mweinelt · Oct 8, 2026 · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026
diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
@@ -140,6 +140,8 @@
 
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
 
+- `buildPythonPackage` and `buildPythonApplication` now set `__structuredAttrs = true` by default. You can explicitly set `__structuredAttrs = false` in packages broken by this change.
+
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
   - `linux-kernel.name` has been removed.
   - `linux-kernel.target` is available as the `target` parameter and passthru attribute on the kernel builders.

diff --git a/pkgs/by-name/al/alibuild/package.nix b/pkgs/by-name/al/alibuild/package.nix
@@ -38,7 +38,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     homepage = "https://alisw.github.io/alibuild/";
     description = "Build tool for ALICE experiment software";
-    license = lib.licenses.gpl3;
+    changelog = "https://github.com/alisw/alibuild/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ ktf ];
   };
 })
diff --git a/pkgs/by-name/am/amphetype/package.nix b/pkgs/by-name/am/amphetype/package.nix
@@ -44,9 +44,9 @@ python3Packages.buildPythonApplication {
     translitcodec
   ];
 
-  makeWrapperArgs = [
-    "\${qtWrapperArgs[@]}"
-  ];
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
 
   # no tests
   doCheck = false;

diff --git a/pkgs/by-name/an/ansible-lint/package.nix b/pkgs/by-name/an/ansible-lint/package.nix
@@ -87,7 +87,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test_discover_lintables_umlaut"
   ];
 
-  makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ ansible ]}" ];
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    "${lib.makeBinPath [ ansible ]}"
+  ];
 
   meta = {
     description = "Best practices checker for Ansible";

diff --git a/pkgs/by-name/ar/arandr/package.nix b/pkgs/by-name/ar/arandr/package.nix
@@ -69,13 +69,15 @@ buildPythonApplication (finalAttrs: {
 
   dontWrapGApps = true;
 
-  makeWrapperArgs = [
-    "--prefix"
-    "PATH"
-    ":"
-    (lib.makeBinPath [ xrandr ])
-    "\${gappsWrapperArgs[@]}"
-  ];
+  preFixup = ''
+    makeWrapperArgs+=(
+      "--prefix"
+      "PATH"
+      ":"
+      "${lib.makeBinPath [ xrandr ]}"
+      "''${gappsWrapperArgs[@]}"
+    )
+  '';
 
   passthru.updateScript = nix-update-script {
     extraArgs = [

diff --git a/pkgs/by-name/au/aurea/package.nix b/pkgs/by-name/au/aurea/package.nix
@@ -48,7 +48,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   dontWrapGApps = true;
 
-  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
 
   postInstallCheck = ''
     mesonCheckPhase

diff --git a/pkgs/by-name/aw/awscli2/package.nix b/pkgs/by-name/aw/awscli2/package.nix
@@ -55,14 +55,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.35.11"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.36.31"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     tag = version;
-    hash = "sha256-sjbuzDRFvqTD087vSwOM2IyG++El3NaDNCqHlyQwsxo=";
+    hash = "sha256-OTLezXSBAlgyrd7O8MGWsylBSOYxb01ljINbpLhLWDE=";
   };
 
   postPatch = ''

diff --git a/pkgs/by-name/be/benchexec/package.nix b/pkgs/by-name/be/benchexec/package.nix
@@ -7,25 +7,20 @@
   testers,
   benchexec,
 }:
+
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "benchexec";
-  version = "3.27";
+  version = "3.35";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sosy-lab";
     repo = "benchexec";
     tag = finalAttrs.version;
-    hash = "sha256-lokz7klAQAascij0T/T43/PrbMh6ZUAvFnIqg13pVUk=";
+    hash = "sha256-qYBSpDZqKBPiGkftjTVxVah+eS8NaAt9q0UEaara+iE=";
   };
 
-  pyproject = true;
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail 'setuptools ==' 'setuptools >='
-  '';
-
-  nativeBuildInputs = with python3.pkgs; [ setuptools ];
+  build-system = with python3.pkgs; [ setuptools ];
 
