Merge staging-next into staging

maintainers/maintainer-list.nix

···
     githubId = 293586;
     name = "Adam Gamble";
   };
+  gamedungeon = {
+    github = "GameDungeon";
+    githubId = 60719255;
+    name = "gamedungeon";
+  };
   gangaram = {
     email = "[e-mail]";
     github = "gangaram-tii";
···
     github = "Szczyp";
     githubId = 203195;
     name = "Szczyp";
+  };
+  szkiba = {
+    email = "[e-mail]";
+    github = "szkiba";
+    githubId = 16244553;
+    name = "Iván Szkiba";
   };
   szlend = {
     email = "[e-mail]";

nixos/doc/manual/configuration/x-windows.chapter.md

···
 supports Glamor (2D graphics acceleration via OpenGL) and is actively
 maintained, it may perform worse in some cases (like in old chipsets).
 
+There is a second driver, `intel` (provided by the xf86-video-intel package),
+specific to older Intel iGPUs from generation 2 to 9. It is not recommended by
+most distributions: it lacks several modern features (for example, it doesn't
+support Glamor) and the package hasn't been officially updated since 2015.
+
+Third generation and older iGPUs (15-20+ years old) are not supported by the
+`modesetting` driver (X will crash upon startup). Thus, the `intel` driver is
+required for these chipsets.
+Otherwise, the results vary depending on the hardware, so you may have to try
+both drivers. Use the option
+[](#opt-services.xserver.videoDrivers)
+to set one. The recommended configuration for modern systems is:
+
+```nix
+{
+  services.xserver.videoDrivers = [ "modesetting" ];
+}
+```
 ::: {.note}
 The `modesetting` driver doesn't currently provide a `TearFree` option (this
 will become available in an upcoming X.org release), So, without using a
···
 experience screen tearing.
 :::
 
-There also used to be a second driver, `intel` (provided by the
-xf86-video-intel package), specific to older Intel iGPUs from generation 2 to
-9.
-This driver hasn't been maintained in years and was removed in NixOS 24.11
-after it stopped working. If you chipset is too old to be supported by
-`modesetting` and have no other choice you may try an unsupported NixOS version
-(reportedly working up to NixOS 24.05) and set
+If you experience screen tearing no matter what, this configuration was
+reported to resolve the issue:
 
 ```nix
 {
   services.xserver.videoDrivers = [ "intel" ];
+    services.xserver.deviceSection = ''
+    Option "DRI" "2"
+    Option "TearFree" "true"
+  '';
 }
 ```
+
+Note that this will likely downgrade the performance compared to
+`modesetting` or `intel` with DRI 3 (default).
 
 ## Proprietary NVIDIA drivers {#sec-x11-graphics-cards-nvidia}
 

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - `nixos-option` has been rewritten to a Nix expression called by a simple bash script. This lowers our maintenance threshold, makes eval errors less verbose, adds support for flake-based configurations, descending into `attrsOf` and `listOf` submodule options, and `--show-trace`.
 
+- The `intel` video driver for X.org (from the xf86-video-intel package) which was previously removed because it was non-functional has been fixed and the driver has been re-introduced.
+
 - The Mattermost module ({option}`services.mattermost`) and packages (`mattermost` and `mmctl`) have been substantially updated:
   - {option}`services.mattermost.preferNixConfig` now defaults to true if you advance {option}`system.stateVersion` to 25.05. This means that if you have {option}`services.mattermost.mutableConfig` set, NixOS will override your settings to those that you define in the module. It is recommended to leave this at the default, even if you used a mutable config before, because it will ensure that your Mattermost data directories are correct. If you moved your data directories, you may want to review the module changes before upgrading.
   - Mattermost telemetry reporting is now disabled by default, though security update notifications are enabled. Look at {option}`services.mattermost.telemetry` for options to control this behavior.
···
 - `ast-grep` remove `sg` command to prevent conflict with `sg` command from shadow-utils. If you need legacy sg command compatibility with old code, you can use `ast-grep.override { enableLegacySg = true; }`
 
 - rename package `wtf` to `wtfutil`.
+
+- The udev rules of the libjaylink package require users to be in the `jlink` instead of `plugdev` group now, since the `plugdev` group is very uncommon for NixOS. Alternatively, access is granted to seat sessions.
 
 - `python3Packages.beancount` was updated to 3.1.0. Previous major version remains available as `python3Packages.beancount_2`.
 

nixos/modules/hardware/libjaylink.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.hardware.libjaylink;
+in
+{
+  options.hardware.libjaylink = {
+    enable = lib.mkEnableOption ''
+      udev rules for devices supported by libjaylink.
+      Add users to the `jlink` group in order to grant
+      them access
+    '';
+    package = lib.mkPackageOption pkgs "libjaylink" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.groups.jlink = { };
+    services.udev.packages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ felixsinger ];
+}

nixos/modules/module-list.nix

···
   ./hardware/ksm.nix
   ./hardware/ledger.nix
   ./hardware/libftdi.nix
+  ./hardware/libjaylink.nix
   ./hardware/logitech.nix
   ./hardware/mcelog.nix
   ./hardware/network/ath-user-regd.nix

nixos/modules/programs/direnv.nix

···
     enableFishIntegration = enabledOption ''
       Fish integration
     '';
+    enableXonshIntegration = enabledOption ''
+      Xonsh integration
+    '';
 
     direnvrcExtra = lib.mkOption {
       type = lib.types.lines;
···
          ${lib.getExe cfg.package} hook fish | source
         end
       '';
+
+      xonsh = lib.mkIf cfg.enableXonshIntegration {
+        extraPackages = ps: [ ps.xonsh.xontribs.xonsh-direnv ];
+        config = ''
+          if ${
+            if cfg.loadInNixShell then
+              "True"
+            else
+              "not any(map(lambda s: s.startswith('/nix/store'), __xonsh__.env.get('PATH')))"
+          }:
+              xontrib load direnv
+        '';
+      };
     };
 
     environment = {

nixos/modules/services/system/kerberos/heimdal.nix

···
           target,
           ...
         }:
-        "${principal}\t${lib.concatStringsSep "," (lib.toList access)}\t${target}"
+        if target != "*" && target != "" then
+          "${principal}\t${lib.concatStringsSep "," (lib.toList access)}\t${target}"
+        else
+          "${principal}\t${lib.concatStringsSep "," (lib.toList access)}"
       ) acl
     ))
     (lib.mapAttrsToList (
···
       description = "Kerberos Administration Daemon";
       partOf = [ "kerberos-server.target" ];
       wantedBy = [ "kerberos-server.target" ];
+      documentation = [
+        "man:kadmind(8)"
+        "info:heimdal"
+      ];
       serviceConfig = {
         ExecStart = "${package}/libexec/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
         Slice = "system-kerberos-server.slice";
···
       description = "Key Distribution Center daemon";
       partOf = [ "kerberos-server.target" ];
       wantedBy = [ "kerberos-server.target" ];
+      documentation = [
+        "man:kdc(8)"
+        "info:heimdal"
+      ];
       serviceConfig = {
         ExecStart = "${package}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
         Slice = "system-kerberos-server.slice";
···
       description = "Kerberos Password Changing daemon";
       partOf = [ "kerberos-server.target" ];
       wantedBy = [ "kerberos-server.target" ];
+      documentation = [
+        "man:kpasswdd(8)"
+        "info:heimdal"
+      ];
       serviceConfig = {
         ExecStart = "${package}/libexec/kpasswdd";
         Slice = "system-kerberos-server.slice";

nixos/tests/kerberos/heimdal.nix

···
   {
     name = "kerberos_server-heimdal";
 
