gominimal · twitchyliquid64 · Jul 22, 2026 · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026
diff --git a/packages/cabal/build.ncl b/packages/cabal/build.ncl
@@ -4,15 +4,15 @@ let ghc = import "../ghc/build.ncl" in
 let gmp = import "../gmp/build.ncl" in
 let python = import "../python/build.ncl" in
 
-let version = "3.12.1.0" in
+let version = "3.18.1.0" in
 {
   name = "cabal",
   build_deps = [
     { file = "build.sh" } | Local,
     { file = "update_bootstrap_json.py" } | Local,
     {
       url = "https://github.com/haskell/cabal/archive/refs/tags/cabal-install-v%{version}.tar.gz",
-      sha256 = "84e883989cf44341dada05f866ec2b0256ac1f3bd111fcf80e7b6a7b77942af3",
+      sha256 = "ae794d9b803b31922a80338f4671a3abd8eba995424db549438ad211f4657193",
       extract = true,
       strip_prefix = "cabal-cabal-install-v%{version}",
     } | Source,

diff --git a/packages/cabal/build.sh b/packages/cabal/build.sh
@@ -33,8 +33,27 @@ for cabal_file in \
     fi
 done
 
-# Generate a bootstrap JSON that matches the actual GHC in the sandbox
-python3 update_bootstrap_json.py bootstrap/linux-9.8.2.json > bootstrap/linux-actual.json
+# Generate a bootstrap JSON that matches the actual GHC in the sandbox.
+#
+# The base plan is picked by cabal's OWN bootstrap/ directory, which ships a
+# fixed set of linux-<ghc>.json files per cabal release — it does NOT track the
+# GHC we build with. cabal 3.18.1.0 ships 9.6.7 / 9.8.4 / 9.10.3 / 9.12.4; the
+# 9.8.2 this used to name existed only in older cabals, so bumping cabal broke
+# it with a bare FileNotFoundError from our own script.
+#
+# Which one matters less than it looks: update_bootstrap_json.py REPLACES the
+# `builtin` list with the real `ghc-pkg list` output, so the compiler-package
+# half adapts to whatever GHC is on PATH. The base plan supplies the
+# `dependencies` (Hackage packages to build), so take the newest available.
+BOOTSTRAP_PLAN=bootstrap/linux-9.10.3.json
+[ -f "$BOOTSTRAP_PLAN" ] || {
+  echo "ERROR: $BOOTSTRAP_PLAN not found — cabal $(basename "$PWD") ships a different set of bootstrap plans." >&2
+  echo "Available:" >&2
+  ls bootstrap/linux-*.json >&2 || echo "  (none)" >&2
+  echo "Pick the newest and update BOOTSTRAP_PLAN in build.sh." >&2
+  exit 1
+}
+python3 update_bootstrap_json.py "$BOOTSTRAP_PLAN" > bootstrap/linux-actual.json
 
 # Run the bootstrap script with the generated JSON
 retry python3 bootstrap/bootstrap.py -w "$(command -v ghc)" -d bootstrap/linux-actual.json

diff --git a/packages/cabal/update_bootstrap_json.py b/packages/cabal/update_bootstrap_json.py
@@ -28,82 +28,35 @@
 