   # NOTE: CPU Energy Meter is not added,
   # because BenchExec should call the wrapper configured
@@ -34,14 +29,18 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   # capabilities to access MSR.
   # If we add `cpu-energy-meter` here, BenchExec will instead call an executable
   # without `CAP_SYS_RAWIO` and fail.
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     coloredlogs
     lxml
     pystemd
     pyyaml
   ];
 
-  makeWrapperArgs = [ "--set-default LIBSECCOMP ${lib.getLib libseccomp}/lib/libseccomp.so" ];
+  makeWrapperArgs = [
+    "--set-default"
+    "LIBSECCOMP"
+    "${lib.getLib libseccomp}/lib/libseccomp.so"
+  ];
 
   passthru.tests =
     let

diff --git a/pkgs/by-name/bi/binary/package.nix b/pkgs/by-name/bi/binary/package.nix
@@ -46,7 +46,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
   dependencies = with python3Packages; [ pygobject3 ];
 
   dontWrapGApps = true;
-  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
 
   # NOTE: `postCheck` is intentionally not used here, as the entire checkPhase
   # is skipped by `buildPythonApplication`

diff --git a/pkgs/by-name/bl/bleachbit/package.nix b/pkgs/by-name/bl/bleachbit/package.nix
@@ -54,9 +54,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   # Prevent double wrapping from wrapGApps and wrapPythonProgram
   dontWrapGApps = true;
-  makeWrapperArgs = [
-    "\${gappsWrapperArgs[@]}"
-  ];
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
 
   strictDeps = false;
 

diff --git a/pkgs/by-name/ca/calligraphy/package.nix b/pkgs/by-name/ca/calligraphy/package.nix
@@ -45,7 +45,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   dontWrapGApps = true;
 
-  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
 
   passthru.updateScript = nix-update-script { };
 

diff --git a/pkgs/by-name/ca/cartridges/package.nix b/pkgs/by-name/ca/cartridges/package.nix
@@ -55,7 +55,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
   ];
 
   dontWrapGApps = true;
-  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
 
   postFixup = ''
     wrapPythonProgramsIn $out/libexec "$out ''${pythonPath[*]}"

diff --git a/pkgs/by-name/cl/cloud-init/package.nix b/pkgs/by-name/cl/cloud-init/package.nix
@@ -86,7 +86,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   makeWrapperArgs = [
-    "--prefix PATH : ${
+    "--prefix"
+    "PATH"
+    ":"
+    "${
       lib.makeBinPath [
         dmidecode
         cloud-utils.guest

diff --git a/pkgs/by-name/co/copyparty/package.nix b/pkgs/by-name/co/copyparty/package.nix
@@ -109,7 +109,12 @@ python3Packages.buildPythonApplication rec {
     ++ lib.optional withMagic magic
     ++ (extraPythonPackages python3Packages);
 
-  makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath runtimeDeps}" ];
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath runtimeDeps)
+  ];
 
   meta = {
     description = "turn almost any device into a file server over http(s), webdav, ftp(s), and tftp";

diff --git a/pkgs/by-name/cp/cpupower-gui/package.nix b/pkgs/by-name/cp/cpupower-gui/package.nix
@@ -86,7 +86,9 @@ python3Packages.buildPythonApplication rec {
   strictDeps = false;
   dontWrapGApps = true;
 
-  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
 
   postFixup = ''
     wrapPythonProgramsIn $out/lib "$out $propagatedBuildInputs"

diff --git a/pkgs/by-name/de/dep-scan/package.nix b/pkgs/by-name/de/dep-scan/package.nix
@@ -63,11 +63,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
   # INFO [2025-07-28 20:17:35,654] Generating Software Bill-of-Materials for container image shiftleft/scan-slim. This might take a few mins ...
   # WARNING [2025-07-28 20:17:35,654] Unable to locate cdxgen command.
   makeWrapperArgs = [
-    "--prefix PATH : ${
-      lib.makeBinPath [
-        cdxgen
-      ]
-    }"
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [
+      cdxgen
+    ])
   ];
 
   passthru.tests = { inherit (nixosTests) dep-scan; };

diff --git a/pkgs/by-name/de/devpi-server/unwrapped.nix b/pkgs/by-name/de/devpi-server/unwrapped.nix
@@ -57,11 +57,9 @@ buildPythonPackage (finalAttrs: {
       --replace-fail '"setuptools_changelog_shortener",' ""
   '';
 