-    nodes.machine =
-      {
-        config,
-        libs,
-        pkgs,
-        ...
-      }:
-      {
-        services.kerberos_server = {
-          enable = true;
-          settings.realms = {
-            "FOO.BAR".acl = [
-              {
-                principal = "admin";
-                access = [
-                  "add"
-                  "cpw"
-                ];
-              }
-            ];
+    nodes = {
+      server =
+        { config, pkgs, ... }:
+        {
+          imports = [ ../common/user-account.nix ];
+
+          users.users.alice.extraGroups = [ "wheel" ];
+
+          services.getty.autologinUser = "alice";
+
+          virtualisation.vlans = [ 1 ];
+
+          time.timeZone = "Etc/UTC";
+
+          networking = {
+            domain = "foo.bar";
+            useDHCP = false;
+            firewall.enable = false;
+            hosts."10.0.0.1" = [ "server.foo.bar" ];
+            hosts."10.0.0.2" = [ "client.foo.bar" ];
           };
-        };
-        security.krb5 = {
-          enable = true;
-          package = pkgs.heimdal;
-          settings = {
-            libdefaults = {
-              default_realm = "FOO.BAR";
+
+          systemd.network.networks."01-eth1" = {
+            name = "eth1";
+            networkConfig.Address = "10.0.0.1/24";
+          };
+
+          security.krb5 = {
+            enable = true;
+            package = pkgs.heimdal;
+            settings = {
+              libdefaults.default_realm = "FOO.BAR";
+
+              # Enable extra debug output
+              logging = {
+                admin_server = "SYSLOG:DEBUG:AUTH";
+                default = "SYSLOG:DEBUG:AUTH";
+                kdc = "SYSLOG:DEBUG:AUTH";
+              };
+
+              realms = {
+                "FOO.BAR" = {
+                  admin_server = "server.foo.bar";
+                  kpasswd_server = "server.foo.bar";
+                  kdc = [ "server.foo.bar" ];
+                };
+              };
             };
-            realms = {
+          };
+
+          services.kerberos_server = {
+            enable = true;
+            settings.realms = {
               "FOO.BAR" = {
-                admin_server = "machine";
-                kdc = "machine";
+                acl = [
+                  {
+                    principal = "kadmin/[e-mail]";
+                    access = "all";
+                  }
+                  {
+                    principal = "alice/[e-mail]";
+                    access = [
+                      "add"
+                      "cpw"
+                      "delete"
+                      "get"
+                      "list"
+                      "modify"
+                    ];
+                  }
+                ];
               };
             };
           };
         };
-      };
 
-    testScript = ''
-      machine.succeed(
-          "kadmin -l init --realm-max-ticket-life='8 day' --realm-max-renewable-life='10 day' FOO.BAR",
-          "systemctl restart kadmind.service kdc.service",
-      )
+      client =
+        { config, pkgs, ... }:
+        {
+          imports = [ ../common/user-account.nix ];
 
-      for unit in ["kadmind", "kdc", "kpasswdd"]:
-          machine.wait_for_unit(f"{unit}.service")
+          users.users.alice.extraGroups = [ "wheel" ];
 
-      machine.succeed(
-          "kadmin -l add --password=admin_pw --use-defaults admin",
-          "kadmin -l ext_keytab --keytab=admin.keytab admin",
-          "kadmin -p admin -K admin.keytab add --password=alice_pw --use-defaults alice",
-          "kadmin -l ext_keytab --keytab=alice.keytab alice",
-          "kinit -kt alice.keytab alice",
-      )
-    '';
+          services.getty.autologinUser = "alice";
+
+          virtualisation.vlans = [ 1 ];
+
+          time.timeZone = "Etc/UTC";
 
-    meta.maintainers = [ pkgs.lib.maintainers.dblsaiko ];
+          networking = {
+            domain = "foo.bar";
+            useDHCP = false;
+            hosts."10.0.0.1" = [ "server.foo.bar" ];
+            hosts."10.0.0.2" = [ "client.foo.bar" ];
+          };
+
+          systemd.network.networks."01-eth1" = {
+            name = "eth1";
+            networkConfig.Address = "10.0.0.2/24";
+          };
+
+          security.krb5 = {
+            enable = true;
+            package = pkgs.heimdal;
+            settings = {
+              libdefaults.default_realm = "FOO.BAR";
+
+              logging = {
+                admin_server = "SYSLOG:DEBUG:AUTH";
+                default = "SYSLOG:DEBUG:AUTH";
+                kdc = "SYSLOG:DEBUG:AUTH";
+              };
+
+              realms = {
+                "FOO.BAR" = {
+                  admin_server = "server.foo.bar";
+                  kpasswd_server = "server.foo.bar";
+                  kdc = [ "server.foo.bar" ];
+                };
+              };
+            };
+          };
+        };
+    };
+
+    testScript =
+      { nodes, ... }:
+      ''
+        import string
+        import random
+        random.seed(0)
+
+        start_all()
+
+        with subtest("Server: initialize realm"):
+          # for unit in ["kadmind.service", "kdc.socket", "kpasswdd.socket"]:
+          for unit in ["kadmind.service", "kdc.service", "kpasswdd.service"]:
+              server.wait_for_unit(unit)
+
+          server.succeed("kadmin -l init --realm-max-ticket-life='8 day' --realm-max-renewable-life='10 day' FOO.BAR")
+
+          for unit in ["kadmind.service", "kdc.service", "kpasswdd.service"]:
+              server.systemctl(f"restart {unit}")
+
+        alice_krb_pw = "alice_hunter2"
+        alice_old_krb_pw = ""
+        alice_krb_admin_pw = "alice_admin_hunter2"
+
+        def random_password():
+          password_chars = string.ascii_letters + string.digits + string.punctuation.replace('"', "")
+          return "".join(random.choice(password_chars) for _ in range(16))
+
+        with subtest("Server: initialize user principals and keytabs"):
+          server.succeed(f'kadmin -l add --password="{alice_krb_admin_pw}" --use-defaults alice/admin')
+          server.succeed("kadmin -l ext_keytab --keytab=admin.keytab alice/admin")
+
+          server.succeed(f'kadmin -p alice/admin -K admin.keytab add --password="{alice_krb_pw}" --use-defaults alice')
+          server.succeed("kadmin -l ext_keytab --keytab=alice.keytab alice")
+
+        server.wait_for_unit("[e-mail]")
+        server.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+        server.wait_for_unit("default.target")
+
+        with subtest("Server: initialize host principal with keytab"):
+          server.send_chars("sudo ktutil get -p alice/admin host/server.foo.bar\n")
+          server.wait_until_tty_matches("1", "password for alice:")
+          server.send_chars("${nodes.server.config.users.users.alice.password}\n")
+          server.wait_until_tty_matches("1", "alice/[e-mail]'s Password:")
+          server.send_chars(f'{alice_krb_admin_pw}\n')
+          server.wait_for_file("/etc/krb5.keytab")
+
+          ktutil_list = server.succeed("sudo ktutil list")
+          if not "host/server.foo.bar" in ktutil_list:
+            exit(1)
+
+          server.send_chars("clear\n")
+
+        client.systemctl("start network-online.target")
+        client.wait_for_unit("network-online.target")
+        client.wait_for_unit("[e-mail]")
+        client.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+        client.wait_for_unit("default.target")
+
+        with subtest("Client: initialize host principal with keytab"):
+          client.succeed(
+            f'echo "{alice_krb_admin_pw}" > pw.txt',
+            "kinit -p --password-file=pw.txt alice/admin",
+          )
+
+          client.send_chars("sudo ktutil get -p alice/admin host/client.foo.bar\n")
+          client.wait_until_tty_matches("1", "password for alice:")
+          client.send_chars("${nodes.client.config.users.users.alice.password}\n")
+          client.wait_until_tty_matches("1", "alice/[e-mail]'s Password:")
+          client.send_chars(f"{alice_krb_admin_pw}\n")
+          client.wait_for_file("/etc/krb5.keytab")
+
+          ktutil_list = client.succeed("sudo ktutil list")
+          if not "host/client.foo.bar" in ktutil_list:
+            exit(1)
+
+          client.send_chars("clear\n")
+
+        with subtest("Client: kinit alice"):
+          client.succeed(
+            f"echo '{alice_krb_pw}' > pw.txt",
+            "kinit -p --password-file=pw.txt alice",
+          )
+          tickets = client.succeed("klist")
+          assert "Principal: [e-mail]" in tickets
+          client.send_chars("clear\n")
+
+        with subtest("Client: kpasswd alice"):
+          alice_old_krb_pw = alice_krb_pw
+          alice_krb_pw = random_password()
+          client.send_chars("kpasswd\n")
+          client.wait_until_tty_matches("1", "[e-mail]'s Password:")
+          client.send_chars(f"{alice_old_krb_pw}\n", 0.1)
+          client.wait_until_tty_matches("1", "New password:")
+          client.send_chars(f"{alice_krb_pw}\n", 0.1)
+          client.wait_until_tty_matches("1", "Verify password - New password:")
+          client.send_chars(f"{alice_krb_pw}\n", 0.1)
+
+          client.wait_until_tty_matches("1", "Success : Password changed")
+
+          client.send_chars("clear\n")
+
+        with subtest("Server: kinit alice"):
+          server.succeed(
+            "echo 'alice_pw_2' > pw.txt"
+            "kinit -p --password-file=pw.txt alice",
+          )
+          tickets = client.succeed("klist")
+          assert "Principal: [e-mail]" in tickets
+          server.send_chars("clear\n")
+
+        with subtest("Server: kpasswd alice"):
+          alice_old_krb_pw = alice_krb_pw
+          alice_krb_pw = random_password()
+          server.send_chars("kpasswd\n")
+          server.wait_until_tty_matches("1", "[e-mail]'s Password:")
+          server.send_chars(f"{alice_old_krb_pw}\n", 0.1)
+          server.wait_until_tty_matches("1", "New password:")
+          server.send_chars(f"{alice_krb_pw}\n", 0.1)
+          server.wait_until_tty_matches("1", "Verify password - New password:")
+          server.send_chars(f"{alice_krb_pw}\n", 0.1)
+
+          server.wait_until_tty_matches("1", "Success : Password changed")
+
+          server.send_chars("clear\n")
+      '';
+
+    meta.maintainers = pkgs.heimdal.meta.maintainers;
   }
 )

pkgs/applications/editors/vim/plugins/overrides.nix

···
     dependencies = [ self.nui-nvim ];
   };
 
