Merge remote-tracking branch 'origin/staging-next' into staging

doc/release-notes/rl-2511.section.md

···
 - `base16-builder` node package has been removed due to lack of upstream maintenance.
 - `gentium` package now provides `Gentium-*.ttf` files, and not `GentiumPlus-*.ttf` files like before. The font identifiers `Gentium Plus*` are available in the `gentium-plus` package, and if you want to use the more recently updated package `gentium` [by sil](https://software.sil.org/gentium/), you should update your configuration files to use the `Gentium` font identifier.
 - `space-orbit` package has been removed due to lack of upstream maintenance. Debian upstream stopped tracking it in 2011.
-- `command-not-found` package is now disabled by default; it works only for nix-channels based systems, and requires setup for it to work.
+
 - Derivations setting both `separateDebugInfo` and one of `allowedReferences`, `allowedRequistes`, `disallowedReferences` or `disallowedRequisites` must now set `__structuredAttrs` to `true`. The effect of reference whitelisting or blacklisting will be disabled on the `debug` output created by `separateDebugInfo`.
 - `victoriametrics` no longer contains VictoriaLogs components. These have been separated into the new package `victorialogs`.
 

nixos/doc/manual/release-notes/rl-2511.section.md

···
 
 - NixOS display manager modules now strictly use tty1, where many of them previously used tty7. Options to configure display managers' VT have been dropped. A configuration with a display manager enabled will not start `[e-mail]`, even if the system is forced to boot into `multi-user.target` instead of `graphical.target`.
 
+- `command-not-found` package is now disabled by default; it works only for nix-channels based systems, and requires setup for it to work.
+
 ## Other Notable Changes {#sec-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/tests/all-tests.nix

···
   k3s = handleTest ./k3s { };
   kafka = handleTest ./kafka { };
   kanboard = runTest ./web-apps/kanboard.nix;
-  kanidm =
-    kanidmVersion:
-    runTest {
-      imports = [ ./kanidm.nix ];
-      _module.args = { inherit kanidmVersion; };
-    };
-  kanidm-provisioning =
-    kanidmVersion:
-    runTest {
-      imports = [ ./kanidm-provisioning.nix ];
-      _module.args = { inherit kanidmVersion; };
-    };
+  kanidm = runTest ./kanidm.nix;
+  kanidm-provisioning = runTest ./kanidm-provisioning.nix;
   karma = runTest ./karma.nix;
   kavita = runTest ./kavita.nix;
   kbd-setfont-decompress = runTest ./kbd-setfont-decompress.nix;

nixos/tests/kanidm-provisioning.nix

···
-{ kanidmVersion, pkgs, ... }:
+{ kanidmPackage, pkgs, ... }:
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   serverDomain = certs.domain;
···
   provisionAdminPassword = "very-strong-password-for-admin";
   provisionIdmAdminPassword = "very-strong-password-for-idm-admin";
   provisionIdmAdminPassword2 = "very-strong-alternative-password-for-idm-admin";
-
-  kanidmPackage = pkgs."kanidmWithSecretProvisioning_${kanidmVersion}";
 in
 {
-  name = "kanidm-provisioning";
+  name = "kanidm-provisioning-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
+
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning;
 
   nodes.provision =
     { pkgs, lib, ... }:

nixos/tests/kanidm.nix

···
-{ kanidmVersion, pkgs, ... }:
+{ kanidmPackage, pkgs, ... }:
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   serverDomain = certs.domain;
···
     cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
     cp ${certs."${serverDomain}".key} $out/snakeoil.key
   '';
-
-  kanidmPackage = pkgs."kanidm_${kanidmVersion}";
 in
 {
-  name = "kanidm";
+  name = "kanidm-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [
     Flakebi
     oddlama
   ];
+
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm;
 
   nodes.server =
     { pkgs, ... }:

pkgs/applications/backup/timeshift/unwrapped.nix

···
 
 stdenv.mkDerivation rec {
   pname = "timeshift";
-  version = "25.07.4";
+  version = "25.07.5";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "timeshift";
     rev = version;
-    hash = "sha256-yrLpEhSt7QB0qWCXjIjTVeXKRpgue2pVdV+6hSixeuA=";
+    hash = "sha256-AXtHs19DeSF2v5v4aBchGlsO59Z7h5OfmAaDb9SjwSc=";
   };
 
   postPatch = ''

pkgs/applications/editors/vim/plugins/generated.nix

···
 
   augment-vim = buildVimPlugin {
     pname = "augment.vim";
-    version = "2025-03-18";
+    version = "2025-07-30";
     src = fetchFromGitHub {
       owner = "augmentcode";
       repo = "augment.vim";
-      rev = "97418c9dfc1918fa9bdd23863ea3d2e49130727f";
-      sha256 = "1sq4lpwzd2xc97l4h7zyglhg0jwg3xfw9qfidi26rz28dd1v2ivs";
+      rev = "b35cda0dab3b729e2eee3d792dcdb0ca7bb2482e";
+      sha256 = "05lwi6wp77dgaa9fn719piab3k8s5x7djfbzmbvmypp8zk8az6wx";
     };
     meta.homepage = "https://github.com/augmentcode/augment.vim/";
     meta.hydraPlatforms = [ ];

pkgs/applications/editors/vim/plugins/vim-plugin-names

···
 https://github.com/skywind3000/asyncrun.vim/,,
 https://github.com/skywind3000/asynctasks.vim/,,
 https://github.com/vmchale/ats-vim/,,
-https://github.com/augmentcode/augment.vim/,HEAD,
+https://github.com/augmentcode/augment.vim/,prerelease,
 https://github.com/ray-x/aurora/,,
 https://github.com/Jay-Madden/auto-fix-return.nvim/,HEAD,
 https://github.com/hotwatermorning/auto-git-diff/,,

