Merge master into staging-next

Author: github-actions[bot]

maintainers/scripts/nixpkgs-lint.nix

@@ -28,10 +28,10 @@ stdenv.mkDerivation {
     wrapProgram $out/bin/nixpkgs-lint --set PERL5LIB $PERL5LIB
   '';
 
-  meta = with lib; {
-    maintainers = [ maintainers.eelco ];
+  meta = {
+    maintainers = [ lib.maintainers.eelco ];
     description = "A utility for Nixpkgs contributors to check Nixpkgs for common errors";
     mainProgram = "nixpkgs-lint";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 }

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -27,6 +27,8 @@
 - `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting [system.rebuild.enableNg](options.html#opt-system.rebuild.enableNg) in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default.
 - A `nixos-rebuild build-image` sub-command has been added.
 
+- `nixos-option` has been rewritten to a Nix expression called by a simple bash script. This lowers our maintenance threshold, makes eval errors less verbose, adds support for flake-based configurations, descending into `attrsOf` and `listOf` submodule options, and `--show-trace`.
+
   It allows users to build platform-specific (disk) images from their NixOS configurations. `nixos-rebuild build-image` works similar to the popular [nix-community/nixos-generators](https://github.com/nix-community/nixos-generators) project. See new [section on image building in the nixpkgs manual](https://nixos.org/manual/nixpkgs/unstable/#sec-image-nixos-rebuild-build-image).
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/services/networking/dhcpcd.nix

@@ -249,6 +249,7 @@ in
             ExecReload = "${dhcpcd}/sbin/dhcpcd --rebind";
             Restart = "always";
             AmbientCapabilities = [ "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_NET_BIND_SERVICE" ];
+            CapabilityBoundingSet = [ "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_NET_BIND_SERVICE" ];
             ReadWritePaths = [ "/proc/sys/net/ipv4" ]
               ++ lib.optional cfgN.enableIPv6 "/proc/sys/net/ipv6"
               ++ lib.optionals useResolvConf ([ "/run/resolvconf" ] ++ config.networking.resolvconf.subscriberFiles);
@@ -276,7 +277,7 @@ in
             RestrictSUIDSGID = true;
             SystemCallFilter = [
               "@system-service"
-              "~@aio" "~@chown" "~@keyring" "~@memlock"
+              "~@aio" "~@keyring" "~@memlock" "~@mount" "~@privileged" "~@resources"
             ];
             SystemCallArchitectures = "native";
             UMask = "0027";

pkgs/applications/audio/youtube-music/default.nix

@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
       exec = "youtube-music %u";
       icon = "youtube-music";
       desktopName = "YouTube Music";
-      startupWMClass = "YouTube Music";
+      startupWMClass = "com.github.th_ch.youtube_music";
       categories = [ "AudioVideo" ];
     })
   ];

pkgs/applications/editors/vscode/extensions/default.nix

@@ -5589,8 +5589,8 @@ let
         mktplcRef = {
           name = "pretty-ts-errors";
           publisher = "yoavbls";
-          version = "0.5.4";
-          hash = "sha256-SMEqbpKYNck23zgULsdnsw4PS20XMPUpJ5kYh1fpd14=";
+          version = "0.6.1";
+          hash = "sha256-LvX21nEjgayNd9q+uXkahmdYwzfWBZOhQaF+clFUUF4=";
         };
         meta = {
           description = "Make TypeScript errors prettier and human-readable in VSCode";

