staging-next 2025-05-07 (#404858)

```nix

haskellPackages.haskell-ci.overrideScope (self: super: {

  Cabal = self.Cabal_3_14_1_1;

  Cabal = self.Cabal_3_14_2_0;

})

```

If dependencies should be resolved at runtime, use `--suffix` to append fallback values to `PATH`.

There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.

There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.

`wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.

Using the `makeBinaryWrapper` implementation is usually preferred, as it creates a tiny _compiled_ wrapper executable, that can be used as a shebang interpreter. This is needed mostly on Darwin, where shebangs cannot point to scripts, [due to a limitation with the `execve`-syscall](https://stackoverflow.com/questions/67100831/macos-shebang-with-absolute-path-not-working). Compiled wrappers generated by `makeBinaryWrapper` can be inspected with `less <path-to-wrapper>` - by scrolling past the binary data you should be able to see the shell command that generated the executable and there see the environment variables that were injected into the wrapper.

However, `makeWrapper` is more flexible and implements more arguments.

Use `makeWrapper` if you need the wrapper to use shell features (e.g. look up environment variables) at runtime.

### `remove-references-to -t` \<storepath\> [ `-t` \<storepath\> ... ] \<file\> ... {#fun-remove-references-to}

Removes the references of the specified files to the specified store files. This is done without changing the size of the file by replacing the hash by `eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`, and should work on compiled executables. This is meant to be used to remove the dependency of the output on inputs that are known to be unnecessary at runtime. Of course, reckless usage will break the patched programs.

lusc_luv,,,,,,

lush.nvim,,,https://luarocks.org/dev,,,teto

luuid,,,,20120509-2,,

luv,,,,1.48.0-2,,

lyaml,,,,,,lblasc

lz.n,,,,,,mrcjkb

lze,,,,,,birdee

- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.

- GNOME has been updated to version 48.

  - `decibels` music player is now installed by default. You can disable it using [](#opt-environment.gnome.excludePackages).

  - `gnome-shell-extensions` extension collection (which included GNOME Classic extensions, Apps Menu, and User Themes, among others) are no longer installed by default. You can install them again with [](#opt-services.xserver.desktopManager.gnome.sessionPath).

  - Option [](#opt-services.gnome.core-developer-tools.enable) now also installs `sysprof` and `d-spy`.

  - Option `services.gnome.core-utilities.enable` has been renamed to [](#opt-services.gnome.core-apps.enable).

  - `cantarell-fonts`, `source-code-pro` and `source-sans` fonts are no longer installed by default. They have been replaced by `adwaita-fonts`.

  Refer to the [GNOME release notes](https://release.gnome.org/48/) for more details.

- The `intel` video driver for X.org (from the xf86-video-intel package, which was previously removed because it was non-functional) has been fixed and the driver has been re-introduced.

- The Mattermost module ([`services.mattermost`](#opt-services.mattermost.enable)) and packages (`mattermost` and `mmctl`) have been substantially updated:

let

  cfg = config.services.speechd;

  inherit (lib)

    getExe

    mkEnableOption

    mkIf

    mkPackageOption

    package = mkPackageOption pkgs "speechd" { };

  };

  # FIXME: speechd 0.12 (or whatever the next version is)

  # will support socket activation, so switch to that once it's out.

  config = mkIf cfg.enable {

    environment = {

      systemPackages = [ cfg.package ];

      sessionVariables.SPEECHD_CMD = getExe cfg.package;

    };

    systemd.packages = [ cfg.package ];

    # have to set `wantedBy` since `systemd.packages` ignores `[Install]`

    systemd.user.sockets.speech-dispatcher.wantedBy = [ "sockets.target" ];

  };

}