-system = [
       calver
       setuptools
···
       homepage = "https://github.com/pypa/trove-classifiers";
       changelog = "https://github.com/pypa/trove-classifiers/releases/tag/${version}";
       license = lib.licenses.asl20;
+      mainProgram = "trove-classifiers";
       maintainers = with lib.maintainers; [ dotlambda ];
     };
   };

pkgs/development/python-modules/typer/default.nix

···
   pytestCheckHook,
   writableTmpDirAsHomeHook,
   procps,
+
+  # typer or typer-slim
+  package ? "typer",
 }:
 
 buildPythonPackage rec {
-  pname = "typer";
+  pname = package;
   version = "0.16.0";
   pyproject = true;
 
···
     hash = "sha256-WB9PIxagTHutfk3J+mNTVK8bC7TMDJquu3GLBQgaras=";
   };
 
+  env.TIANGOLO_BUILD_PACKAGE = package;
+
   build-system = [ pdm-backend ];
 
   dependencies = [
     click
     typing-extensions
-    # Build includes the standard optional by default
-    # https://github.com/tiangolo/typer/blob/0.12.3/pyproject.toml#L71-L72
   ]
-  ++ optional-dependencies.standard;
+  # typer includes the standard optional by default
+  # https://github.com/tiangolo/typer/blob/0.12.3/pyproject.toml#L71-L72
+  ++ lib.optionals (package == "typer") optional-dependencies.standard;
 
   optional-dependencies = {
     standard = [
···
       shellingham
     ];
   };
+
+  doCheck = package == "typer"; # tests expect standard dependencies
 
   nativeCheckInputs = [
     coverage # execs coverage in tests

pkgs/development/python-modules/ueberzug/default.nix

···
 
   pythonImportsCheck = [ "ueberzug" ];
 
-  meta = with lib; {
+  meta = {
     description = "Alternative for w3mimgdisplay";
     homepage = "https://github.com/ueber-devel/ueberzug";
     changelog = "https://github.com/ueber-devel/ueberzug/releases/tag/${version}";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
     mainProgram = "ueberzug";
-    maintainers = with maintainers; [ Br1ght0ne ];
+    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/development/python-modules/units-llnl/default.nix

···
     ninja
   ];
   dontUseCmakeConfigure = true;
-  env = {
-    SKBUILD_CMAKE_ARGS = lib.strings.concatStringsSep ";" (
-      cmakeFlags
-      ++ [
-        (lib.cmakeBool "UNITS_BUILD_PYTHON_LIBRARY" true)
-      ]
-    );
-  };
+  cmakeFlags = cmakeFlags ++ [
+    (lib.cmakeBool "UNITS_BUILD_PYTHON_LIBRARY" true)
+  ];
 
   # Also upstream turns off testing for the python build so it seems, see:
   # https://github.com/LLNL/units/blob/v0.13.1/pyproject.toml#L65-L66 However

pkgs/development/python-modules/uv/default.nix

···
   build-system = [ hatchling ];
 
   postPatch =
-    # Do not rely on path lookup at runtime to find the uv binary.
-    # Use the propagated binary instead.
+    # Add the path to the uv binary as a fallback after other path search methods have been exhausted
     ''
       substituteInPlace python/uv/_find_uv.py \
-        --replace-fail '"""Return the uv binary path."""' "return '${lib.getExe uv}'"
+        --replace-fail \
+        'sysconfig.get_path("scripts", scheme=_user_scheme()),' \
+        'sysconfig.get_path("scripts", scheme=_user_scheme()), "${builtins.baseNameOf (lib.getExe uv)}",'
     ''
     # Sidestep the maturin build system in favour of reusing the binary already built by nixpkgs,
     # to avoid rebuilding the uv binary for every active python package set.

pkgs/development/tools/misc/patchelf/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "0.15.0";
+  version = "0.15.2";
 
   src = fetchurl {
     url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-9ANtPuTY4ijewb7/8PbkbYpA6eVw4AaOOdd+YuLIvcI=";
+    sha256 = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw=";
   };
 
   strictDeps = true;
···
   enableParallelBuilding = true;
 
   # fails 8 out of 24 tests, problems when loading libc.so.6
-  doCheck =
-    stdenv.name == "stdenv-linux"
-    # test scripts require unprefixed bintools binaries
-    # https://github.com/NixOS/patchelf/issues/417
-    && stdenv.cc.targetPrefix == "";
+  doCheck = stdenv.name == "stdenv-linux";
 
   meta = with lib; {
     homepage = "https://github.com/NixOS/patchelf";

pkgs/development/web/nodejs/bypass-darwin-xcrun-node16.patch

···
-Avoids needing xcrun or xcodebuild in PATH for native package builds
-
---- a/tools/gyp/pylib/gyp/xcode_emulation.py
-+++ b/tools/gyp/pylib/gyp/xcode_emulation.py
-@@ -522,7 +522,13 @@ class XcodeSettings:
-         # Since the CLT has no SDK paths anyway, returning None is the
-         # most sensible route and should still do the right thing.
-         try:
--            return GetStdoutQuiet(["xcrun", "--sdk", sdk, infoitem])
-+            #return GetStdoutQuiet(["xcrun", "--sdk", sdk, infoitem])
-+            return {
-+                "--show-sdk-platform-path": "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform",
-+                "--show-sdk-path": "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk",
-+                "--show-sdk-build-version": "19A547",
-+                "--show-sdk-version": "10.15"
-+            }[infoitem]
-         except GypError:
-             pass
- 
-@@ -1499,7 +1505,8 @@ def XcodeVersion():
-     version = ""
-     build = ""
-     try:
--        version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
-+        #version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
-+        version_list = []
-         # In some circumstances xcodebuild exits 0 but doesn't return
-         # the right results; for example, a user on 10.7 or 10.8 with
-         # a bogus path set via xcode-select
-@@ -1510,7 +1517,8 @@ def XcodeVersion():
-         version = version_list[0].split()[-1]  # Last word on first line
-         build = version_list[-1].split()[-1]  # Last word on last line
-     except GypError:  # Xcode not installed so look for XCode Command Line Tools
--        version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
-+        #version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
-+        version = "11.0.0.0.1.1567737322"
-         if not version:
-             raise GypError("No Xcode or CLT version detected!")
-     # Be careful to convert "4.2.3" to "0423" and "11.0.0" to "1100":
---- a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
-+++ b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
-@@ -522,7 +522,13 @@ class XcodeSettings:
-         # Since the CLT has no SDK paths anyway, returning None is the
-         # most sensible route and should still do the right thing.
-         try:
--            return GetStdoutQuiet(["xcrun", "--sdk", sdk, infoitem])
-+            #return GetStdoutQuiet(["xcrun", "--sdk", sdk, infoitem])
-+            return {
-+                "--show-sdk-platform-path": "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform",
-+                "--show-sdk-path": "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk",
-+                "--show-sdk-build-version": "19A547",
-+                "--show-sdk-version": "10.15"
-+            }[infoitem]
-         except GypError:
-             pass
- 
-@@ -1499,7 +1505,8 @@ def XcodeVersion():
-     version = ""
-     build = ""
-     try:
--        version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
-+        #version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
-+        version_list = []
-         # In some circumstances xcodebuild exits 0 but doesn't return
-         # the right results; for example, a user on 10.7 or 10.8 with
-         # a bogus path set via xcode-select
-@@ -1510,7 +1517,8 @@ def XcodeVersion():
-         version = version_list[0].split()[-1]  # Last word on first line
-         build = version_list[-1].split()[-1]  # Last word on last line
-     except GypError:  # Xcode not installed so look for XCode Command Line Tools
--        version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
-+        #version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
-+        version = "11.0.0.0.1.1567737322"
-         if not version:
-             raise GypError("No Xcode or CLT version detected!")
-     # Be careful to convert "4.2.3" to "0423" and "11.0.0" to "1100":

pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch

···
-Disable v8 system instrumentation on Darwin
-
-On Darwin, the v8 system instrumentation requires the header "os/signpost.h"
-which is available since apple_sdk 11+. See: https://github.com/nodejs/node/issues/39584
-
---- old/tools/v8_gypfiles/features.gypi
-+++ new/tools/v8_gypfiles/features.gypi
-@@ -62,7 +62,7 @@
-       }, {
-         'is_component_build': 0,
-       }],
--      ['OS == "win" or OS == "mac"', {
-+      ['OS == "win"', {
-         # Sets -DENABLE_SYSTEM_INSTRUMENTATION. Enables OS-dependent event tracing
-         'v8_enable_system_instrumentation': 1,
-       }, {

pkgs/development/web/nodejs/gyp-patches-set-fallback-value-for-CLT-darwin.patch

···
+Sandboxed builds need a fallback value for the version of the Command Line Tools
+being used.
+
+diff --git a/tools/gyp/pylib/gyp/xcode_emulation.py b/tools/gyp/pylib/gyp/xcode_emulation.py
+index 508f6ccac3e..44bcd988c4c 100644
+--- a/tools/gyp/pylib/gyp/xcode_emulation.py
++++ b/tools/gyp/pylib/gyp/xcode_emulation.py
+@@ -1495,24 +1495,8 @@ def XcodeVersion():
+     global XCODE_VERSION_CACHE
+     if XCODE_VERSION_CACHE:
+         return XCODE_VERSION_CACHE
+-    version = ""
++    version = "11.0.0.0.1.1567737322"
+     build = ""
+-    try:
+-        version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
+-        # In some circumstances xcodebuild exits 0 but doesn't return
+-        # the right results; for example, a user on 10.7 or 10.8 with
+-        # a bogus path set via xcode-select
+-        # In that case this may be a CLT-only install so fall back to
+-        # checking that version.
+-        if len(version_list) < 2:
+-            raise GypError("xcodebuild returned unexpected results")
+-        version = version_list[0].split()[-1]  # Last word on first line
+-        build = version_list[-1].split()[-1]  # Last word on last line
+-    except (GypError, OSError):
+-        # Xcode not installed so look for XCode Command Line Tools
+-        version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
+-        if not version:
+-            raise GypError("No Xcode or CLT version detected!")
+     # Be careful to convert "4.2.3" to "0423" and "11.0.0" to "1100":
+     version = version.split(".")[:3]  # Just major, minor, micro
+     version[0] = version[0].zfill(2)  # Add a leading zero if major is one digit
+ 
+ 
+--- a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
++++ b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
+@@ -1495,24 +1495,8 @@ def XcodeVersion():
+     global XCODE_VERSION_CACHE
+     if XCODE_VERSION_CACHE:
+         return XCODE_VERSION_CACHE
+-    version = ""
++    version = "11.0.0.0.1.1567737322"
+     build = ""
+-    try:
+-        version_list = GetStdoutQuiet(["xcodebuild", "-version"]).splitlines()
+-        # In some circumstances xcodebuild exits 0 but doesn't return
+-        # the right results; for example, a user on 10.7 or 10.8 with
+-        # a bogus path set via xcode-select
+-        # In that case this may be a CLT-only install so fall back to
+-        # checking that version.
+-        if len(version_list) < 2:
+-            raise GypError("xcodebuild returned unexpected results")
+-        version = version_list[0].split()[-1]  # Last word on first line
+-        build = version_list[-1].split()[-1]  # Last word on last line
+-    except (GypError, OSError):
+-        # Xcode not installed so look for XCode Command Line Tools
+-        version = CLTVersion()  # macOS Catalina returns 11.0.0.0.1.1567737322
+-        if not version:
+-            raise GypError("No Xcode or CLT version detected!")
+     # Be careful to convert "4.2.3" to "0423" and "11.0.0" to "1100":
+     version = version.split(".")[:3]  # Just major, minor, micro
+     version[0] = version[0].zfill(2)  # Add a leading zero if major is one digit

pkgs/development/web/nodejs/gyp-patches-set-fallback-value-for-CLT.patch

···
+Sandboxed builds need a fallback value for the version of the Command Line Tools
+being used.
+
+--- a/tools/gyp/pylib/gyp/xcode_emulation.py
++++ b/tools/gyp/pylib/gyp/xcode_emulation.py
+@@ -1552,7 +1552,7 @@ def CLTVersion():
+         output = GetStdout(["/usr/sbin/softwareupdate", "--history"])
+         return re.search(regex, output).groupdict()["version"]
+     except (GypError, OSError):
+-        return None
++        return "11.0.0.0.1.1567737322"
+ 
+ 
+ def GetStdoutQuiet(cmdlist):
+--- a/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
++++ b/deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
+@@ -1552,7 +1552,7 @@ def CLTVersion():
+         output = GetStdout(["/usr/sbin/softwareupdate", "--history"])
+         return re.search(regex, output).groupdict()["version"]
+     except (GypError, OSError):
+-        return None
++        return "11.0.0.0.1.1567737322"
+ 
+ 
+ def GetStdoutQuiet(cmdlist):

pkgs/development/web/nodejs/gyp-patches.nix

···
 {
   lib,
+  stdenv,
   fetchpatch2,
   patch_npm ? true,
   patch_tools ? true,
+  patch_npm_catch_oserror ? patch_npm,
+  patch_tools_catch_oserror ? patch_tools,
+  patch_npm_regex_handling ? patch_npm && stdenv.buildPlatform.isDarwin,
+  patch_tools_regex_handling ? patch_tools && stdenv.buildPlatform.isDarwin,
 }:
 let
-  url = "https://github.com/nodejs/gyp-next/commit/706d04aba5bd18f311dc56f84720e99f64c73466.patch?full_index=1";
+  url = "https://github.com/nodejs/gyp-next/commit/8224deef984add7e7afe846cfb82c9d3fa6da1fb.patch?full_index=1";
+  url_regex_handling = "https://github.com/nodejs/gyp-next/commit/b21ee3150eea9fc1a8811e910e5ba64f42e1fb77.patch?full_index=1";
 in
-lib.optionals patch_tools ([
+lib.optionals patch_tools_catch_oserror ([
   # Fixes builds with Nix sandbox on Darwin for gyp.
-  # See https://github.com/NixOS/nixpkgs/issues/261820
-  # and https://github.com/nodejs/gyp-next/pull/216
   (fetchpatch2 {
     inherit url;
-    hash = "sha256-iV9qvj0meZkgRzFNur2v1jtLZahbqvSJ237NoM8pPZc=";
+    hash = "sha256-kvCMpedjrY64BlaC1R0NVjk/vIVivYAGVgWwMEGeP6k=";
     stripLen = 1;
     extraPrefix = "tools/gyp/";
   })
 ])
-++ lib.optionals patch_npm ([
+++ lib.optionals patch_npm_catch_oserror ([
   (fetchpatch2 {
     inherit url;
-    hash = "sha256-1iyeeAprmWpmLafvOOXW45iZ4jWFSloWJxQ0reAKBOo=";
+    hash = "sha256-cXTwmCRHrNhuY1+3cD/EvU0CJ+1Nk4TRh6c3twvfaW8=";
+    stripLen = 1;
+    extraPrefix = "deps/npm/node_modules/node-gyp/gyp/";
+  })
+])
+++ lib.optionals patch_tools_regex_handling ([
+  # Fixes builds with Nix sandbox on Darwin for gyp.
+  (fetchpatch2 {
+    url = url_regex_handling;
+    hash = "sha256-xDZO8GgZLPvCeTrCu6RVVFV5bmbuz9UPgHiaAJE6im0=";
+    stripLen = 1;
+    extraPrefix = "tools/gyp/";
+  })
+])
+++ lib.optionals patch_npm_regex_handling ([
+  (fetchpatch2 {
+    url = url_regex_handling;
+    hash = "sha256-fW5kQh+weCK0g3wzTJLZgAuXxetb14UAf6yxW6bIgbU=";
     stripLen = 1;
     extraPrefix = "deps/npm/node_modules/node-gyp/gyp/";
   })
 ])
+# TODO: remove the Darwin conditionals from this file
+++ lib.optionals stdenv.buildPlatform.isDarwin ([
+  ./gyp-patches-set-fallback-value-for-CLT-darwin.patch
+])

pkgs/development/web/nodejs/nodejs.nix

···
   runtimeShell,
   gnupg,
   installShellFiles,
+  darwin,
 }:
 
