NixOS · vcunat · Dec 15, 2025 · Nov 16, 2025 · Nov 17, 2025 · Nov 18, 2025
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-8";
+  version = "7.1.2-9";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-2jSQ59Wi6/1dbS/AgM1DfW6WlwoYuJlnTLoM8Mc6Ji8=";
+    hash = "sha256-bXVVnjJhtmcbczZI9rsy2JQ3p2oYX5g5vp3YdsQkdrE=";
   };
 
   outputs = [

diff --git a/pkgs/applications/misc/kup/default.nix b/pkgs/applications/misc/kup/default.nix
@@ -15,20 +15,21 @@
   kconfig,
   kinit,
   kjobwidgets,
+  kcmutils,
   plasma-framework,
   libgit2,
 }:
 
 stdenv.mkDerivation rec {
   pname = "kup";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     repo = "kup";
     owner = "system";
     rev = "kup-${version}";
-    sha256 = "1s180y6vzkxxcjpfdvrm90251rkaf3swzkjwdlpm6m4vnggq0hvs";
+    hash = "sha256-G/GXmcQI1OBnCE7saPHeHDAMeL2WR6nVttMlKV2e01I=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +51,7 @@ stdenv.mkDerivation rec {
     kjobwidgets
     plasma-framework
     libgit2
+    kcmutils
   ];
 
   meta = {

diff --git a/pkgs/build-support/buildenv/builder.pl b/pkgs/build-support/buildenv/builder.pl
@@ -74,7 +74,7 @@ ($path)
 
 sub findFilesInDir($relName, $target, $ignoreCollisions, $checkCollisionContents, $priority, $ignoreSingleFileOutputs) {
     opendir DIR, "$target" or die "cannot open `$target': $!";
-    my @names = readdir DIR or die;
+    my @names = readdir DIR;
     closedir DIR;
 
     foreach my $name (@names) {

diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -89,17 +89,20 @@ lib.extendMkDerivation {
       "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it"
       true;
     {
-      env = {
-        PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
-        RUST_LOG = logLevel;
-        RUSTFLAGS =
-          lib.optionalString (
-            stdenv.hostPlatform.isDarwin && buildType == "debug"
-          ) "-C split-debuginfo=packed "
-          # Workaround the existing RUSTFLAGS specified as a list.
-          + interpolateString (args.RUSTFLAGS or "");
-      }
-      // args.env or { };
+      env =
+        let
+          isDarwinDebug = stdenv.hostPlatform.isDarwin && buildType == "debug";
+        in
+        {
+          PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
+          RUST_LOG = logLevel;
+          # Prevent shadowing *_RUSTFLAGS environment variables
+          ${if args ? RUSTFLAGS || isDarwinDebug then "RUSTFLAGS" else null} =
+            lib.optionalString isDarwinDebug "-C split-debuginfo=packed "
+            # Workaround the existing RUSTFLAGS specified as a list.
+            + interpolateString (args.RUSTFLAGS or "");
+        }
+        // args.env or { };
 
       cargoDeps =
         if cargoVendorDir != null then

diff --git a/pkgs/by-name/at/at-spi2-core/package.nix b/pkgs/by-name/at/at-spi2-core/package.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.58.1";
+  version = "2.58.2";
 
   outputs = [
     "out"
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor version}/at-spi2-core-${version}.tar.xz";
-    hash = "sha256-fzdKajjNcP9LMsnToDEL+oBNlG/tTJ5pp9SfrNy5Xpw=";
+    hash = "sha256-ooI7li7RbN1csfxTZQKf0hg5TYUqzUCYsyGFS9ZpL24=";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/by-name/au/autogen/package.nix b/pkgs/by-name/au/autogen/package.nix
@@ -148,6 +148,9 @@ stdenv.mkDerivation rec {
       local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)'$NIX_BUILD_TOP'[^:]*:@\1@g')"
       patchelf --set-rpath "$nrp" "$f"
     done
+  ''
+  + lib.optionalString (stdenv.system == "aarch64-darwin") ''
+    # FIXME: remove/revert; just trigerring a rebuild because of bad binary in cache.nixos.org
   '';
 
   meta = {

diff --git a/pkgs/by-name/bo/boulder/package.nix b/pkgs/by-name/bo/boulder/package.nix
@@ -4,29 +4,35 @@
   buildGoModule,
   testers,
   boulder,
+  minica,
   nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "boulder";
-  version = "2025-04-17";
+  version = "0.20251118.0";
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
     repo = "boulder";
-    tag = "release-${version}";
+    tag = "v${version}";
     leaveDotGit = true;
     postFetch = ''
       pushd $out
       git rev-parse --short=8 HEAD 2>/dev/null >$out/COMMIT
       find $out -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-FXk+JZJ1azpgN6IQ9aYmpUEO1CGs9/3sog1NjrfB4d8=";
+    hash = "sha256-JVkIu8Fh5F8WQXa45I0hnSedAaIQIOFidtWVpVHbAWA=";
   };
 
   vendorHash = null;
 