pkgs/applications/networking/browsers/firefox-bin/release_sources.nix

@@ -67,8 +67,8 @@ in
 , glib
 , gnum4
 , gtk3
-, icu72
 , icu73
+, icu74
 , libGL
 , libGLU
 , libevent
@@ -268,6 +268,12 @@ buildStdenv.mkDerivation {
       hash = "sha256-2IpdSyye3VT4VB95WurnyRFtdN1lfVtYpgEiUVhfNjw=";
     })
   ]
+  ++ lib.optionals ((lib.versionAtLeast version "129" && lib.versionOlder version "134") || lib.versionOlder version "128.6.0") [
+    # Python 3.12.8 compat
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1935621
+    # https://phabricator.services.mozilla.com/D231480
+    ./mozbz-1935621-attachment-9442305.patch
+  ]
   ++ [
     # LLVM 19 turned on WASM reference types by default, exposing a bug
     # that broke the Mozilla WASI build. Supposedly, it has been fixed
@@ -286,10 +292,6 @@ buildStdenv.mkDerivation {
       url = "https://hg.mozilla.org/integration/autoland/raw-rev/23a9f6555c7c";
       hash = "sha256-CRywalJlRMFVLITEYXxpSq3jLPbUlWKNRHuKLwXqQfU=";
     })
-    # Python 3.12.8 compat
-    # https://bugzilla.mozilla.org/show_bug.cgi?id=1935621
-    # https://phabricator.services.mozilla.com/D231480
-    ./mozbz-1935621-attachment-9442305.patch
     # Fix for missing vector header on macOS
     # https://bugzilla.mozilla.org/show_bug.cgi?id=1939405
     ./firefox-mac-missing-vector-header.patch
@@ -526,11 +528,9 @@ buildStdenv.mkDerivation {
     ++ lib.optional  sndioSupport sndio
     ++ lib.optionals waylandSupport [ libxkbcommon libdrm ]
   ))
-  # icu73 changed how it follows symlinks which breaks in the firefox sandbox
-  # https://bugzilla.mozilla.org/show_bug.cgi?id=1839287
   # icu74 fails to build on 127 and older
   # https://bugzilla.mozilla.org/show_bug.cgi?id=1862601
-  ++ [ (if (lib.versionAtLeast version "115") then icu73 else icu72) ]
+  ++ [ (if (lib.versionAtLeast version "134") then icu74 else icu73) ]
   ++ lib.optional  gssSupport libkrb5
   ++ lib.optional  jemallocSupport jemalloc
   ++ extraBuildInputs;

pkgs/applications/networking/browsers/firefox/common.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "128.5.2esr";
+  version = "128.6.0esr";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "1e5b6bfe63279acc8b7350c08f2767620f01b979057f50ab1952331b6efc05124f7c9530a7cc793b0f3616344334a2903fe5712bbb45418e936684d294c5530a";
+    sha512 = "49bce966e062766861712bd65cca46a438b339fe31598f69e4fe64da78ef6f8b4581c1d502341ef1c032aafaab2f4f88e69cb93a0b845ba7173fec277ae695b5";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-128.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "133.0.3";
+  version = "134.0";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "ce48beaa5bb1717d9b6dbfff035b1bb5de1456df14b6a91adfaf3ccfb7ac550ab7ee854546231424a920e01d981825253609fce2ec326c4aa1ca316bbbdb31f8";
+    sha512 = "1275a686dc0a27b48df4ae05616511512f676e03474e3095b2521eac25a385d345aa3e8786716dbe812af49e07d72b32772479089d648968e2004ca0c9c35344";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -171,13 +171,13 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-fvSy0gnSQkpSCfKlmOQW+ItMi6utocsDB6ex4RZMvGo=",
+    "hash": "sha256-cHuBfF0R/n03Y5KNnbdsWcGeX24+NPT2HnsQpTivCf0=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.42.0",
+    "rev": "v2.45.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-oDMKf39uNMO9/kyiZ1IuZlj2yIF1q5Z3wewxEBh3yso="
+    "vendorHash": "sha256-iNY6Jz/SKOLynx33smDFbg371Wa31CouNtrOuV7lkcw="
   },
   "bitwarden": {
     "hash": "sha256-zvl9B1RhViJ83/7i9ab1KvQc9Yfpzq3c1JIz+bzwVmM=",

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -45,6 +45,12 @@ stdenv.mkDerivation (finalAttrs: rec {
     sha256 = "sha256-6+DOJPeVzP4x0UsN9MlZRAyusapBTICX0BuyvVBQBC8=";
   };
 