-  YankRing-vim = super.YankRing-vim.overrideAttrs {
-    sourceRoot = ".";
-  };
-
   yanky-nvim = super.yanky-nvim.overrideAttrs {
     nvimSkipModule = [
       # Optional telescope integration

pkgs/applications/editors/vscode/extensions/default.nix

···
           name = "astro-vscode";
           publisher = "astro-build";
           version = "2.15.4";
-          hash = "sha256-gpDbEasdrpY9Djd6g9lUYXcMFZRBMn7P4wW0/iU+qz8=";
+          hash = "sha256-dyv7GTscj57Uc+HgImXETKW8olGcWpL+FyAHoS36rmk=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/astro-build.astro-vscode/changelog";

pkgs/applications/editors/vscode/vscodium.nix

···
 
   hash =
     {
-      x86_64-linux = "sha256-HzNK7/Y5PrFYNYtlfBqqq3ECRDbQVK83Xq7WnG1WYYI=";
-      x86_64-darwin = "sha256-w+nUsvlo/rsslw6Mn3npPaCwYW42YZ3Ku5QhXYhaHJ8=";
-      aarch64-linux = "sha256-0l1i76yPfn/kaj8vvsQ8Pzx77Bxqjm5ZCYMsB6gYrcU=";
-      aarch64-darwin = "sha256-yDXacWuhhMxfJn6KI51zThet6FUYY7pKfznpeZYg9fw=";
-      armv7l-linux = "sha256-F1ox+G1fMoLoAcBoydizWjkudg17j8JnQ63RzeWwi6o=";
+      x86_64-linux = "sha256-+RHzGJ5Y6j93ojnqg9hSe+Zs0sewcSSfWu8qlxJEoWQ=";
+      x86_64-darwin = "sha256-Yaxb7cB/JADJ4i2PScYb9ovTKiClwd7TdQXbzg9ViSs=";
+      aarch64-linux = "sha256-CK4geEBeLc1M5z4wuRS3rrqsL9nG1ra5+e3PGEOrYHA=";
+      aarch64-darwin = "sha256-S1XYikl1FzHvGBcudSD2xyuOH4gfsrYyEfwzL/csfSE=";
+      armv7l-linux = "sha256-aAgCL6clX/lXWdBmCSin/60krW5Sbn2KZZovmS16CfI=";
     }
     .${system} or throwSystem;
 
···
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.98.0.25067";
+  version = "1.98.1.25070";
   pname = "vscodium";
 
   executableName = "codium";

pkgs/applications/misc/trenchbroom/default.nix

···
     "-DCMAKE_PREFIX_PATH=cmake/packages"
   ];
 
-  ninjaFlags = [
-    "TrenchBroom"
-  ];
+  ninjaFlags = [ "TrenchBroom" ];
 
   postInstall = ''
-    pushd $out/share/TrenchBroom/icons
+    pushd ../app/resources/linux/icons
 
     for F in icon_*.png; do
       SIZE=$(echo $F|sed -e s/icon_// -e s/.png//)
       DIR=$out/share/icons/hicolor/$SIZE"x"$SIZE/apps
-      mkdir -p $DIR
-      ln -s ../../../../TrenchBroom/icons/$F $DIR/trenchbroom.png
+      install -Dm644 $F $DIR/trenchbroom.png
     done
 
     popd

pkgs/applications/networking/mailreaders/astroid/default.nix

···
       url = "https://github.com/astroidmail/astroid/commit/7c2022f06a4146ad62e858bcaacdb4ee817851b9.patch";
       hash = "sha256-hZHOg1wUR8Kpd6017fWzhMmG+/WQxSOCnsiyIvUcpbU=";
     })
+    (fetchpatch {
+      name = "boost_is_regular.patch";
+      url = "https://github.com/astroidmail/astroid/commit/abd84171dc6c4e639f3e86649ddc7ff211077244.patch";
+      hash = "sha256-IY60AnWm18ZwrCFsOvBg76UginpMo7gXBf8GT87FqW4=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/applications/networking/syncthing/default.nix

···
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.29.2";
+      version = "1.29.3";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         tag = "v${version}";
-        hash = "sha256-1IQdwnP4nUcDtSeqrnTF8OtlIZTnPlgP1NLnLJnOAbk=";
+        hash = "sha256-dTDrKLAUfZ+12JX6P6cWRs1ArWnDRmfhNAh0ZTTWpYU=";
       };
 
-      vendorHash = "sha256-eLUHYpAjq+viRwNiqC+42FKswdItBA0QriHn3JK1B5M=";
+      vendorHash = "sha256-/t+TIW66A6jKZvDtp/WcldqdkP5PtC6eP/R4Fspywxc=";
 
       nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
         # Recent versions of macOS seem to require binaries to be signed when

pkgs/applications/version-management/git-absorb/default.nix

···
 {
   lib,
   stdenv,
+  asciidoc,
   fetchFromGitHub,
+  gitMinimal,
   rustPlatform,
   installShellFiles,
+  which,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "git-absorb";
-  version = "0.6.17";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "tummychow";
     repo = "git-absorb";
     tag = version;
-    hash = "sha256-wtXqJfI/I0prPip3AbfFk0OvPja6oytPsl6hFtZ6b50=";
+    hash = "sha256-fn4xeXlYl8xB/wjpt7By9tATzb5t58jcuwfqw0tNH7M=";
   };
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    asciidoc
+    installShellFiles
+    which # used by Documentation/Makefile
+  ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-QQNGUlEamMPRS5sPi3VYbIU28KWxM4ibIEQnk/1sgNA=";
+  cargoHash = "sha256-PC040PtMK0OUS4zlLoHPcSzgEw5H3kndnVuyME/jEz4=";
+
+  nativeCheckInputs = [
+    gitMinimal
+  ];
 
   postInstall =
     ''
-      installManPage Documentation/git-absorb.1
+      cd Documentation/
+      make
+      installManPage git-absorb.1
+      cd -
     ''
     + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
       installShellCompletion --cmd git-absorb \

pkgs/applications/video/mpv/scripts.nix

···
       autodeint
       autoload
       ; # added 2024-11-28
+    inherit (self.eisa01)
+      smart-copy-paste-2
+      smartskip
+      ; # added 2025-03-09
     inherit (self.occivink)
       blacklistExtensions
       crop

pkgs/applications/video/mpv/scripts/eisa01.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  unstableGitUpdater,
+  buildLua,
+  xclip,
+}:
+
+let
+  mkScript =
+    pname: args:
+    let
+      self = {
+        inherit pname;
+        version = "0-unstable-2023-11-25";
+
+        src = fetchFromGitHub {
+          owner = "Eisa01";
+          repo = "mpv-scripts";
+          rev = "48d68283cea47ff8e904decc9003b3abc3e2123e";
+          hash = "sha256-edJfotlC5T8asqPIygR67BEWjP4i54Wx54StLfjpc48=";
+          # avoid downloading screenshots and videos
+          sparseCheckout = [
+            "scripts/"
+            "script-opts/"
+          ];
+        };
+        passthru.updateScript = unstableGitUpdater { };
+
+        meta = with lib; {
+          homepage = "https://github.com/Eisa01/mpv-scripts";
+          license = licenses.bsd2;
+        };
+
+        # Sadly needed to make `common-updaters` work here
+        pos = builtins.unsafeGetAttrPos "version" self;
+      };
+    in
+    buildLua (lib.attrsets.recursiveUpdate self args);
+in
+lib.recurseIntoAttrs (
+  lib.mapAttrs (name: lib.makeOverridable (mkScript name)) {
+
+    # Usage: `pkgs.mpv.override { scripts = [ pkgs.mpvScripts.seekTo ]; }`
+    smart-copy-paste-2 = {
+      scriptPath = "scripts/SmartCopyPaste_II.lua";
+      prePatch = ''
+        substituteInPlace $scriptPath --replace-fail 'xclip' "${lib.getExe xclip}"
+      '';
+
+      meta = {
+        description = "Smart copy paste with logging and clipboard support";
+        maintainers = with lib.maintainers; [ luftmensch-luftmensch ];
+      };
+    };
+
+    smartskip = {
+      scriptPath = "scripts/SmartSkip.lua";
+      meta = {
+        description = "Automatically or manually skip opening, intro, outro, and preview";
+        maintainers = with lib.maintainers; [ iynaix ];
+      };
+    };
+  }
+)

