···11+#!/usr/bin/env bash
22+# Find alleged cherry-picks
33+44+set -eo pipefail
55+66+if [ $# != "2" ] ; then
77+ echo "usage: check-cherry-picks.sh base_rev head_rev"
88+ exit 2
99+fi
1010+1111+# Make sure we are inside the nixpkgs repo, even when called from outside
1212+cd "$(dirname "${BASH_SOURCE[0]}")"
1313+1414+PICKABLE_BRANCHES="master release-??.?? staging-??.?? haskell-updates python-updates"
1515+problem=0
1616+1717+# Not everyone calls their remote "origin"
1818+remote="$(git remote -v | grep -i 'NixOS/nixpkgs' | head -n1 | cut -f1 || true)"
1919+2020+commits="$(git rev-list --reverse "$1..$2")"
2121+2222+while read -r new_commit_sha ; do
2323+ if [ -z "$new_commit_sha" ] ; then
2424+ continue # skip empty lines
2525+ fi
2626+ if [ "$GITHUB_ACTIONS" = 'true' ] ; then
2727+ echo "::group::Commit $new_commit_sha"
2828+ else
2929+ echo "================================================="
3030+ fi
3131+ git rev-list --max-count=1 --format=medium "$new_commit_sha"
3232+ echo "-------------------------------------------------"
3333+3434+ original_commit_sha=$(
3535+ git rev-list --max-count=1 --format=format:%B "$new_commit_sha" \
3636+ | grep -Ei -m1 "cherry.*[0-9a-f]{40}" \
3737+ | grep -Eoi -m1 '[0-9a-f]{40}' || true
3838+ )
3939+ if [ -z "$original_commit_sha" ] ; then
4040+ if [ "$GITHUB_ACTIONS" = 'true' ] ; then
4141+ echo ::endgroup::
4242+ echo -n "::error ::"
4343+ else
4444+ echo -n " ✘ "
4545+ fi
4646+ echo "Couldn't locate original commit hash in message"
4747+ echo "Note this should not necessarily be treated as a hard fail, but a reviewer's attention should" \
4848+ "be drawn to it and github actions have no way of doing that but to raise a 'failure'"
4949+ problem=1
5050+ continue
5151+ fi
5252+5353+ set -f # prevent pathname expansion of patterns
5454+ for pattern in $PICKABLE_BRANCHES ; do
5555+ set +f # re-enable pathname expansion
5656+5757+ # Reverse sorting by refname and taking one match only means we can only backport
5858+ # from unstable and the latest stable. That makes sense, because even right after
5959+ # branch-off, when we have two supported stable branches, we only ever want to cherry-pick
6060+ # **to** the older one, but never **from** it.
6161+ # This makes the job significantly faster in the case when commits can't be found,
6262+ # because it doesn't need to iterate through 20+ branches, which all need to be fetched.
6363+ branches="$(git for-each-ref --sort=-refname --format="%(refname)" \
6464+ "refs/remotes/${remote:-origin}/$pattern" | head -n1)"
6565+6666+ while read -r picked_branch ; do
6767+ if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then
6868+ echo " ✔ $original_commit_sha present in branch $picked_branch"
6969+7070+ range_diff_common='git --no-pager range-diff
7171+ --no-notes
7272+ --creation-factor=100
7373+ '"$original_commit_sha~..$original_commit_sha"'
7474+ '"$new_commit_sha~..$new_commit_sha"'
7575+ '
7676+7777+ if $range_diff_common --no-color 2> /dev/null | grep -E '^ {4}[+-]{2}' > /dev/null ; then
7878+ if [ "$GITHUB_ACTIONS" = 'true' ] ; then
7979+ echo ::endgroup::
8080+ echo -n "::warning ::"
8181+ else
8282+ echo -n " ⚠ "
8383+ fi
8484+ echo "Difference between $new_commit_sha and original $original_commit_sha may warrant inspection:"
8585+8686+ $range_diff_common --color
8787+8888+ echo "Note this should not necessarily be treated as a hard fail, but a reviewer's attention should" \
8989+ "be drawn to it and github actions have no way of doing that but to raise a 'failure'"
9090+ problem=1
9191+ else
9292+ echo " ✔ $original_commit_sha highly similar to $new_commit_sha"
9393+ $range_diff_common --color
9494+ [ "$GITHUB_ACTIONS" = 'true' ] && echo ::endgroup::
9595+ fi
9696+9797+ # move on to next commit
9898+ continue 3
9999+ fi
100100+ done <<< "$branches"
101101+ done
102102+103103+ if [ "$GITHUB_ACTIONS" = 'true' ] ; then
104104+ echo ::endgroup::
105105+ echo -n "::error ::"
106106+ else
107107+ echo -n " ✘ "
108108+ fi
109109+ echo "$original_commit_sha not found in any pickable branch"
110110+111111+ problem=1
112112+done <<< "$commits"
113113+114114+exit $problem
+3-1
ci/eval/default.nix
···7373 # The number of attributes per chunk, see ./README.md for more info.