+  postPatch = lib.optionals stdenv.hostPlatform.isDarwin ''
+    # same error as https://github.com/pocoproject/poco/issues/4586
+    substituteInPlace zlib/zutil.h \
+      --replace-fail '#if defined(MACOS) || defined(TARGET_OS_MAC)' '#if defined(MACOS)'
+  '';
+
   nativeBuildInputs = [ jam ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [

pkgs/applications/version-management/p4/default.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "7.14.1";
+  version = "7.18.0";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-62+2N+TjKq+TdJuaOizpiSvGQnkC2+VhBX+3A2QepwI=";
+    hash = "sha256-9+XK+rDyV2V4RIAfMR2EUcSf6AEpQKAOLDp6RXb5Wb8=";
   };
 
   sourceRoot = ".";

pkgs/by-name/al/alt-tab-macos/package.nix

@@ -3,7 +3,7 @@
   callPackage,
   lib,
   fetchRepoProject,
-  writeScript,
+  nix-update-script,
   cmake,
   directx-shader-compiler,
   glslang,
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amdvlk";
-  version = "2024.Q4.2";
+  version = "2024.Q4.3";
 
   src = fetchRepoProject {
     name = "amdvlk-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${finalAttrs.version}";
-    hash = "sha256-16eHtdxoSCVEPQNvi7Kuo7CP4yddMsZqpuRsWobEOnw=";
+    hash = "sha256-PQxTRCSOk8E6y7pXyqxt1QKtRsqnrj/9dQZ8NjnUbhA=";
   };
 
   buildInputs =
@@ -102,23 +102,14 @@ stdenv.mkDerivation (finalAttrs: {
   # Keep the rpath, otherwise vulkaninfo and vkcube segfault
   dontPatchELF = true;
 
-  passthru.updateScript = writeScript "update.sh" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p coreutils curl gnused jq common-updater-scripts
-
-    packagePath="pkgs/by-name/am/amdvlk/package.nix"
-
-    function setHash() {
-      sed -i $packagePath -e 's,sha256 = "[^'"'"'"]*",sha256 = "'"$1"'",'
-    }
-
-    version="$(curl -sL "https://api.github.com/repos/GPUOpen-Drivers/AMDVLK/releases?per_page=1" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
-    sed -i $packagePath -e 's/version = "[^'"'"'"]*"/version = "'"$version"'"/'
-
-    setHash "$(nix-instantiate --eval -A lib.fakeSha256 | xargs echo)"
-    hash="$(nix to-base64 $(nix-build -A amdvlk 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true))"
-    setHash "$hash"
-  '';
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--url"
+      "https://github.com/GPUOpen-Drivers/AMDVLK"
+      "--version-regex"
+      "v-(.*)"
+    ];
+  };
 
   passthru.impureTests = {
     amdvlk = callPackage ./test.nix { };

pkgs/by-name/am/amdvlk/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.47.0";
+  version = "1.48.0";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     tag = "v${version}";
-    hash = "sha256-yr5ik+DxOcW3UFK6KiPvheGlDdwSz2s7DKm2vAsSwG0=";
+    hash = "sha256-M9Usz+qQH4QNA/0TgtvjuqwnaCpyxr9OMIc8pJ/FjDE=";
   };
 
   vendorHash = "sha256-A0zy5O2+afhn6jAfLd/k7wvL3z1PVI0e6bO39cnYrhM=";

pkgs/by-name/be/bearer/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "boxbuddy";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "Dvlv";
     repo = "BoxBuddyRS";
     rev = version;
-    hash = "sha256-W+SeleZsQbHw0sS7du8AylERt1FBxxLUvnxfvS9YQGM=";
+    hash = "sha256-wtAc5h3bm/X1aCPGjl30NaM7XR602q5NdlamUQvADDo=";
   };
 
-  cargoHash = "sha256-nFBLhCxHmdF7WvYcmt5aLVhCO/q1LLgMldc7nofX+CU=";
+  cargoHash = "sha256-oyxO92wXVN7kbIcTy5OAaqK/ySnetpkFwcop34ERpxs=";
 
   # The software assumes it is installed either in flatpak or in the home directory
   # so the xdg data path needs to be patched here

pkgs/by-name/bo/boxbuddy/package.nix

@@ -7,7 +7,6 @@
   makeWrapper,
   pkg-config,
   libgit2,
-  oniguruma,
   zlib,
   buildPackages,
   withClipboard ? true,
@@ -33,11 +32,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  # TODO: once https://github.com/Canop/broot/issues/956 is released, oniguruma can be removed.
   buildInputs =
     [
       libgit2
-      oniguruma
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       zlib