pkgs/applications/video/mpv/scripts/smart-copy-paste-2.nix

···
-{
-  lib,
-  buildLua,
-  fetchFromGitHub,
-  unstableGitUpdater,
-  xclip,
-}:
-buildLua (finalAttrs: {
-  pname = "smart-copy-paste-2";
-  version = "0-unstable-2023-11-25";
-
-  scriptPath = "scripts/SmartCopyPaste_II.lua";
-  src = fetchFromGitHub {
-    owner = "Eisa01";
-    repo = "mpv-scripts";
-    rev = "48d68283cea47ff8e904decc9003b3abc3e2123e";
-    hash = "sha256-95CAKjBRELX2f7oWSHFWJnI0mikAoxhfUphe9k51Qf4=";
-  };
-
-  prePatch = ''
-    substituteInPlace scripts/SmartCopyPaste_II.lua \
-      --replace-fail 'xclip' "${lib.getExe xclip}"
-  '';
-
-  passthru.updateScript = unstableGitUpdater { };
-
-  meta = with lib; {
-    description = "Smart copy paste with logging and clipboard support";
-    homepage = "https://github.com/Eisa01/mpv-scripts";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ luftmensch-luftmensch ];
-  };
-})

pkgs/applications/video/mpv/scripts/smartskip.nix

···
-{
-  lib,
-  fetchFromGitHub,
-  unstableGitUpdater,
-  buildLua,
-}:
-
-buildLua {
-  pname = "smartskip";
-  version = "0-unstable-2023-11-25";
-
-  scriptPath = "scripts/SmartSkip.lua";
-  src = fetchFromGitHub {
-    owner = "Eisa01";
-    repo = "mpv-scripts";
-    rev = "48d68283cea47ff8e904decc9003b3abc3e2123e";
-    hash = "sha256-95CAKjBRELX2f7oWSHFWJnI0mikAoxhfUphe9k51Qf4=";
-  };
-
-  passthru.updateScript = unstableGitUpdater { };
-
-  meta = {
-    description = "Automatically or manually skip opening, intro, outro, and preview";
-    homepage = "https://github.com/Eisa01/mpv-scripts";
-    license = lib.licenses.bsd2;
-    maintainers = [ lib.maintainers.iynaix ];
-  };
-}

pkgs/build-support/node/fetch-yarn-deps/default.nix

···
   makeSetupHook,
   cacert,
   callPackage,
-  nix,
+  nixForLinking,
 }:
 
 let
···
           lib.makeBinPath [
             coreutils
             nix-prefetch-git
-            nix
+            nixForLinking
           ]
         }
 

pkgs/by-name/at/attic-client/package.nix

···
   lib,
   rustPlatform,
   fetchFromGitHub,
-  nix,
+  nixForLinking,
   nixosTests,
   boost,
   pkg-config,
···
 
   buildInputs =
     [
-      nix
+      nixForLinking
       boost
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin (
···
   useFetchCargoVendor = true;
 
   ATTIC_DISTRIBUTOR = "nixpkgs";
-  NIX_INCLUDE_PATH = "${lib.getDev nix}/include";
+  NIX_INCLUDE_PATH = "${lib.getDev nixForLinking}/include";
 
   # Attic interacts with Nix directly and its tests require trusted-user access
   # to nix-daemon to import NARs, which is not possible in the build sandbox.

pkgs/by-name/bo/bosh-cli/package.nix

···
 buildGoModule rec {
   pname = "bosh-cli";
 
-  version = "7.9.3";
+  version = "7.9.4";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ESM0DpCW97ulo5U/RCEaiKz1C5FeXflB7f/OlJaRwIQ=";
+    sha256 = "sha256-GTxl0lsM1BMWTUAQfNYkJupDUCnXWavTnRZrkaCRpPc=";
   };
   vendorHash = null;
 

pkgs/by-name/ca/cargo-deny/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deny";
-  version = "0.17.0";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-deny";
     rev = version;
-    hash = "sha256-SEcs6iYVreZXbZl29CY6orjaN440T4oIh95H93RUUxo=";
+    hash = "sha256-u93x0w6gSPxDCrp9bNJDCxLBZfh8EhXU4qvhklI4GKY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-egVM6ESB2CzAe4tw+4LRw1A+a/j7CSI1bUIr1EpurIM=";
+  cargoHash = "sha256-3fCACetvO9KRjoTh3V41+vhWFjwaNtoHZ/Zh+Zxmxlc=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/de/deno/librusty_v8.nix

···
 { fetchLibrustyV8 }:
 
 fetchLibrustyV8 {
-  version = "134.4.0";
+  version = "134.5.0";
   shas = {
-    x86_64-linux = "sha256-yG9p8b0dQTtoa234eTRBumjQ5GWxWJFsKHbgNFCUUAA=";
-    aarch64-linux = "sha256-5IrviupPjTUHTeuwmeA3FHuOy2H8qc05WNqRmlE0UJk=";
-    x86_64-darwin = "sha256-RPEW5a51WjfYyPjvkKvFbs+fPTlsv9/2sFtqUdtz7EY=";
-    aarch64-darwin = "sha256-PFyJTOYHWw3YOoG85w+y0899vc0+psz0TtCMXORcsHI=";
+    x86_64-linux = "sha256-Mo7PJoU/GuEIPCIDeLshfwNoYpkpD5NilOljFRgjLgw=";
+    aarch64-linux = "sha256-h51n1SosveRhKlq47pnOMUMi5Avg23GLdMW24mj//PU=";
+    x86_64-darwin = "sha256-76AP6aLuPmf6wC3yrfI/dkomOAjqVJjJPkUQxjAgDhI=";
+    aarch64-darwin = "sha256-IpiLBL51Q06t402bwE8bFQew5dPuHBNvkFC8gsWXvsY=";
   };
 }

pkgs/by-name/de/deno/package.nix

···
 in
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${version}";
-    hash = "sha256-ogvrDDwiMmsTRRpXwlH5VWhtnrSkRZErfjj2lhirALQ=";
+    hash = "sha256-eYzDCQVjilm6Olc9Ko+EYlSCNN7UVl/YXuK55xeoOOg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-eaB6e6DGWbQKVR+huHBUbXGjzrY/4xGYdu8tXp+6jBM=";
+  cargoHash = "sha256-Hmxz4bryk6wMbccaXcKg8XuD9H9BF+nuvMkiCNeYMXY=";
 
   postPatch = ''
     # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857
-    substituteInPlace ext/ffi/Cargo.toml --replace-fail "libffi = \"=3.2.0\"" "libffi = { version = \"3.2.0\", features = [\"system\"] }"
+    substituteInPlace Cargo.toml --replace-fail "libffi = \"=3.2.0\"" "libffi = { version = \"3.2.0\", features = [\"system\"] }"
   '';
 
   # uses zlib-ng but can't dynamically link yet

pkgs/by-name/dn/dnf5/package.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   appstream,
   cmake,
   createrepo_c,
···
   libyaml,
   pcre2,
   rpm,
-  sdbus-cpp,
+  sdbus-cpp_2,
   sphinx,
   sqlite,
   systemd,
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnf5";
-  version = "5.2.10.0";
+  version = "5.2.11.0";
 
   outputs = [
     "out"
···
   src = fetchFromGitHub {
     owner = "rpm-software-management";
     repo = "dnf5";
-    rev = finalAttrs.version;
-    hash = "sha256-FDC9va2UKnmAHMQeoH7Rwvu/IN+vZCspvupYvo81nkY=";
+    tag = finalAttrs.version;
+    hash = "sha256-89zJ2ORHPqy6qgmMdOSyPEcgxtEYE4CPnmRp7FfNj8Y=";
   };
 