7474 chunkSize,
7575 checkMeta ? true,
7676- includeBroken ? true,
7676+7777+ # Don't try to eval packages marked as broken.
7878+ includeBroken ? false,
7779 # Whether to just evaluate a single chunk for quick testing
7880 quickTest ? false,
7981 }:
+2
doc/languages-frameworks/agda.section.md
···121121}
122122```
123123124124+To install Agda without GHC, use `ghc = null;`.
125125+124126## Writing Agda packages {#writing-agda-packages}
125127126128To write a nix derivation for an Agda library, first check that the library has a `*.agda-lib` file.
+1-1
doc/languages-frameworks/neovim.section.md
···5959- `neovimRcContent`: Extra vimL code sourced by the generated `init.lua`.
6060- `wrapperArgs`: Extra arguments forwarded to the `makeWrapper` call.
6161- `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
6262- generated Neovim configuration via its `-u` argument, i.e. : `-u /nix/store/...generatedInit.lua`. This has side effects like preventing Neovim from reading your config in `$XDG_CONFIG_HOME` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#_initialization) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse while reusing the logic of the nixpkgs wrapper and access the generated config via `neovim.passthru.initRc`.
6262+ generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
6363- `plugins`: A list of plugins to add to the wrapper.
64646565```
+1-1
doc/release-notes/rl-2505.section.md
···2828 - Applications linked against different Mesa versions than installed on the system should now work correctly going forward (however, applications against older Mesa, e.g. from Nixpkgs releases before 25.05, remain broken)
2929 - Packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively
30303131-- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
3131+- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
32323333- Emacs has been updated to 30.1.
3434 This introduces some backwards‐incompatible changes; see the NEWS for details.
+3-1
doc/release-notes/rl-2511.section.md
···37373838### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
39394040-- Create the first release note entry in this section!
4040+- `neovim`: Added support for the `vim.o.exrc` option, the `VIMINIT` environment variable, and sourcing of `sysinit.vim`.
4141+4242+ See the neovim help page [`:help startup`](https://neovim.io/doc/user/starting.html#startup) for more information, as well as [the nixpkgs neovim wrapper documentation](#neovim-custom-configuration).