 {
···
 
       inherit patches;
 
+      postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+        substituteInPlace test/parallel/test-macos-app-sandbox.js \
+          --subst-var-by codesign '${darwin.sigtool}/bin/codesign'
+      '';
+
       __darwinAllowLocalNetworking = true; # for tests
 
       doCheck = canExecute;
···
               "test-process-initgroups"
               "test-process-setgroups"
               "test-process-uid-gid"
-              "test-setproctitle"
               # This is a bit weird, but for some reason fs watch tests fail with
               # sandbox.
               "test-fs-promises-watch"
···
             ]
             ++ lib.optionals stdenv.buildPlatform.isDarwin [
               # Disable tests that don’t work under macOS sandbox.
-              "test-macos-app-sandbox"
+              # uv_os_setpriority returned EPERM (operation not permitted)
               "test-os"
               "test-os-process-priority"
 
···
           )
         }"
       ];
+
+      sandboxProfile = ''
+        (allow file-read*
+          (literal "/Library/Keychains/System.keychain")
+          (literal "/private/var/db/mds/system/mdsDirectory.db")
+          (literal "/private/var/db/mds/system/mdsObject.db"))
+
+        ; Allow files written by Module Directory Services (MDS), which is used
+        ; by Security.framework: https://apple.stackexchange.com/a/411476
+        ; These rules are based on the system sandbox profiles found in
+        ; /System/Library/Sandbox/Profiles.
+        (allow file-write*
+          (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsDirectory\.db$")
+          (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsObject\.db_?$")
+          (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mds\.lock$"))
+
+        (allow mach-lookup
+          (global-name "com.apple.FSEvents")
+          (global-name "com.apple.SecurityServer")
+          (global-name "com.apple.system.opendirectoryd.membership"))
+      '';
 
       postInstall =
         let

pkgs/development/web/nodejs/use-nix-codesign.patch

···
+diff --git a/test/parallel/test-macos-app-sandbox.js b/test/parallel/test-macos-app-sandbox.js
+index 60ad67b3db..b6ac0dcef4 100644
+--- a/test/parallel/test-macos-app-sandbox.js
++++ b/test/parallel/test-macos-app-sandbox.js
+@@ -45,11 +45,11 @@ fs.copyFileSync(
+ 
+ // Sign the app bundle with sandbox entitlements:
+ assert.strictEqual(
+-  child_process.spawnSync('/usr/bin/codesign', [
++  child_process.spawnSync('@codesign@', [
+     '--entitlements', fixtures.path(
+       'macos-app-sandbox', 'node_sandboxed.entitlements'),
+     '--force', '-s', '-',
+-    appBundlePath,
++    appExecutablePath,
+   ]).status,
+   0);
+ 

pkgs/development/web/nodejs/v20.nix

···
   };
 
   gypPatches = callPackage ./gyp-patches.nix { } ++ [
+    # Fixes builds with Nix sandbox on Darwin for gyp.
+    # See https://github.com/NixOS/nixpkgs/issues/261820
+    # and https://github.com/nodejs/gyp-next/pull/216
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/gyp-next/commit/706d04aba5bd18f311dc56f84720e99f64c73466.patch?full_index=1";
+      hash = "sha256-iV9qvj0meZkgRzFNur2v1jtLZahbqvSJ237NoM8pPZc=";
+      stripLen = 1;
+      extraPrefix = "tools/gyp/";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/gyp-next/commit/706d04aba5bd18f311dc56f84720e99f64c73466.patch?full_index=1";
+      hash = "sha256-1iyeeAprmWpmLafvOOXW45iZ4jWFSloWJxQ0reAKBOo=";
+      stripLen = 1;
+      extraPrefix = "deps/npm/node_modules/node-gyp/gyp/";
+    })
+
     ./gyp-patches-pre-v22-import-sys.patch
+    ./gyp-patches-set-fallback-value-for-CLT.patch
   ];
 in
 buildNodejs {
···
   patches = [
     ./configure-emulator.patch
     ./configure-armv6-vfpv2.patch
-    ./disable-darwin-v8-system-instrumentation-node19.patch
-    ./bypass-darwin-xcrun-node16.patch
     ./node-npm-build-npm-package-logic.patch
     ./use-correct-env-in-tests.patch
+    ./use-nix-codesign.patch
+
+    # TODO: remove when included in a release
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/8caa1dcee63b2c6fd7a9edf9b9a6222b38a2cf62.patch?full_index=1";
+      hash = "sha256-DtN0bpYfo5twHz2GrLLgq4Bu2gFYTkNPMRKhrgeYRyA=";
+      includes = [ "test/parallel/test-setproctitle.js" ];
+    })
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/499a5c345165f0d4a94b98d08f1ace7268781564.patch?full_index=1";
+      hash = "sha256-wF4+CytC1OB5egJGOfLm1USsYY12f9kADymVrxotezE=";
+    })
   ]
   ++ gypPatches;
 }

pkgs/development/web/nodejs/v22.nix

···
     inherit openssl;
     python = python3;
   };
+
+  gypPatches =
+    if stdenv.buildPlatform.isDarwin then
+      callPackage ./gyp-patches.nix { }
+      ++ [
+        ./gyp-patches-set-fallback-value-for-CLT.patch
+      ]
+    else
+      [ ];
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.18.0";
-  sha256 = "120e0f74419097a9fafae1fd80b9de7791a587e6f1c48c22b193239ccd0f7084";
+  version = "22.19.0";
+  sha256 = "0272acfce50ce9ad060288321b1092719a7f19966f81419835410c59c09daa46";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
···
         hash = "sha256-hSTLljmVzYmc3WAVeRq9EPYluXGXFeWVXkykufGQPVw=";
       })
     ]
+    ++ gypPatches
     ++ [
       ./configure-armv6-vfpv2.patch
-      ./disable-darwin-v8-system-instrumentation-node19.patch
-      ./bypass-darwin-xcrun-node16.patch
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
+      ./use-nix-codesign.patch
+
+      # TODO: remove when included in a release
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/499a5c345165f0d4a94b98d08f1ace7268781564.patch?full_index=1";
+        hash = "sha256-wF4+CytC1OB5egJGOfLm1USsYY12f9kADymVrxotezE=";
+      })
     ];
 }

pkgs/development/web/nodejs/v24.nix

···
     inherit openssl;
     python = python3;
   };
+
+  gypPatches =
+    if stdenv.buildPlatform.isDarwin then
+      callPackage ./gyp-patches.nix { patch_tools_catch_oserror = false; }
+      ++ [
+        ./gyp-patches-set-fallback-value-for-CLT.patch
+      ]
+    else
+      [ ];
 in
 buildNodejs {
   inherit enableNpm;
···
     ]
     ++ [
       ./configure-armv6-vfpv2.patch
-      ./disable-darwin-v8-system-instrumentation-node19.patch
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
-
-      # TODO: newer GYP versions have been patched to be more compatible with Nix sandbox. We need
-      # to adapt our patch to this newer version, see https://github.com/NixOS/nixpkgs/pull/434742.
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/886e4b3b534a9f3ad2facbc99097419e06615900.patch?full_index=1";
-        hash = "sha256-HFTabl92NPkBwXD0mUGDN+Gzabyi+Ph0kL0FEHHknbk=";
-        revert = true;
-      })
-      ./bypass-darwin-xcrun-node16.patch
+      ./use-nix-codesign.patch
     ]
+    ++ gypPatches
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [
       # test-icu-env is failing without the reverts
       (fetchpatch2 {

pkgs/os-specific/linux/fuse/default.nix

···
   };
 
   fuse_3 = mkFuse {
-    version = "3.17.2";
-    hash = "sha256-rpWA97ZnoYWEQoUCGtITpx9w1J4qy6LGSxomFNOnKBc=";
+    version = "3.17.4";
+    hash = "sha256-G3+cBp8q8S8oLIcgWp0p+TAtzqXlKYbRSY/5Y3L7QO4=";
   };
 }

pkgs/os-specific/linux/iptables/default.nix

···
   libnfnetlink,
   libnftnl,
   libpcap,
+  bash,
+  bashNonInteractive,
   nftablesCompat ? true,
   gitUpdater,
 }:
···
 stdenv.mkDerivation rec {
   version = "1.8.11";
   pname = "iptables";
+
+  __structuredAttrs = true;
 
   src = fetchurl {
     url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
···
 
   outputs = [
     "out"
+    "lib"
     "dev"
     "man"
   ];
+
+  strictDeps = true;
 
   nativeBuildInputs = [
     autoreconfHook
···
     libnfnetlink
     libnftnl
     libpcap
+    bash
   ];
 
   configureFlags = [
···
     ln -sv xtables-nft-multi $out/bin/ip6tables-restore
     ln -sv xtables-nft-multi $out/bin/ip6tables-save
   '';
+
+  outputChecks.lib.disallowedRequisites = [
+    bash
+    bashNonInteractive
+  ];
 
   passthru = {
     updateScript = gitUpdater {

pkgs/os-specific/linux/kernel/manual-config.nix

···
           "KBUILD_BUILD_VERSION=1-NixOS"
           kernelConf.target
           "vmlinux" # for "perf" and things like that
+          "scripts_gdb"
         ]
         ++ optional isModular "modules"
         ++ optionals buildDTBs [
···
         postInstall = optionalString isModular ''
           mkdir -p $dev
           cp vmlinux $dev/
+
+          mkdir -p $dev/lib/modules/${modDirVersion}/build/scripts
+          cp -rL ../scripts/gdb/ $dev/lib/modules/${modDirVersion}/build/scripts
+
           if [ -z "''${dontStrip-}" ]; then
             installFlags+=("INSTALL_MOD_STRIP=1")
           fi

pkgs/os-specific/linux/libbpf/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    hash = "sha256-2AtUwCN17bSM0mJrERTklVluUduMMAX25pOGEwNPjAU=";
+    hash = "sha256-igjjwirg3O5mC3DzGCAO9OgrH2drnE/gV6NH7ZLNnFE=";
   };
+
+  patches = [
+    # Fix redefinition when using linux/netlink.h from libbpf with musl
+    # https://github.com/libbpf/libbpf/pull/919
+    ./sync-uapi-move-constants-from-linux-kernel-h-to-linux-const-h.patch
+  ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [

pkgs/os-specific/linux/libbpf/sync-uapi-move-constants-from-linux-kernel-h-to-linux-const-h.patch

···
+From 448f3f2e2065a5ef20010133dae58c5311ecc538 Mon Sep 17 00:00:00 2001
+From: Yureka <[e-mail]>
+Date: Sat, 23 Aug 2025 18:24:07 +0200
+Subject: [PATCH] sync: uapi: move constants from <linux/kernel.h> to
+ <linux/const.h>
+
+This change was applied to the kernel tree in 2020 afaict, to fix redefinition issues with musl-libc.
+
+I ran into this issue while building with the headers included with libbpf, since it seems they were not synced since then.
+
+Signed-off-by: Yureka Lilian <[e-mail]>
+---
+ include/uapi/linux/netlink.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h
+index b857821e3..e900b1f88 100644
+--- a/include/uapi/linux/netlink.h
++++ b/include/uapi/linux/netlink.h
+@@ -2,7 +2,7 @@
+ #ifndef __LINUX_NETLINK_H
+ #define __LINUX_NETLINK_H
+ 
+-#include <linux/kernel.h>
++#include <linux/const.h>
+ #include <linux/socket.h> /* for __kernel_sa_family_t */
+ #include <linux/types.h>
+ 

pkgs/os-specific/linux/lvm2/common.nix

···
   coreutils,
   libuuid,
   libaio,
+  bash,
+  bashNonInteractive,
   replaceVars,
   enableCmdlib ? false,
   enableDmeventd ? false,
···
     + lib.optionalString enableVDO "-with-vdo";
   inherit version;
 
+  __structuredAttrs = true;
+
   src = fetchurl {
     urls = [
       "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz"
···
     inherit hash;
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals udevSupport [ udevCheckHook ];
   buildInputs = [
     libaio
+    bash
   ]
   ++ lib.optionals udevSupport [
     udev
···
     "--with-systemd-run=/run/current-system/systemd/bin/systemd-run"
     "--with-default-profile-subdir=profile.d"
   ]
-  ++ lib.optionals (!enableCmdlib && !onlyLib) [
-    "--bindir=${placeholder "bin"}/bin"
-    "--sbindir=${placeholder "bin"}/bin"
-    "--libdir=${placeholder "lib"}/lib"
-    "--with-libexecdir=${placeholder "lib"}/libexec"
-  ]
+  ++ lib.optionals (!onlyLib) (
+    if enableCmdlib then
+      [
+        "--bindir=${placeholder "out"}/bin"
+        "--sbindir=${placeholder "out"}/bin"
+      ]
+    else
+      [
+        "--bindir=${placeholder "bin"}/bin"
+        "--sbindir=${placeholder "bin"}/bin"
+        "--libdir=${placeholder "lib"}/lib"
+        "--with-libexecdir=${placeholder "lib"}/libexec"
+      ]
+  )
   ++ lib.optional enableCmdlib "--enable-cmdlib"
   ++ lib.optionals enableDmeventd [
     "--enable-dmeventd"
···
   ]
   ++ lib.optionals enableVDO [
     "--enable-vdo"
+    "--with-vdo-format=${vdo}/bin/vdoformat"
   ]
   ++ lib.optionals stdenv.hostPlatform.isStatic [
     "--enable-static_link"
···
   ++ lib.optionals (!onlyLib) [
     "dev"
     "man"
+    "scripts"
   ]
   ++ lib.optionals (!onlyLib && !enableCmdlib) [
     "bin"
     "lib"
   ];
 