pkgs/applications/editors/vscode/generic.nix

···
 
             # mono
             krb5
+
+            # Needed for headless browser-in-vscode based plugins such as
+            # anything based on Puppeteer https://pptr.dev .
+            # e.g. Roo Code
+            glib
+            nspr
+            nss
+            dbus
+            at-spi2-atk
+            cups
+            expat
+            libxkbcommon
+            xorg.libX11
+            xorg.libXcomposite
+            xorg.libXdamage
+            xorg.libxcb
+            xorg.libXext
+            xorg.libXfixes
+            xorg.libXrandr
+            cairo
+            pango
+            alsa-lib
+            libgbm
+            udev
+            libudev0-shim
           ])
           ++ additionalPkgs pkgs;
 

pkgs/applications/emulators/libretro/cores/pcsx2.nix

···
 }:
 mkLibretroCore {
   core = "pcsx2";
-  version = "0-unstable-2025-07-11";
+  version = "0-unstable-2025-08-07";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "ps2";
-    rev = "553770c8d886acb12ff43d06b83215f46be89acc";
-    hash = "sha256-C2uASKAol7PB3TEdLPCHlcUdRcaYlFwngnviY3rBklE=";
+    rev = "c26b06ac2752a11ee47abc6f9c73595ee874341c";
+    hash = "sha256-c7y1jCRQd/o4RTrOeqltcH8HOwrb+BLtaw//0ZWW4E0=";
     fetchSubmodules = true;
   };
 

pkgs/applications/science/misc/openmvs/default.nix

···
 {
   lib,
   boost,
-  breakpad,
   ceres-solver,
   cgal,
   cmake,
···
 
   buildInputs = [
     boostWithZstd
-    breakpad
     ceres-solver
     cgal
     eigen

pkgs/by-name/ag/agate/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "agate";
-  version = "3.3.17";
+  version = "3.3.18";
 
   __darwinAllowLocalNetworking = true;
 
···
     owner = "mbrubeck";
     repo = "agate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zT56JGP2SfOqLL/sLxo3PHnbAvLI+lifmCvLdPwzCZM=";
+    hash = "sha256-Q4+0haPvhUfIAmexYkxsKObQtounbybQG/36cJImL9A=";
   };
 
-  cargoHash = "sha256-vemmO7xYf83rBNEvJKaq5CjobG1LUxt7M5zeQegTUmM=";
+  cargoHash = "sha256-LdnLLCUFa8wpsA5Pi0HtiyLw5dkLLxtAoOnqSUx9HVI=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];

pkgs/by-name/bi/bikeshed/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "bikeshed";
-  version = "5.3.3";
+  version = "5.3.4";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hHLodlbHuDRXCR8GlTwSvaryOENPCiHgFj3S1hpApA8=";
+    hash = "sha256-QcypdeFIzEt2cx8PWWWhnMMhnc2oEWZUOm8kge4KJQY=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/br/brave/package.nix

···
 
 let
   pname = "brave";
-  version = "1.80.125";
+  version = "1.81.131";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-FfD0HNcA/OgDOgDvqTdn+C0PlazX/VuBh6xxvy1+4JM=";
+      hash = "sha256-zMZSFNjbygITH7hn3QnDwg30BMgevEdz8VX9xvcTSC4=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-ih1XSJgDGj2gAwkyUJiOyKruvpouco+iWyOEyz67M2k=";
+      hash = "sha256-EgZi6JKwM3xf+kecenLJTzE2MtcEBnjbG7cVpRZZFE0=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-GjxeUJgQ+8Mq6cY6yA4fMFKM0LH59VJYOwRe1d0zI3c=";
+      hash = "sha256-Q8CJn2JxFgQ6Daw2bJUjjKQ7vv/ce2pvIfGyxjygQP4=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-NA5HRQtBh0oEy2K17iYocoDMJP5Bdg2d/SGpuVwE1nA=";
+      hash = "sha256-SPAGx1PYrDtmAu3avi06UgJY0D0/DQCq2u4kJtHwSZ0=";
     };
   };
 

pkgs/by-name/br/breakpad/package.nix

···
   lib,
   stdenv,
   fetchgit,
-  fetchpatch,
   zlib,
 }:
 let
···
 stdenv.mkDerivation (finalAttrs: {
   pname = "breakpad";
 
-  version = "2023.06.01";
+  version = "2024.02.16";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/breakpad/breakpad";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8AkC/8oX4OWAcV21laJ0AeMRB9G04rFc6UJFy7Wus4A=";
+    hash = "sha256-yk+TSzjmAr9QMTYduKVe/Aizph/NNmSS385pvGJckiQ=";
   };
-
-  patches = [
-    (fetchpatch {
-      name = "gcc-14-fixes.patch";
-      url = "https://github.com/google/breakpad/commit/898a997855168c0e6a689072fefba89246271a5d.patch";
-      hash = "sha256-OxodMx7XfKiD9j6b8oFvloslYagSSpQn7BPdpMVOoDY=";
-    })
-  ];
 
   buildInputs = [ zlib ];
 

pkgs/by-name/co/codex/package.nix

···
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.14.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-qpYkD8fpnlTJ7RLAQrfswLFc58l/KY0x8NgGl/msG/I=";
+    hash = "sha256-s7gN1fsk/PRiVVzlrtmAUd2Vu8hhKtlCesLOVrzJ/58=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-oPWkxEMnffDZ7cmjWmmYGurYnHn4vYu64BhG7NhrxhE=";
+  cargoHash = "sha256-zgmiWyWB08v1WQVFzxpC/LGwF+XXbs8iW1d7i9Iw0Q4=";
 
   nativeBuildInputs = [
     installShellFiles
···
 
   buildInputs = [
     openssl
-    python3 # Required because of codex-rs/login/src/login_with_chatgpt.py
+    # Required because of codex-rs/login/src/login_with_chatgpt.py
+    python3
   ];
 
   nativeCheckInputs = [ gitMinimal ];
 
