Merge branch 'staging' into staging-next

  inputs =

    basePackages

    ++ lib.optionals stdenv.hostPlatform.isLinux [ inotify-tools ]

    ++ lib.optionals stdenv.hostPlatform.isDarwin (

      with darwin.apple_sdk.frameworks;

      [

        CoreFoundation

        CoreServices

      ]

    );

    ++ lib.optionals stdenv.hostPlatform.isLinux [ inotify-tools ];

  # define shell startup command

  hooks = ''

it. However, the non-standard package sets are not tested regularly and, as a

result, contain fewer working packages. The corresponding package set for GHC

9.4.8 is `haskell.packages.ghc948`. In fact `haskellPackages` (at the time of writing) is just an alias

for `haskell.packages.ghc966`:

for `haskell.packages.ghc984`:

Every package set also re-exposes the GHC used to build its packages as `haskell.packages.*.ghc`.

: Whether to build (HTML) documentation using [haddock][haddock].

Defaults to `true` if supported.

`testTarget`

: Name of the test suite to build and run. If unset, all test suites will be executed.

`testTargets`

: Names of the test suites to build and run. If unset, all test suites will be executed.

`preCompileBuildDriver`

: Shell code to run before compiling `Setup.hs`.

nixpkgs, but also use local Nix expressions like this: `hpkgs: [

(hpkgs.callPackage ./my-project.nix { }) ]`.

`extraDependencies`

: Extra dependencies, in the form of cabal2nix build attributes. An example use

case is when you have Haskell scripts that use libraries that don't occur in

your packages' dependencies. Example: `hpkgs: {libraryHaskellDepends =

[ hpkgs.releaser ]}`. Defaults to `hpkgs: { }`.

`nativeBuildInputs`

: Expects a list of derivations to add as build tools to the build environment.

This is the place to add packages like `cabal-install`, `doctest` or `hlint`.

```nix

haskellPackages.haskell-ci.overrideScope (self: super: {

  Cabal = self.Cabal_3_14_1_0;

  Cabal = self.Cabal_3_14_1_1;

})

```

- GCC has been updated from GCC 13 to GCC 14.

  This introduces some backwards‐incompatible changes; see the [upstream porting guide](https://gcc.gnu.org/gcc-14/porting_to.html) for details.

- The default GHC version has been updated from 9.6 to 9.8.

  `haskellPackages` also uses Stackage LTS 23 (instead of LTS 22) as a baseline.

- LLVM has been updated from LLVM 16 (on Darwin) and LLVM 18 (on other platforms) to LLVM 19.

  This introduces some backwards‐incompatible changes; see the [upstream release notes](https://releases.llvm.org/) for details.

- `mkBinaryCache` now defaults to using `zstd` compression for the binary caches it creates. The previous `xz` compression method can be used by passing `compression = "xz";`.

- `nodejs_latest` was updated from 23.x to 24.x. `nodejs_23` has been removed in favor of `nodejs_24`.

- `nodejs_18` package was removed due to upstream End-of-Life in April 2025.

- `nodePackages."@commitlint/config-conventional"` has been removed, as it is a library, and projects should depend on it instead.

    - `lib.types.coercedTo`

    - `lib.types.either`

- The `testTarget` argument of `haskellPackages.mkDerivation` has been deprecated in favour of `testTargets`.

  `testTarget` took a space separated string of targets, whereas the new `testTargets` argument takes a list of targets.

  For instance, `testTarget = "foo bar baz"` should become `testTargets = [ "foo" "bar" "baz" ]`.

- Plasma 5 and Qt 5 based versions of associated software are deprecated in NixOS 25.05, and will be removed in NixOS 25.11. Users are encouraged to upgrade to Plasma 6.

- `rustPlatform.buildRustPackage` stops handling the deprecated argument `cargoSha256`. Out-of-tree packages that haven't migrated from `cargoSha256` to `cargoHash` now receive errors.

The following flags are disabled by default and should be enabled with `hardeningEnable` for packages that take untrusted input like network services.

#### `nostrictaliasing` {#nostrictaliasing}

This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.

#### `pie` {#pie}

This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for

      fullName = "BSD Protection License";

    };

    bsdSourceCode = {

      spdxId = "BSD-Source-Code";

      fullName = "BSD Source Code Attribution";

    };

    bsl11 = {

      spdxId = "BUSL-1.1";

      fullName = "Business Source License 1.1";

      fullName = "Common Public License 1.0";

    };

    cronyx = {

      spdxId = "Cronyx";

      fullName = "Cronyx License";

    };

    curl = {

      spdxId = "curl";

      fullName = "curl License";

      fullName = "MIT No Attribution";

    };

    mitOpenGroup = {

      spdxId = "MIT-open-group";

      fullName = "MIT Open Group variant";

    };

    mpl10 = {

      spdxId = "MPL-1.0";

      fullName = "Mozilla Public License 1.0";

      fullName = "Unicode License Agreement - Data Files and Software (2016)";

    };

    unicodeTOU = {

      spdxId = "Unicode-TOU";

      fullName = "Unicode Terms of Use";

    };

    unlicense = {

      spdxId = "Unlicense";

      fullName = "The Unlicense";