···11-#!/usr/bin/env bash
22-# Find alleged cherry-picks
33-44-set -eo pipefail
55-66-if [ $# != "2" ] ; then
77- echo "usage: check-cherry-picks.sh base_rev head_rev"
88- exit 2
99-fi
1010-1111-# Make sure we are inside the nixpkgs repo, even when called from outside
1212-cd "$(dirname "${BASH_SOURCE[0]}")"
1313-1414-PICKABLE_BRANCHES=${PICKABLE_BRANCHES:-master staging release-??.?? staging-??.??}
1515-problem=0
1616-1717-commits="$(git rev-list \
1818- -E -i --grep="cherry.*[0-9a-f]{40}" --reverse \
1919- "$1..$2")"
2020-2121-while read new_commit_sha ; do
2222- if [ -z "$new_commit_sha" ] ; then
2323- continue # skip empty lines
2424- fi
2525- if [ "$GITHUB_ACTIONS" = 'true' ] ; then
2626- echo "::group::Commit $new_commit_sha"
2727- else
2828- echo "================================================="
2929- fi
3030- git rev-list --max-count=1 --format=medium "$new_commit_sha"
3131- echo "-------------------------------------------------"
3232-3333- original_commit_sha=$(
3434- git rev-list --max-count=1 --format=format:%B "$new_commit_sha" \
3535- | grep -Ei -m1 "cherry.*[0-9a-f]{40}" \
3636- | grep -Eoi -m1 '[0-9a-f]{40}'
3737- )
3838- if [ "$?" != "0" ] ; then
3939- echo " ? Couldn't locate original commit hash in message"
4040- [ "$GITHUB_ACTIONS" = 'true' ] && echo ::endgroup::
4141- continue
4242- fi
4343-4444- set -f # prevent pathname expansion of patterns
4545- for branch_pattern in $PICKABLE_BRANCHES ; do
4646- set +f # re-enable pathname expansion
4747-4848- while read -r picked_branch ; do
4949- if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then
5050- echo " ✔ $original_commit_sha present in branch $picked_branch"
5151-5252- range_diff_common='git range-diff
5353- --no-notes
5454- --creation-factor=100
5555- '"$original_commit_sha~..$original_commit_sha"'
5656- '"$new_commit_sha~..$new_commit_sha"'
5757- '
5858-5959- if $range_diff_common --no-color | grep -E '^ {4}[+-]{2}' > /dev/null ; then
6060- if [ "$GITHUB_ACTIONS" = 'true' ] ; then
6161- echo ::endgroup::
6262- echo -n "::warning ::"
6363- else
6464- echo -n " ⚠ "
6565- fi
6666- echo "Difference between $new_commit_sha and original $original_commit_sha may warrant inspection:"
6767-6868- $range_diff_common --color
6969-7070- echo "Note this should not necessarily be treated as a hard fail, but a reviewer's attention should" \
7171- "be drawn to it and github actions have no way of doing that but to raise a 'failure'"
7272- problem=1
7373- else
7474- echo " ✔ $original_commit_sha highly similar to $new_commit_sha"
7575- $range_diff_common --color
7676- [ "$GITHUB_ACTIONS" = 'true' ] && echo ::endgroup::
7777- fi
7878-7979- # move on to next commit
8080- continue 3
8181- fi
8282- done <<< "$(
8383- git for-each-ref \
8484- --format="%(refname)" \
8585- "refs/remotes/origin/$branch_pattern"
8686- )"
8787- done
8888-8989- if [ "$GITHUB_ACTIONS" = 'true' ] ; then
9090- echo ::endgroup::
9191- echo -n "::error ::"
9292- else
9393- echo -n " ✘ "
9494- fi
9595- echo "$original_commit_sha not found in any pickable branch"
9696-9797- problem=1
9898-done <<< "$commits"
9999-100100-exit $problem
+2
nixos/doc/manual/release-notes/rl-2511.section.md
···12121313- [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
14141515+- [FileBrowser](https://filebrowser.org/), a web application for managing and sharing files. Available as [services.filebrowser](#opt-services.filebrowser.enable).
1616+1517- [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
16181719## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
···336336 [
337337 gitMinimal
338338 openssh
339339- util-linux
339339+ # TODO (#409339): remove this patch. We had to add it to avoid a mass rebuild
340340+ # for the 25.05 release. Once the staging cycle referenced in the above PR completes,
341341+ # switch back to plain util-linux.
342342+ util-linux.withPatches
340343 iproute2
341344 ethtool
342345 thin-provisioning-tools
···5050 '';
5151 };
52525353- suppressNvidiaDriverAssertion = lib.mkOption {
5454- default = false;
5555- type = lib.types.bool;
5353+ device-name-strategy = lib.mkOption {
5454+ default = "index";
5555+ type = lib.types.enum [
5656+ "index"
5757+ "uuid"
5858+ "type-index"
5959+ ];
6060+ description = ''
6161+ Specify the strategy for generating device names,
6262+ passed to `nvidia-ctk cdi generate`. This will affect how
6363+ you reference the device using `nvidia.com/gpu=` in
6464+ the container runtime.