-  postInstall = lib.optionalString (enableCmdlib != true) ''
-    moveToOutput lib/libdevmapper.so $lib
-  '';
+  postInstall =
+    lib.optionalString (!onlyLib) ''
+      moveToOutput bin/fsadm $scripts
+      moveToOutput bin/blkdeactivate $scripts
+      moveToOutput bin/lvmdump $scripts
+      moveToOutput bin/lvm_import_vdo $scripts
+      moveToOutput libexec/lvresize_fs_helper $scripts/lib
+    ''
+    + lib.optionalString (!enableCmdlib) ''
+      moveToOutput lib/libdevmapper.so $lib
+    '';
+
+  outputChecks = lib.optionalAttrs (!stdenv.hostPlatform.isStatic && !enableVDO) {
+    out.disallowedRequisites = [
+      bash
+      bashNonInteractive
+    ];
+    lib.disallowedRequisites = [
+      bash
+      bashNonInteractive
+    ];
+  };
 
   passthru.tests = {
     installer = nixosTests.installer.lvm;

pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch

···
  1 file changed, 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index 7ede6f7a96..90860be99a 100644
+index a4730f0570..b5aaecd669 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2795,7 +2795,6 @@ install_data('LICENSE.GPL2',
+@@ -2815,7 +2815,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  

pkgs/os-specific/linux/systemd/0018-bootctl-do-not-fail-when-the-same-file-is-updated-mu.patch

···
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Yu Watanabe <[e-mail]>
-Date: Wed, 19 Jun 2024 16:11:23 +0900
-Subject: [PATCH] bootctl: do not fail when the same file is updated multiple
- times
-
-In the second or later trial, copy_file_with_version_check() -> version_check()
-fails with -ESRCH. Let's ignore the failure.
-
-This also adds missing assertions in update_efi_boot_binaries(), and
-drop redundant version check in update_efi_boot_binaries(), as version
-will be anyway checked later.
-
-Fixes a regression caused by 929f41c6528fb630753d4e2f588a8eb6c2f6a609.
-Fixes #33392.
----
- src/bootctl/bootctl-install.c | 16 +++++++---------
- 1 file changed, 7 insertions(+), 9 deletions(-)
-
-diff --git a/src/bootctl/bootctl-install.c b/src/bootctl/bootctl-install.c
-index e15c2c6bed..5b4cff5d5e 100644
---- a/src/bootctl/bootctl-install.c
-+++ b/src/bootctl/bootctl-install.c
-@@ -329,6 +329,9 @@ static int update_efi_boot_binaries(const char *esp_path, const char *source_pat
-         _cleanup_free_ char *p = NULL;
-         int r, ret = 0;
- 
-+        assert(esp_path);
-+        assert(source_path);
-+
-         r = chase_and_opendir("/EFI/BOOT", esp_path, CHASE_PREFIX_ROOT|CHASE_PROHIBIT_SYMLINKS, &p, &d);
-         if (r == -ENOENT)
-                 return 0;
-@@ -354,19 +357,14 @@ static int update_efi_boot_binaries(const char *esp_path, const char *source_pat
-                 if (r == 0)
-                         continue;
- 
--                r = get_file_version(fd, &v);
--                if (r == -ESRCH)
--                        continue;  /* No version information */
--                if (r < 0)
--                        return r;
--                if (!startswith(v, "systemd-boot "))
--                        continue;
--
-                 _cleanup_free_ char *dest_path = path_join(p, de->d_name);
-                 if (!dest_path)
-                         return log_oom();
- 
--                RET_GATHER(ret, copy_file_with_version_check(source_path, dest_path, /* force = */ false));
-+                r = copy_file_with_version_check(source_path, dest_path, /* force = */ false);
-+                if (IN_SET(r, -ESTALE, -ESRCH))
-+                        continue;
-+                RET_GATHER(ret, r);
-         }
- 
-         return ret;

pkgs/os-specific/linux/systemd/0019-meson-Don-t-link-ssh-dropins.patch pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch

···
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 90860be99a..f021f76031 100644
+index b5aaecd669..91b23f2d72 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -207,13 +207,13 @@ sshconfdir = get_option('sshconfdir')

pkgs/os-specific/linux/systemd/default.nix

···
   libseccomp,
   withKexectools ? lib.meta.availableOn stdenv.hostPlatform kexec-tools,
   kexec-tools,
-  bashInteractive,
   bash,
+  bashNonInteractive,
   libmicrohttpd,
   libfido2,
   p11-kit,
···
   withHostnamed ? true,
   withHwdb ? true,
   withImportd ? !stdenv.hostPlatform.isMusl,
-  withIptables ? true,
   withKmod ? true,
   withLibBPF ?
     lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
···
 let
   wantCurl = withRemote || withImportd;
 
-  version = "257.7";
+  version = "257.8";
 
   # Use the command below to update `releaseTimestamp` on every (major) version
   # change. More details in the commentary at mesonFlags.
···
     owner = "systemd";
     repo = "systemd";
     rev = "v${version}";
-    hash = "sha256-9OnjeMrfV5DSAoX/aetI4r/QLPYITUd2aOY0DYfkTzQ=";
+    hash = "sha256-XQ+IyRar74qQij96CKClHXW0kkPnGeKUgA8ULiWh5YY=";
   };
 
   # On major changes, or when otherwise required, you *must* :
···
     ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
     ./0017-meson.build-do-not-create-systemdstatedir.patch
 
-    # https://github.com/systemd/systemd/issues/33392
-    # https://github.com/systemd/systemd/pull/33400
-    ./0018-bootctl-do-not-fail-when-the-same-file-is-updated-mu.patch
-
     # systemd tries to link the systemd-ssh-proxy ssh config snippet with tmpfiles
     # if the install prefix is not /usr, but that does not work for us
     # because we include the config snippet manually
-    ./0019-meson-Don-t-link-ssh-dropins.patch
+    ./0018-meson-Don-t-link-ssh-dropins.patch
 
-    ./0020-install-unit_file_exists_full-follow-symlinks.patch
+    ./0019-install-unit_file_exists_full-follow-symlinks.patch
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
-    ./0021-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+    ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ]
   ++ lib.optionals (stdenv.hostPlatform.isPower64) [
     # Auto-detect ELF ABI instead of hardcoding ELFv2 for BPF build
···
     (if withPam then libcap else libcap.override { usePam = false; })
     libuuid
     linuxHeaders
-    bashInteractive # for patch shebangs
   ]
 
   ++ lib.optionals withGcrypt [
···
   ++ lib.optional withKmod kmod
   ++ lib.optional withLibidn2 libidn2
   ++ lib.optional withLibseccomp libseccomp
-  ++ lib.optional withIptables iptables
   ++ lib.optional withPam pam
   ++ lib.optional withPCRE2 pcre2
   ++ lib.optional withSelinux libselinux
···
     (lib.mesonOption "version-tag" version)
     (lib.mesonOption "mode" "release")
     (lib.mesonOption "tty-gid" "3") # tty in NixOS has gid 3
-    (lib.mesonOption "debug-shell" "${bashInteractive}/bin/bash")
     (lib.mesonOption "pamconfdir" "${placeholder "out"}/etc/pam.d")
     (lib.mesonOption "shellprofiledir" "${placeholder "out"}/etc/profile.d")
     (lib.mesonOption "kmod-path" "${kmod}/bin/kmod")
+
+    # /bin/sh is also the upstream default. Explicitly set this so that we're
+    # independent of upstream changes to the default.
+    (lib.mesonOption "debug-shell" "/bin/sh")
 
     # Attempts to check /usr/sbin and that fails in macOS sandbox because
     # permission is denied. If /usr/sbin is not a symlink, it defaults to true.
···
     (lib.mesonOption "sshconfdir" "")
     (lib.mesonOption "sshdconfdir" "no")
 
+    # RPM
+    # This stops building/installing RPM specific tools.
+    (lib.mesonOption "rpmmacrosdir" "no")
+
     # Features
 
     # Tests
···
     (lib.mesonEnable "libcurl" wantCurl)
     (lib.mesonEnable "libidn" false)
     (lib.mesonEnable "libidn2" withLibidn2)
-    (lib.mesonEnable "libiptc" withIptables)
+    (lib.mesonEnable "libiptc" false)
     (lib.mesonEnable "repart" withRepart)
     (lib.mesonEnable "sysupdate" withSysupdate)
     (lib.mesonEnable "sysupdated" withSysupdate)
···
           builtins.map (p: p.__spliced.buildHost or p) finalAttrs.nativeBuildInputs
         )
       );
+
+  disallowedRequisites = lib.optionals (!withUkify) [
+    bash
+    bashNonInteractive
+  ];
 
   passthru = {
     # The `interfaceVersion` attribute below points out the incompatibilities

pkgs/servers/sql/postgresql/generic.nix

···
       gettext,
 
       # NUMA
-      numaSupport ?
-        lib.versionAtLeast version "18"
-        && lib.meta.availableOn stdenv.hostPlatform numactl
-        # NUMA can fail in 18beta2 on some hardware with:
-        # ERROR:  invalid NUMA node id outside of allowed range [0, 0]: 1
-        # https://github.com/NixOS/nixpkgs/pull/411958#issuecomment-3031680123
-        # https://www.postgresql.org/message-id/flat/E1u1tr8-003BbN-2E%40gemulon.postgresql.org
-        && version != "18beta2",
+      numaSupport ? lib.versionAtLeast version "18" && lib.meta.availableOn stdenv.hostPlatform numactl,
       numactl,
 
       # PAM
···
         substituteInPlace "src/common/config_info.c" --subst-var dev
         cat ${./pg_config.env.mk} >> src/common/Makefile
       ''
+      # This test always fails on hardware with >1 NUMA node: the sysfs
+      # dirs providing information about the topology are hidden in the sandbox,
+      # so postgres assumes there's only a single node `0`. However,
+      # the test checks on which NUMA nodes the allocated pages are which is >1
+      # on such hardware. This in turn triggers a safeguard in the view
+      # which breaks the test.
+      # Manual tests confirm that the testcase behaves properly outside of the
+      # Nix sandbox.
+      + lib.optionalString (atLeast "18") ''
+        substituteInPlace src/test/regress/parallel_schedule \
+          --replace-fail numa ""
+      ''
       # This check was introduced upstream to prevent calls to "exit" inside libpq.
       # However, this doesn't work reliably with static linking, see this and following:
       # https://postgr.es/m/flat/20210703001639.GB2374652%40rfd.leadboat.com#52584ca4bd3cb9dac376f3158c419f97
···
         "$out/bin/pg_config" > "$dev/nix-support/pg_config.expected"
       ''
       + ''
-        rm "$out/bin/pg_config"
-        make -C src/common pg_config.env
-        install -D src/common/pg_config.env "$dev/nix-support/pg_config.env"
+          rm "$out/bin/pg_config"
+          make -C src/common pg_config.env
+          substituteInPlace src/common/pg_config.env \
+            --replace-fail "$out" "@out@" \
+            --replace-fail "$man" "@man@"
+          install -D src/common/pg_config.env "$dev/nix-support/pg_config.env"
 
         # postgres exposes external symbols get_pkginclude_path and similar. Those
         # can't be stripped away by --gc-sections/LTO, because they could theoretically
···
             postgresql = this;
           };
 
-          pg_config = buildPackages.callPackage ./pg_config.nix { inherit (finalAttrs) finalPackage; };
+          pg_config = buildPackages.callPackage ./pg_config.nix {
+            inherit (finalAttrs) finalPackage;
+            outputs = {
+              out = lib.getOutput "out" finalAttrs.finalPackage;
+              man = lib.getOutput "man" finalAttrs.finalPackage;
+            };
+          };
 
           tests = {
             postgresql = nixosTests.postgresql.postgresql.passthru.override finalAttrs.finalPackage;
···
     f:
     let
       installedExtensions = f postgresql.pkgs;
-      finalPackage =
-        (buildEnv {
-          name = "${postgresql.pname}-and-plugins-${postgresql.version}";
-          paths = installedExtensions ++ [
-            # consider keeping in-sync with `postBuild` below
-            postgresql
-            postgresql.man # in case user installs this into environment
-          ];
+      finalPackage = buildEnv {
+        name = "${postgresql.pname}-and-plugins-${postgresql.version}";
+        paths = installedExtensions ++ [
+          # consider keeping in-sync with `postBuild` below
+          postgresql
+          postgresql.man # in case user installs this into environment
+        ];
+
+        pathsToLink = [
+          "/"
+          "/bin"
+          "/share/postgresql/extension"
+          # Unbreaks Omnigres' build system
+          "/share/postgresql/timezonesets"
+          "/share/postgresql/tsearch_data"
+        ];
 
-          pathsToLink = [
-            "/"
-            "/bin"
-            "/share/postgresql/extension"
-            # Unbreaks Omnigres' build system
-            "/share/postgresql/timezonesets"
-            "/share/postgresql/tsearch_data"
-          ];
+        nativeBuildInputs = [ makeBinaryWrapper ];
+        postBuild =
+          let
+            args = lib.concatMap (ext: ext.wrapperArgs or [ ]) installedExtensions;
+          in
+          ''
+            wrapProgram "$out/bin/postgres" ${lib.concatStringsSep " " args}
+          '';
 
-          nativeBuildInputs = [ makeBinaryWrapper ];
-          postBuild =
-            let
-              args = lib.concatMap (ext: ext.wrapperArgs or [ ]) installedExtensions;
-            in
-            ''
-              wrapProgram "$out/bin/postgres" ${lib.concatStringsSep " " args}
+        passthru = {
+          inherit installedExtensions;
+          inherit (postgresql)
+            pkgs
+            psqlSchema
+            version
+            ;
 
-              mkdir -p "$dev/nix-support"
-              substitute "${lib.getDev postgresql}/nix-support/pg_config.env" "$dev/nix-support/pg_config.env" \
-                --replace-fail "${postgresql}" "$out" \
-                --replace-fail "${postgresql.man}" "$out"
-            '';
+          pg_config = postgresql.pg_config.override {
+            outputs = {
+              out = finalPackage;
+              man = finalPackage;
+            };
+          };
 
-          passthru = {
-            inherit installedExtensions;
-            inherit (postgresql)
-              pkgs
-              psqlSchema
-              version
+          withJIT = postgresqlWithPackages {
+            inherit
+              buildEnv
+              lib
+              makeBinaryWrapper
+              postgresql
               ;
-
-            pg_config = postgresql.pg_config.override { inherit finalPackage; };
+          } (_: installedExtensions ++ [ postgresql.jit ]);
+          withoutJIT = postgresqlWithPackages {
+            inherit
+              buildEnv
+              lib
+              makeBinaryWrapper
+              postgresql
+              ;
+          } (_: lib.remove postgresql.jit installedExtensions);
 