-  sourceRoot = "${finalAttrs.src.name}/server";
+  pythonRelaxDeps = [ "cryptography" ];
 
-  build-system = [
-    setuptools_80
-  ];
+  sourceRoot = "${finalAttrs.src.name}/server";
 
   dependencies = [
     aiohttp
@@ -102,26 +100,28 @@ buildPythonPackage (finalAttrs: {
     export PATH=$PATH:$out/bin
     export HOME=$TMPDIR
   '';
+
   pytestFlags = [
     "-rfsxX"
   ];
+
   enabledTestPaths = [
     "./test_devpi_server"
   ];
+
   disabledTestPaths = [
     "test_devpi_server/test_nginx_replica.py"
     "test_devpi_server/test_streaming_nginx.py"
     "test_devpi_server/test_streaming_replica_nginx.py"
   ];
+
   disabledTests = [
     "test_fetch_later_deleted" # incompatible with newer pytest
   ];
 
   __darwinAllowLocalNetworking = true;
 
-  pythonImportsCheck = [
-    "devpi_server"
-  ];
+  pythonImportsCheck = [ "devpi_server" ];
 
   passthru.tests = {
     devpi-server = nixosTests.devpi-server;
@@ -137,7 +137,6 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     homepage = "http://doc.devpi.net";
-    description = "Github-style pypi index server and packaging meta tool";
     changelog = "https://github.com/devpi/devpi/blob/${finalAttrs.src.tag}/server/CHANGELOG";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [

diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
@@ -277,10 +277,16 @@ python.pkgs.buildPythonApplication rec {
 
   makeWrapperArgs = lib.optionals enableBloat (
     [
-      "--prefix PATH : ${lib.makeBinPath [ hdf5 ]}"
+      "--prefix"
+      "PATH"
+      ":"
+      (lib.makeBinPath [ hdf5 ])
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      "--prefix DYLD_LIBRARY_PATH : ${lib.makeLibraryPath [ hdf5 ]}"
+      "--prefix"
+      "DYLD_LIBRARY_PATH"
+      ":"
+      (lib.makeLibraryPath [ hdf5 ])
     ]
   );
 

diff --git a/pkgs/by-name/di/diffuse/package.nix b/pkgs/by-name/di/diffuse/package.nix
@@ -61,7 +61,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   env.DESTDIR = "/";
 
   makeWrapperArgs = [
-    "--prefix XDG_DATA_DIRS : ${hicolor-icon-theme}/share"
+    "--prefix"
+    "XDG_DATA_DIRS"
+    ":"
+    "${hicolor-icon-theme}/share"
   ];
 
   passthru = {

diff --git a/pkgs/by-name/di/discover-overlay/package.nix b/pkgs/by-name/di/discover-overlay/package.nix
@@ -31,11 +31,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   dontWrapGApps = true;
 
-  makeWrapperArgs = [
-    "\${gappsWrapperArgs[@]}"
-    "--set DISPLAY ':0.0'"
-  ];
-
   propagatedBuildInputs = with python3.pkgs; [
     pulsectl-asyncio
     pycairo
@@ -47,10 +42,21 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     setuptools
     python-xlib
   ];
+
   postPatch = ''
     substituteInPlace discover_overlay/image_getter.py \
       --replace-fail /usr $out
   '';
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+      "--set"
+      "DISPLAY"
+      ":0.0"
+    )
+  '';
+
   doCheck = false;
 
   meta = {