6565+ '';
6666+ };
6767+6868+ discovery-mode = lib.mkOption {
6969+ default = "auto";
7070+ type = lib.types.enum [
7171+ "auto"
7272+ "csv"
7373+ "nvml"
7474+ "wsl"
7575+ ];
7676+ description = ''
7777+ The mode to use when discovering the available entities.
7878+ '';
7979+ };
8080+8181+ csv-files = lib.mkOption {
8282+ default = [ ];
8383+ type = lib.types.listOf lib.types.path;
5684 description = ''
5757- Suppress the assertion for installing Nvidia driver.
5858- Useful in WSL where drivers are mounted from Windows, not provided by NixOS.
8585+ The path to the list of CSV files to use when generating the CDI specification in CSV mode.
5986 '';
6087 };
6188···74101 '';
75102 };
761037777- device-name-strategy = lib.mkOption {
7878- default = "index";
7979- type = lib.types.enum [
8080- "index"
8181- "uuid"
8282- "type-index"
8383- ];
104104+ mount-nvidia-docker-1-directories = lib.mkOption {
105105+ default = true;
106106+ type = lib.types.bool;
84107 description = ''
8585- Specify the strategy for generating device names,
8686- passed to `nvidia-ctk cdi generate`. This will affect how
8787- you reference the device using `nvidia.com/gpu=` in
8888- the container runtime.
108108+ Mount nvidia-docker-1 directories on containers: /usr/local/nvidia/lib and
109109+ /usr/local/nvidia/lib64.
89110 '';
90111 };
911129292- mount-nvidia-docker-1-directories = lib.mkOption {
9393- default = true;
113113+ suppressNvidiaDriverAssertion = lib.mkOption {
114114+ default = false;
94115 type = lib.types.bool;
95116 description = ''
9696- Mount nvidia-docker-1 directories on containers: /usr/local/nvidia/lib and
9797- /usr/local/nvidia/lib64.
117117+ Suppress the assertion for installing Nvidia driver.
118118+ Useful in WSL where drivers are mounted from Windows, not provided by NixOS.
98119 '';
99120 };
100121···111132 || lib.elem "nvidia" config.services.xserver.videoDrivers
112133 || config.hardware.nvidia-container-toolkit.suppressNvidiaDriverAssertion;
113134 message = ''`nvidia-container-toolkit` requires nvidia drivers: set `hardware.nvidia.datacenter.enable`, add "nvidia" to `services.xserver.videoDrivers`, or set `hardware.nvidia-container-toolkit.suppressNvidiaDriverAssertion` if the driver is provided by another NixOS module (e.g. from NixOS-WSL)'';
135135+ }
136136+ {
137137+ assertion =
138138+ ((builtins.length config.hardware.nvidia-container-toolkit.csv-files) > 0)
139139+ -> config.hardware.nvidia-container-toolkit.discovery-mode == "csv";
140140+ message = ''When CSV files are provided, `config.hardware.nvidia-container-toolkit.discovery-mode` has to be set to `csv`.'';
114141 }
115142 ];
116143···209236 ExecStart =
210237 let
211238 script = pkgs.callPackage ./cdi-generate.nix {
212212- inherit (config.hardware.nvidia-container-toolkit) mounts;
239239+ inherit (config.hardware.nvidia-container-toolkit)
240240+ csv-files
241241+ device-name-strategy
242242+ discovery-mode
243243+ mounts
244244+ ;
213245 nvidia-container-toolkit = config.hardware.nvidia-container-toolkit.package;
214246 nvidia-driver = config.hardware.nvidia.package;
215215- deviceNameStrategy = config.hardware.nvidia-container-toolkit.device-name-strategy;
216247 };
217248 in
218249 lib.getExe script;
+4-4
nixos/modules/services/security/kanidm.nix
···185185186186 finalJson =
187187 if cfg.provision.extraJsonFile != null then
188188- "<(${lib.getExe pkgs.jq} -s '.[0] * .[1]' ${provisionStateJson} ${cfg.provision.extraJsonFile})"
188188+ ''
189189+ <(${lib.getExe pkgs.yq-go} '. *+ load("${cfg.provision.extraJsonFile}") | (.. | select(type == "!!seq")) |= unique' ${provisionStateJson})
190190+ ''
189191 else
190192 provisionStateJson;
191193···442444 description = ''