-            withJIT = postgresqlWithPackages {
+          withPackages =
+            f':
+            postgresqlWithPackages {
               inherit
                 buildEnv
                 lib
                 makeBinaryWrapper
                 postgresql
                 ;
-            } (_: installedExtensions ++ [ postgresql.jit ]);
-            withoutJIT = postgresqlWithPackages {
-              inherit
-                buildEnv
-                lib
-                makeBinaryWrapper
-                postgresql
-                ;
-            } (_: lib.remove postgresql.jit installedExtensions);
-
-            withPackages =
-              f':
-              postgresqlWithPackages {
-                inherit
-                  buildEnv
-                  lib
-                  makeBinaryWrapper
-                  postgresql
-                  ;
-              } (ps: installedExtensions ++ f' ps);
-          };
-        }).overrideAttrs
-          {
-            # buildEnv doesn't support passing `outputs`, so going via overrideAttrs.
-            outputs = [
-              "out"
-              "dev"
-            ];
-          };
+            } (ps: installedExtensions ++ f' ps);
+        };
+      };
     in
     finalPackage;
 

pkgs/servers/sql/postgresql/libpq.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpq";
-  version = "17.5";
+  version = "17.6";
 
   src = fetchFromGitHub {
     owner = "postgres";
     repo = "postgres";
     # rev, not tag, on purpose: see generic.nix.
-    rev = "refs/tags/REL_17_5";
-    hash = "sha256-jWV7hglu7IPMZbqHrZVZHLbZYjVuDeut7nH50aSQIBc=";
+    rev = "refs/tags/REL_17_6";
+    hash = "sha256-/7C+bjmiJ0/CvoAc8vzTC50vP7OsrM6o0w+lmmHvKvU=";
   };
 
   __structuredAttrs = true;
···
     make -C src/interfaces/libpq install
     make -C src/port install
 
+    substituteInPlace src/common/pg_config.env \
+      --replace-fail "$out" "@out@"
+
     install -D src/common/pg_config.env "$dev/nix-support/pg_config.env"
     moveToOutput "lib/*.a" "$dev"
 
···
 
   passthru.pg_config = buildPackages.callPackage ./pg_config.nix {
     inherit (finalAttrs) finalPackage;
+    outputs = {
+      out = lib.getOutput "out" finalAttrs.finalPackage;
+    };
   };
 
   meta = {

pkgs/servers/sql/postgresql/pg_config.nix

···
   stdenv,
   # PostgreSQL package
   finalPackage,
+  # PostgreSQL package's outputs
+  outputs,
 }:
 
 replaceVarsWith {
···
   isExecutable = true;
   replacements = {
     inherit runtimeShell;
-    postgresql-dev = lib.getDev finalPackage;
+    "pg_config.env" = replaceVarsWith {
+      name = "pg_config.env";
+      src = "${lib.getDev finalPackage}/nix-support/pg_config.env";
+      replacements = outputs;
+    };
   };
   nativeCheckInputs = [
     diffutils
   ];
-  postCheck = ''
+  # The expected output only matches when outputs have *not* been altered by postgresql.withPackages.
+  postCheck = lib.optionalString (outputs.out == lib.getOutput "out" finalPackage) ''
     if [ -e ${lib.getDev finalPackage}/nix-support/pg_config.expected ]; then
         diff ${lib.getDev finalPackage}/nix-support/pg_config.expected <($out/bin/pg_config)
     fi

pkgs/servers/sql/postgresql/pg_config.sh

···
 #   https://github.com/postgres/postgres/blob/7510ac6203bc8e3c56eae95466feaeebfc1b4f31/src/bin/pg_config/pg_config.sh
 #   https://github.com/postgres/postgres/blob/master/src/bin/pg_config/pg_config.c
 
-source @postgresql-dev@/nix-support/pg_config.env
+source @pg_config.env@
 
 help="
 pg_config provides information about the installed version of PostgreSQL.

pkgs/servers/x11/xorg/default.nix

···
 {
   lib,
   bdftopcf,
+  font-adobe-100dpi,
+  font-adobe-75dpi,
+  font-adobe-utopia-100dpi,
+  font-adobe-utopia-75dpi,
+  font-adobe-utopia-type1,
   font-alias,
+  font-bh-ttf,
+  font-bh-type1,
+  font-encodings,
+  font-mutt-misc,
   font-util,
   gccmakedep,
+  ico,
   imake,
+  libapplewm,
+  libdmx,
+  libfontenc,
+  libfs,
+  libice,
   libpciaccess,
   libpthread-stubs,
+  libsm,
   libx11,
   libxau,
+  libxaw,
   libxcb,
+  libxcb-errors,
+  libxcb-image,
+  libxcb-keysyms,
+  libxcb-render-util,
+  libxcb-util,
+  libxcb-wm,
   libxcvt,
+  libxcursor,
   libxdmcp,
   libxext,
+  libxfixes,
+  libxmu,
+  libxpm,
+  libxrandr,
+  libxrender,
+  libxt,
+  libxv,
+  libxvmc,
+  libxxf86dga,
+  libxxf86misc,
+  libxxf86vm,
   lndir,
   luit,
   makedepend,
+  mkfontscale,
   pixman,
   sessreg,
+  transset,
   util-macros,
   xbitmaps,
   xcb-proto,
+  xcmsdb,
+  xcursorgen,
+  xcursor-themes,
+  xdriinfo,
+  xev,
+  xfsinfo,
+  xgamma,
+  xgc,
+  xhost,
+  xkbutils,
   xkeyboard-config,
+  xkill,
+  xlsatoms,
+  xlsclients,
+  xlsfonts,
+  xmodmap,
   xorg-cf-files,
   xorg-docs,
   xorgproto,
   xorg-sgml-doctools,
+  xprop,
+  xrandr,
+  xrefresh,
   xtrans,
+  xvinfo,
+  xwininfo,
+  xwud,
 }:
 
