haskellPackages: stackage LTS 24.23 -> LTS 24.25

pkgs/by-name/hl/hledger-check-fancyassertions/package.nix

@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation rec {
   src = fetchurl {
     name = "hledger-check-fancyassertion-${version}.hs";
     url = "https://raw.githubusercontent.com/simonmichael/hledger/hledger-lib-${version}/bin/hledger-check-fancyassertions.hs";
-    hash = "sha256-p1JvPHSB5hkfZsTq1sSL0mxCRkhZu1zkpXTELVNFE64=";
+    hash = "sha256-Zokrrcy9CfVV2tNI1DDsjqC+PcTdlMdit4O4Y1gP1O4=";
   };
 
   dontUnpack = true;

pkgs/data/misc/hackage/pin.json

@@ -1,6 +1,6 @@
 {
-  "commit": "598216fa2815cc50449239d72043b12a04a83709",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/598216fa2815cc50449239d72043b12a04a83709.tar.gz",
-  "sha256": "030yfbdzzdsxfjin97kl1kzqqnvkvjvjfns3p84xkq59fw8096cr",
-  "msg": "Update from Hackage at 2025-10-22T21:20:29Z"
+  "commit": "52d973cb0421cdffbdc3e26d40c8202034c6a873",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/52d973cb0421cdffbdc3e26d40c8202034c6a873.tar.gz",
+  "sha256": "007nwq696dcbppgpamlc20xaj0p7drccg15xig8dngbliv04cgjy",
+  "msg": "Update from Hackage at 2025-12-26T08:56:01Z"
 }

pkgs/development/compilers/ghc/common-hadrian.nix

@@ -342,6 +342,10 @@ let
     ]
     ++ lib.optionals targetPlatform.useAndroidPrebuilt [
       "*.*.ghc.c.opts += -optc-std=gnu99"
+    ]
+    # Inform GHC that we can't load dynamic libraries which forces iserv-proxy to load static libraries.
+    ++ lib.optionals targetPlatform.isStatic [
+      "*.ghc.cabal.configure.opts += --flags=-dynamic-system-linker"
     ];
 
   # Splicer will pull out correct variations

pkgs/development/haskell-modules/cabal2nix-unstable/cabal2nix.nix

@@ -35,10 +35,10 @@
 }:
 mkDerivation {
   pname = "cabal2nix";
-  version = "2.20.1-unstable-2025-11-11";
+  version = "2.20.1-unstable-2025-11-20";
   src = fetchzip {
-    url = "https://github.com/NixOS/cabal2nix/archive/a152152295a9fa6698583e84a2b8c7eee1446296.tar.gz";
-    sha256 = "1jpgzyc360g5snvc5ji6wqfvbsc7siwxvhrwafzzfg762niq0c49";
+    url = "https://github.com/NixOS/cabal2nix/archive/459859839cfe4fb352a29c1a72a1c4f0f537a1b8.tar.gz";
+    sha256 = "1443hlbz29y2dn22kf91zx7g284zp3l2vgw6jg4wgx66v2sxrqii";
   };
   postUnpack = "sourceRoot+=/cabal2nix; echo source root reset to $sourceRoot";
   isLibrary = true;

pkgs/development/haskell-modules/cabal2nix-unstable/distribution-nixpkgs.nix

@@ -18,10 +18,10 @@
 }:
 mkDerivation {
   pname = "distribution-nixpkgs";
-  version = "1.7.1.1-unstable-2025-11-11";
+  version = "1.7.1.1-unstable-2025-11-20";
   src = fetchzip {
-    url = "https://github.com/NixOS/cabal2nix/archive/a152152295a9fa6698583e84a2b8c7eee1446296.tar.gz";
-    sha256 = "1jpgzyc360g5snvc5ji6wqfvbsc7siwxvhrwafzzfg762niq0c49";
+    url = "https://github.com/NixOS/cabal2nix/archive/459859839cfe4fb352a29c1a72a1c4f0f537a1b8.tar.gz";
+    sha256 = "1443hlbz29y2dn22kf91zx7g284zp3l2vgw6jg4wgx66v2sxrqii";
   };
   postUnpack = "sourceRoot+=/distribution-nixpkgs; echo source root reset to $sourceRoot";
   enableSeparateDataOutput = true;