443445 A JSON file for provisioning persons, groups & systems.
444446 Options set in this file take precedence over values set using the other options.
445445- In the case of duplicates, `jq` will remove all but the last one
446446- when merging this file with the options.
447447+ The files get deeply merged, and deduplicated.
447448 The accepted JSON schema can be found at <https://github.com/oddlama/kanidm-provision#json-schema>.
448448- Note: theoretically `jq` cannot merge nested types, but this does not pose an issue as kanidm-provision's JSON scheme does not use nested types.
449449 '';
450450 type = types.nullOr types.path;
451451 default = null;
···4848 viAlias ? false,
49495050 # additional argument not generated by makeNeovimConfig
5151- # it will append "-u <customRc>" to the wrapped arguments
5151+ # it sets the VIMINIT environment variable to "lua dofile('${customRc}')"
5252 # set to false if you want to control where to save the generated config
5353 # (e.g., in ~/.config/init.vim or project/.nvimrc)
5454 wrapRc ? true,
···193193 "${placeholder "out"}/rplugin.vim"
194194 ]
195195 ++ lib.optionals finalAttrs.wrapRc [
196196- "--add-flags"
197197- "-u ${writeText "init.lua" rcContent}"
196196+ "--set-default"
197197+ "VIMINIT"
198198+ "lua dofile('${writeText "init.lua" rcContent}')"
198199 ]
199200 ++ finalAttrs.generatedWrapperArgs;
200201
···333333 }).overrideAttrs
334334 overrideContainerdAttrs;
335335336336- # TODO (#405952): remove this patch. We had to add it to avoid a mass rebuild
337337- # for the 25.05 release. Once the above PR is merged, switch back to plain util-linuxMinimal.
338338- k3sUtilLinux = util-linuxMinimal.overrideAttrs (prev: {
339339- patches =
340340- prev.patches or [ ]
341341- ++ lib.singleton (fetchpatch {
342342- url = "https://github.com/util-linux/util-linux/commit/7dbfe31a83f45d5aef2b508697e9511c569ffbc8.patch";
343343- hash = "sha256-bJqpZiPli5Pm/XpDA445Ab5jesXrlcnaO6e4V0B3rSw=";
344344- });
345345- });
336336+ # TODO (#409339): remove this patch. We had to add it to avoid a mass rebuild
337337+ # for the 25.05 release. Once the staging cycle referenced in the above PR completes,
338338+ # switch back to plain util-linuxMinimal.
339339+ k3sUtilLinux = util-linuxMinimal.withPatches;
346340in
347341buildGoModule rec {
348342 pname = "k3s";
···103103 hash = "sha256-Sgk5eaPC0C3i+8AFSaMncQB/LngDLG+qXs0vep4VICU=";
104104 };
105105106106- patches = [
107107- # Backport of https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6
108108- ./0001-http2-fix-stream-window-size-after-unpausing.patch
109109- ];
106106+ patches =
107107+ [
108108+ # Backport of https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6
109109+ ./0001-http2-fix-stream-window-size-after-unpausing.patch
110110+ ]
111111+ ++ lib.optionals wolfsslSupport [
112112+ (fetchpatch {
113113+ # https://curl.se/docs/CVE-2025-4947.html backported to 8.13. Remove when version is bumped to 8.14.
114114+ # Note that this works since fetchpatch uses curl, but does not use WolfSSL.