pkgs/by-name/br/broot/package.nix

@@ -0,0 +1,35 @@
+diff --git a/casadi/interfaces/clang/clang_compiler.hpp b/casadi/interfaces/clang/clang_compiler.hpp
+index 7f54853..9f8d4b1 100644
+--- a/casadi/interfaces/clang/clang_compiler.hpp
++++ b/casadi/interfaces/clang/clang_compiler.hpp
+@@ -52,7 +52,7 @@
+ #include "llvm/IR/LLVMContext.h"
+ //#include "llvm/IR/Verifier.h"
+ #include <llvm/Support/FileSystem.h>
+-#include <llvm/Support/Host.h>
++#include <llvm/TargetParser/Host.h>
+ #include <llvm/Support/ManagedStatic.h>
+ #include <llvm/Support/Path.h>
+ #include <llvm/Support/TargetSelect.h>
+diff --git a/cmake/FindCLANG.cmake b/cmake/FindCLANG.cmake
+index 4edf60b..f23a348 100644
+--- a/cmake/FindCLANG.cmake
++++ b/cmake/FindCLANG.cmake
+@@ -16,7 +16,7 @@ set(CLANG_CXX_FLAGS "-fPIC -fvisibility-inlines-hidden -ffunction-sections -fdat
+ set(CLANG_INCLUDE_DIR ${LLVM_INSTALL_PREFIX}/include)
+ 
+ # All clang libraries
+-set(CLANG_DEP clangFrontend clangDriver clangCodeGen clangRewriteFrontend clangSerialization clangParse clangSema clangAnalysis clangEdit clangAST clangLex clangBasic ${LLVM_DEP})
++set(CLANG_DEP clangFrontend clangDriver clangCodeGen clangRewriteFrontend clangSerialization clangParse clangSema clangAPINotes clangAnalysis clangEdit clangAST clangLex clangBasic ${LLVM_DEP})
+ 
+ # Get libraries
+ set(CLANG_LIBRARIES)
+@@ -86,7 +86,7 @@ set(CLANG_INCLUDE_DIR ${CLANG_LLVM_INCLUDE_DIR})
+ 
+ # All clang libraries
+ set(CLANG_DEP clangFrontend clangDriver clangCodeGen clangRewriteFrontend clangSerialization
+-              clangParse clangSema clangAnalysis clangEdit clangAST clangLex clangBasic)
++              clangParse clangSema clangAPINotes clangAnalysis clangEdit clangAST clangLex clangBasic)
+ 
+ # Get libraries
+ foreach(D ${CLANG_DEP})

pkgs/by-name/ca/casadi/clang-19.diff

@@ -17,8 +17,9 @@
   lib,
   ipopt,
   lapack,
-  llvmPackages_17, # llvm/Support/Host.h required by casadi 3.6.5 and not available in llvm 18
+  llvmPackages,
   mumps,
+  ninja,
   osqp,
   pkg-config,
   pythonSupport ? false,
@@ -52,6 +53,9 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/casadi/casadi/pull/3899/commits/274f4b23f73e60c5302bec0479fe1e92682b63d2.patch";
       hash = "sha256-3GWEWlN8dKLD6htpnOQLChldcT3hE09JWLeuCfAhY+4=";
     })
+    # update include file path and link with clangAPINotes
+    # https://github.com/casadi/casadi/issues/3969
+    ./clang-19.diff
   ];
 
   postPatch =
@@ -64,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
       # nix provide lib/clang headers in libclang, not in llvm.
       substituteInPlace casadi/interfaces/clang/CMakeLists.txt --replace-fail \
         '$'{CLANG_LLVM_LIB_DIR} \
-        ${lib.getLib llvmPackages_17.libclang}/lib
+        ${lib.getLib llvmPackages.libclang}/lib
 
       # help casadi find its own libs
       substituteInPlace casadi/core/casadi_os.cpp --replace-fail \
@@ -101,6 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    ninja
     pkg-config
   ];
 
@@ -118,9 +123,9 @@ stdenv.mkDerivation (finalAttrs: {
       hpipm
       ipopt
       lapack
-      llvmPackages_17.clang
-      llvmPackages_17.libclang
-      llvmPackages_17.llvm
+      llvmPackages.clang
+      llvmPackages.libclang
+      llvmPackages.llvm
       mumps
       osqp
       proxsuite
@@ -140,7 +145,7 @@ stdenv.mkDerivation (finalAttrs: {
       python3Packages.numpy
       python3Packages.python
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages_17.openmp ];
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.openmp ];
 
   cmakeFlags = [
     (lib.cmakeBool "WITH_PYTHON" pythonSupport)