pkgs/development/haskell-modules/cabal2nix-unstable/hackage-db.nix

@@ -17,10 +17,10 @@
 }:
 mkDerivation {
   pname = "hackage-db";
-  version = "2.1.3-unstable-2025-11-11";
+  version = "2.1.3-unstable-2025-11-20";
   src = fetchzip {
-    url = "https://github.com/NixOS/cabal2nix/archive/a152152295a9fa6698583e84a2b8c7eee1446296.tar.gz";
-    sha256 = "1jpgzyc360g5snvc5ji6wqfvbsc7siwxvhrwafzzfg762niq0c49";
+    url = "https://github.com/NixOS/cabal2nix/archive/459859839cfe4fb352a29c1a72a1c4f0f537a1b8.tar.gz";
+    sha256 = "1443hlbz29y2dn22kf91zx7g284zp3l2vgw6jg4wgx66v2sxrqii";
   };
   postUnpack = "sourceRoot+=/hackage-db; echo source root reset to $sourceRoot";
   isLibrary = true;

pkgs/development/haskell-modules/cabal2nix-unstable/language-nix.nix

@@ -9,14 +9,15 @@
   lib,
   parsec-class,
   pretty,
+  process,
   QuickCheck,
 }:
 mkDerivation {
   pname = "language-nix";
-  version = "2.3.0-unstable-2025-11-11";
+  version = "2.3.0-unstable-2025-11-20";
   src = fetchzip {
-    url = "https://github.com/NixOS/cabal2nix/archive/a152152295a9fa6698583e84a2b8c7eee1446296.tar.gz";
-    sha256 = "1jpgzyc360g5snvc5ji6wqfvbsc7siwxvhrwafzzfg762niq0c49";
+    url = "https://github.com/NixOS/cabal2nix/archive/459859839cfe4fb352a29c1a72a1c4f0f537a1b8.tar.gz";
+    sha256 = "1443hlbz29y2dn22kf91zx7g284zp3l2vgw6jg4wgx66v2sxrqii";
   };
   postUnpack = "sourceRoot+=/language-nix; echo source root reset to $sourceRoot";
   libraryHaskellDepends = [
@@ -33,6 +34,7 @@ mkDerivation {
     lens
     parsec-class
     pretty
+    process
     QuickCheck
   ];
   homepage = "https://github.com/NixOS/cabal2nix/tree/master/language-nix#readme";

pkgs/development/haskell-modules/configuration-common.nix

@@ -257,6 +257,10 @@ with haskellLib;
   ### END HASKELL-LANGUAGE-SERVER SECTION ###
   ###########################################
 
+  # network < 3.2.8
+  # bound only required when running under WINE: https://github.com/haskell/network/issues/604
+  iserv-proxy = doJailbreak super.iserv-proxy;
+
   # Test ldap server test/ldap.js is missing from sdist
   # https://github.com/supki/ldap-client/issues/18
   ldap-client-og = dontCheck super.ldap-client-og;
@@ -605,42 +609,36 @@ with haskellLib;
   # but we want e.g. completions as well. See
   # https://web.archive.org/web/20160724083703/https://git-annex.branchable.com/bugs/bash_completion_file_is_missing_in_the_6.20160527_tarball_on_hackage/
   # or git-annex @ 3571b077a1244330cc736181ee04b4d258a78476 doc/bugs/bash_completion_file_is_missing*
-  git-annex = lib.pipe super.git-annex (
-    [
-      (overrideCabal (drv: {
-        src = pkgs.fetchgit {
-          name = "git-annex-${super.git-annex.version}-src";
-          url = "git://git-annex.branchable.com/";
-          rev = "refs/tags/" + super.git-annex.version;
-          sha256 = "sha256-HkUrc9T8qpGsONIuM7ciKbx4vuJTOLFNxneIPte0wv4=";
-          # delete android and Android directories which cause issues on
-          # darwin (case insensitive directory). Since we don't need them
-          # during the build process, we can delete it to prevent a hash
-          # mismatch on darwin.
-          postFetch = ''
-            rm -r $out/doc/?ndroid*
-          '';
-        };
+  git-annex = lib.pipe super.git-annex [
+    (overrideCabal (drv: {
+      src = pkgs.fetchgit {
+        name = "git-annex-${super.git-annex.version}-src";
+        url = "git://git-annex.branchable.com/";
+        rev = "refs/tags/" + super.git-annex.version;
+        sha256 = "sha256-Cnkohi1sl7kS4JECCsNDbxXKIWBus1gDcWoO3xZtXoM=";
+        # delete android and Android directories which cause issues on
+        # darwin (case insensitive directory). Since we don't need them
+        # during the build process, we can delete it to prevent a hash
+        # mismatch on darwin.
+        postFetch = ''
+          rm -r $out/doc/?ndroid*
+        '';
+      };
 