115115+ name = "curl-CVE-2025-4947.patch";
116116+ url = "https://github.com/curl/curl/commit/a85f1df4803bbd272905c9e7125.diff";
117117+ hash = "sha256-z4IYAkg/RylTs1m8tbwI2tVqTCHkIpmkzdFBcRBJmH4=";
118118+119119+ # All the test patches fail to apply (seemingly, they were added for 8.14)
120120+ includes = [ "lib/vquic/vquic-tls.c" ];
121121+ })
122122+ (fetchpatch {
123123+ # https://curl.se/docs/CVE-2025-5025.html backported to 8.13. Remove when version is bumped to 8.14.
124124+ # Note that this works since fetchpatch uses curl, but does not use WolfSSL.
125125+ name = "curl-CVE-2025-5025.patch";
126126+ url = "https://github.com/curl/curl/commit/e1f65937a96a451292e92313396.diff";
127127+ hash = "sha256-9k05eDGUA7XT+H4p8H8v0lYXC4cW7W2uvO+z4gLapX4=";
128128+ })
129129+ ];
110130111131 # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
112132 # necessary for FreeBSD code path in configure
+10-9
pkgs/by-name/ed/edk2/package.nix
···34343535 edk2 = stdenv.mkDerivation {
3636 pname = "edk2";
3737- version = "202411";
3737+ version = "202505";
38383939 srcWithVendoring = fetchFromGitHub {
4040 owner = "tianocore";
4141 repo = "edk2";
4242- rev = "edk2-stable${edk2.version}";
4242+ tag = "edk2-stable${edk2.version}";
4343 fetchSubmodules = true;
4444- hash = "sha256-KYaTGJ3DHtWbPEbP+n8MTk/WwzLv5Vugty/tvzuEUf0=";
4444+ hash = "sha256-VuiEqVpG/k7pfy0cOC6XmY+8NBtU/OHdDB9Y52tyNe8=";
4545 };
46464747 src = applyPatches {
···6262 })
6363 ];
64646565- # EDK2 is currently working on OpenSSL 3.3.x support. Use buildpackages.openssl again,
6666- # when "https://github.com/tianocore/edk2/pull/6167" is merged.
6765 postPatch = ''
6868- # We don't want EDK2 to keep track of OpenSSL, they're frankly bad at it.
6666+ # de-vendor OpenSSL
6967 rm -r CryptoPkg/Library/OpensslLib/openssl
7068 mkdir -p CryptoPkg/Library/OpensslLib/openssl
7169 (
7270 cd CryptoPkg/Library/OpensslLib/openssl
7373- tar --strip-components=1 -xf ${buildPackages.openssl_3.src}
7171+ tar --strip-components=1 -xf ${buildPackages.openssl.src}
74727573 # Apply OpenSSL patches.
7676- ${lib.pipe buildPackages.openssl_3.patches [
7474+ ${lib.pipe buildPackages.openssl.patches [
7775 (builtins.filter (
7876 patch:
7977 !builtins.elem (baseNameOf patch) [
···144142145143 passthru = {
146144 # exercise a channel blocker
147147- tests.uefiUsb = nixosTests.boot.uefiCdrom;
145145+ tests = {
146146+ systemdBootExtraEntries = nixosTests.systemd-boot.extraEntries;
147147+ uefiUsb = nixosTests.boot.uefiCdrom;
148148+ };
148149149150 updateScript = writeScript "update-edk2" ''
150151 #!/usr/bin/env nix-shell
+5-7
pkgs/by-name/ed/edusong/package.nix
···6677stdenvNoCC.mkDerivation rec {
88 pname = "edusong";
99- version = "1.0"; # The upstream doesn't provide the version
99+ version = "4.0";
10101111 src = fetchzip {
1212 name = "${pname}-${version}";
1313 url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/eduSong_Unicode.zip";
1414- hash = "sha256-pIG1EbFGf2O2AzM4+HCCvGPodBBwUt7ozpb+BpPk5Kw=";
1414+ hash = "sha256-4NBnwMrYufeZbgSiD2fAhe4tuy0aAA5u9tWwjQQjEQk=";
1515 };
16161717 installPhase = ''
1818 mkdir -p $out/share/fonts/
1919- mv *.ttf $out/share/fonts/
1919+ mv eduSong_Unicode*.ttf $out/share/fonts/eduSong_Unicode\(2024年12月\).ttf
2020 '';
21212222 meta = {
2323- description = "The MOE Standard Song Font, a Chinese font by the Ministry of Education, ROC (Taiwan)";
2323+ description = "The MOE Song font, a Song-style Chinese character typeface";
2424 longDescription = ''
2525- The MOE Standard Song Font is a Chinese Song font provided by
2626- the Midistry of Education, Republic of China (Taiwan).