 self: with self; {
···
   inherit
     bdftopcf
     gccmakedep
+    ico
     imake
+    libdmx
+    libfontenc
     libpciaccess
     libxcb
     libxcvt
     lndir
     luit
     makedepend
+    mkfontscale
     pixman
     sessreg
+    transset
     xbitmaps
+    xcmsdb
+    xcursorgen
+    xdriinfo
+    xev
+    xfsinfo
+    xgamma
+    xgc
+    xhost
+    xkbutils
+    xkill
+    xlsatoms
+    xlsclients
+    xlsfonts
+    xmodmap
     xorgproto
+    xprop
+    xrandr
+    xrefresh
     xtrans
+    xvinfo
+    xwininfo
+    xwud
     ;
+  encodings = font-encodings;
+  fontadobe100dpi = font-adobe-100dpi;
+  fontadobe75dpi = font-adobe-75dpi;
+  fontadobeutopia100dpi = font-adobe-utopia-100dpi;
+  fontadobeutopia75dpi = font-adobe-utopia-75dpi;
+  fontadobeutopiatype1 = font-adobe-utopia-type1;
   fontalias = font-alias;
+  fontbhttf = font-bh-ttf;
+  fontbhtype1 = font-bh-type1;
+  fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
+  libAppleWM = libapplewm;
+  libFS = libfs;
+  libICE = libice;
   libpthreadstubs = libpthread-stubs;
+  libSM = libsm;
   libX11 = libx11;
   libXau = libxau;
+  libXaw = libxaw;
+  libXcursor = libxcursor;
   libXdmcp = libxdmcp;
   libXext = libxext;
+  libXfixes = libxfixes;
+  libXmu = libxmu;
+  libXpm = libxpm;
+  libXrandr = libxrandr;
+  libXrender = libxrender;
+  libXt = libxt;
+  libXv = libxv;
+  libXvMC = libxvmc;
+  libXxf86dga = libxxf86dga;
+  libXxf86misc = libxxf86misc;
+  libXxf86vm = libxxf86vm;
   utilmacros = util-macros;
   xcbproto = xcb-proto;
+  xcbutilerrors = libxcb-errors;
+  xcbutilimage = libxcb-image;
+  xcbutilkeysyms = libxcb-keysyms;
+  xcbutil = libxcb-util;
+  xcbutilrenderutil = libxcb-render-util;
+  xcbutilwm = libxcb-wm;
   xkeyboardconfig = xkeyboard-config;
+  xcursorthemes = xcursor-themes;
   xorgcffiles = xorg-cf-files;
   xorgdocs = xorg-docs;
   xorgsgmldoctools = xorg-sgml-doctools;
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  encodings = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "encodings";
-      version = "1.1.0";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/encodings-1.1.0.tar.xz";
-        sha256 = "0xg99nmpvik6vaz4h03xay7rx0r3bf5a8azkjlpa3ksn2xi3rwcz";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobe100dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-adobe-100dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-adobe-100dpi-1.0.4.tar.xz";
-        sha256 = "1kwwbaiqnfm3pcysy9gw0g9xhpgmhjcd6clp7zajhqq5br2gyymn";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobe75dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-adobe-75dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-adobe-75dpi-1.0.4.tar.xz";
-        sha256 = "04drk4wi176524lxjwfrnkr3dwz1hysabqfajpj6klfypqnsd08j";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobeutopia100dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-adobe-utopia-100dpi";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.5.tar.xz";
-        sha256 = "0jq27gs5xpwkghggply5pr215lmamrnpr6x5iia76schg8lyr17v";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobeutopia75dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-adobe-utopia-75dpi";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.5.tar.xz";
-        sha256 = "0q3pg4imdbwwiq2g8a1rypjrgmb33n0r5j9qqnh4ywnh69cj89m7";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontadobeutopiatype1 = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-adobe-utopia-type1";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.5.tar.xz";
-        sha256 = "15snyyy3rk75fikz1hs80nybxai1aynybl0gw32hffv98yy81cjc";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontarabicmisc = callPackage (
     {
       stdenv,
···
         pkg-config
         bdftopcf
         fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhttf = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-ttf";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-ttf-1.0.4.tar.xz";
-        sha256 = "0misxkpjc2bir20m01z355sfk3lbpjnshphjzl32p364006zk9c5";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhtype1 = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-type1";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-type1-1.0.4.tar.xz";
-        sha256 = "19kjdm0cx766yj9vwkyv7gyg1q4bjag5g500s7nnppmb0vnc7phr";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
         mkfontscale
       ];
       buildInputs = [ fontutil ];
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmuttmisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-mutt-misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-mutt-misc-1.0.4.tar.xz";
-        sha256 = "095vd33kqd157j6xi4sjxwdsjpwpgqliifa8nkybq8rcw7s5j8xi";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontschumachermisc = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  ico = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "ico";
-      version = "1.0.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/ico-1.0.6.tar.xz";
-        sha256 = "01a4kykayckxzi4jzggaz3wh9qjcr6f4iykhvq7jhlz767a6kwrq";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libAppleWM = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libAppleWM";
-      version = "be972ebc3a97292e7d2b2350eff55ae12df99a42";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "https://gitlab.freedesktop.org/xorg/lib/libAppleWM/-/archive/be972ebc3a97292e7d2b2350eff55ae12df99a42/libAppleWM-be972ebc3a97292e7d2b2350eff55ae12df99a42.tar.bz2";
-        sha256 = "1hrq03pahmrbb05r6a7j7m1nxl65wlfi6d2lwm1kvra63q91f9ph";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "applewm" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libFS = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      xtrans,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libFS";
-      version = "1.0.10";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libFS-1.0.10.tar.xz";
-        sha256 = "0xrv9x5v6km7ib3d5k9xr704xkhfvigh8i507mb9i706hqybvawv";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        xtrans
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "libfs" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libICE = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      xtrans,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libICE";
-      version = "1.1.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libICE-1.1.2.tar.xz";
-        sha256 = "09c656nqkz3dpik012d2cwmd5a2dkxqgjpcq2v3v6pi22ka4wklp";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        xtrans
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "ice" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libSM = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libICE,
-      libuuid,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libSM";
-      version = "1.2.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libSM-1.2.6.tar.xz";
-        sha256 = "1gimv11iwzd9gqg345dd8x09szw75v4c2wr5qsdd5gswn6yhlz5y";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libICE
-        libuuid
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "sm" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libWindowsWM = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXaw = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      xorgproto,
-      libXmu,
-      libXpm,
-      libXt,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXaw";
-      version = "1.0.16";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXaw-1.0.16.tar.xz";
-        sha256 = "13wwqfwaahm6dh35w0nkvw32x3li2s0glsks34ggh267ahmmf7bk";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXext
-        xorgproto
-        libXmu
-        libXpm
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [
-          "xaw6"
-          "xaw7"
-        ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXcomposite = callPackage (
     {
       stdenv,
···
       passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       meta = {
         pkgConfigModules = [ "xcomposite" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXcursor = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXfixes,
-      libXrender,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXcursor";
-      version = "1.2.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXcursor-1.2.3.tar.xz";
-        sha256 = "1h62narayrhrkqalrmx7z3s6yppw1acbp5id3skrvrygshnl1sgx";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXfixes
-        libXrender
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xcursor" ];
         platforms = lib.platforms.unix;
       };
     })
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXfixes = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXfixes";
-      version = "6.0.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXfixes-6.0.1.tar.xz";
-        sha256 = "0n1dq2mi60i0c06i7j6lq64cq335ir2l89yj0amj3529s8ygk5dn";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xfixes" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXfont = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXmu = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      xorgproto,
-      libXt,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXmu";
-      version = "1.2.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXmu-1.2.1.tar.xz";
-        sha256 = "1cp82iz7yki63iykvb3alwy4nwy01k2axi5rqpyfafca4j9pgcpw";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXext
-        xorgproto
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [
-          "xmu"
-          "xmuu"
-        ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXp = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXpm = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      xorgproto,
-      libXt,
-      gettext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXpm";
-      version = "3.5.17";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXpm-3.5.17.tar.xz";
-        sha256 = "0hvf49qy55gwldpwpw7ihcmn5i2iinpjh2rbha63hzcy060izcv4";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        gettext
-      ];
-      buildInputs = [
-        libX11
-        libXext
-        xorgproto
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xpm" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXpresent = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXrandr = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      libXrender,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXrandr";
-      version = "1.5.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXrandr-1.5.4.tar.xz";
-        sha256 = "1lxlqd9ffjr1myfpyk91594n1h07ck6121m6ba8qajjz6xjv1m8s";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-        libXrender
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xrandr" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXrender = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXrender";
-      version = "0.9.12";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXrender-0.9.12.tar.xz";
-        sha256 = "15qv3lbxyx61x55lwmafpy8idb836is82i1213bchfcblj6i4cmq";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xrender" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXres = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXt = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libICE,
-      xorgproto,
-      libSM,
-      libX11,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXt";
-      version = "1.3.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXt-1.3.1.tar.xz";
-        sha256 = "120jjd6l7fjdxy5myrc1dmc0cwpqa18a97hrbg0d9x146frp99z0";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libICE
-        xorgproto
-        libSM
-        libX11
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xt" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXtst = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXv = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXv";
-      version = "1.0.13";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXv-1.0.13.tar.xz";
-        sha256 = "0m9pl0xh0bv9y1x46d8a52bj46fsnyhzwa6qjg8zihg1b04r2d3x";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xv" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXvMC = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      libXv,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXvMC";
-      version = "1.0.14";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXvMC-1.0.14.tar.xz";
-        sha256 = "1nayf8qck0b1xb88dirdbvj7clr18wq1dxs73zwbpzdsnsv9xgp4";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-        libXv
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [
-          "xvmc"
-          "xvmc-wrapper"
-        ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXxf86dga = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXxf86dga";
-      version = "1.1.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXxf86dga-1.1.6.tar.xz";
-        sha256 = "03wqsxbgyrdbrhw8fk3fxc9nk8jnwz5537ym2yif73w0g5sl4i5y";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXext
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xxf86dga" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXxf86misc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXxf86misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2";
-        sha256 = "107k593sx27vjz3v7gbb223add9i7w0bjc90gbb3jqpin3i07758";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXext
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xxf86misc" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXxf86vm = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXxf86vm";
-      version = "1.1.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXxf86vm-1.1.6.tar.xz";
-        sha256 = "1qryzfzf3qr2xx1sipdn8kw310zs4ygpzgh4mm4m87fffd643bwn";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXext
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xxf86vm" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libdmx = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libdmx";
-      version = "1.1.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libdmx-1.1.5.tar.xz";
-        sha256 = "0kzprd1ak3m3042m5hra50nsagswciis9p21ckilyaqbidmf591m";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "dmx" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libfontenc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      zlib,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libfontenc";
-      version = "1.1.8";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libfontenc-1.1.8.tar.xz";
-        sha256 = "1ihlznj4m49jn1887cr86qqhrrlghvbfj7bbh230svi30pac60kv";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        zlib
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "fontenc" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libxkbfile = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  mkfontscale = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libfontenc,
-      freetype,
-      xorgproto,
-      zlib,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "mkfontscale";
-      version = "1.2.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/mkfontscale-1.2.3.tar.xz";
-        sha256 = "0pp7dyfrrkrqxslk9q8660k0h4swaqlixsnnph2fxb7i8k1ws899";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libfontenc
-        freetype
-        xorgproto
-        zlib
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   oclock = callPackage (
     {
       stdenv,
···
         libSM
         libXmu
         libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  transset = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "transset";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/transset-1.0.4.tar.xz";
-        sha256 = "0f0bgi1jq9zzq2gqaszhgvz2d1clja17z8xnijm36xqkmxsapac1";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
       ];
       passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       meta = {
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcbutil = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      gperf,
-      libxcb,
-      xorgproto,
-      m4,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcb-util";
-      version = "0.4.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/xcb/xcb-util-0.4.1.tar.xz";
-        sha256 = "04p54r0zjc44fpw1hdy4rhygv37sx2vr2lllxjihykz5v2xkpgjs";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        m4
-      ];
-      buildInputs = [
-        gperf
-        libxcb
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [
-          "xcb-atom"
-          "xcb-aux"
-          "xcb-event"
-          "xcb-util"
-        ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutilcursor = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcbutilerrors = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      gperf,
-      libxcb,
-      xcbproto,
-      xorgproto,
-      m4,
-      python3,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcb-util-errors";
-      version = "1.0.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/xcb/xcb-util-errors-1.0.1.tar.xz";
-        sha256 = "0mzkh3xj1n690dw8hrdhyjykd71ib0ls9n5cgf9asna2k1xwha2n";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        m4
-        python3
-      ];
-      buildInputs = [
-        gperf
-        libxcb
-        xcbproto
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xcb-errors" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcbutilimage = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      gperf,
-      libxcb,
-      xcbutil,
-      xorgproto,
-      m4,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcb-util-image";
-      version = "0.4.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/xcb/xcb-util-image-0.4.1.tar.xz";
-        sha256 = "0g8dwknrlz96k176qxh8ar84x9kpppci9b978zyp24nvvbjqxbfc";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        m4
-      ];
-      buildInputs = [
-        gperf
-        libxcb
-        xcbutil
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xcb-image" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcbutilkeysyms = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      gperf,
-      libxcb,
-      xorgproto,
-      m4,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcb-util-keysyms";
-      version = "0.4.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/xcb/xcb-util-keysyms-0.4.1.tar.xz";
-        sha256 = "0f66snk179hmp8ppgv1zp9y7pl1vzn52znpikm1fsaj1ji90l9kw";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        m4
-      ];
-      buildInputs = [
-        gperf
-        libxcb
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xcb-keysyms" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcbutilrenderutil = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      gperf,
-      libxcb,
-      xorgproto,
-      m4,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcb-util-renderutil";
-      version = "0.3.10";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/xcb/xcb-util-renderutil-0.3.10.tar.xz";
-        sha256 = "1fh4dnlwlqyccrhmmwlv082a7mxc7ss7vmzmp7xxp39dwbqd859y";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        m4
-      ];
-      buildInputs = [
-        gperf
-        libxcb
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xcb-renderutil" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcbutilwm = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      gperf,
-      libxcb,
-      xorgproto,
-      m4,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcb-util-wm";
-      version = "0.4.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/xcb/xcb-util-wm-0.4.2.tar.xz";
-        sha256 = "02wai17mxfbvlnj4l4bjbvah97rccdivzvd7mrznhr32s0hlxhv2";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        m4
-      ];
-      buildInputs = [
-        gperf
-        libxcb
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [
-          "xcb-ewmh"
-          "xcb-icccm"
-        ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xclock = callPackage (
     {
       stdenv,
···
         libXrender
         libXt
       ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcmsdb = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcmsdb";
-      version = "1.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xcmsdb-1.0.7.tar.xz";
-        sha256 = "0f5wddi707cjqm21hynckkqr12mpjqn3dq9fm5gb11w19270di2y";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ libX11 ];
       passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       meta = {
         pkgConfigModules = [ ];
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcursorgen = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libpng,
-      libX11,
-      libXcursor,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcursorgen";
-      version = "1.0.9";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xcursorgen-1.0.9.tar.xz";
-        sha256 = "1g1v96yprk5nnkip2w3r2cfsbzzsw0ssy417j3m1djl4mibf3j8c";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libpng
-        libX11
-        libXcursor
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcursorthemes = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libXcursor,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcursor-themes";
-      version = "1.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz";
-        sha256 = "1j3qfga5llp8g702n7mivvdvfjk7agsgnbglbfh99n13i3sfiflm";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ libXcursor ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xdm = callPackage (
     {
       stdenv,
···
         libXxf86dga
         libXxf86misc
         libXxf86vm
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xdriinfo = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libGL,
-      xorgproto,
-      libX11,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xdriinfo";
-      version = "1.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xdriinfo-1.0.7.tar.xz";
-        sha256 = "0d7p9fj3znq0av9pjgi2kphqaz5w7b9hxlz63zbxs69bknp8p0yx";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libGL
-        xorgproto
-        libX11
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xev = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      libXrandr,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xev";
-      version = "1.2.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xev-1.2.6.tar.xz";
-        sha256 = "1mq7332kgisd9yq0w0rv11vhwhgpkmpg7pfdlyn776dc13hcbqb1";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-        libXrandr
       ];
       passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       meta = {
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xfsinfo = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libFS,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xfsinfo";
-      version = "1.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xfsinfo-1.0.7.tar.xz";
-        sha256 = "0x48p4hk0lds2s8nwzgfl616r99s28ydx02zs7p1fxxs3i2wmwwj";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libFS
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xgamma = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      libXxf86vm,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xgamma";
-      version = "1.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xgamma-1.0.7.tar.xz";
-        sha256 = "13xw2fqp9cs7xj3nqi8khqxv81rk0dd8khp59xgs2lw9bbldly8w";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-        libXxf86vm
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xgc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libXaw,
-      libXt,
-      wrapWithXFileSearchPathHook,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xgc";
-      version = "1.0.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xgc-1.0.6.tar.xz";
-        sha256 = "0h5jm2946f5m1g8a3qh1c01h3zrsjjivi09vi9rmij2frvdvp1vv";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        wrapWithXFileSearchPathHook
-      ];
-      buildInputs = [
-        libXaw
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xhost = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXau,
-      libXmu,
-      xorgproto,
-      gettext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xhost";
-      version = "1.0.10";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xhost-1.0.10.tar.xz";
-        sha256 = "1qavfaxqpj2mp2jdb8ivvv7bza546lff95dq90lp3727b40dgbx8";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        gettext
-      ];
-      buildInputs = [
-        libX11
-        libXau
-        libXmu
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xinit = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xkbutils = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXaw,
-      libXt,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xkbutils";
-      version = "1.0.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xkbutils-1.0.6.tar.xz";
-        sha256 = "0pp2bsksblvvw0fx667k2bl5sm0baj7pp2cjvq0vmk093vpbp8ii";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXaw
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xkill = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXmu,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xkill";
-      version = "1.0.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xkill-1.0.6.tar.xz";
-        sha256 = "01xrmqw498hqlhn6l1sq89s31k6sjf6xlij6a08pnrvmqiwama75";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXmu
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xload = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xlsatoms = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libxcb,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xlsatoms";
-      version = "1.1.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xlsatoms-1.1.4.tar.xz";
-        sha256 = "1dviriynilkw0jwl0s2h8y95pwh8cxj95cnmllkd6rn0args3gzl";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ libxcb ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xlsclients = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libxcb,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xlsclients";
-      version = "1.1.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xlsclients-1.1.5.tar.xz";
-        sha256 = "1qxsav5gicsfwv1dqlcfpj47vy9i30i7iysrfx5aql02wxbyxfk8";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ libxcb ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xlsfonts = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xlsfonts";
-      version = "1.0.8";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xlsfonts-1.0.8.tar.xz";
-        sha256 = "1kdnzyrm1wqwylghavn9lqi0h4lwf9ifkcv3zikbi176mjg90zw0";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xmag = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xmodmap = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xmodmap";
-      version = "1.0.11";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xmodmap-1.0.11.tar.xz";
-        sha256 = "10byhzdfv1xckqc3d2v52xg1ggxn5j806x4450l3ig5hyxl82bws";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xmore = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xprop = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xprop";
-      version = "1.2.8";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xprop-1.2.8.tar.xz";
-        sha256 = "1vk7kl10ykgqp2iw4m1q4j1zrbkxibd1rdb9cjgl6yzgnyny52fn";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xrandr = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      libXrandr,
-      libXrender,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xrandr";
-      version = "1.5.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xrandr-1.5.3.tar.xz";
-        sha256 = "0744kfafd98q2zswyzva837qgvmdpfv80ilnp7x4fhdpmmk7bpgq";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-        libXrandr
-        libXrender
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xrdb = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xrefresh = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xrefresh";
-      version = "1.1.0";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xrefresh-1.1.0.tar.xz";
-        sha256 = "0pwb5c9g3xxs70gc35hahxq2ky8261pw9n04j01a6dffbqnmkv99";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xset = callPackage (
     {
       stdenv,
···
   ) { };
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xvinfo = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      libXv,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xvinfo";
-      version = "1.1.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xvinfo-1.1.5.tar.xz";
-        sha256 = "0164qpbjmxxa1rbvh6ay1iz2qnp9hl1745k9pk6195kdnbn73piy";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-        libXv
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xwd = callPackage (
     {
       stdenv,
···
       nativeBuildInputs = [ pkg-config ];
       buildInputs = [
         libxkbfile
-        libX11
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xwininfo = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libxcb,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xwininfo";
-      version = "1.1.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xwininfo-1.1.6.tar.xz";
-        sha256 = "0gr5m4lyvkil3cl63zf0sw7bq5qgraqrnvddk6xgk3a42xy8j61m";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libxcb
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xwud = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xwud";
-      version = "1.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xwud-1.0.7.tar.xz";
-        sha256 = "07n6q1z33sjkx8lx8lbd26m8ri5gi145k3mz39kmyykdngdbwp75";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
         libX11
         xorgproto
       ];

pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl

···
 $pcMap{"GL"} = "libGL";
 $pcMap{"gbm"} = "libgbm";
 $pcMap{"hwdata"} = "hwdata";
+$pcMap{"dmx"} = "libdmx";
+$pcMap{"fontenc"} = "libfontenc";
 $pcMap{"fontutil"} = "fontutil";
+$pcMap{"ice"} = "libICE";
+$pcMap{"libfs"} = "libFS";
 $pcMap{"pciaccess"} = "libpciaccess";
 $pcMap{"pthread-stubs"} = "libpthreadstubs";
+$pcMap{"sm"} = "libSM";
 $pcMap{"x11"} = "libX11";
 $pcMap{"x11-xcb"} = "libX11";
 $pcMap{"xau"} = "libXau";
+$pcMap{"xaw6"} = "libXaw";
+$pcMap{"xaw7"} = "libXaw";
 $pcMap{"xbitmaps"} = "xbitmaps";
+$pcMap{"xcb-atom"} = "xcbutil";
+$pcMap{"xcb-aux"} = "xcbutil";
+$pcMap{"xcb-errors"} = "xcbutilerrors";
+$pcMap{"xcb-event"} = "xcbutil";
+$pcMap{"xcb-ewmh"} = "xcbutilwm";
+$pcMap{"xcb-icccm"} = "xcbutilwm";
+$pcMap{"xcb-image"} = "xcbutilimage";
+$pcMap{"xcb-keysyms"} = "xcbutilkeysyms";
 $pcMap{"xcb-proto"} = "xcbproto";
+$pcMap{"xcb-renderutil"} = "xcbutilrenderutil";
+$pcMap{"xcb-util"} = "xcbutil";
+$pcMap{"xcursor"} = "libXcursor";
 $pcMap{"xdmcp"} = "libXdmcp";
 $pcMap{"xext"} = "libXext";
+$pcMap{"xfixes"} = "libXfixes";
+$pcMap{"xmu"} = "libXmu";
+$pcMap{"xmuu"} = "libXmu";
+$pcMap{"xpm"} = "libXpm";
+$pcMap{"xrandr"} = "libXrandr";
+$pcMap{"xrender"} = "libXrender";
+$pcMap{"xt"} = "libXt";
 $pcMap{"xtrans"} = "xtrans";
+$pcMap{"xv"} = "libXv";
+$pcMap{"xvmc"} = "libXvMC";
+$pcMap{"xvmc-wrapper"} = "libXvMC";
+$pcMap{"xxf86dga"} = "libXxf86dga";
+$pcMap{"xxf86misc"} = "libXxf86misc";
+$pcMap{"xxf86vm"} = "libXxf86vm";
 $pcMap{"\$PIXMAN"} = "pixman";
 $pcMap{"\$RENDERPROTO"} = "xorgproto";
 $pcMap{"\$DRI3PROTO"} = "xorgproto";
···
 {
   lib,
   bdftopcf,
+  font-adobe-100dpi,
+  font-adobe-75dpi,
+  font-adobe-utopia-100dpi,
+  font-adobe-utopia-75dpi,
+  font-adobe-utopia-type1,
   font-alias,
+  font-bh-ttf,
+  font-bh-type1,
+  font-encodings,
+  font-mutt-misc,
   font-util,
   gccmakedep,
+  ico,
   imake,
+  libapplewm,
+  libdmx,
+  libfontenc,
+  libfs,
+  libice,
   libpciaccess,
   libpthread-stubs,
+  libsm,
   libx11,
   libxau,
+  libxaw,
   libxcb,
+  libxcb-errors,
+  libxcb-image,
+  libxcb-keysyms,
+  libxcb-render-util,
+  libxcb-util,
+  libxcb-wm,
   libxcvt,
+  libxcursor,
   libxdmcp,
   libxext,
+  libxfixes,
+  libxmu,
+  libxpm,
+  libxrandr,
+  libxrender,
+  libxt,
+  libxv,
+  libxvmc,
+  libxxf86dga,
+  libxxf86misc,
+  libxxf86vm,
   lndir,
   luit,
   makedepend,
+  mkfontscale,
   pixman,
   sessreg,
+  transset,
   util-macros,
   xbitmaps,
   xcb-proto,
+  xcmsdb,
+  xcursorgen,
+  xcursor-themes,
+  xdriinfo,
+  xev,
+  xfsinfo,
+  xgamma,
+  xgc,
+  xhost,
+  xkbutils,
   xkeyboard-config,
+  xkill,
+  xlsatoms,
+  xlsclients,
+  xlsfonts,
+  xmodmap,
   xorg-cf-files,
   xorg-docs,
   xorgproto,
   xorg-sgml-doctools,
+  xprop,
+  xrandr,
+  xrefresh,
   xtrans,
+  xvinfo,
+  xwininfo,
+  xwud,
 }:
 
 self: with self; {
···
   inherit
     bdftopcf
     gccmakedep
+    ico
     imake
+    libdmx
+    libfontenc
     libpciaccess
     libxcb
     libxcvt
     lndir
     luit
     makedepend
+    mkfontscale
     pixman
     sessreg
+    transset
     xbitmaps
+    xcmsdb
+    xcursorgen
+    xdriinfo
+    xev
+    xfsinfo
+    xgamma
+    xgc
+    xhost
+    xkbutils
+    xkill
+    xlsatoms
+    xlsclients
+    xlsfonts
+    xmodmap
     xorgproto
+    xprop
+    xrandr
+    xrefresh
     xtrans
+    xvinfo
+    xwininfo
+    xwud
     ;
+  encodings = font-encodings;
+  fontadobe100dpi = font-adobe-100dpi;
+  fontadobe75dpi = font-adobe-75dpi;
+  fontadobeutopia100dpi = font-adobe-utopia-100dpi;
+  fontadobeutopia75dpi = font-adobe-utopia-75dpi;
+  fontadobeutopiatype1 = font-adobe-utopia-type1;
   fontalias = font-alias;
+  fontbhttf = font-bh-ttf;
+  fontbhtype1 = font-bh-type1;
+  fontmuttmisc = font-mutt-misc;
   fontutil = font-util;
+  libAppleWM = libapplewm;
+  libFS = libfs;
+  libICE = libice;
   libpthreadstubs = libpthread-stubs;
+  libSM = libsm;
   libX11 = libx11;
   libXau = libxau;
+  libXaw = libxaw;
+  libXcursor = libxcursor;
   libXdmcp = libxdmcp;
   libXext = libxext;
+  libXfixes = libxfixes;
+  libXmu = libxmu;
+  libXpm = libxpm;
+  libXrandr = libxrandr;
+  libXrender = libxrender;
+  libXt = libxt;
+  libXv = libxv;
+  libXvMC = libxvmc;
+  libXxf86dga = libxxf86dga;
+  libXxf86misc = libxxf86misc;
+  libXxf86vm = libxxf86vm;
   utilmacros = util-macros;
   xcbproto = xcb-proto;
+  xcbutilerrors = libxcb-errors;
+  xcbutilimage = libxcb-image;
+  xcbutilkeysyms = libxcb-keysyms;
+  xcbutil = libxcb-util;
+  xcbutilrenderutil = libxcb-render-util;
+  xcbutilwm = libxcb-wm;
   xkeyboardconfig = xkeyboard-config;
+  xcursorthemes = xcursor-themes;
   xorgcffiles = xorg-cf-files;
   xorgdocs = xorg-docs;
   xorgsgmldoctools = xorg-sgml-doctools;

pkgs/servers/x11/xorg/overrides.nix

···
   });
 
   iceauth = addMainProgram super.iceauth { };
-  ico = addMainProgram super.ico { };
 
   mkfontdir = xorg.mkfontscale;
 
-  libAppleWM = super.libAppleWM.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [
-      autoreconfHook
-      xorg.utilmacros
-    ];
-    meta = attrs.meta // {
-      platforms = lib.platforms.darwin;
-    };
-  });
-
   libXtst = super.libXtst.overrideAttrs (attrs: {
     meta = attrs.meta // {
       pkgConfigModules = [ "xtst" ];
···
     configureFlags = lib.optional isDarwin "CFLAGS=-O0";
   });
 
-  libXxf86vm = super.libXxf86vm.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-  libXxf86dga = super.libXxf86dga.overrideAttrs (attrs: {
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-  libXxf86misc = super.libXxf86misc.overrideAttrs (attrs: {
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-  libdmx = super.libdmx.overrideAttrs (attrs: {
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-  libFS = super.libFS.overrideAttrs (attrs: {
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
   libWindowsWM = super.libWindowsWM.overrideAttrs (attrs: {
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
   });
···
     };
   });
 
-  # Propagate some build inputs because of header file dependencies.
-  # Note: most of these are in Requires.private, so maybe builder.sh
-  # should propagate them automatically.
-  libXt = super.libXt.overrideAttrs (attrs: {
-    preConfigure = ''
-      sed 's,^as_dummy.*,as_dummy="\$PATH",' -i configure
-    '';
-    configureFlags =
-      attrs.configureFlags or [ ]
-      ++ malloc0ReturnsNullCrossFlag
-      ++ lib.optional (stdenv.targetPlatform.useLLVM or false) "ac_cv_path_RAWCPP=cpp";
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ xorg.libSM ];
-    depsBuildBuild = [ buildPackages.stdenv.cc ];
-    CPP = if stdenv.hostPlatform.isDarwin then "clang -E -" else "${stdenv.cc.targetPrefix}cc -E -";
-    outputDoc = "devdoc";
-    outputs = [
-      "out"
-      "dev"
-      "devdoc"
-    ];
-  });
-
-  libICE = super.libICE.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "doc"
-    ];
-  });
-
   libXcomposite = super.libXcomposite.overrideAttrs (attrs: {
     outputs = [
       "out"
···
     propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ xorg.libXfixes ];
   });
 
-  libXaw = super.libXaw.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "devdoc"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ xorg.libXmu ];
-  });
-
-  libXcursor = super.libXcursor.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-  });
-
   libXdamage = super.libXdamage.overrideAttrs (attrs: {
     outputs = [
       "out"
···
     };
   });
 
-  libXfixes = super.libXfixes.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-  });
-
   libXi = super.libXi.overrideAttrs (attrs: {
     outputs = [
       "out"
···
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
   });
 
-  libXmu = super.libXmu.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "doc"
-    ];
-    buildFlags = [ "BITMAP_DEFINES='-DBITMAPDIR=\"/no-such-path\"'" ];
-  });
-
-  libXrandr = super.libXrandr.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ xorg.libXrender ];
-  });
-
-  libSM = super.libSM.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "doc"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [
-      xorg.libICE
-      xorg.xtrans
-    ];
-  });
-
-  libXrender = super.libXrender.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "doc"
-    ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ xorg.xorgproto ];
-  });
-
   libXres = super.libXres.overrideAttrs (attrs: {
     outputs = [
       "out"
···
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
   });
 
-  libXv = super.libXv.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "devdoc"
-    ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-
-  libXvMC = super.libXvMC.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "doc"
-    ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-    buildInputs = attrs.buildInputs ++ [ xorg.xorgproto ];
-  });
-
   libXp = super.libXp.overrideAttrs (attrs: {
     outputs = [
       "out"
···
     ];
   });
 
-  libXpm = super.libXpm.overrideAttrs (attrs: {
-    outputs = [
-      "bin"
-      "dev"
-      "out"
-    ]; # tiny man in $bin
-    patchPhase = "sed -i '/USE_GETTEXT_TRUE/d' sxpm/Makefile.in cxpm/Makefile.in";
-    XPM_PATH_COMPRESS = lib.makeBinPath [ ncompress ];
-    XPM_PATH_GZIP = lib.makeBinPath [ gzip ];
-    XPM_PATH_UNCOMPRESS = lib.makeBinPath [ gzip ];
-    meta = attrs.meta // {
-      mainProgram = "sxpm";
-    };
-  });
-
   libXpresent = super.libXpresent.overrideAttrs (attrs: {
     buildInputs = attrs.buildInputs ++ [
       xorg.libXext
···
     };
   });
 
-  mkfontscale = addMainProgram super.mkfontscale { };
   oclock = addMainProgram super.oclock { };
   smproxy = addMainProgram super.smproxy { };
-  transset = addMainProgram super.transset { };
 
   viewres = addMainProgram super.viewres { };
 
···
 
   xcalc = addMainProgram super.xcalc { };
 
-  xcbutil = super.xcbutil.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-  });
-
-  xcbutilerrors = super.xcbutilerrors.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ]; # mainly to get rid of propagating others
-  });
-
   xcbutilcursor = super.xcbutilcursor.overrideAttrs (attrs: {
     outputs = [
       "out"
···
     };
   });
 
-  xcbutilimage = super.xcbutilimage.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ]; # mainly to get rid of propagating others
-  });
-
-  xcbutilkeysyms = super.xcbutilkeysyms.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ]; # mainly to get rid of propagating others
-  });
-
-  xcbutilrenderutil = super.xcbutilrenderutil.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ]; # mainly to get rid of propagating others
-  });
-
-  xcbutilwm = super.xcbutilwm.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ]; # mainly to get rid of propagating others
-  });
-
   xf86inputevdev = super.xf86inputevdev.overrideAttrs (attrs: {
     outputs = [
       "out"
···
     };
   });
 
-  xdriinfo = super.xdriinfo.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [ libGL ];
-    meta = attrs.meta // {
-      mainProgram = "xdriinfo";
-    };
-  });
-
-  xev = addMainProgram super.xev { };
   xeyes = addMainProgram super.xeyes { };
 
-  xvinfo = super.xvinfo.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [ xorg.libXext ];
-    meta = attrs.meta // {
-      mainProgram = "xvinfo";
-    };
-  });
-
   xkbcomp = super.xkbcomp.overrideAttrs (attrs: {
     configureFlags = [ "--with-xkb-config-root=${xorg.xkeyboardconfig}/share/X11/xkb" ];
     meta = attrs.meta // {
···
       nativeBuildInputs = old.nativeBuildInputs ++ [ automake ];
       postPatch = lib.concatStrings (lib.mapAttrsToList patchIn layouts);
     });
-
-  xlsfonts = super.xlsfonts.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      license = lib.licenses.mit;
-      mainProgram = "xlsfonts";
-    };
-  });
 
   xorgserver = super.xorgserver.overrideAttrs (
     attrs_passed:
···
 
   xbacklight = addMainProgram super.xbacklight { };
   xclock = addMainProgram super.xclock { };
-  xcmsdb = addMainProgram super.xcmsdb { };
   xcompmgr = addMainProgram super.xcompmgr { };
   xconsole = addMainProgram super.xconsole { };
-  xcursorgen = addMainProgram super.xcursorgen { };
-
-  xcursorthemes = super.xcursorthemes.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [ xorg.xcursorgen ];
-    buildInputs = attrs.buildInputs ++ [ xorg.xorgproto ];
-    configureFlags = [ "--with-cursordir=$(out)/share/icons" ];
-  });
 
   xinit =
     (super.xinit.override {
···
   xfd = addMainProgram super.xfd { };
   xfontsel = addMainProgram super.xfontsel { };
   xfs = addMainProgram super.xfs { };
-  xfsinfo = addMainProgram super.xfsinfo { };
-  xgamma = addMainProgram super.xgamma { };
-  xgc = addMainProgram super.xgc { };
-  xhost = addMainProgram super.xhost { };
   xinput = addMainProgram super.xinput { };
   xkbevd = addMainProgram super.xkbevd { };
   xkbprint = addMainProgram super.xkbprint { };
-  xkill = addMainProgram super.xkill { };
   xload = addMainProgram super.xload { };
-  xlsatoms = addMainProgram super.xlsatoms { };
-  xlsclients = addMainProgram super.xlsclients { };
   xmag = addMainProgram super.xmag { };
   xmessage = addMainProgram super.xmessage { };
-  xmodmap = addMainProgram super.xmodmap { };
   xmore = addMainProgram super.xmore { };
 
   xpr = addMainProgram super.xpr { };
-  xprop = addMainProgram super.xprop { };
 
   xrdb = super.xrdb.overrideAttrs (attrs: {
     configureFlags = [ "--with-cpp=${mcpp}/bin/mcpp" ];
···
     };
   });
 
-  xrandr = super.xrandr.overrideAttrs (attrs: {
-    postInstall = ''
-      rm $out/bin/xkeystone
-    '';
-    meta = attrs.meta // {
-      mainProgram = "xrandr";
-    };
-  });
-
-  xrefresh = addMainProgram super.xrefresh { };
   xset = addMainProgram super.xset { };
   xsetroot = addMainProgram super.xsetroot { };
   xsm = addMainProgram super.xsm { };
   xstdcmap = addMainProgram super.xstdcmap { };
   xwd = addMainProgram super.xwd { };
-  xwininfo = addMainProgram super.xwininfo { };
-  xwud = addMainProgram super.xwud { };
 