-        patches = drv.patches or [ ] ++ [
-          # Prevent .desktop files from being installed to $out/usr/share.
-          # TODO(@sternenseemann): submit upstreamable patch resolving this
-          # (this should be possible by also taking PREFIX into account).
-          ./patches/git-annex-no-usr-prefix.patch
-        ];
+      patches = drv.patches or [ ] ++ [
+        # Prevent .desktop files from being installed to $out/usr/share.
+        # TODO(@sternenseemann): submit upstreamable patch resolving this
+        # (this should be possible by also taking PREFIX into account).
+        ./patches/git-annex-no-usr-prefix.patch
+      ];
 
-        postPatch = ''
-          substituteInPlace Makefile \
-            --replace-fail 'InstallDesktopFile $(PREFIX)/bin/git-annex' \
-                           'InstallDesktopFile git-annex'
-        '';
-      }))
-    ]
-    ++ lib.optionals (lib.versionOlder self.ghc.version "9.10") [
-      (disableCabalFlag "OsPath")
-      (addBuildDepends [ self.filepath-bytestring ])
-    ]
-  );
+      postPatch = ''
+        substituteInPlace Makefile \
+          --replace-fail 'InstallDesktopFile $(PREFIX)/bin/git-annex' \
+                         'InstallDesktopFile git-annex'
+      '';
+    }))
+  ];
 
   # Too strict bounds on servant
   # Pending a hackage revision: https://github.com/berberman/arch-web/commit/5d08afee5b25e644f9e2e2b95380a5d4f4aa81ea#commitcomment-89230555
@@ -659,6 +657,16 @@ with haskellLib;
   # https://github.com/awakesecurity/nix-deploy/issues/35
   nix-deploy = doJailbreak super.nix-deploy;
 
+  call-stack = appendPatches [
+    # Fixes test suites with GHC >= 9.10
+    (pkgs.fetchpatch {
+      name = "call-stack-tests-normalize-pkg-name.patch";
+      url = "https://github.com/sol/call-stack/commit/cbbee23ce309d18201951e16a8b6d30b57e2bdf9.patch";
+      sha256 = "sha256-xkdjf8zXW+UMxot2Z8WYYmvAJsT+VGKXWGt19mZZwCg=";
+      includes = [ "test/Data/CallStackSpec.hs" ];
+    })
+  ] super.call-stack;
+
   # Too strict upper bound on algebraic-graphs
   # https://github.com/awakesecurity/nix-graph/issues/5
   nix-graph = doJailbreak super.nix-graph;
@@ -2862,12 +2870,12 @@ with haskellLib;
         doJailbreak
         # 2022-12-02: Hackage release lags behind actual releases: https://github.com/PostgREST/postgrest/issues/2275
         (overrideSrc rec {
-          version = "14.0";
+          version = "14.1";
           src = pkgs.fetchFromGitHub {
             owner = "PostgREST";
             repo = "postgrest";
             rev = "v${version}";
-            hash = "sha256-GokYeVDuVdIbowU6xE3l8iaGbH4jnpqQFy/E+sb/Unw=";
+            hash = "sha256-VGmo0Y8Q86euPlu3AhMmcmy3rintNy6s9efpUaliBWY=";
           };
         })
       ];
@@ -3014,24 +3022,14 @@ with haskellLib;
   # https://github.com/mchav/snappy-hs/commit/400490df38e0db7f353c0427f034a231bdf73098#r167007963
   snappy-hs = doJailbreak super.snappy-hs;
 