2727- Song or Ming is a category of CKJ typefaces in print.
2525+ A Song-style Chinese character typeface published by the Ministry of Education of the Republic of China (Taiwan). The Song style is also referred to as 宋體, 宋体, sòngtǐ, 明體, 明体, or míngtǐ, in Chinese; 명조체, 明朝體, or myeongjo in Korean; 明朝体, みんちょうたい, or minchōtai in Japanese.
2826 '';
2927 homepage = "https://language.moe.gov.tw/result.aspx?classify_sn=23&subclassify_sn=436&content_sn=48";
3028 license = lib.licenses.cc-by-nd-30;
···4242# as bootloader for various platforms and corresponding binary and helper files.
4343stdenv.mkDerivation (finalAttrs: {
4444 pname = "limine";
4545- version = "9.3.2";
4545+ version = "9.3.3";
46464747 # We don't use the Git source but the release tarball, as the source has a
4848 # `./bootstrap` script performing network access to download resources.
4949 # Packaging that in Nix is very cumbersome.
5050 src = fetchurl {
5151 url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
5252- hash = "sha256-aYzNgErrlRIIv4hmekdoPMCZ4g5xDYIeTUJhEkfuuJQ=";
5252+ hash = "sha256-+yhHFt9SvYUl/tjfwZyR0OJK8+BDzieLS2AFY1VyNLE=";
5353 };
54545555 enableParallelBuilding = true;
···2727}:
28282929let
3030+ atLeast15 = lib.versionAtLeast version "15";
3031 atLeast14 = lib.versionAtLeast version "14";
3132 atLeast13 = lib.versionAtLeast version "13";
3233 atLeast12 = lib.versionAtLeast version "12";
3334 atLeast11 = lib.versionAtLeast version "11";
3435 atLeast10 = lib.versionAtLeast version "10";
3636+ is15 = majorVersion == "15";
3537 is14 = majorVersion == "14";
3638 is13 = majorVersion == "13";
3739 is12 = majorVersion == "12";
···145147146148# Fixes detection of Darwin on x86_64-darwin. Otherwise, GCC uses a deployment target of 10.5, which crashes ld64.
147149++ optional (
148148- atLeast14 && stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64
150150+ is14 && stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64
149151) ../patches/14/libgcc-darwin-detection.patch
152152+++ optional (
153153+ atLeast15 && stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64
154154+) ../patches/15/libgcc-darwin-detection.patch
150155151156# Fix detection of bootstrap compiler Ada support (cctools as) on Nix Darwin
152157++ optional (
···161166# Use absolute path in GNAT dylib install names on Darwin
162167++ optionals (stdenv.hostPlatform.isDarwin && langAda) (
163168 {
169169+ "15" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
164170 "14" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
165171 "13" = [ ./gnat-darwin-dylib-install-name-13.patch ];
166172 "12" = [ ./gnat-darwin-dylib-install-name.patch ];
···170176171177++ optionals canApplyIainsDarwinPatches (
172178 {
179179+ "15" = [
180180+ (fetchpatch {
181181+ name = "gcc-15-darwin-aarch64-support.patch";
182182+ url = "https://raw.githubusercontent.com/Homebrew/formula-patches/a25079204c1cb3d78ba9dd7dd22b8aecce7ce264/gcc/gcc-15.1.0.diff";
183183+ sha256 = "sha256-MJxSGv6LEP1sIM8cDqbmfUV7byV0bYgADeIBY/Teyu8=";
184184+ })
185185+ ];
173186 "14" = [
174187 (fetchpatch {
175188 name = "gcc-14-darwin-aarch64-support.patch";
-2
pkgs/development/cuda-modules/README.md
···2929 short, the Multiplex builder adds multiple versions of a single package to
3030 single instance of the CUDA Packages package set. It is used primarily for
3131 packages like `cudnn` and `cutensor`.