+  patches = [
+    # Only define systemd constants when WITH_SYSTEMD is enabled
+    (fetchpatch {
+      name = "0001-offline-only-define-systemd-constants.patch";
+      url = "https://github.com/rpm-software-management/dnf5/commit/f75894eea0892917d80e8f0bf3f9f6c8db0ac400.patch";
+      hash = "sha256-4eBeBTzhOTUDtiOlfiddh7gJ8AoiMty4FSTlLtdymos=";
+    })
+  ];
+
   nativeBuildInputs =
     [
       cmake
···
     libyaml
     pcre2.dev
     rpm
-    sdbus-cpp
+    sdbus-cpp_2
     sqlite
     systemd
     toml11

pkgs/by-name/ex/excalifont/package.nix

···
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  woff2,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "excalifont";
+  version = "0.18.0";
+
+  src = fetchFromGitHub {
+    owner = "excalidraw";
+    repo = "excalidraw";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Nfzh5rNvHP7R418PP44FXD7xNenzmzMHu7RLAdJsE/c=";
+  };
+
+  nativeBuildInputs = [
+    woff2
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    for file in packages/excalidraw/fonts/Excalifont/*.woff2; do
+      woff2_decompress $file
+    done
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m 444 packages/excalidraw/fonts/Excalifont/*.ttf -t $out/share/fonts/ttf
+    install -D -m 444 packages/excalidraw/fonts/Excalifont/*.woff2 -t $out/share/fonts/woff2
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://plus.excalidraw.com/excalifont";
+    description = "Excalifont is based on the original handwritten Virgil font carefully curated to improve legibility while preserving its hand-drawn nature";
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ drupol ];
+    license = lib.licenses.ofl;
+  };
+})

pkgs/by-name/fg/fg-virgil/package.nix

···
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  woff2,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fg-virgil";
-  version = "0.17.3";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "excalidraw";
     repo = "excalidraw";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-j8fT17RkgMQAAS4KsC2+uItT8Z300SZWnLkyo4XI1WY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Nfzh5rNvHP7R418PP44FXD7xNenzmzMHu7RLAdJsE/c=";
   };
 
+  nativeBuildInputs = [
+    woff2
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    for file in packages/excalidraw/fonts/Virgil/*.woff2; do
+      woff2_decompress $file
+    done
+
+    runHook postBuild
+  '';
+
   installPhase = ''
     runHook preInstall
 
-    install -D -m 444 public/Virgil.woff2 -t $out/share/fonts/woff2
-    install -D -m 444 public/FG_Virgil.woff2 -t $out/share/fonts/woff2
-    install -D -m 444 public/FG_Virgil.ttf -t $out/share/fonts/ttf
+    install -D -m 444 packages/excalidraw/fonts/Virgil/*.ttf -t $out/share/fonts/ttf
+    install -D -m 444 packages/excalidraw/fonts/Virgil/*.woff2 -t $out/share/fonts/woff2
 
     runHook postInstall
   '';

pkgs/by-name/gr/grenedalf/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  autoconf,
+  pkg-config,
+  libz,
+  bzip2,
+  xz,
+  libdeflate,
+  htslib,
+  fetchurl,
+}:
+
+let
+  # Grenedalf is binded to htslib 1.16 and does not link with libcurl
+  htslib_gr = htslib.overrideDerivation (oldAttrs: rec {
+    version = "1.16";
+    name = "${oldAttrs.pname}-nocurl-${version}";
+    src = fetchurl {
+      url = "https://github.com/samtools/htslib/releases/download/${version}/htslib-${version}.tar.bz2";
+      sha256 = "sha256-YGt8ev9zc0zwM+zRVvQFKfpXkvVFJJUqKJOMoIkNeSQ=";
+    };
+    configureFlags = [
+      "--disable-libcurl"
+      "--disable-plugins"
+    ];
+  });
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "grenedalf";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "lczech";
+    repo = "grenedalf";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-DJ7nZjOvYFQlN/L+S2QcMVvH/M9Dhla4VXl2nxc22m4=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    autoconf
+  ];
+
+  buildInputs = [
+    libz
+    bzip2
+    xz
+    libdeflate
+    htslib_gr
+  ];
+
+  cmakeFlags = [
+    "-DHTSLIB_DIR=${htslib_gr}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp ../bin/grenedalf $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/lczech/grenedalf";
+    description = "Collection of commands for working with population genetic data";
+    longDescription = ''
+      grenedalf is a collection of commands for working with population genetic
+      data, in particular from pool sequencing. Its main focus are statistical
+      analyses such as Tajima's D and Fst. The statistics follow the approaches
+      of PoPoolation and PoPoolation2, as well as poolfstat and npstat. However,
+      compared to those, grenedalf is significantly more scalable, more user
+      friendly, and offers more settings and input file formats.
+    '';
+    platforms = platforms.all;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ bzizou ];
+  };
+})

pkgs/by-name/gu/gum/package.nix

···
 
 buildGoModule rec {
   pname = "gum";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kQDCgQXI9jTUHM8UEfDSLXMoUUMOt0Iccv3P3RtPOIg=";
+    hash = "sha256-77102I7pOGfpPBSGelsA/9GJYos05akF0kdmr522RC0=";
   };
 
-  vendorHash = "sha256-WxM1gCIsxRWNq9IdBux4BJi6r87wY2/6vtMjEDSQnv0=";
+  vendorHash = "sha256-wrl4Zo5NSaTTMrc95Fs9cevG7ITJtHuV3pGkFd8jpxU=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ko/komac/package.nix

···
   bzip2,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
-  version = "2.10.1";
+  pname = "komac";
+  version = "2.11.0";
+
   src = fetchFromGitHub {
     owner = "russellbanks";
     repo = "Komac";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oqnFenSFWCe3vax5mqstvNNTFWOecLOkuhJzaxv78yE=";
+    hash = "sha256-iohqtbzebX/1hkAwEe6UT6cw0BOQF5Ec5MS5ycrHoNU=";
   };
-
-  pname = "komac";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-g7R4Vk6bFaJ5TA4IdeXRiFzZOcj1T4JY3HsOt+Zx2mU=";
+  cargoHash = "sha256-LvYweWuMytBcke1lKNmIPeFFfjEqzR07vO2MQQ37ASY=";
 
   nativeBuildInputs =
     [

pkgs/by-name/li/libjaylink/package.nix

···
 {
-  autoreconfHook,
   fetchFromGitLab,
   lib,
   libusb1,
+  meson,
+  ninja,
   nix-update-script,
   pkg-config,
   stdenv,
···
   };
 
   nativeBuildInputs = [
-    autoreconfHook
+    meson
+    ninja
     pkg-config
   ];
+
   buildInputs = [ libusb1 ];
 
   postPatch = ''
-    patchShebangs autogen.sh
+    substituteInPlace contrib/60-libjaylink.rules \
+      --replace-fail 'GROUP="plugdev"' 'GROUP="jlink"'
   '';
 
   postInstall = ''
-    install -Dm644 contrib/60-libjaylink.rules $out/lib/udev/rules.d/60-libjaylink.rules
+    install -Dm644 ../contrib/60-libjaylink.rules $out/lib/udev/rules.d/60-libjaylink.rules
   '';
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/lo/localproxy/package.nix

···
       url = "https://github.com/aws-samples/aws-iot-securetunneling-localproxy/commit/de8779630d14e4f4969c9b171d826acfa847822b.patch";
       hash = "sha256-11k6mRvCx72+5G/5LZZx2qnx10yfKpcAZofn8t8BD3E=";
     })
+    (fetchpatch {
+      name = "boost187.patch";
+      url = "https://github.com/aws-samples/aws-iot-securetunneling-localproxy/commit/12022770e89c6787c3eda4ca01a7cedaf2affa92.patch";
+      hash = "sha256-THY+dRkKhpbpK+wLskRjWvqr6uFuT0JMt/VHvgzKTzw=";
+      excludes = [ ".github/workflows/ci.yml" ];
+    })
   ];
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/me/mediathekview/package.nix

···
 }:
 
 stdenv.mkDerivation rec {
-  version = "14.1.0";
+  version = "14.2.0";
   pname = "mediathekview";
   src = fetchurl {
     url = "https://download.mediathekview.de/stabil/MediathekView-${version}-linux.tar.gz";
-    sha256 = "sha256-2dC7y4SbGsjU6UBHbfye1MUNiLvIQjqTcqPX0I11qIk=";
+    sha256 = "sha256-EWpa6YE9Fk7K14vvsbjadKuGGZGqNhlouDtwj6KpbdE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ne/neomutt/package.nix