   __darwinAllowLocalNetworking = true;
   env = {
-    CODEX_SANDBOX = "seatbelt"; # Disables sandbox tests which want to access /usr/bin/touch
-    CODEX_SANDBOX_NETWORK_DISABLED = 1; # Skips tests that require networking
+    # Disables sandbox tests which want to access /usr/bin/touch
+    CODEX_SANDBOX = "seatbelt";
+    # Skips tests that require networking
+    CODEX_SANDBOX_NETWORK_DISABLED = 1;
   };
   checkFlags = [
-    "--skip=shell::tests::test_run_with_profile_escaping_and_execution" # Wants to access /bin/zsh
-    "--skip=includes_base_instructions_override_in_request" # Fails with 'stream ended unexpectedly: InternalAgentDied'
-    "--skip=includes_user_instructions_message_in_request" # Fails with 'stream ended unexpectedly: InternalAgentDied'
-    "--skip=originator_config_override_is_used" # Fails with 'stream ended unexpectedly: InternalAgentDied'
-    "--skip=azure_overrides_assign_properties_used_for_responses_url" # Panics
-    "--skip=test_conversation_create_and_send_message_ok" # Version 0.0.0 hardcoded
-    "--skip=test_send_message_session_not_found" # Version 0.0.0 hardcoded
-    "--skip=test_send_message_success" # Version 0.0.0 hardcoded
+    # Wants to access /bin/zsh
+    "--skip=shell::tests::test_run_with_profile_escaping_and_execution"
+    # Fails with 'stream ended unexpectedly: InternalAgentDied'
+    "--skip=includes_base_instructions_override_in_request"
+    # Fails with 'stream ended unexpectedly: InternalAgentDied'
+    "--skip=includes_user_instructions_message_in_request"
+    # Fails with 'stream ended unexpectedly: InternalAgentDied'
+    "--skip=originator_config_override_is_used"
+    # Fails with 'called `Result::unwrap()` on an `Err` value: NotPresent'
+    "--skip=azure_overrides_assign_properties_used_for_responses_url"
+    # Fails with 'called `Result::unwrap()` on an `Err` value: NotPresent'
+    "--skip=env_var_overrides_loaded_auth"
+    # Version 0.0.0 hardcoded
+    "--skip=test_conversation_create_and_send_message_ok"
+    # Version 0.0.0 hardcoded
+    "--skip=test_send_message_session_not_found"
+    # Version 0.0.0 hardcoded
+    "--skip=test_send_message_success"
   ];
 
   postInstall = lib.optionalString installShellCompletions ''

pkgs/by-name/go/goresym/package.nix

···
 
 buildGoModule rec {
   pname = "goresym";
-  version = "3.0.2";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "mandiant";
     repo = "goresym";
     rev = "v${version}";
-    hash = "sha256-tt13vHe6wE27kv+1HVXytY1hKmOt6rWJaMBgLRCvO2E=";
+    hash = "sha256-OvdARJwz/ijduil3JIpoR15+F3QNQyqQKeOmiAV7h2A=";
   };
 
   subPackages = [ "." ];

pkgs/by-name/ka/kanidm/generic.nix

···
   pam,
   bashInteractive,
   rust-jemalloc-sys,
-  kanidm,
+  kanidmWithSecretProvisioning,
   # If this is enabled, kanidm will be built with two patches allowing both
   # oauth2 basic secrets and admin credentials to be provisioned.
   # This is NOT officially supported (and will likely never be),
···
 let
   arch = if stdenv.hostPlatform.isx86_64 then "x86_64" else "generic";
 
-  versionUnderscored = builtins.replaceStrings [ "." ] [ "_" ] (
-    lib.versions.majorMinor kanidm.version
-  );
-
-  provisionPatches = [
-    (./. + "/provision-patches/${versionUnderscored}/oauth2-basic-secret-modify.patch")
-    (./. + "/provision-patches/${versionUnderscored}/recover-account.patch")
-  ];
+  versionUnderscored =
+    finalAttrs: lib.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor finalAttrs.version);
 
   upgradeNote = ''
     Please upgrade by verifying `kanidmd domain upgrade-check` and choosing the
···
   src = fetchFromGitHub {
     owner = "kanidm";
     repo = "kanidm";
-    rev = "refs/tags/v${version}";
+    tag = "v${finalAttrs.version}";
     inherit hash;
   };
 
   env.KANIDM_BUILD_PROFILE = "release_nixpkgs_${arch}";
 
-  patches = lib.optionals enableSecretProvisioning provisionPatches;
+  patches = lib.optionals enableSecretProvisioning [
+    (./. + "/provision-patches/${versionUnderscored finalAttrs}/oauth2-basic-secret-modify.patch")
+    (./. + "/provision-patches/${versionUnderscored finalAttrs}/recover-account.patch")
+  ];
 
   postPatch =
     let
···
       profile = {
         cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none";
       }
-      // lib.optionalAttrs (lib.versionAtLeast version "1.5") {
+      // lib.optionalAttrs (lib.versionAtLeast finalAttrs.version "1.5") {
         client_config_path = "/etc/kanidm/config";
         resolver_config_path = "/etc/kanidm/unixd";
         resolver_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash";
···
 
   passthru = {
     tests = {
-      kanidm = nixosTests.kanidm versionUnderscored;
-      kanidm-provisioning = nixosTests.kanidm-provisioning versionUnderscored;
+      kanidm = nixosTests.kanidm.extend {
+        modules = [ { _module.args.kanidmPackage = finalAttrs.finalPackage; } ];
+      };
+      kanidm-provisioning = nixosTests.kanidm-provisioning.extend {
+        modules = [ { _module.args.kanidmPackage = finalAttrs.finalPackage.withSecretProvisioning; } ];
+      };
     };
 
     updateScript = lib.optionals (!enableSecretProvisioning) (nix-update-script {
       extraArgs = [
         "-vr"
-        "v(${lib.versions.major kanidm.version}\\.${lib.versions.minor kanidm.version}\\.[0-9]*)"
+        "v(${lib.versions.major finalAttrs.version}\\.${lib.versions.minor finalAttrs.version}\\.[0-9]*)"
         "--override-filename"
-        "pkgs/by-name/ka/kanidm/${versionUnderscored}.nix"
+        "pkgs/by-name/ka/kanidm/${versionUnderscored finalAttrs}.nix"
       ];
     });
 
     inherit enableSecretProvisioning;
-    withSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };
+    # Unfortunately there is no such thing as finalAttrs.finalPackage.override,
+    # so we have to resort to this.
+    withSecretProvisioning = kanidmWithSecretProvisioning;
 
     eolMessage = lib.optionalString (eolDate != null) ''
-      kanidm ${lib.versions.majorMinor version} is deprecated and will reach end-of-life on ${eolDate}
+      kanidm ${lib.versions.majorMinor finalAttrs.version} is deprecated and will reach end-of-life on ${eolDate}
 