3232-- `lib`: A library of functions and data used by and for the CUDA package set.
3333- This library is exposed at the top-level as `pkgs.cudaLib`.
3432- `modules`: Nixpkgs modules to check the shape and content of CUDA
3533 redistributable and feature manifests. These modules additionally use shims
3634 provided by some CUDA packages to allow them to re-use the
+4-4
pkgs/development/cuda-modules/_cuda/default.nix
···11# The _cuda attribute set is a fixed-point which contains the static functionality required to construct CUDA package
22-# sets. For example, `_cuda.cudaData` includes information about NVIDIA's redistributables (such as the names NVIDIA
33-# uses for different systems), `_cuda.cudaLib` contains utility functions like `formatCapabilities` (which generate
44-# common arguments passed to NVCC and `cmakeFlags`), and `_cuda.cudaFixups` contains `callPackage`-able functions
55-# which are provided to the corresponding package's `overrideAttrs` attribute to provide package-specific fixups
22+# sets. For example, `_cuda.bootstrapData` includes information about NVIDIA's redistributables (such as the names
33+# NVIDIA uses for different systems), `_cuda.lib` contains utility functions like `formatCapabilities` (which generate
44+# common arguments passed to NVCC and `cmakeFlags`), and `_cuda.fixups` contains `callPackage`-able functions which
55+# are provided to the corresponding package's `overrideAttrs` attribute to provide package-specific fixups
66# out of scope of the generic redistributable builder.
77#
88# Since this attribute set is used to construct the CUDA package sets, it must exist outside the fixed point of the
···11diff --git a/pyproject.toml b/pyproject.toml
22-index d045458f..efa9161d 100644
22+index 451d83d9..817b27ea 100644
33--- a/pyproject.toml
44+++ b/pyproject.toml
55@@ -16,7 +16,7 @@ dependencies = [
66 "img2pdf>=0.5",
77 "packaging>=20",
88 "pdfminer.six>=20220319",
99-- "pi-heif", # Heif image format - maintainers: if this is removed, it will NOT break
1010-+ "pillow-heif", # Heif image format - maintainers: if this is removed, it will NOT break
1111- "pikepdf>=8.10.1",
99+- "pi-heif", # Heif image format - maintainers: if this is removed, it will NOT break
1010++ "pillow-heif", # Heif image format - maintainers: if this is removed, it will NOT break
1111+ "pikepdf>=8.10.1, != 9.8.0",
1212 "Pillow>=10.0.1",
1313 "pluggy>=1",
1414diff --git a/src/ocrmypdf/_pipeline.py b/src/ocrmypdf/_pipeline.py
1515-index 043a78a0..522197b1 100644
1515+index 90524d58..0be5a0f8 100644
1616--- a/src/ocrmypdf/_pipeline.py
1717+++ b/src/ocrmypdf/_pipeline.py
1818@@ -42,7 +42,7 @@ from ocrmypdf.pdfinfo import Colorspace, Encoding, PageInfo, PdfInfo
···576576 edUnstable = throw "edUnstable was removed; use ed instead"; # Added 2024-07-01
577577 edgedb = throw "edgedb replaced to gel because of change of upstream"; # Added 2025-02-24
578578 edge-runtime = throw "'edge-runtime' was removed as it was unused, unmaintained, likely insecure and failed to build"; # Added 2025-05-18
579579+ eidolon = throw "eidolon was removed as it is unmaintained upstream."; # Added 2025-05-28
579580 eintopf = lauti; # Project was renamed, added 2025-05-01
580581 elasticsearch7Plugins = elasticsearchPlugins;
581582 electronplayer = throw "'electronplayer' has been removed as it had been discontinued upstream since October 2024"; # Added 2024-12-17