···
   enableLua ? false,
   enableSmimeKeys ? true,
   withContrib ? true,
+  withNotmuch ? true,
 }:
 
 assert lib.warnIf (
···
       libkrb5
       libidn2
       ncurses
-      notmuch
       openssl
       perl
       lmdb
···
       sqlite
     ]
     ++ lib.optional enableZstd zstd
-    ++ lib.optional enableLua lua;
+    ++ lib.optional enableLua lua
+    ++ lib.optional withNotmuch notmuch;
 
   nativeBuildInputs = [
     docbook_xsl
···
       "--gpgme"
       "--gss"
       "--lmdb"
-      "--notmuch"
       "--ssl"
       "--sasl"
       "--with-homespool=mailbox"
···
       "--zlib"
     ]
     ++ lib.optional enableZstd "--zstd"
-    ++ lib.optional enableLua "--lua";
+    ++ lib.optional enableLua "--lua"
+    ++ lib.optional withNotmuch "--notmuch";
 
   postInstall =
     ''

pkgs/by-name/ni/nix-search-tv/package.nix

···
 
 buildGoModule rec {
   pname = "nix-search-tv";
-  version = "2.1.0";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "3timeslazy";
     repo = "nix-search-tv";
     tag = "v${version}";
-    hash = "sha256-bQrn7tX1Pe1glH84OSO96Ud0bG/aq+HxdzQwyNFB3R4=";
+    hash = "sha256-ZUc9aphl2+KRGwH7cn3dtcTcC3RxrR6qZC4RqwVddFw=";
   };
 
   vendorHash = "sha256-hgZWppiy+P3BfoKOMClzCot1shKcGTZnsMCJ/ItxckE=";

pkgs/by-name/nu/nurl/package.nix

···
   darwin,
   gitMinimal,
   mercurial,
-  nix,
+  nixForLinking,
 }:
 
 rustPlatform.buildRustPackage rec {
···
         lib.makeBinPath [
           gitMinimal
           mercurial
-          nix
+          nixForLinking
         ]
       }
     installManPage artifacts/nurl.1

pkgs/by-name/re/recon-ng/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+  substituteAll,
+  fetchpatch,
+}:
+python3.pkgs.buildPythonApplication rec {
+  pname = "recon-ng";
+  version = "5.1.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "lanmaster53";
+    repo = "recon-ng";
+    tag = "v${version}";
+    hash = "sha256-W7pL4Rl86i881V53SAwECAMp2Qj/azPM3mdvxvt+gjc=";
+  };
+
+  build-system = [
+    python3.pkgs.setuptools
+  ];
+
+  dependencies = with python3.pkgs; [
+    pyyaml
+    dnspython
+    lxml
+    mechanize
+    requests
+    flask
+    flask-restful
+    flasgger
+    dicttoxml
+    xlsxwriter
+    unicodecsv
+    rq
+  ];
+
+  patches = [
+    # Support python 3.12
+    # https://github.com/lanmaster53/recon-ng/pull/218
+    # This is merged and can be removed when updating
+    (fetchpatch {
+      name = "fix_python12.patch";
+      url = "https://github.com/lanmaster53/recon-ng/commit/e31c30e5c314cbc5e57a13f9d3ddf29afafc4cb3.patch";
+      hash = "sha256-e8BTRkwb42mTTwivZ0sTxVw1hnYCUVInmy91jyVc/tw=";
+    })
+  ];
+
+  postPatch =
+    let
+      setup = substituteAll {
+        src = ./setup.py;
+        inherit pname version;
+      };
+    in
+    ''
+      ln -s ${setup} setup.py
+    '';
+
+  postInstall = ''
+    cp VERSION $out/${python3.sitePackages}/
+    cp -R recon/core/web/{definitions.yaml,static,templates} $out/${python3.sitePackages}/recon/core/web/
+  '';
+
+  meta = {
+    description = "Full-featured framework providing a powerful environment to conduct web-based reconnaissance";
+    license = lib.licenses.gpl3Only;
+    homepage = "https://github.com/lanmaster53/recon-ng/";
+    maintainers = with lib.maintainers; [ gamedungeon ];
+  };
+}

pkgs/by-name/re/recon-ng/setup.py

···
+from setuptools import setup
+
+setup(
+    name='@pname@',
+    version='@version@',
+    install_requires=[
+        "pyyaml",
+        "dnspython",
+        "lxml",
+        "mechanize",
+        "requests",
+        "flask",
+        "flask-restful",
+        "flasgger",
+        "dicttoxml",
+        "xlsxwriter",
+        "unicodecsv",
+        "rq"
+    ],
+    scripts=[
+        'recon-ng',
+        "recon-cli",
+        "recon-web"
+    ],
+)

pkgs/by-name/rp/rpiboot/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "rpiboot";
-  version = "20250129-123632";
+  version = "20250227-132106";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "usbboot";
     rev = version;
-    hash = "sha256-m11SX31GLmb/LGiO7X8P7eL88zvLfoJ/anAVEpg8WL4=";
+    hash = "sha256-WccnaIUF5M080M4vg5NzBCLpLVcE7ts/oJJE8CLRi8A=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/wg/wgpu-native/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "wgpu-native";
-  version = "24.0.0.1";
+  version = "24.0.0.2";
 
   src = fetchFromGitHub {
     owner = "gfx-rs";
     repo = "wgpu-native";
     tag = "v${version}";
-    hash = "sha256-hCGLOMsX83VxgNIhkBouN551XgH9Vd/ndaIZP0SY+kc=";
+    hash = "sha256-3Z9LBmFBVZD8e65OwBuzg1S/q/5Qq9Zu0tjiWPm2inc=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/wi/windsurf/info.json

···
 {
   "aarch64-darwin": {
-    "version": "1.4.3",
+    "version": "1.4.6",
     "vscodeVersion": "1.94.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/d4fc55fbd0d7b321c4f3b5fb4f56e01c0775d394/Windsurf-darwin-arm64-1.4.3.zip",
-    "sha256": "06b7ec93c16669e702e3db5da48236dd6fe736637849dc9146559b5b8280a5cb"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/724a915b3b4c73cea3d2c93fc85672d6aa3961e0/Windsurf-darwin-arm64-1.4.6.zip",
+    "sha256": "156d4d4d54033e15fb0edd0c8f17a30ae26c622692cfcb915fd548a1596ec103"
   },
   "x86_64-darwin": {
-    "version": "1.4.3",
+    "version": "1.4.6",
     "vscodeVersion": "1.94.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/d4fc55fbd0d7b321c4f3b5fb4f56e01c0775d394/Windsurf-darwin-x64-1.4.3.zip",
-    "sha256": "01eb6a7b117b5aab3f9b5aeaad23e1b50d8daeb0faaccac391f3a160a7874287"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/724a915b3b4c73cea3d2c93fc85672d6aa3961e0/Windsurf-darwin-x64-1.4.6.zip",
+    "sha256": "f41e4ab9d79062357765064993fdf993a05358aae675fdf511996fa3fdf01e55"
   },
   "x86_64-linux": {
-    "version": "1.4.3",
+    "version": "1.4.6",
     "vscodeVersion": "1.94.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/d4fc55fbd0d7b321c4f3b5fb4f56e01c0775d394/Windsurf-linux-x64-1.4.3.tar.gz",
-    "sha256": "4a9b9c6cf723db24e830e15cae3c37be4799d0934f92d85d17c8f8ec3430d02e"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/724a915b3b4c73cea3d2c93fc85672d6aa3961e0/Windsurf-linux-x64-1.4.6.tar.gz",
+    "sha256": "116e1fcefe98321764f4d6a5e36a8e16282b20d994c385fd3e3826dd9945e8f4"
   }
 }

pkgs/by-name/xb/xbps/package.nix

···
       --replace 'define _BSD_SOURCE' 'define _DEFAULT_SOURCE' \
       --replace '# define _BSD_SOURCE' '#define _DEFAULT_SOURCE'
 