       ${upgradeNote}
     '';
···
   requiredSystemFeatures = [ "big-parallel" ];
 
   meta = {
-    changelog = "https://github.com/kanidm/kanidm/releases/tag/v${version}";
+    changelog = "https://github.com/kanidm/kanidm/releases/tag/v${finalAttrs.version}";
     description = "Simple, secure and fast identity management platform";
     homepage = "https://github.com/kanidm/kanidm";
     license = lib.licenses.mpl20;
···
     ];
     knownVulnerabilities = lib.optionals unsupported [
       ''
-        kanidm ${lib.versions.majorMinor version} has reached end-of-life.
+        kanidm ${lib.versions.majorMinor finalAttrs.version} has reached end-of-life.
 
         ${upgradeNote}
       ''

pkgs/by-name/li/linux-firmware/package.nix

···
 in
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20250708";
+  version = "20250808";
 
   src = fetchFromGitLab {
     owner = "kernel-firmware";
     repo = "linux-firmware";
     tag = version;
-    hash = "sha256-TJ97A9I0ipsqgg7ex3pAQgdhDJcLbkNCvuLppt9a07o=";
+    hash = "sha256-bmvhAKAY43WaPr3VLUUYoX6BU2Ret47vDnyCVP7157s=";
   };
 
   postUnpack = ''

pkgs/by-name/mi/mint-artwork/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "mint-artwork";
-  version = "1.8.9";
+  version = "1.9.2";
 
   src = fetchurl {
     urls = [
       "http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
-      "https://web.archive.org/web/20250111022232/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
+      "https://web.archive.org/web/20250807131013/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
     ];
-    hash = "sha256-MKXKne3wqxfIqmOawpmZbX/NRVSA5fBetpSE+mr/eqA=";
+    hash = "sha256-zmVpy7T1AyVE5nwD0aZ//9kIFK2IYjl3rSq+9bcHPDE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ol/ollama/package.nix

···
     changelog = "https://github.com/ollama/ollama/releases/tag/v${finalAttrs.version}";
     license = licenses.mit;
     platforms = if (rocmRequested || cudaRequested) then platforms.linux else platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin; # TODO: Remove after upstream issue is fixed, see issue #431464 and comments.
     mainProgram = "ollama";
     maintainers = with maintainers; [
       abysssol

pkgs/by-name/te/tempo/package.nix

···
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "tempo";
-  version = "2.8.1";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tempo";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-RzDOx2ZyA0ZntFD1ryfipsgPsxVmsdOusZ37RCnQQnM=";
+    hash = "sha256-mROhsqbCwPulxtg3pHVZi8FmW9PrYzGPdE0ajVvzRBY=";
   };
 
   vendorHash = null;
···
   ldflags = [
     "-s"
     "-w"
-    "-X=main.Version=${version}"
+    "-X=main.Version=${finalAttrs.version}"
     "-X=main.Branch=<release>"
-    "-X=main.Revision=${version}"
+    "-X=main.Revision=${finalAttrs.version}"
   ];
 
   # tests use docker
···
 
   meta = with lib; {
     description = "High volume, minimal dependency trace storage";
+    changelog = "https://github.com/grafana/tempo/releases/tag/v${finalAttrs.version}";
     license = licenses.asl20;
     homepage = "https://grafana.com/oss/tempo/";
     maintainers = [ ];
   };
-}
+})

pkgs/by-name/va/vault-bin/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src =
     let
···
         aarch64-darwin = "darwin_arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-wfp3qQ6vKE/k9lKW+h2LSVG9C/+4yJxsjksg5asfSj4=";
-        aarch64-linux = "sha256-pEnKCiZHrO5xwkfSA1bsqrtASj9BRNTsoTPJdu4hulE=";
-        i686-linux = "sha256-jsQFuiY1F8rSDaqtTdjbOaAfh0/WEITkXkmxgcH8U9g=";
-        x86_64-darwin = "sha256-tT6W9DJu6sehfAkbWmE4Z4MradJM50Ps2iWraQANUok=";
-        aarch64-darwin = "sha256-2bDtbRnMOCF91AZSMaBEgnwLDX44BRHv6Wb1UqZ86Ks=";
+        x86_64-linux = "sha256-enaT1ACAW2jG5IbmKlJMRTDrGlCiIlT0HzZV6MjLeFw=";
+        aarch64-linux = "sha256-D0+uRm6+942R3AkSnD03PRtG32hdbKsyVFKk5bGgqGQ=";
+        i686-linux = "sha256-fP9Cmp2h2/8Gwe6hCddwRZ7+9yqzxodqhLWytZQBJOc=";
+        x86_64-darwin = "sha256-gEXitrmyxl3Dq9T/o4QnG9+Bwfc0IMUPWEqu/U/4Dpk=";
+        aarch64-darwin = "sha256-ps4uIJ6tQPyDQ5hJyDksSRTYDwRqbSeIFOuLStrnos4=";
       };
     in
     fetchzip {

pkgs/by-name/ve/veilid/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "veilid";
-  version = "0.4.7";
+  version = "0.4.8";
 
   src = fetchFromGitLab {
     owner = "veilid";
     repo = "veilid";
     rev = "v${version}";
-    hash = "sha256-SEmXZvv6951Ln87/sRQwr4FgGRSvowGyeyApfF+JnJ4=";
+    hash = "sha256-ZhF9dMYrd+nui/tw1SuL0i6zB/niBfsd40SQzRgGF6Q=";
   };
 