   # convert Type1 vector fonts to OpenType fonts
   fontbitstreamtype1 = super.fontbitstreamtype1.overrideAttrs (attrs: {
···
   let
     # unfree but redistributable
     redist = [
-      "fontadobeutopiatype1"
-      "fontadobeutopia100dpi"
-      "fontadobeutopia75dpi"
-      "fontbhtype1"
       "fontibmtype1"
-      "fontbhttf"
       "fontbh100dpi"
       "fontbh75dpi"
 

pkgs/servers/x11/xorg/tarballs.list

···
-mirror://xorg/individual/xcb/xcb-util-0.4.1.tar.xz
-mirror://xorg/individual/xcb/xcb-util-errors-1.0.1.tar.xz
-mirror://xorg/individual/xcb/xcb-util-image-0.4.1.tar.xz
-mirror://xorg/individual/xcb/xcb-util-keysyms-0.4.1.tar.xz
-mirror://xorg/individual/xcb/xcb-util-renderutil-0.3.10.tar.xz
-mirror://xorg/individual/xcb/xcb-util-wm-0.4.2.tar.xz
 mirror://xorg/individual/app/appres-1.0.7.tar.xz
 mirror://xorg/individual/app/bitmap-1.1.1.tar.xz
 mirror://xorg/individual/app/editres-1.0.9.tar.xz
 mirror://xorg/individual/app/fonttosfnt-1.2.4.tar.xz
 mirror://xorg/individual/app/iceauth-1.0.10.tar.xz
-mirror://xorg/individual/app/ico-1.0.6.tar.xz
 mirror://xorg/individual/app/listres-1.0.6.tar.xz
-mirror://xorg/individual/app/mkfontscale-1.2.3.tar.xz
 mirror://xorg/individual/app/oclock-1.0.6.tar.xz
 mirror://xorg/individual/app/setxkbmap-1.3.4.tar.xz
 mirror://xorg/individual/app/smproxy-1.0.8.tar.xz
-mirror://xorg/individual/app/transset-1.0.4.tar.xz
 mirror://xorg/individual/app/twm-1.0.13.1.tar.xz
 mirror://xorg/individual/app/viewres-1.0.8.tar.xz
 mirror://xorg/individual/app/x11perf-1.6.1.tar.bz2
···
 mirror://xorg/individual/app/xbacklight-1.2.4.tar.xz
 mirror://xorg/individual/app/xcalc-1.1.2.tar.xz
 mirror://xorg/individual/app/xclock-1.1.1.tar.xz
-mirror://xorg/individual/app/xcmsdb-1.0.7.tar.xz
 mirror://xorg/individual/app/xcompmgr-1.1.10.tar.xz
 mirror://xorg/individual/app/xconsole-1.1.0.tar.xz
-mirror://xorg/individual/app/xcursorgen-1.0.9.tar.xz
 mirror://xorg/individual/app/xdm-1.1.17.tar.xz
 mirror://xorg/individual/app/xdpyinfo-1.3.4.tar.xz
-mirror://xorg/individual/app/xdriinfo-1.0.7.tar.xz
-mirror://xorg/individual/app/xev-1.2.6.tar.xz
 mirror://xorg/individual/app/xeyes-1.3.0.tar.xz
 mirror://xorg/individual/app/xfd-1.1.4.tar.xz
 mirror://xorg/individual/app/xfontsel-1.1.1.tar.xz
 mirror://xorg/individual/app/xfs-1.2.2.tar.xz
-mirror://xorg/individual/app/xfsinfo-1.0.7.tar.xz
-mirror://xorg/individual/app/xgamma-1.0.7.tar.xz
-mirror://xorg/individual/app/xgc-1.0.6.tar.xz
-mirror://xorg/individual/app/xhost-1.0.10.tar.xz
 mirror://xorg/individual/app/xinit-1.4.4.tar.xz
 mirror://xorg/individual/app/xinput-1.6.4.tar.xz
 mirror://xorg/individual/app/xkbcomp-1.4.7.tar.xz
 mirror://xorg/individual/app/xkbevd-1.1.6.tar.xz
 mirror://xorg/individual/app/xkbprint-1.0.7.tar.xz
-mirror://xorg/individual/app/xkbutils-1.0.6.tar.xz
-mirror://xorg/individual/app/xkill-1.0.6.tar.xz
 mirror://xorg/individual/app/xload-1.2.0.tar.xz
-mirror://xorg/individual/app/xlsatoms-1.1.4.tar.xz
-mirror://xorg/individual/app/xlsclients-1.1.5.tar.xz
-mirror://xorg/individual/app/xlsfonts-1.0.8.tar.xz
 mirror://xorg/individual/app/xmag-1.0.8.tar.xz
 mirror://xorg/individual/app/xmessage-1.0.7.tar.xz
-mirror://xorg/individual/app/xmodmap-1.0.11.tar.xz
 mirror://xorg/individual/app/xmore-1.0.4.tar.xz
 mirror://xorg/individual/app/xpr-1.2.0.tar.xz
-mirror://xorg/individual/app/xprop-1.2.8.tar.xz
-mirror://xorg/individual/app/xrandr-1.5.3.tar.xz
 mirror://xorg/individual/app/xrdb-1.2.2.tar.xz
-mirror://xorg/individual/app/xrefresh-1.1.0.tar.xz
 mirror://xorg/individual/app/xset-1.2.5.tar.xz
 mirror://xorg/individual/app/xsetroot-1.1.3.tar.xz
 mirror://xorg/individual/app/xsm-1.0.6.tar.xz
 mirror://xorg/individual/app/xstdcmap-1.0.5.tar.xz
 mirror://xorg/individual/app/xtrap-1.0.3.tar.bz2
-mirror://xorg/individual/app/xvinfo-1.1.5.tar.xz
 mirror://xorg/individual/app/xwd-1.0.9.tar.xz
-mirror://xorg/individual/app/xwininfo-1.1.6.tar.xz
-mirror://xorg/individual/app/xwud-1.0.7.tar.xz
-mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz
 mirror://xorg/individual/driver/xf86-input-evdev-2.11.0.tar.xz
 mirror://xorg/individual/driver/xf86-input-joystick-1.6.4.tar.xz
 mirror://xorg/individual/driver/xf86-input-keyboard-2.1.0.tar.xz
···
 mirror://xorg/individual/driver/xf86-video-vmware-13.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
-mirror://xorg/individual/font/encodings-1.1.0.tar.xz
-mirror://xorg/individual/font/font-adobe-75dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-adobe-100dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.5.tar.xz
-mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.5.tar.xz
-mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.5.tar.xz
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-ttf-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-type1-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz
···
 mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/font/font-mutt-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-schumacher-misc-1.1.3.tar.xz
 mirror://xorg/individual/font/font-screen-cyrillic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-sony-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
-https://gitlab.freedesktop.org/xorg/lib/libAppleWM/-/archive/be972ebc3a97292e7d2b2350eff55ae12df99a42/libAppleWM-be972ebc3a97292e7d2b2350eff55ae12df99a42.tar.bz2
-mirror://xorg/individual/lib/libdmx-1.1.5.tar.xz
-mirror://xorg/individual/lib/libfontenc-1.1.8.tar.xz
-mirror://xorg/individual/lib/libFS-1.0.10.tar.xz
-mirror://xorg/individual/lib/libICE-1.1.2.tar.xz
-mirror://xorg/individual/lib/libSM-1.2.6.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXaw-1.0.16.tar.xz
 mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz
-mirror://xorg/individual/lib/libXcursor-1.2.3.tar.xz
 mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz
-mirror://xorg/individual/lib/libXfixes-6.0.1.tar.xz
 mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
 mirror://xorg/individual/lib/libXfont2-2.0.7.tar.xz
 mirror://xorg/individual/lib/libXft-2.3.9.tar.xz
 mirror://xorg/individual/lib/libXi-1.8.2.tar.xz
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
-mirror://xorg/individual/lib/libXmu-1.2.1.tar.xz
 mirror://xorg/individual/lib/libXp-1.0.4.tar.xz
-mirror://xorg/individual/lib/libXpm-3.5.17.tar.xz
 mirror://xorg/individual/lib/libXpresent-1.0.1.tar.xz
-mirror://xorg/individual/lib/libXrandr-1.5.4.tar.xz
-mirror://xorg/individual/lib/libXrender-0.9.12.tar.xz
 mirror://xorg/individual/lib/libXres-1.2.2.tar.xz
 mirror://xorg/individual/lib/libXScrnSaver-1.2.4.tar.xz
 mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXt-1.3.1.tar.xz
 mirror://xorg/individual/lib/libXtst-1.2.5.tar.xz
-mirror://xorg/individual/lib/libXv-1.0.13.tar.xz
-mirror://xorg/individual/lib/libXvMC-1.0.14.tar.xz
-mirror://xorg/individual/lib/libXxf86dga-1.1.6.tar.xz
-mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
-mirror://xorg/individual/lib/libXxf86vm-1.1.6.tar.xz
 mirror://xorg/individual/lib/xcb-util-cursor-0.1.5.tar.xz
 mirror://xorg/individual/xserver/xorg-server-21.1.18.tar.xz

pkgs/stdenv/generic/make-derivation.nix

···
     "pie"
     "relro"
     "stackprotector"
+    "glibcxxassertions"
     "stackclashprotection"
     "strictoverflow"
     "trivialautovarinit"
···
               "-c"
               ''
                 out="${placeholder "out"}"
-                if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
+                if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; fi
                 declare -p > $out
                 for var in $passAsFile; do
                     pathVar="''${var}Path"

pkgs/stdenv/generic/setup.sh

···
     set -x
 fi
 
-if [ -f .attrs.sh ] || [[ -n "${NIX_ATTRS_JSON_FILE:-}" ]]; then
+if [[ -n "${NIX_ATTRS_JSON_FILE:-}" ]]; then
     __structuredAttrs=1
     echo "structuredAttrs is enabled"
 
···
         # ex: out=/nix/store/...
         export "$outputName=${outputs[$outputName]}"
     done
-
-    # $NIX_ATTRS_JSON_FILE pointed to the wrong location in sandbox
-    # https://github.com/NixOS/nix/issues/6736; please keep around until the
-    # fix reaches *every patch version* that's >= lib/minver.nix
-    if ! [[ -e "${NIX_ATTRS_JSON_FILE:-}" ]]; then
-        export NIX_ATTRS_JSON_FILE="$NIX_BUILD_TOP/.attrs.json"
-    fi
-    if ! [[ -e "${NIX_ATTRS_SH_FILE:-}" ]]; then
-        export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
-    fi
 else
     __structuredAttrs=
     : "${outputs:=out}"

pkgs/stdenv/generic/source-stdenv.sh

···
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; fi
 source "$stdenv/setup"
 source "$1"

pkgs/test/cc-wrapper/hardening.nix

···
   runCommand,
   runCommandWith,
   runCommandCC,
+  writeText,
   bintools,
   hello,
   debian-devscripts,
···
   f3exampleWithStdEnv = writeCBinWithStdenv ./fortify3-example.c;
 
   flexArrF2ExampleWithStdEnv = writeCBinWithStdenv ./flex-arrays-fortify-example.c;
+
+  checkGlibcxxassertionsWithStdEnv =
+    expectDefined:
+    writeCBinWithStdenv (
+      writeText "main.cpp" ''
+        #if${if expectDefined then "n" else ""}def _GLIBCXX_ASSERTIONS
+        #error "Expected _GLIBCXX_ASSERTIONS to be ${if expectDefined then "" else "un"}defined"
+        #endif
+        int main() {}
+      ''
+    );
 
   # for when we need a slightly more complicated program
   helloWithStdEnv =
···
       hardeningEnable = [ "shadowstack" ];
     }) false;
 
+    glibcxxassertionsExplicitEnabled = checkGlibcxxassertionsWithStdEnv true stdenv {
+      hardeningEnable = [ "glibcxxassertions" ];
+    };
+
     bindNowExplicitDisabled =
       checkTestBin
         (f2exampleWithStdEnv stdenv {
···
       hardeningDisable = [ "shadowstack" ];
     }) true;
 
+    glibcxxassertionsExplicitDisabled = checkGlibcxxassertionsWithStdEnv false stdenv {
+      hardeningDisable = [ "glibcxxassertions" ];
+    };
+
     # most flags can't be "unsupported" by compiler alone and
     # binutils doesn't have an accessible hardeningUnsupportedFlags
     # mechanism, so can only test a couple of flags through altered
···
           expectFailure = true;
         };
 
+    glibcxxassertionsStdenvUnsupp =
+      checkGlibcxxassertionsWithStdEnv false (stdenvUnsupport [ "glibcxxassertions" ])
+        {
+          hardeningEnable = [ "glibcxxassertions" ];
+        };
+
     fortify3EnabledEnvEnablesFortify1 =
       checkTestBin
         (f1exampleWithStdEnv stdenv {
···
       allExplicitDisabledShadowStack = shadowStackTest (f1exampleWithStdEnv stdenv {
         hardeningDisable = [ "all" ];
       }) true;
+
+      glibcxxassertionsExplicitDisabled = checkGlibcxxassertionsWithStdEnv false stdenv {
+        hardeningDisable = [ "all" ];
+      };
     }
   )
 )

pkgs/test/default.nix

···
 
   php = recurseIntoAttrs (callPackages ./php { });
 
+  go = recurseIntoAttrs (callPackage ../build-support/go/tests.nix { });
+
   pkg-config = recurseIntoAttrs (callPackage ../top-level/pkg-config/tests.nix { });
 
   buildRustCrate = recurseIntoAttrs (callPackage ../build-support/rust/build-rust-crate/test { });

pkgs/tools/security/pinentry/fix-with-xcbuild-plistbuddy.patch

···
+diff --git a/macosx/copyInfoPlist.sh b/macosx/copyInfoPlist.sh
+index f366665153..dfd9511e79 100755
+--- a/macosx/copyInfoPlist.sh
++++ b/macosx/copyInfoPlist.sh
+@@ -20,9 +20,10 @@
+ cp "$1" "$dest" || exit 1
+ 
+ 
+-/usr/libexec/PlistBuddy \
+-	-c "Set CommitHash '${COMMIT_HASH:--}'" \
+-	-c "Set BuildNumber '${BUILD_NUMBER:-0}'" \
+-	-c "Set CFBundleVersion '${BUILD_VERSION:-0n}'" \
+-	-c "Set CFBundleShortVersionString '$VERSION'" \
+-	"$dest" || exit 1
++PlistBuddy "$dest" <<EOF || exit 1
++    Set CommitHash "${COMMIT_HASH:--}"
++    Set BuildNumber "${BUILD_NUMBER:-0}"
++    Set CFBundleVersion "${BUILD_VERSION:-0n}"
++    Set CFBundleShortVersionString "$VERSION"
++    Save
++EOF

pkgs/tools/security/pinentry/mac.nix

···
   libgpg-error,
   makeBinaryWrapper,
   texinfo,
+  xcbuild,
   common-updater-scripts,
   writers,
 }:
···
 
   patches = [
     ./gettext-0.25.patch
+
+    # Fix the build with xcbuild’s inferior `PlistBuddy(8)`.
+    ./fix-with-xcbuild-plistbuddy.patch
   ];
 