+  # Too strict upper bound on doctest
+  # https://github.com/awakesecurity/proto3-wire/pull/111
   proto3-wire = appendPatches [
     (fetchpatch {
-      # https://github.com/awakesecurity/proto3-wire/pull/108
       name = "add-reverse-encoders-for-packed-repeated-fields.patch";
-      url = "https://github.com/awakesecurity/proto3-wire/commit/d4376fb6f1c1ac03ee8ec5c5793700ca6508ea70.patch";
-      hash = "sha256-vtEYg/jLoTn1YRVhQJi6kyta+U4XiWeS7i1ZSN7BYf8=";
-      includes = [
-        "**.cabal"
-        "*.hs"
-      ];
-    })
-    (fetchpatch {
-      # https://github.com/awakesecurity/proto3-wire/pull/111
-      name = "support-LTS-24.patch";
-      url = "https://github.com/awakesecurity/proto3-wire/commit/35fd88c4daf6643135db6da9ab6ed6d6f33eb3de.patch";
+      url = "https://github.com/awakesecurity/proto3-wire/commit/fcc53d9935b64b6d8aaf65c8cef17f4bbed56867.patch";
       hash = "sha256-GzXlweRshVLA29xVHhJSRIU40y+KtAplIqfvp0I8cY0=";
     })
-
   ] super.proto3-wire;
 
   # 2024-07-27: building test component requires non-trivial custom build steps
@@ -3092,7 +3090,7 @@ with haskellLib;
   http2-tls =
     lib.warnIf (lib.versionAtLeast self.tls.version "2.1.10")
       "haskellPackages.http2-tls: tls override can be removed"
-      (super.http2-tls.override { tls = self.tls_2_1_12; });
+      (super.http2-tls.override { tls = self.tls_2_1_13; });
 
   # Relax http2 version bound (5.3.9 -> 5.3.10)
   # https://github.com/well-typed/grapesy/issues/297
@@ -3176,7 +3174,7 @@ with haskellLib;
       ]
     ) super)
     what4
-    what4_1_7
+    what4_1_7_2
     ;
 
   copilot-theorem = lib.pipe super.copilot-theorem [
@@ -3188,6 +3186,12 @@ with haskellLib;
     doJailbreak super.egison-pattern-src-th-mode
   );
 
+  # 2025-12-27: doctests broken with -Wx-partial warning
+  # https://github.com/junjihashimoto/th-cas/issues/1
+  th-cas = overrideCabal {
+    testTargets = [ "spec" ];
+  } super.th-cas;
+
   # 2025-04-09: jailbreak to allow base >= 4.17, hasql >= 1.6, hasql-transaction-io >= 0.2
   hasql-streams-core = warnAfterVersion "0.1.0.0" (doJailbreak super.hasql-streams-core);
 
@@ -3238,29 +3242,15 @@ with haskellLib;
       # https://github.com/tweag/monad-bayes/issues/378
       (doJailbreak super.monad-bayes);
 
-  crucible =
-    lib.pipe
-      (super.crucible.override {
-        what4 = self.what4_1_7;
-      })
-      [
-        # 2025-04-13: jailbreak to allow th-abstraction >= 0.7
-        (warnAfterVersion "0.7.2")
-        doJailbreak
-
-        # Prevent clashes with now exported Prelude.foldl'
-        (appendPatch (
-          pkgs.fetchpatch {
-            name = "base-4.20-foldl'.patch";
-            url = "https://github.com/GaloisInc/crucible/commit/10f372e4b0389dd3966e04163dcd67d71e651709.patch";
-            relative = "crucible";
-            sha256 = "sha256-frxTs5SB1ENjH+X0lIlQ8k6pDIDOANylrqIOQpEtObU=";
-          }
-        ))
-      ];
+  # 2025-04-13: jailbreak to allow th-abstraction >= 0.7
+  crucible = doJailbreak (
+    super.crucible.override {
+      what4 = self.what4_1_7_2;
+    }
+  );
 
   crucible-llvm = super.crucible-llvm.override {
-    what4 = self.what4_1_7;
+    what4 = self.what4_1_7_2;
   };
 