+  postPatch = ''
+    # We already built the application with custom settings. This fails, so we have to disable it.
+    substituteInPlace test/certs/generate.sh --replace-fail 'make build' ""
+  '';
+
   subPackages = [ "cmd/boulder" ];
 
   ldflags = [
@@ -40,9 +46,14 @@ buildGoModule rec {
     ldflags+=" -X \"github.com/letsencrypt/boulder/core.BuildTime=$(date -u -d @0)\""
   '';
 
+  nativeCheckInputs = [ minica ];
+
   preCheck = ''
     # Test all targets.
     unset subPackages
+    # Generate integration test certificates, but skip webpki certificates that are hard to make without errors and are currently unneeded.
+    mkdir test/certs/webpki
+    bash test/certs/generate.sh
   '';
 
   # Tests that fail or require additional services.
@@ -58,6 +69,7 @@ buildGoModule rec {
     "TestAddPrecertificateIncomplete"
     "TestAddPrecertificateKeyHash"
     "TestAddPrecertificateNoOCSP"
+    "TestAddRateLimitOverride"
     "TestAddRegistration"
     "TestAddReplacementOrder"
     "TestAddSerial"
@@ -110,6 +122,7 @@ buildGoModule rec {
     "TestEnforceJWSAuthType"
     "TestExactPublicSuffixCertLimit"
     "TestExtractJWK"
+    "TestExtractRequestTarget"
     "TestFQDNSetExists"
     "TestFQDNSetTimestampsForWindow"
     "TestFQDNSets"
@@ -249,6 +262,8 @@ buildGoModule rec {
     "TestRecheckCAAFail"
     "TestRecheckCAAInternalServerError"
     "TestRecheckCAASuccess"
+    "TestRecheckInvalidIdentifierType"
+    "TestRecheckSkipIPAddress"
     "TestRedisSource_BatchSetAndGet"
     "TestRedisSource_Ping"
     "TestRegistrationsPerIPOverrideUsage"

diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
@@ -23,7 +23,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  srcVersion = "3.115";
+  srcVersion = "3.117";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -47,7 +47,7 @@ let
           owner = "nss-dev";
           repo = "nss";
           rev = "NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM";
-          hash = "sha256-8PeFeaIOtjBZJLBx3ONwZlK5SaLnjKEFoZWvVsu/3tA=";
+          hash = "sha256-sAs0TiV3TK/WtgHvEjl2KFAgebyWZYmcRcmxjpn2AME=";
         };
 
     dontBuild = true;

diff --git a/pkgs/by-name/ca/cargo-valgrind/package.nix b/pkgs/by-name/ca/cargo-valgrind/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cargo-valgrind";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "jfrimmel";
     repo = "cargo-valgrind";
     tag = version;
-    sha256 = "sha256-fAZngB4Z5dd6j+CfX+Tc3NNZHGRCz1C+T7QYmUn96SM=";
+    sha256 = "sha256-sVW3zNe0a9iQQ0vRWJofqG4gwUJ/w0U4ugVyMNtWX98=";
   };
 
-  cargoHash = "sha256-hcUZm2h7rtBiYl2JXlt/AuKfhf/5YpqTYYAWxq0dQ8U=";
+  cargoHash = "sha256-sRJGnbQFCk+SJtG/hnde+8ggZuutrdk0279ziickmnA=";
 
   passthru = {
     updateScript = nix-update-script { };
@@ -35,6 +35,7 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     "--skip tests_are_runnable"
     "--skip default_cargo_project_reports_no_violations"
+    "--skip empty_tests_not_leak_in_release_mode"
   ];
 
   meta = {

diff --git a/pkgs/by-name/ce/ceph/package.nix b/pkgs/by-name/ce/ceph/package.nix
@@ -321,9 +321,6 @@ let
           };
         });
 
-        httpcore = super.httpcore.overridePythonAttrs (old: {
-          nativeCheckInputs = lib.remove self.pproxy old.nativeCheckInputs;
-        });
       };
   };
 

diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cups";
-  version = "2.4.14";
+  version = "2.4.15";
 
   src = fetchurl {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    hash = "sha256-ZgKIAg3W95yveZgRxMGjIHpIaJiZrCCTlZ1wo73Ldpk=";
+    hash = "sha256-7/C71I/xq8u45G4o6Frvr/o5Gh2cTY3JKrOCKhMAjX8=";
   };
 
   outputs = [

diff --git a/pkgs/by-name/cy/cyrus_sasl/package.nix b/pkgs/by-name/cy/cyrus_sasl/package.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     libxcrypt
   ]
   ++ lib.optional enableLdap openldap
-  ++ lib.optional stdenv.hostPlatform.isLinux pam;
+  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform pam) pam;
 
   configureFlags = [
     "--with-openssl=${openssl.dev}"

diff --git a/pkgs/by-name/fi/fittrackee/package.nix b/pkgs/by-name/fi/fittrackee/package.nix
@@ -22,6 +22,15 @@ python3Packages.buildPythonApplication rec {
     python3Packages.poetry-core
   ];
 