   # use pregenerated nib files because generating them requires XCode
···
     cp '${lib.getDev libassuan}/share/aclocal/libassuan.m4' m4/libassuan.m4
   '';
 
-  # Unfortunately, PlistBuddy from xcbuild is not compatible enough pinentry-mac’s build process.
-  sandboxProfile = ''
-    (allow process-exec (literal "/usr/libexec/PlistBuddy"))
-  '';
-
   strictDeps = true;
   nativeBuildInputs = [
     autoreconfHook
     makeBinaryWrapper
     texinfo
+
+    # for `PlistBuddy(8)`
+    xcbuild
   ];
 
   configureFlags = [

pkgs/top-level/aliases.nix

···
   budgiePlugins = throw "The `budgiePlugins` scope has been removed and all packages moved to the top-level"; # Added 2024-07-14
   buildBarebox = throw "buildBarebox has been removed due to lack of interest in maintaining it in nixpkgs"; # Added 2025-04-19
   buildGo122Module = throw "Go 1.22 is end-of-life, and 'buildGo122Module' has been removed. Please use a newer builder version."; # Added 2025-03-28
+  buildGo123Module = throw "Go 1.23 is end-of-life, and 'buildGo123Module' has been removed. Please use a newer builder version."; # Added 2025-08-13
   buildGoPackage = throw "`buildGoPackage` has been deprecated and removed, see the Go section in the nixpkgs manual for details"; # Added 2024-11-18
   buildXenPackage = throw "'buildXenPackage' has been removed as a custom Xen build can now be achieved by simply overriding 'xen'."; # Added 2025-05-12
 
···
   gnupg1orig = throw "'gnupg1orig' has been removed due to lack of active upstream maintainance. Consider using 'gnupg' instead"; # Added 2025-01-11
   gnupg22 = throw "'gnupg22' is end-of-life. Consider using 'gnupg24' instead"; # Added 2025-01-05
   go_1_22 = throw "Go 1.22 is end-of-life and 'go_1_22' has been removed. Please use a newer Go toolchain."; # Added 2024-03-28
+  go_1_23 = throw "Go 1.23 is end-of-life and 'go_1_23' has been removed. Please use a newer Go toolchain."; # Added 2025-08-13
   gogs = throw ''
     Gogs development has stalled. Also, it has several unpatched, critical vulnerabilities that
     weren't addressed within a year: https://github.com/gogs/gogs/issues/7777
···
   python = python2; # Added 2022-01-11
   python-swiftclient = throw "'python-swiftclient' has been renamed to/replaced by 'swiftclient'"; # Converted to throw 2024-10-17
   pythonFull = python2Full; # Added 2022-01-11
+  python3Full = throw "python3Full has been removed. Bluetooth support is now enabled by default. The tkinter package is available within the package set.";
+  python310Full = throw "python310Full has been removed. Bluetooth support is now enabled by default. The tkinter package is available within the package set.";
+  python311Full = throw "python311Full has been removed. Bluetooth support is now enabled by default. The tkinter package is available within the package set.";
+  python312Full = throw "python312Full has been removed. Bluetooth support is now enabled by default. The tkinter package is available within the package set.";
+  python313Full = throw "python313Full has been removed. Bluetooth support is now enabled by default. The tkinter package is available within the package set.";
+  python314Full = throw "python314Full has been removed. Bluetooth support is now enabled by default. The tkinter package is available within the package set.";
   pythonPackages = python.pkgs; # Added 2022-01-11
   pypy39 = throw "pypy 3.9 has been removed, use pypy 3.10 instead"; # Added 2025-01-03
 
···
   # spidermonkey is not ABI upwards-compatible, so only allow this for nix-shell
   spidermonkey = throw "'spidermonkey' has been renamed to/replaced by 'spidermonkey_91'"; # Converted to throw 2024-10-17
   spidermonkey_78 = throw "'spidermonkey_78' has been removed because it was unused."; # Added 2025-02-02
+  spidermonkey_91 = throw "'spidermonkey_91 is EOL since 2022/09"; # Added 2025-08-26
   spidermonkey_102 = throw "'spidermonkey_102' is EOL since 2023/03"; # Added 2024-08-07
   spotify-unwrapped = spotify; # added 2022-11-06
   spring-boot = throw "'spring-boot' has been renamed to/replaced by 'spring-boot-cli'"; # Converted to throw 2024-10-17
···
   xmlroff = throw "'xmlroff' has been removed as it is unmaintained and broken"; # Added 2025-05-18
   xmr-stak = throw "xmr-stak has been removed from nixpkgs because it was broken"; # Added 2024-07-15
   xmake-core-sv = throw "'xmake-core-sv' has been removed, use 'libsv' instead"; # Added 2024-10-10
+  xorg-autoconf = util-macros; # Added 2025-08-18
   xournal = throw "'xournal' has been removed due to lack of activity upstream and depending on gnome2. Consider using 'xournalpp' instead."; # Added 2024-12-06
   xonsh-unwrapped = python3Packages.xonsh; # Added 2024-06-18
   xplayer = throw "xplayer has been removed as the upstream project was archived"; # Added 2024-12-27

pkgs/top-level/all-packages.nix

···
 
   cup-docker-noserver = cup-docker.override { withServer = false; };
 
-  deck = callPackage ../by-name/de/deck/package.nix {
-    buildGoModule = buildGo123Module;
-  };
-
   dhallDirectoryToNix = callPackage ../build-support/dhall/directory-to-nix.nix { };
 
   dhallPackageToNix = callPackage ../build-support/dhall/package-to-nix.nix { };
···
 
   # The full-featured Git.
   gitFull = git.override {
-    svnSupport = true;
+    svnSupport = stdenv.buildPlatform == stdenv.hostPlatform;
     guiSupport = true;
-    sendEmailSupport = true;
+    sendEmailSupport = stdenv.buildPlatform == stdenv.hostPlatform;
     withSsh = true;
     withLibsecret = !stdenv.hostPlatform.isDarwin;
   };
···
 
   inherit (cue) writeCueValidator;
 
-  cyclonedx-gomod = callPackage ../tools/security/cyclonedx-gomod {
-    buildGoModule = buildGo123Module;
-  };
+  cyclonedx-gomod = callPackage ../tools/security/cyclonedx-gomod { };
 
   dazel = python3Packages.callPackage ../development/tools/dazel { };
 
···
   };
   bashInteractiveFHS = bashFHS;
 
-  carapace = callPackage ../shells/carapace {
-    buildGoModule = buildGo123Module;
-  };
+  carapace = callPackage ../shells/carapace { };
 
   wrapFish = callPackage ../shells/fish/wrapper.nix { };
 
···
     pythonAttr = "python27Full";
     x11Support = true;
   };
-  python3Full = python3.override {
-    self = python3Full;
-    pythonAttr = "python3Full";
-    bluezSupport = lib.meta.availableOn stdenv.hostPlatform bluez;
-    x11Support = true;
-  };
-  python310Full = python310.override {
-    self = python310Full;
-    pythonAttr = "python310Full";
-    bluezSupport = lib.meta.availableOn stdenv.hostPlatform bluez;
-    x11Support = true;
-  };
-  python311Full = python311.override {
-    self = python311Full;
-    pythonAttr = "python311Full";
-    bluezSupport = lib.meta.availableOn stdenv.hostPlatform bluez;
-    x11Support = true;
-  };
-  python312Full = python312.override {
-    self = python312Full;
-    pythonAttr = "python312Full";
-    bluezSupport = lib.meta.availableOn stdenv.hostPlatform bluez;
-    x11Support = true;
-  };
-  python313Full = python313.override {
-    self = python313Full;
-    pythonAttr = "python313Full";
-    bluezSupport = lib.meta.availableOn stdenv.hostPlatform bluez;
-    x11Support = true;
-  };
-  python314Full = python314.override {
-    self = python314Full;
-    pythonAttr = "python314Full";
-    bluezSupport = lib.meta.availableOn stdenv.hostPlatform bluez;
-    x11Support = true;
-  };
 
   # https://py-free-threading.github.io
   python313FreeThreading = python313.override {
···
 
   inherit
     ({
-      spidermonkey_91 = callPackage ../development/interpreters/spidermonkey/91.nix { };
       spidermonkey_115 = callPackage ../development/interpreters/spidermonkey/115.nix { };
       spidermonkey_128 = callPackage ../development/interpreters/spidermonkey/128.nix { };
       spidermonkey_140 = callPackage ../development/interpreters/spidermonkey/140.nix { };
     })
-    spidermonkey_91
     spidermonkey_115
     spidermonkey_128
     spidermonkey_140
···
 
   prospector = callPackage ../development/tools/prospector { };
 
-  protobuf = protobuf_31;
+  protobuf = protobuf_32;
 
   inherit
     ({
···
   ### DEVELOPMENT / GO
 
   # the unversioned attributes should always point to the same go version
-  go = go_1_24;
-  buildGoModule = buildGo124Module;
+  go = go_1_25;
+  buildGoModule = buildGo125Module;
 
   go_latest = go_1_25;
   buildGoLatestModule = buildGo125Module;
-
-  go_1_23 = callPackage ../development/compilers/go/1.23.nix { };
-  buildGo123Module = callPackage ../build-support/go/module.nix {
-    go = buildPackages.go_1_23;
-  };
 
   go_1_24 = callPackage ../development/compilers/go/1.24.nix { };
   buildGo124Module = callPackage ../build-support/go/module.nix {
···
       "3000"
     ];
   };
-  sbcl_2_5_4 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.5.4"; };
+  sbcl_2_5_5 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.5.5"; };
     faslExt = "fasl";
     flags = [
       "--dynamic-space-size"
       "3000"
     ];
   };
-  sbcl_2_5_5 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.5.5"; };
+  sbcl_2_5_7 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.5.7"; };
     faslExt = "fasl";
     flags = [
       "--dynamic-space-size"
       "3000"
     ];
   };
-  sbcl = sbcl_2_5_5;
+  sbcl = sbcl_2_5_7;
 
   sbclPackages = recurseIntoAttrs sbcl.pkgs;
 
···
     withHomed = false;
     withHwdb = false;
     withImportd = false;
-    withIptables = false;
     withLibBPF = false;
     withLibidn2 = false;
     withLocaled = false;
···
     freeoffice
     ;
 
-  inherit (xorg) xlsfonts;
-
   gimp3 = callPackage ../applications/graphics/gimp {
     lcms = lcms2;
   };
···
   amoeba = callPackage ../games/amoeba { };
   amoeba-data = callPackage ../games/amoeba/data.nix { };
 
-  anki = callPackage ../games/anki { };
+  anki = callPackage ../games/anki {
+    protobuf = protobuf_31;
+  };
   anki-utils = callPackage ../games/anki/addons/anki-utils.nix { };
   ankiAddons = recurseIntoAttrs (callPackage ../games/anki/addons { });
   anki-bin = callPackage ../games/anki/bin.nix { };
···
 
   rustdesk-flutter = callPackage ../by-name/ru/rustdesk-flutter/package.nix {
     flutter = flutter324;
-  };
-
-  openfreebuds = callPackage ../by-name/op/openfreebuds/package.nix {
-    python3Packages = python3Full.pkgs;
   };
 
   davis = callPackage ../by-name/da/davis/package.nix {

pkgs/top-level/perl-packages.nix

···
       url = "mirror://cpan/authors/id/P/PL/PLICEASE/Alien-Build-2.80.tar.gz";
       hash = "sha256-2e3JNrBnBbtcte5aLqi89hEaPogVkU8XfhXjwP7TAfM=";
     };
+
+    # override default postPatch to avoid patchShebangs breaking tests
+    postPatch = "";
+
     propagatedBuildInputs = [
       CaptureTiny
       FFICheckLib
···
 
   CryptURandom = buildPerlPackage {
     pname = "Crypt-URandom";
-    version = "0.39";
+    version = "0.54";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DD/DDICK/Crypt-URandom-0.39.tar.gz";
-      hash = "sha256-Jol7PPualWAJFRLWCHMaPVv08pn20Pj3LIXzmQEkQSI=";
+      url = "mirror://cpan/authors/id/D/DD/DDICK/Crypt-URandom-0.54.tar.gz";
+      hash = "sha256-SnPNOUkzMo2khKrrhkXXNbNUZd9gEJ5VngoosGYFOlc=";
     };
     meta = {
       description = "Provide non blocking randomness";
···
 
   DigestHMAC = buildPerlPackage {
     pname = "Digest-HMAC";
-    version = "1.04";
+    version = "1.05";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AR/ARODLAND/Digest-HMAC-1.04.tar.gz";
-      hash = "sha256-1ryBVqonXETXlLfBj0TNrEpYFAJFyVnmsZssODiwjtQ=";
+      url = "mirror://cpan/authors/id/A/AR/ARODLAND/Digest-HMAC-1.05.tar.gz";
+      hash = "sha256-IVy1nLphB0XPstSz+O91bVkOV+OteYapkuh8SWn83Ho=";
     };
     meta = {
       description = "Keyed-Hashing for Message Authentication";
···
       url = "mirror://cpan/authors/id/M/MI/MITHALDU/PPI-1.277.tar.gz";
       hash = "sha256-h8efg7aHbiBgUZZdUBnSUHxVH4GahnUAgOx+xDsuCvg=";
     };
+
+    # override default postPatch to avoid patchShebangs breaking tests
+    postPatch = "";
+
     buildInputs = [
       ClassInspector
       TestDeep

pkgs/top-level/python-packages.nix

···
 
   tivars = callPackage ../development/python-modules/tivars { };
 
-  tkinter = callPackage ../development/python-modules/tkinter {
-    py = python.override (lib.optionalAttrs (!python.isPyPy) { x11Support = true; });
-  };
+  tkinter =
+    if isPyPy then
+      null
+    else
+      callPackage ../development/python-modules/tkinter {
+        tcl = pkgs.tcl-9_0;
+        tk = pkgs.tk-9_0;
+      };
 
   tkinter-gl = callPackage ../development/python-modules/tkinter-gl { };
 
···
   typer = callPackage ../development/python-modules/typer { };
 
   typer-shell = callPackage ../development/python-modules/typer-shell { };
+
+  typer-slim = self.typer.override { package = "typer-slim"; };
 
   types-aiobotocore = callPackage ../development/python-modules/types-aiobotocore { };
 

pkgs/top-level/variants.nix

···
               "shadowstack"
               "nostrictaliasing"
               "pacret"
+              "glibcxxassertions"
               "trivialautovarinit"
             ]
           ) super'.stdenv;