-  cargoHash = "sha256-2fZAds4wNLd/mWh7EWpP2hqspBfAtTHIEe+dFag7Lw4=";
+  cargoHash = "sha256-Q4M6cb9xYxeH4O7YL2K8olJ9w8Iq34hYpuJEGGhVN+Y=";
 
   nativeBuildInputs = [
     capnproto

pkgs/by-name/wa/waybar/package.nix

···
   stdenv,
   bash,
   fetchFromGitHub,
-  fetchpatch,
   SDL2,
   alsa-lib,
   catch2_3,
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waybar";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "Alexays";
     repo = "Waybar";
     tag = finalAttrs.version;
-    hash = "sha256-KfWjYDqJf2jNmYAnmV7EQHweMObEBreUc2G7/LpvvC0=";
+    hash = "sha256-mGiBZjfvtZZkSHrha4UF2l1Ogbij8J//r2h4gcZAJ6w=";
   };
 
   postUnpack = lib.optional cavaSupport ''
···
     patchShebangs .
     popd
   '';
-
-  patches = [
-    (fetchpatch {
-      name = "waybar-default-icon.patch";
-      url = "https://github.com/Alexays/Waybar/commit/c336bc5466c858ac41dc9afd84f04a5ffec9e292.patch";
-      hash = "sha256-RRGy/aeFX95fW0pT6mXhww2RdEtoOnaT3+dc7iB3bAY=";
-    })
-  ];
 
   nativeBuildInputs = [
     meson

pkgs/by-name/xv/xviewer/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "xviewer";
-  version = "3.4.10";
+  version = "3.4.11";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xviewer";
     rev = version;
-    hash = "sha256-ELjr6W1Hqpvc7ChOrLhVUw9YPRoS/JjXQMNBrCn7JOQ=";
+    hash = "sha256-fW+hhHJ4i3u0vtbvaQWliIZSLI1WCFhR5CvVZL6Vy8U=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ze/zellij/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zellij";
-  version = "0.43.0";
+  version = "0.43.1";
 
   src = fetchFromGitHub {
     owner = "zellij-org";
     repo = "zellij";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VlK9ONyNQAlRqLQM62ZDCv/efJbj66DgM0P9DNhvRvk=";
+    hash = "sha256-pUExOToThqDBrNNKHh8Z+PFkijx22I7gpYXTAywlSxM=";
   };
 
   # Remove the `vendored_curl` feature in order to link against the libcurl from nixpkgs instead of
···
       --replace-fail ', "vendored_curl"' ""
   '';
 
-  cargoHash = "sha256-P4VabkEFBvj2YkkhXqH/JZp3m3WMKcr0qUMhdorEm1Q=";
+  cargoHash = "sha256-KWE9K7M2pelow5I2rvEZho9L0kmnSXVLDD9XBpzlEEY=";
 
   env.OPENSSL_NO_VENDOR = 1;
 

pkgs/data/fonts/openmoji/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "openmoji";
-  version = "15.1.0";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "hfg-gmuend";
     repo = pname;
     rev = version;
-    hash = "sha256-k37MsBbRUZ4vIEPAgVMiCK8gz377DWwAfjjjOassNMY=";
+    hash = "sha256-4dYtLaABu88z25Ud/cuOECajxSJWR01qcTIZNWN7Fhw=";
   };
 
   patches = [

pkgs/development/compilers/emscripten/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "emscripten";
-  version = "4.0.11";
+  version = "4.0.12";
 
   llvmEnv = symlinkJoin {
     name = "emscripten-llvm-${version}";
···
   src = fetchFromGitHub {
     owner = "emscripten-core";
     repo = "emscripten";
-    hash = "sha256-QNbXgTkzI0fqvg3nU2TAE8A8h6MNMm2TsTzOXBdpqYA=";
+    hash = "sha256-MwCUilfyum1yJb6nHEViYiYWufXlz2+krHZmXw2NAck=";
     rev = version;
   };
 
···
 
     patchShebangs .
 
-    # emscripten 4 requires LLVM tip-of-tree instead of LLVM 20
-    sed -i -e "s/EXPECTED_LLVM_VERSION = 21/EXPECTED_LLVM_VERSION = 20.1/g" tools/shared.py
+    # emscripten 4.0.12 requires LLVM tip-of-tree instead of LLVM 21
+    sed -i -e "s/EXPECTED_LLVM_VERSION = 22/EXPECTED_LLVM_VERSION = 21.1/g" tools/shared.py
 
     # fixes cmake support
     sed -i -e "s/print \('emcc (Emscript.*\)/sys.stderr.write(\1); sys.stderr.flush()/g" emcc.py

pkgs/development/php-packages/phan/default.nix

···
 (php.withExtensions ({ enabled, all }: enabled ++ (with all; [ ast ]))).buildComposerProject
   (finalAttrs: {
     pname = "phan";
-    version = "5.5.0";
+    version = "5.5.1";
 
     src = fetchFromGitHub {
       owner = "phan";
       repo = "phan";
       rev = finalAttrs.version;
-      hash = "sha256-jWlxBCfkN5nTd3nEwRLobDuxnJirk53ChSw59rj4gq0=";
+      hash = "sha256-G17ORkHmu6nkfJ8UrGzcaybPOKPrq1Q+LXVS56aVOZ8=";
     };
 
     vendorHash = "sha256-Ake5/7IyoweC2ONDuWt9jJSbG0JbnU9lmCRu2p6uUQM=";

pkgs/development/python-modules/coiled/default.nix

···
 
 buildPythonPackage rec {
   pname = "coiled";
-  version = "1.113.0";
+  version = "1.116.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1AIE06pssYFaiYBTv7gY4/Kw2jwKntvU/AMy2I77nsY=";
+    hash = "sha256-OBaGd9aC1TGtVeQ5K7iI2sWuBV0wG9Jt5sN92EMvi9M=";
   };
 
   build-system = [

pkgs/os-specific/darwin/xcode/default.nix

···
         description = "Apple's XCode SDK";
         license = licenses.unfree;
         platforms = platforms.darwin ++ platforms.linux;
+        hydraPlatforms = [ ];
         sourceProvenance = [ sourceTypes.binaryNativeCode ];
       };
 

pkgs/servers/sql/postgresql/ext/omnigres.nix

···
 in
 postgresqlBuildExtension (finalAttrs: {
   pname = "omnigres";
-  version = "0-unstable-2025-07-17";
+  version = "0-unstable-2025-08-06";
 
   src = fetchFromGitHub {
     owner = "omnigres";
     repo = "omnigres";
-    rev = "8e844ab16c393f850a99afdfdd28f2cc2f4e1729";
-    hash = "sha256-N+w0Tty1oC269IlInKm8CQve76P8Wprg64f6RR8Vdjw=";
+    rev = "dbfaeb18f4653b1263a61d7b937ec1392a7cfda2";
+    hash = "sha256-IjZ+U9p4qjhCrgPGLMkuVumGdeiWqYy80byCmUrNSvQ=";
   };
 