   # Test suite invokes cabal-install in a way incompatible with our generic builder
@@ -3356,12 +3346,6 @@ with haskellLib;
   # 2025-5-15: Too strict bounds on base <4.19, see: https://github.com/zachjs/sv2v/issues/317
   sv2v = doJailbreak super.sv2v;
 
-  # 2025-09-20: New revision already on hackage.
-  nvfetcher = lib.pipe super.nvfetcher [
-    (warnAfterVersion "0.7.0.0")
-    doJailbreak
-  ];
-
   # 2025-06-25: Upper bounds of transformers and bytestring too strict,
   # as haskore 0.2.0.8 was released in 2016 and is quite outdated.
   # Tests fail with:
@@ -3398,25 +3382,6 @@ with haskellLib;
   stripe-signature = doJailbreak super.stripe-signature;
   stripe-wreq = doJailbreak super.stripe-wreq;
 
-  # 2025-10-12: gi-gtk was renamed to gi-gtk3
-  # https://github.com/haskell-gi/haskell-gi/issues/478
-  gi-gtk-hs =
-    appendPatches
-      [
-        (pkgs.fetchpatch {
-          name = "gi-gtk-hs-use-gtk3.patch";
-          url = "https://github.com/haskell-gi/haskell-gi/commit/e2ed85835499f70e119f050a2f37f22481f93886.patch";
-          sha256 = "sha256-MzxXtBNBbJJaNwTOrq/CYqK4yGfS4Yk5fQ38ihFcclA=";
-          relative = "gi-gtk-hs";
-        })
-      ]
-      (
-        super.gi-gtk-hs.override {
-          gi-gdk = self.gi-gdk3;
-          gi-gtk = self.gi-gtk3;
-        }
-      );
-
   # 2025-08-04: Disable failing testcases. It would feel bad to disable all the
   # checks in a cryptography related package.
   botan-low = overrideCabal (drv: {

pkgs/development/haskell-modules/configuration-darwin.nix

@@ -415,6 +415,10 @@ self: super:
       '';
     }) super.rio;
 
+    # Don't use homebrew icu on macOS
+    # https://github.com/NixOS/nixpkgs/issues/462046
+    text-icu = disableCabalFlag "homebrew" super.text-icu;
+
     # https://github.com/haskell-crypto/cryptonite/issues/360
     cryptonite = appendPatch ./patches/cryptonite-remove-argon2.patch super.cryptonite;
 

pkgs/development/haskell-modules/configuration-ghc-9.10.x.nix

@@ -88,7 +88,6 @@ in
   #
   # Test suite issues
   #
-  call-stack = dontCheck super.call-stack; # https://github.com/sol/call-stack/issues/19
   monad-dijkstra = dontCheck super.monad-dijkstra; # needs hlint 3.10
 
   # Workaround https://github.com/haskell/haskell-language-server/issues/4674

pkgs/development/haskell-modules/configuration-ghc-9.12.x.nix

@@ -106,8 +106,6 @@ with haskellLib;
   # Test suite issues
   #
 
-  call-stack = dontCheck super.call-stack; # https://github.com/sol/call-stack/issues/19
-
   relude = dontCheck super.relude;
 
   # https://gitlab.haskell.org/ghc/ghc/-/issues/25930

pkgs/development/haskell-modules/configuration-ghc-9.4.x.nix

@@ -96,6 +96,9 @@ self: super: {
     ++ drv.testFlags or [ ];
   }) (doJailbreak super.hpack);
 
+  # Later versions require unix >= 2.8 which is tricky to provide with GHC 9.4
+  crypton-x509-store = doDistribute self.crypton-x509-store_1_6_11;
+
   # 2022-08-01: Tests are broken on ghc 9.2.4: https://github.com/wz1000/HieDb/issues/46
   hiedb = dontCheck super.hiedb;
 
@@ -142,6 +145,8 @@ self: super: {
       "haskell-language-server has dropped support for ghc 9.4 in version 2.12.0.0, please use a newer ghc version or an older nixpkgs"
       (markBroken super.haskell-language-server);
 
+  hlint = doDistribute self.hlint_3_6_1;
+
   # directory-ospath-streaming requires the ospath API in core packages
   # filepath, directory and unix.
   stan = super.stan.override {