+  # The upstream project changed the behavior of the CLI when --set-admin and --set-role are used together.
+  # Previously, it would raise an error, but now it issues a deprecation warning.
+  # This patch updates the test assertion to expect the new deprecation warning message.
+  # See upstream commit 6eda1b6119b3e41bdf8896e74b4a07d3c9e97609.
+  postPatch = ''
+    substituteInPlace fittrackee/tests/users/test_users_commands.py \
+      --replace '"--set-admin and --set-role can not be used together."' '"WARNING: --set-admin is deprecated. Please use --set-role option instead."'
+  '';
+
   pythonRelaxDeps = [
     "authlib"
     "fitdecode"
@@ -33,6 +42,7 @@ python3Packages.buildPythonApplication rec {
     "pyopenssl"
     "pytz"
     "sqlalchemy"
+    "xmltodict"
   ];
 
   dependencies =

diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
@@ -74,7 +74,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.86.1";
+  version = "2.86.2";
 
   outputs = [
     "bin"
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EZ0XCMoCJVbW0pie6QrRuCvZwNFmfgZpRKbQAg4tXlc=";
+    hash = "sha256-inJOlwhVNX6oEB4ncnICOSoP/VQQqYM2rtVOxZET5hE=";
   };
 
   patches =

diff --git a/pkgs/by-name/hl/hledger-check-fancyassertions/package.nix b/pkgs/by-name/hl/hledger-check-fancyassertions/package.nix
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation rec {
   src = fetchurl {
     name = "hledger-check-fancyassertion-${version}.hs";
     url = "https://raw.githubusercontent.com/simonmichael/hledger/hledger-lib-${version}/bin/hledger-check-fancyassertions.hs";
-    hash = "sha256-p1JvPHSB5hkfZsTq1sSL0mxCRkhZu1zkpXTELVNFE64=";
+    hash = "sha256-Zokrrcy9CfVV2tNI1DDsjqC+PcTdlMdit4O4Y1gP1O4=";
   };
 
   dontUnpack = true;

diff --git a/pkgs/by-name/in/inko/package.nix b/pkgs/by-name/in/inko/package.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "inko";
-  version = "0.18.1";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "inko-lang";
     repo = "inko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jVfAfR02R2RaTtzFSBoLuq/wdPaaI/eochrZaRVdmHY=";
+    hash = "sha256-ZHVOwYvNRL2ObZt2PvayoqvS64MumN4oXQOgeCWbEUM=";
   };
 
-  cargoHash = "sha256-IOMhwcZHB5jVYDM65zifxCjVHWl1EBbxNA3WVmarWcs=";
+  cargoHash = "sha256-BHrbqPMQnhw8pjN8e0/qW1rPe/fMhs2iUbRVPt5ATrg=";
 
   buildInputs = [
     libffi

diff --git a/pkgs/by-name/in/inko/test.nix b/pkgs/by-name/in/inko/test.nix
@@ -7,26 +7,30 @@
 
 let
   source =
+    # https://docs.inko-lang.org/manual/v0.19.1/getting-started/hello-concurrency/#channels
     writeText "hello.inko" # inko
       ''
         import std.process (sleep)
-        import std.stdio (STDOUT)
+        import std.stdio (Stdout)
+        import std.sync (Channel)
         import std.time (Duration)
 
-        class async Printer {
-          fn async print(message: String, channel: Channel[Nil]) {
-            let _ = STDOUT.new.print(message)
+        type async Printer {
+          fn async print(message: String, channel: uni Channel[Nil]) {
+            let _ = Stdout.new.print(message)
 
             channel.send(nil)
           }
         }
 
-        class async Main {
+        type async Main {
           fn async main {
-            let channel = Channel.new(size: 2)
+            let channel = Channel.new
 
-            Printer().print('Hello', channel)
-            Printer().print('world', channel)
+            Printer().print('Hello', recover channel.clone)
+            Printer().print('world', recover channel.clone)
+
+            sleep(Duration.from_millis(500))
 
             channel.receive
             channel.receive
-Original file line number
+Diff line change
@@ Expand Up / @@ -321,9 +321,6 @@ let @@
               };
             });
-            httpcore = super.httpcore.overridePythonAttrs (old: {
-              nativeCheckInputs = lib.remove self.pproxy old.nativeCheckInputs;
-            });
           };
       };
@@ Expand Down @@