+    # fix calloc argument cause a build failure
+    substituteInPlace bin/xbps-fbulk/main.c \
+      --replace-fail 'calloc(sizeof(*depn), 1)' 'calloc(1UL, sizeof(*depn))'
+
     # fix unprefixed ranlib (needed on cross)
     substituteInPlace lib/Makefile \
       --replace 'SILENT}ranlib ' 'SILENT}$(RANLIB) '

pkgs/by-name/xk/xk6/package.nix

···
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  installShellFiles,
+}:
+
+buildGoModule rec {
+  pname = "xk6";
+  version = "0.14.3";
+
+  src = fetchFromGitHub {
+    owner = "grafana";
+    repo = "xk6";
+    tag = "v${version}";
+    hash = "sha256-pxiZelbAEEtibNdpEuRplPFtJ61YicoiAnAs8oaX6IA=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [ "cmd/xk6" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Build k6 with extensions";
+    mainProgram = "xk6";
+    homepage = "https://k6.io/";
+    changelog = "https://github.com/grafana/xk6/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ szkiba ];
+  };
+}

pkgs/by-name/zi/zitadel/console.nix

···
 let
   protobufGenerated = generateProtobufCode {
     pname = "zitadel-console";
+    inherit version;
     nativeBuildInputs = [
       grpc-gateway
       protoc-gen-grpc-web
···
     workDir = "console";
     bufArgs = "../proto --include-imports --include-wkt";
     outputPath = "src/app/proto";
-    hash = "sha256-n6BJ1gSSm66yOGdHcSea/nQbjiHZX2YX2zbFT4o75/4=";
+    hash = "sha256-3WvfbhLpp03yP7Nb8bmZXYSlGJuEnBkBuyEzNVkIYZg=";
   };
 in
 stdenv.mkDerivation {
···
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${zitadelRepo}/console/yarn.lock";
-    hash = "sha256-MWATjfhIbo3cqpzOdXP52f/0Td60n99OTU1Qk6oWmXU=";
+    hash = "sha256-+7CFBEKfRsqXbJR+BkLdB+pZ/dEEk4POGwZOVQ1LAUo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/zi/zitadel/package.nix

···
 }:
 
 let
-  version = "2.58.3";
+  version = "2.71.1";
   zitadelRepo = fetchFromGitHub {
     owner = "zitadel";
     repo = "zitadel";
     rev = "v${version}";
-    hash = "sha256-RXcJwGO8OQ38lbuy2uLTSkh6yUbyqY42FpwgMXC3g6c=";
+    hash = "sha256-izYsf2Cc0jG8Wf82K6HsTVP+kAhmoEJVU7OJXhSzXLo=";
   };
-  goModulesHash = "sha256-gp17dP67HX7Tx3Gq+kEu9xCYkfs/rGpqLFiKT7cKlrc=";
+  goModulesHash = "sha256-mE0vhW1nW16SzqIu0C3q8qCXabJO7fZgkp7GeLWCwog=";
 
   buildZitadelProtocGen =
     name:
···
   generateProtobufCode =
     {
       pname,
+      version,
       nativeBuildInputs ? [ ],
       bufArgs ? "",
       workDir ? ".",
···
       hash,
     }:
     stdenv.mkDerivation {
-      name = "${pname}-buf-generated";
+      pname = "${pname}-buf-generated";
+      inherit version;
 
       src = zitadelRepo;
       patches = [ ./console-use-local-protobuf-plugins.patch ];
···
 
   protobufGenerated = generateProtobufCode {
     pname = "zitadel";
+    inherit version;
     nativeBuildInputs = [
       grpc-gateway
       protoc-gen-authoption
···
       protoc-gen-zitadel
     ];
     outputPath = ".artifacts";
-    hash = "sha256-KRf11PNn7LtVFjG3NYUtPEJtLNbnxfzR4B69US07B3k=";
+    hash = "sha256-11ByEuamYpCUeuqNr8ZVNCo4r3aSfuPXXhIu6mUqlzU=";
   };
 in
 buildGoModule rec {

pkgs/development/libraries/kerberos/heimdal.nix

···
     description = "Implementation of Kerberos 5 (and some more stuff)";
     license = licenses.bsd3;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ h7x4 ];
+    maintainers = with maintainers; [
+      h7x4
+      dblsaiko
+    ];
   };
 }

pkgs/development/php-packages/phalcon/default.nix

···
 
 buildPecl rec {
   pname = "phalcon";
-  version = "5.8.0";
+  version = "5.9.0";
 
   src = fetchFromGitHub {
     owner = "phalcon";
     repo = "cphalcon";
     rev = "v${version}";
-    hash = "sha256-Jgl/sBWgP4N4rYloaGn78T6XWF/yTYYCsSC9Q6gD6Wg=";
+    hash = "sha256-S+y0HIAFAVpWfeH2yvbYzbCd1iSyae3x1syuLQL3Ago=";
   };
 
   internalDeps = [

pkgs/development/php-packages/tideways/default.nix

···
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-php";
   extensionName = "tideways";
-  version = "5.18.2";
+  version = "5.19.0";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
···
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-x86_64.tar.gz";
-        hash = "sha256-JThRW4ghBy2NXe2hNP2Q1VHbocrYmZi7wMTdWYX8QTo=";
+        hash = "sha256-AaTrbrdi/XLeKlG+//DTjRGQEheLTtfHwx7Ztn+/Nuk=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-arm64.tar.gz";
-        hash = "sha256-hz5lzjsfFT61fBFyMlV9ZB99S4jYokzN0lLtxm3G9gc=";
+        hash = "sha256-BSXKLxh2ex7rU4vsxHWqQIca+yFQlZDbB0TyNcpYmKs=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-macos-arm.tar.gz";
-        hash = "sha256-BmmoHQE0gL1dDhS+WpmAIkEuIOb/EPLT4RMMLkkeMvw=";
+        hash = "sha256-a63cr/547MxyB7irVlONUpdep3M42YA2C6H9sGbEAI8=";
       };
     };
 

pkgs/development/php-packages/xdebug/default.nix

···
 }:
 
 let
-  version = "3.4.1";
+  version = "3.4.2";
 in
 buildPecl {
   inherit version;
···
     owner = "xdebug";
     repo = "xdebug";
     rev = version;
-    hash = "sha256-yOqVS58bsFXGhdkQ20LK0E80bV7O2r/BE76CfBoeEqA=";
+    hash = "sha256-LTM2c9DC837y0t4S3m9292x37q4tXg1Poh2dm0KAyJc=";
   };
 
   doCheck = true;

pkgs/development/python-modules/authlib/default.nix

···
 
 buildPythonPackage rec {
   pname = "authlib";
-  version = "1.4.1";
+  version = "1.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "lepture";
     repo = "authlib";
     tag = "v${version}";
-    hash = "sha256-1Iygc35+Vc1zyn8rjubnSLmpvjckY4TRKOtf2bkrkdI=";
+    hash = "sha256-RrsQTrOV2v3SzdM7kqdFe1Uj7A+o/Yseq1j7CCG8qtg=";
   };
 
   build-system = [ setuptools ];
···
   meta = with lib; {
     description = "Library for building OAuth and OpenID Connect servers";
     homepage = "https://github.com/lepture/authlib";
-    changelog = "https://github.com/lepture/authlib/blob/v${version}/docs/changelog.rst";
+    changelog = "https://github.com/lepture/authlib/blob/${src.tag}/docs/changelog.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ flokli ];
   };

pkgs/development/python-modules/marimo/default.nix

···
 
 buildPythonPackage rec {
   pname = "marimo";
-  version = "0.11.13";
+  version = "0.11.17";
   pyproject = true;
 
   # The github archive does not include the static assets
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5c74WT2/5XcIi77GWQkM9Mvsp3hSYeuMYlx0NgyCFHc=";
+    hash = "sha256-jKDNbBhDnQyzaPe1JLXpNZaIhQmt0/1LIurT5WAKiNc=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/pwntools/default.nix

···
   doCheck = false; # no setuptools tests for the package
 
   postInstall = ''
-    installShellCompletion --bash extra/bash_completion.d/shellcraft
+    installShellCompletion --cmd pwn \
+      --bash extra/bash_completion.d/pwn \
+      --zsh extra/zsh_completion/_pwn
   '';
 
   postFixup = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''

pkgs/development/python2-modules/hypothesis/default.nix

···
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  isPy3k,
   attrs,
   coverage,
-  enum34,
   pexpect,
   doCheck ? true,
   pytest,
···
     attrs
     coverage
     sortedcontainers
-  ] ++ lib.optional (!isPy3k) enum34;
+  ];
 
   nativeCheckInputs = [
     pytest

pkgs/development/tools/language-servers/nixd/default.nix

···
   llvmPackages,
   meson,
   ninja,
-  nix,
+  nixForLinking,
   nix-update-script,
   nixd,
   nixf,
···
       ];
 
       buildInputs = [
-        nix
+        nixForLinking
         gtest
         boost
       ];
 
-      env.CXXFLAGS = "-include ${nix.dev}/include/nix/config.h";
+      env.CXXFLAGS = "-include ${nixForLinking.dev}/include/nix/config.h";
 
       passthru.tests.pkg-config = testers.hasPkgConfigModules {
         package = nixt;
···
       sourceRoot = "${common.src.name}/nixd";
 
       buildInputs = [
-        nix
+        nixForLinking
         nixf
         nixt
         llvmPackages.llvm
···
 
       nativeBuildInputs = common.nativeBuildInputs ++ [ cmake ];
 