   # This matches postInstall of PostgreSQL's generic.nix, which does this for the PGXS Makefile.

pkgs/tools/security/bitwarden-directory-connector/default.nix

···
     }:
     buildNpmPackage rec {
       pname = name;
-      version = "2025.6.1";
+      version = "2025.7.0";
       nodejs = nodejs_22;
 
       src = fetchFromGitHub {
         owner = "bitwarden";
         repo = "directory-connector";
         rev = "v${version}";
-        hash = "sha256-VRM1kAWP0oNSLwIflTu6s7XjhSfy8z8G+5PUhQCc/tY=";
+        hash = "sha256-ExsOPSU7JT9Q8BCmREJHJSDFx8sGeL8iUKs8F8SZMeQ=";
       };
 
       postPatch = ''
···
           --replace-fail "AppImage" "dir"
       '';
 
-      npmDepsHash = "sha256-bUCnUnBaA+PwRyxDieqPWzCh87KPQUiuF3uW9fDHtQE=";
+      npmDepsHash = "sha256-BV1MvqXOJmnTMHf7mQ1U1vz38b5w1IH9whS3IOD5TqQ=";
 
       env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 

pkgs/top-level/all-packages.nix

···
   buildEmscriptenPackage = callPackage ../development/em-modules/generic { };
 
   emscripten = callPackage ../development/compilers/emscripten {
-    llvmPackages = llvmPackages_20;
+    llvmPackages = llvmPackages_21;
   };
 
   emscriptenPackages = recurseIntoAttrs (callPackage ./emscripten-packages.nix { });
···
 
   gwt240 = callPackage ../development/compilers/gwt/2.4.0.nix { };
 
-  idrisPackages = dontRecurseIntoAttrs (
+  idrisPackages = recurseIntoAttrs (
     callPackage ../development/idris-modules {
       idris-no-deps = haskellPackages.idris;
       pkgs = pkgs.__splicedPackages;
···
 
   ### DEVELOPMENT / LIBRARIES / AGDA
 
-  agdaPackages = callPackage ./agda-packages.nix {
-    inherit (haskellPackages) Agda;
-  };
+  agdaPackages = recurseIntoAttrs (
+    callPackage ./agda-packages.nix {
+      inherit (haskellPackages) Agda;
+    }
+  );
   agda = agdaPackages.agda;
 
   ### DEVELOPMENT / LIBRARIES / BASH
···
 
   jetty = jetty_12;
 
-  kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix { kanidm = kanidm_1_5; };
-  kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix { kanidm = kanidm_1_6; };
-  kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix { kanidm = kanidm_1_7; };
-
-  kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6;
-
-  kanidmWithSecretProvisioning_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix {
-    enableSecretProvisioning = true;
+  kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix {
+    kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_5;
+  };
+  kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix {
+    kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6;
   };
-
-  kanidmWithSecretProvisioning_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix {
-    enableSecretProvisioning = true;
+  kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix {
+    kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_7;
   };
 
-  kanidmWithSecretProvisioning_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix {
-    enableSecretProvisioning = true;
-  };
+  kanidmWithSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };
+  kanidmWithSecretProvisioning_1_5 = kanidm_1_5.override { enableSecretProvisioning = true; };
+  kanidmWithSecretProvisioning_1_6 = kanidm_1_6.override { enableSecretProvisioning = true; };
+  kanidmWithSecretProvisioning_1_7 = kanidm_1_7.override { enableSecretProvisioning = true; };
 
   knot-resolver = callPackage ../servers/dns/knot-resolver {
     systemd = systemdMinimal; # in closure already anyway
···
   # Even though this is a set of packages not single package, use `callPackage`
   # not `callPackages` so the per-package callPackages don't have their
   # `.override` clobbered. C.F. `llvmPackages` which does the same.
-  darwin = recurseIntoAttrs (callPackage ./darwin-packages.nix { });
+  darwin = callPackage ./darwin-packages.nix { };
 
   displaylink = callPackage ../os-specific/linux/displaylink {
     inherit (linuxPackages) evdi;

pkgs/top-level/darwin-packages.nix

···
       impure-cmds = pkgs.callPackage ../os-specific/darwin/impure-cmds { };
     in
 
-    impure-cmds
-    // apple-source-packages
-    // {
+    lib.recurseIntoAttrs (
+      impure-cmds
+      // apple-source-packages
+      // {
 
-      inherit (self.adv_cmds) ps;
+        inherit (self.adv_cmds) ps;
 
-      binutils-unwrapped = callPackage ../os-specific/darwin/binutils {
-        inherit (pkgs) cctools;
-        inherit (pkgs.llvmPackages) clang-unwrapped llvm llvm-manpages;
-      };
+        binutils-unwrapped = callPackage ../os-specific/darwin/binutils {
+          inherit (pkgs) cctools;
+          inherit (pkgs.llvmPackages) clang-unwrapped llvm llvm-manpages;
+        };
 
-      binutils = pkgs.wrapBintoolsWith {
-        inherit (targetPackages) libc;
-        bintools = self.binutils-unwrapped;
-      };
+        binutils = pkgs.wrapBintoolsWith {
+          inherit (targetPackages) libc;
+          bintools = self.binutils-unwrapped;
+        };
 
