Update stacked: 8 packages

packages/lean/build.ncl

@@ -10,14 +10,14 @@ let git = import "../git/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 let gcc = import "../gcc/build.ncl" in
 
-let version = "4.32.0" in
+let version = "4.32.2" in
 {
   name = "lean",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/leanprover/lean4/archive/refs/tags/v%{version}.tar.gz",
-      sha256 = "f39c6d87a9b4e9253bef15ffae460d2652b668e619688e4c01e59bbd2cd3b002",
+      sha256 = "289d38b3055d42b243e9f57a1b6abafaf020c168cff3bb59fd8901dbdcc90c32",
     } | Source,
     base,
     toolchain,

packages/pasta/build.ncl

@@ -4,14 +4,14 @@ let make = import "../make/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "2026_07_16.090d739" in
+let version = "2026_07_28.f8df3f1" in
 {
   name = "pasta",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://passt.top/passt/snapshot/passt-%{version}.tar.gz",
-      sha256 = "503e1f91cb52a8c0d04e6671a66063475b8a2d5d0b7fd428aad48ad6ef0443ee",
+      sha256 = "2b3effb3dcd1f6b1b46da3a2419c037508d24bc39f90513bbbb660e8eb6520e5",
       extract = true,
       strip_prefix = "passt-%{version}",
     } | Source,

packages/pnpm/build.ncl

@@ -5,14 +5,14 @@ let tar = import "../tar/build.ncl" in
 
 let node-lts = import "../node-lts/build.ncl" in
 
-let version = "11.17.0" in
+let version = "11.18.0" in
 {
   name = "pnpm",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://registry.npmjs.org/pnpm/-/pnpm-%{version}.tgz",
-      sha256 = "644eb5079654e87dae59a07e62d7f098162b9ce58f06077328b5ddefca1c8541"
+      sha256 = "29c35ca8d2a287988fdee3e0f36e07d9b93783f567b579b7fd5b798a4563dd81"
     } | Source,
     base,
     tar,

packages/pulumi/build.ncl

@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "3.254.0" in
+let version = "3.255.0" in
 {
   name = "pulumi",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/pulumi/pulumi/v%{version}.tar.gz",
-      sha256 = "dfec607f9030b48a405ba847820a786ebbef615526ca646e27d44b33be2757df",
+      sha256 = "c0ed8c10910d73d484547ab5146b12de3f607d84b63414f7d51bed1017497a8b",
       extract = true,
       strip_prefix = "pulumi-%{version}",
     } | Source,

packages/redis/build.ncl

@@ -11,14 +11,14 @@ let linux_headers = import "../linux_headers/build.ncl" in
 
 let glibc = import "../glibc/build.ncl" in
 
-let version = "8.8.1" in
+let version = "8.10.0" in
 {
   name = "redis",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/redis/redis/%{version}.tar.gz",
-      sha256 = "56008a7e9c87ed4ec5ce13032ff8a685ffff944276c2a993024ce805df8338e2",
+      sha256 = "b928cf47427b94bb0c6866c32df834bc8e5efc815b9ad2e2d24bf33f2c533e2a",
       extract = true,
       strip_prefix = "redis-%{version}",
     } | Source,

packages/shadow/build.ncl

@@ -7,14 +7,14 @@ let libxcrypt = import "../libxcrypt/build.ncl" in
 let pkgconf = import "../pkgconf/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 
-let version = "4.19.4" in
+let version = "4.20.0" in
 {
   name = "shadow",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/shadow-%{version}.tar.xz",
-      sha256 = "ce57a313e315a0a7cb04a8f50cc20753e994e487bbe9b78a2a824ca75cb486c0",
+      sha256 = "239781632846db3b01901028147fb4b57e6f2d5330ca63ce104b21d9b3e6031f",
     } | Source,
     base,
     make,

packages/shadow/build.sh

@@ -22,7 +22,15 @@ case $(uname -m) in
   aarch64) MARCH="-march=armv8-a" ;;
   *)       MARCH="" ;;
 esac
-export CFLAGS="$MARCH -O2 -pipe -gno-record-gcc-switches -ffile-prefix-map=$(pwd)=/builddir"
+# shadow 4.20.0 doesn't build clean under gcc 15's stricter defaults (implicit
+# declarations are now hard errors):
+#   - find_new_sub_{uid,gid}s.c use uintmax_t without <stdint.h> -> force-include it.
+#   - chkname.c uses the GNU extension strdupa without _GNU_SOURCE in effect
+#     -> define it globally so string.h declares it (a missing declaration would
+#     otherwise be silently miscompiled as int-returning).
+# Applied via flags rather than per-file patches: version-agnostic and covers
+# any sibling TUs with the same latent omissions.
+export CFLAGS="$MARCH -O2 -pipe -gno-record-gcc-switches -ffile-prefix-map=$(pwd)=/builddir -include stdint.h -D_GNU_SOURCE"
 export LDFLAGS="-Wl,--build-id=none"
 export CXXFLAGS="${CFLAGS}"
 

packages/syft/build.ncl

@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "1.49.0" in
+let version = "1.50.0" in
 {
   name = "syft",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/anchore/syft/v%{version}.tar.gz",
-      sha256 = "7fa1d225a50be61a17c86a0d523412d60b3d8678a1864839217769d3472a8700",
+      sha256 = "83a6c11669094a6514a620976f22d0a4006509b4e2925f53e43e7bf506f0a3ac",
       extract = true,
       strip_prefix = "syft-%{version}",
     } | Source,

packages/uv/build.ncl

@@ -6,14 +6,14 @@ let make = import "../make/build.ncl" in
 let rust = import "../rust/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 
-let version = "0.11.32" in
+let version = "0.12.0" in
 {
   name = "uv",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/uv-%{version}.tar.gz",
-      sha256 = "62799114a5914728b0de55e65ae856e599fe3103eef9997b479cfc7acdd6ae67"
+      sha256 = "17c768f651d4e09e83a25b781a74924694838f222a1f3676c4450073161c859a"
     } | Source,
     base,
     make,