-      env.CXXFLAGS = "-include ${nix.dev}/include/nix/config.h";
+      env.CXXFLAGS = "-include ${nixForLinking.dev}/include/nix/config.h";
 
       # See https://github.com/nix-community/nixd/issues/519
       doCheck = false;

pkgs/kde/lib/mk-kde-derivation.nix

···
   lib,
   stdenv,
   makeSetupHook,
-  fetchurl,
   cmake,
+  ninja,
   qt6,
 }:
 let
···
 
     nativeBuildInputs = [
       cmake
+      ninja
       qt6.wrapQtAppsHook
       moveDevHook
     ] ++ extraNativeBuildInputs;

pkgs/servers/x11/xorg/overrides.nix

···
     meta = attrs.meta // { mainProgram = "xinit"; };
   });
 
-  xf86videointel = throw ''
-    xf86videointel has been removed as the package is unmaintained and the driver is no longer functional.
-    Please remove "intel" from `services.xserver.videoDrivers` and switch to the "modesetting" driver.
-  ''; # Added 2024-12-16;
+  xf86videointel = super.xf86videointel.overrideAttrs (attrs: {
+    # the update script only works with released tarballs :-/
+    name = "xf86-video-intel-2024-05-06";
+    src = fetchFromGitLab {
+      domain = "gitlab.freedesktop.org";
+      group = "xorg";
+      owner = "driver";
+      repo = "xf86-video-intel";
+      rev = "ce811e78882d9f31636351dfe65351f4ded52c74";
+      sha256 = "sha256-PKCxFHMwxgbew0gkxNBKiezWuqlFG6bWLkmtUNyoF8Q=";
+    };
+    buildInputs = attrs.buildInputs ++ [ xorg.libXScrnSaver xorg.libXv xorg.pixman ];
+    nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook xorg.utilmacros xorg.xorgserver ];
+    configureFlags = [ "--with-default-dri=3" "--enable-tools" ];
+    patches = [ ./use_crocus_and_iris.patch ];
+
+    meta = attrs.meta // {
+      platforms = ["i686-linux" "x86_64-linux"];
+    };
+  });
 
   xf86videoopenchrome = super.xf86videoopenchrome.overrideAttrs (attrs: {
     buildInputs = attrs.buildInputs ++ [ xorg.libXv ];

pkgs/servers/x11/xorg/use_crocus_and_iris.patch

···
+--- a/src/uxa/intel_dri.c
++++ b/src/uxa/intel_dri.c
+@@ -1540,8 +1540,10 @@
+ 			return has_i830_dri() ? "i830" : "i915";
+ 		else if (INTEL_INFO(intel)->gen < 040)
+ 			return "i915";
++		else if (INTEL_INFO(intel)->gen < 0100)
++			return "crocus";
+ 		else
+-			return "i965";
++			return "iris";
+ 	}
+
+ 	return s;
+--- a/src/sna/sna_dri2.c
++++ b/src/sna/sna_dri2.c
+@@ -3707,8 +3707,10 @@
+ 			return has_i830_dri() ? "i830" : "i915";
+ 		else if (sna->kgem.gen < 040)
+ 			return "i915";
++		else if (sna->kgem.gen < 0100)
++			return "crocus";
+ 		else
+-			return "i965";
++			return "iris";
+ 	}
+
+ 	return s;

pkgs/tools/misc/ncdu/default.nix

···
   fetchurl,
   ncurses,
   pkg-config,
-  zig_0_13,
+  zig_0_14,
   zstd,
   installShellFiles,
   testers,
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ncdu";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/ncdu-${finalAttrs.version}.tar.gz";
-    hash = "sha256-shjMFKK7mFLPlR204hrsiYDnqMOsoJfjqjQX8g65MAA=";
+    hash = "sha256-qmFXb37J/fUyyxeBQu9bMqrUJWdwWZLPPg0cb+fjjkA=";
   };
 
   nativeBuildInputs = [
-    zig_0_13.hook
+    zig_0_14.hook
     installShellFiles
     pkg-config
   ];
···
       pSub
       rodrgz
     ];
-    inherit (zig_0_13.meta) platforms;
+    inherit (zig_0_14.meta) platforms;
     mainProgram = "ncdu";
   };
 })

pkgs/tools/package-management/nix-du/default.nix

···
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  nix,
+  nixForLinking,
   nlohmann_json,
   boost,
   graphviz,
···
 
   doCheck = true;
   nativeCheckInputs = [
-    nix
+    nixForLinking
     graphviz
   ];
 
   buildInputs = [
     boost
-    nix
+    nixForLinking
     nlohmann_json
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
 

pkgs/tools/package-management/nix-prefetch-scripts/default.nix

···
 { lib, stdenv, makeWrapper, buildEnv
-, bash, breezy, coreutils, cvs, findutils, gawk, git, git-lfs, gnused, mercurial, nix, subversion
+, bash, breezy, coreutils, cvs, findutils, gawk, git, git-lfs, gnused, mercurial
+, # FIXME: These scripts should not depend on Nix, they should depend on a
+  # `.nar` hasher compatible with Nix.
+  #
+  # The fact that these scripts depend on Nix means that e.g. Chromium depends
+  # on Nix.
+  #
+  # Also should be fixed:
+  # - prefetch-yarn-deps
+  # - nurl, nix-init
+  #
+  # Gridlock is one such candidate: https://github.com/lf-/gridlock
+  nixForLinking
+, subversion
 }:
 
 let mkPrefetchScript = tool: src: deps:
···
     installPhase = ''
       install -vD ${src} $out/bin/$name;
       wrapProgram $out/bin/$name \
-        --prefix PATH : ${lib.makeBinPath (deps ++ [ coreutils gnused nix ])} \
+        --prefix PATH : ${lib.makeBinPath (deps ++ [ coreutils gnused nixForLinking ])} \
         --set HOME /homeless-shelter
     '';
 

pkgs/tools/system/htop/default.nix

···
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   stdenv,
   autoreconfHook,
   pkg-config,
···
 
 stdenv.mkDerivation rec {
   pname = "htop";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "htop-dev";
     repo = pname;
     rev = version;
-    hash = "sha256-qDhQkzY2zj2yxbgFUXwE0MGEgAFOsAhnapUuetO9WTw=";
+    hash = "sha256-4M2Kzy/tTpIZzpyubnXWywQh7Np5InT4sYkVG2v6wWs=";
   };
 
-  patches = [
-    # See https://github.com/htop-dev/htop/pull/1412
-    # Remove when updating to 3.4.0
-    (fetchpatch2 {
-      name = "htop-resolve-configuration-path.patch";
-      url = "https://github.com/htop-dev/htop/commit/0dac8e7d38ec3aeae901a987717b5177986197e4.patch";
-      hash = "sha256-Er1d/yV1fioYfEmXNlLO5ayAyXkyy+IaGSx1KWXvlv0=";
-    })
-  ];
+  # upstream removed pkg-config support and uses dlopen now
+  postPatch =
+    let
+      libnlPath = lib.getLib libnl;
+    in
+    ''
+      substituteInPlace configure.ac \
+        --replace-fail /usr/include/libnl3 ${lib.getDev libnl}/include/libnl3
+      substituteInPlace linux/LibNl.c \
+        --replace-fail libnl-3.so ${libnlPath}/lib/libnl-3.so \
+        --replace-fail libnl-genl-3.so ${libnlPath}/lib/libnl-genl-3.so
+    '';
 
   nativeBuildInputs = [ autoreconfHook ] ++ lib.optional stdenv.hostPlatform.isLinux pkg-config;
 

pkgs/top-level/all-packages.nix

···
 
   nix = nixVersions.stable;
 
+  # Overlays for CppNix nightly, Lix, or Tvix want to change the default Nix
+  # implementation in Nixpkgs by overriding `pkgs.nix`. However, some packages
+  # link against the internal/unstable CppNix APIs directly, and these packages
+  # will break if built with different versions or implementations of Nix.
+  #
+  # If you want to swap out the Nix implementation in your package set, you
+  # don't want these packages to break. Therefore, some packages will refer to
+  # `nixForLinking` explicitly, at least until these dependencies can be sorted out.
+  nixForLinking = nixVersions.stable;
+
   nixStatic = pkgsStatic.nix;
 
   lixVersions = recurseIntoAttrs (callPackage ../tools/package-management/lix {