-      # x86-64 Darwin gnat-bootstrap emits assembly
-      # with MOVQ as the mnemonic for quadword interunit moves
-      # such as `movq %rbp, %xmm0`.
-      # The clang integrated assembler recognises this as valid,
-      # but unfortunately the cctools.gas GNU assembler does not;
-      # it instead uses MOVD as the mnemonic.
-      # The assembly that a GCC build emits is determined at build time
-      # and cannot be changed afterwards.
-      #
-      # To build GNAT on x86-64 Darwin, therefore,
-      # we need both the clang _and_ the cctools.gas assemblers to be available:
-      # the former to build at least the stage1 compiler,
-      # and the latter at least to be detectable
-      # as the target for the final compiler.
-      binutilsDualAs-unwrapped = pkgs.buildEnv {
-        name = "${lib.getName self.binutils-unwrapped}-dualas-${lib.getVersion self.binutils-unwrapped}";
-        paths = [
-          self.binutils-unwrapped
-          (lib.getOutput "gas" pkgs.cctools)
-        ];
-      };
+        # x86-64 Darwin gnat-bootstrap emits assembly
+        # with MOVQ as the mnemonic for quadword interunit moves
+        # such as `movq %rbp, %xmm0`.
+        # The clang integrated assembler recognises this as valid,
+        # but unfortunately the cctools.gas GNU assembler does not;
+        # it instead uses MOVD as the mnemonic.
+        # The assembly that a GCC build emits is determined at build time
+        # and cannot be changed afterwards.
+        #
+        # To build GNAT on x86-64 Darwin, therefore,
+        # we need both the clang _and_ the cctools.gas assemblers to be available:
+        # the former to build at least the stage1 compiler,
+        # and the latter at least to be detectable
+        # as the target for the final compiler.
+        binutilsDualAs-unwrapped = pkgs.buildEnv {
+          name = "${lib.getName self.binutils-unwrapped}-dualas-${lib.getVersion self.binutils-unwrapped}";
+          paths = [
+            self.binutils-unwrapped
+            (lib.getOutput "gas" pkgs.cctools)
+          ];
+        };
 
-      binutilsDualAs = self.binutils.override {
-        bintools = self.binutilsDualAs-unwrapped;
-      };
+        binutilsDualAs = self.binutils.override {
+          bintools = self.binutilsDualAs-unwrapped;
+        };
 
-      binutilsNoLibc = pkgs.wrapBintoolsWith {
-        libc = targetPackages.preLibcHeaders;
-        bintools = self.binutils-unwrapped;
-      };
+        binutilsNoLibc = pkgs.wrapBintoolsWith {
+          libc = targetPackages.preLibcHeaders;
+          bintools = self.binutils-unwrapped;
+        };
 
-      # Removes propagated packages from the stdenv, so those packages can be built without depending upon themselves.
-      bootstrapStdenv = mkBootstrapStdenv pkgs.stdenv;
+        # Removes propagated packages from the stdenv, so those packages can be built without depending upon themselves.
+        bootstrapStdenv = mkBootstrapStdenv pkgs.stdenv;
 
-      libSystem = callPackage ../os-specific/darwin/libSystem { };
+        libSystem = callPackage ../os-specific/darwin/libSystem { };
 
-      DarwinTools = callPackage ../os-specific/darwin/DarwinTools { };
+        DarwinTools = callPackage ../os-specific/darwin/DarwinTools { };
 
-      libunwind = callPackage ../os-specific/darwin/libunwind { };
+        libunwind = callPackage ../os-specific/darwin/libunwind { };
 
-      sigtool = callPackage ../os-specific/darwin/sigtool { };
+        sigtool = callPackage ../os-specific/darwin/sigtool { };
 
-      signingUtils = callPackage ../os-specific/darwin/signing-utils { };
+        signingUtils = callPackage ../os-specific/darwin/signing-utils { };
 
-      autoSignDarwinBinariesHook = pkgs.makeSetupHook {
-        name = "auto-sign-darwin-binaries-hook";
-        propagatedBuildInputs = [ self.signingUtils ];
-      } ../os-specific/darwin/signing-utils/auto-sign-hook.sh;
+        autoSignDarwinBinariesHook = pkgs.makeSetupHook {
+          name = "auto-sign-darwin-binaries-hook";
+          propagatedBuildInputs = [ self.signingUtils ];
+        } ../os-specific/darwin/signing-utils/auto-sign-hook.sh;
 
-      iosSdkPkgs = callPackage ../os-specific/darwin/xcode/sdk-pkgs.nix {
-        buildIosSdk = buildPackages.darwin.iosSdkPkgs.sdk;
-        targetIosSdkPkgs = targetPackages.darwin.iosSdkPkgs;
-        inherit (pkgs.llvmPackages) clang-unwrapped;
-      };
+        iosSdkPkgs = callPackage ../os-specific/darwin/xcode/sdk-pkgs.nix {
+          buildIosSdk = buildPackages.darwin.iosSdkPkgs.sdk;
+          targetIosSdkPkgs = targetPackages.darwin.iosSdkPkgs;
+          inherit (pkgs.llvmPackages) clang-unwrapped;
+        };
 
-      lsusb = callPackage ../os-specific/darwin/lsusb { };
+        lsusb = callPackage ../os-specific/darwin/lsusb { };
 
-      openwith = callPackage ../os-specific/darwin/openwith { };
+        openwith = callPackage ../os-specific/darwin/openwith { };
 
-      trash = callPackage ../os-specific/darwin/trash { };
+        trash = callPackage ../os-specific/darwin/trash { };
 
-      inherit (self.file_cmds) xattr;
+        inherit (self.file_cmds) xattr;
 
-      inherit (pkgs.callPackages ../os-specific/darwin/xcode { })
-        xcode_8_1
-        xcode_8_2
-        xcode_9_1
-        xcode_9_2
-        xcode_9_3
-        xcode_9_4
-        xcode_9_4_1
-        xcode_10_1
-        xcode_10_2
-        xcode_10_2_1
-        xcode_10_3
-        xcode_11
-        xcode_11_1
-        xcode_11_2
-        xcode_11_3_1
-        xcode_11_4
-        xcode_11_5
-        xcode_11_6
-        xcode_11_7
-        xcode_12
-        xcode_12_0_1
-        xcode_12_1
-        xcode_12_2
-        xcode_12_3
-        xcode_12_4
-        xcode_12_5
-        xcode_12_5_1
-        xcode_13
-        xcode_13_1
-        xcode_13_2
-        xcode_13_3
-        xcode_13_3_1
-        xcode_13_4
-        xcode_13_4_1
-        xcode_14
-        xcode_14_1
-        xcode_15
-        xcode_15_0_1
-        xcode_15_1
-        xcode_15_2
-        xcode_15_3
-        xcode_15_4
-        xcode_16
-        xcode_16_1
-        xcode_16_2
-        xcode_16_3
-        xcode_16_4
-        xcode
-        requireXcode
-        ;
+        inherit (pkgs.callPackages ../os-specific/darwin/xcode { })
+          xcode_8_1
+          xcode_8_2
+          xcode_9_1
+          xcode_9_2
+          xcode_9_3
+          xcode_9_4
+          xcode_9_4_1
+          xcode_10_1
+          xcode_10_2
+          xcode_10_2_1
+          xcode_10_3
+          xcode_11
+          xcode_11_1
+          xcode_11_2
+          xcode_11_3_1
+          xcode_11_4
+          xcode_11_5
+          xcode_11_6
+          xcode_11_7
+          xcode_12
+          xcode_12_0_1
+          xcode_12_1
+          xcode_12_2
+          xcode_12_3
+          xcode_12_4
+          xcode_12_5
+          xcode_12_5_1
+          xcode_13
+          xcode_13_1
+          xcode_13_2
+          xcode_13_3
+          xcode_13_3_1
+          xcode_13_4
+          xcode_13_4_1
+          xcode_14
+          xcode_14_1
+          xcode_15
+          xcode_15_0_1
+          xcode_15_1
+          xcode_15_2
+          xcode_15_3
+          xcode_15_4
+          xcode_16
+          xcode_16_1
+          xcode_16_2
+          xcode_16_3
+          xcode_16_4
+          xcode
+          requireXcode
+          ;
+
+        xcodeProjectCheckHook = pkgs.makeSetupHook {
+          name = "xcode-project-check-hook";
+          propagatedBuildInputs = [ pkgs.pkgsBuildHost.openssl ];
+        } ../os-specific/darwin/xcode-project-check-hook/setup-hook.sh;
 
-      xcodeProjectCheckHook = pkgs.makeSetupHook {
-        name = "xcode-project-check-hook";
-        propagatedBuildInputs = [ pkgs.pkgsBuildHost.openssl ];
-      } ../os-specific/darwin/xcode-project-check-hook/setup-hook.sh;
+        # See doc/packages/darwin-builder.section.md
+        linux-builder = lib.makeOverridable (
+          { modules }:
+          let
+            toGuest = builtins.replaceStrings [ "darwin" ] [ "linux" ];
 
-      # See doc/packages/darwin-builder.section.md
-      linux-builder = lib.makeOverridable (
-        { modules }:
-        let
-          toGuest = builtins.replaceStrings [ "darwin" ] [ "linux" ];
+            nixos = import ../../nixos {
+              configuration = {
+                imports = [
+                  ../../nixos/modules/profiles/nix-builder-vm.nix
+                ]
+                ++ modules;
 
-          nixos = import ../../nixos {
-            configuration = {
-              imports = [
-                ../../nixos/modules/profiles/nix-builder-vm.nix
-              ]
-              ++ modules;
+                # If you need to override this, consider starting with the right Nixpkgs
+                # in the first place, ie change `pkgs` in `pkgs.darwin.linux-builder`.
+                # or if you're creating new wiring that's not `pkgs`-centric, perhaps use the
+                # macos-builder profile directly.
+                virtualisation.host = { inherit pkgs; };
 
-              # If you need to override this, consider starting with the right Nixpkgs
-              # in the first place, ie change `pkgs` in `pkgs.darwin.linux-builder`.
-              # or if you're creating new wiring that's not `pkgs`-centric, perhaps use the
-              # macos-builder profile directly.
-              virtualisation.host = { inherit pkgs; };
+                nixpkgs.hostPlatform = lib.mkDefault (toGuest stdenv.hostPlatform.system);
+              };
 
-              nixpkgs.hostPlatform = lib.mkDefault (toGuest stdenv.hostPlatform.system);
+              system = null;
             };
 
-            system = null;
-          };
+          in
+          nixos.config.system.build.macos-builder-installer
+        ) { modules = [ ]; };
 
-        in
-        nixos.config.system.build.macos-builder-installer
-      ) { modules = [ ]; };
+        linux-builder-x86_64 = self.linux-builder.override {
+          modules = [ { nixpkgs.hostPlatform = "x86_64-linux"; } ];
+        };
 
-      linux-builder-x86_64 = self.linux-builder.override {
-        modules = [ { nixpkgs.hostPlatform = "x86_64-linux"; } ];
-      };
-
-    }
+      }
+    )
   );
 }

pkgs/top-level/release.nix

···
                 haskell-language-server
                 ;
             });
-        idrisPackages = packagePlatforms pkgs.idrisPackages;
-        agdaPackages = packagePlatforms pkgs.agdaPackages;
 
         pkgsLLVM.stdenv = [
           "x86_64-linux"
···
           "aarch64-linux"
         ];
 
-        # Language packages disabled in https://github.com/NixOS/nixpkgs/commit/ccd1029f58a3bb9eca32d81bf3f33cb4be25cc66
-
-        #emacsPackages = packagePlatforms pkgs.emacsPackages;
-        #rPackages = packagePlatforms pkgs.rPackages;
+        # Fails CI in its current state
         ocamlPackages = { };
-        perlPackages = { };
-
-        darwin = packagePlatforms pkgs.darwin // {
-          xcode = { };
-        };
       };
       mapTestOn-packages = if attrNamesOnly then packageJobs else mapTestOn packageJobs;
     in