 data['builtin'] = new_builtin
 
-# Update specific dependencies that are too old for GHC 9.10.3.
-# Each entry maps a package name to new version, revision, source hash, and .cabal hash.
-# All hashes are from Hackage and verified at packaging time.
+# Build-CONFIGURATION overrides only — no version or hash pins.
+#
+# This block used to pin ~12 packages to specific versions + Hackage hashes,
+# because the base plan was cabal's linux-9.8.2.json and its dependencies were
+# genuinely too old for the GHC we build with (hence the original comment,
+# "too old for GHC 9.10.3").
+#
+# Since the base plan moved to linux-9.10.3.json (cabal 3.18.1.0), every one of
+# those pins became a DOWNGRADE of cabal's own tested set, with stale hashes:
+#
+#   HTTP              plan 4000.5.0  -> pinned 4000.4.1   <- failed to configure
+#   hashable          plan 1.5.1.0   -> pinned 1.4.7.0
+#   random            plan 1.3.1     -> pinned 1.2.1.2
+#   tar               plan 0.7.1.0   -> pinned 0.6.3.0
+#   splitmix          plan 0.1.3.2   -> pinned 0.1.1
+#   async, zlib, hackage-security    -> all older than the plan
+#
+# So the pins are gone: the plan that ships WITH a cabal release is the set
+# that cabal release was tested against, and re-deriving it by hand is how it
+# drifts. Anything genuinely needed should fail loudly here rather than be
+# pre-empted by a guess.
+#
+# zlib's FLAGS are not a version pin and DO survive: they tell the build to use
+# the system zlib rather than the copy bundled in the Haskell package, which is
+# a property of our sandbox, not of any zlib version.
 dep_updates = {
-    'th-compat': {
-        'version': '0.1.7',
-        'revision': 0,
-        'src_sha256': '9e26f12230d38ae56dcf94f8c139799dc3b7376f3434d35ce74847a0a24fd5ff',
-        'cabal_sha256': '449be09a4e3f46ea4645700c026624c4b6f066f508187326c284dbdea8884bc9',
-    },
-    'hashable': {
-        'version': '1.4.7.0',
-        'revision': 0,
-        'src_sha256': '3baee4c9027a08830d148ec524cbc0471de645e1e8426d46780ef2758df0e8da',
-        'cabal_sha256': '573f3ab242f75465a0d67ce9d84202650a1606575e6dbd6d31ffcf4767a9a379',
-    },
-    'async': {
-        'version': '2.2.5',
-        'revision': 2,
-        'src_sha256': '1818473ebab9212afad2ed76297aefde5fae8b5d4404daf36939aece6a8f16f7',
-        'cabal_sha256': 'cf9e6afba8e01830ca0d32a12b98d481cf389688762c80d1870a1db2061ebf35',
-    },
-    'lukko': {
-        'version': '0.1.2',
-        'revision': 0,
-        'src_sha256': '72d86f8aa625b461f4397f737346f78a1700a7ffbff55cf6375c5e18916e986d',
-        'cabal_sha256': '8a3004c2de2a0b5ef0634d3da6eae62ba8d8a734bab9ed8c6cfd749e7ca08997',
-    },
-    'HTTP': {
-        'version': '4000.4.1',
-        'revision': 6,
-        'src_sha256': 'df31d8efec775124dab856d7177ddcba31be9f9e0836ebdab03d94392f2dd453',
-        'cabal_sha256': 'ad36c6a1b3bc203b02751c8bffae8a684cc755661a2a567362cd4a0da1193c5e',
-    },
-    'hackage-security': {
-        'version': '0.6.3.2',
-        'revision': 0,
-        'src_sha256': 'bf8f97868ed5219d0a13a90fcbfad819bbeba4ab368c5cb590b57202c98768f9',
-        'cabal_sha256': 'ffb311c0750ff3fa159c101838e48ab79c1ea2a23c29fd5cd8932b208dfedb33',
-    },
-    'splitmix': {
-        'version': '0.1.1',
-        'revision': 0,
-        'src_sha256': 'd678c41a603a62032cf7e5f8336bb8222c93990e4b59c8b291b7ca26c7eb12c7',
-        'cabal_sha256': '8f92088f1c51c8d4569279a07565f8aa6b534a6735615b2295d2961dec8f1783',
-    },
-    'cryptohash-sha256': {
-        'version': '0.11.102.1',
-        'revision': 5,
-        'src_sha256': '73a7dc7163871a80837495039a099967b11f5c4fe70a118277842f7a713c6bf6',
-        'cabal_sha256': 'acb64f2af52d81b0bb92c266f11d43def726a7a7b74a2c23d219e160b54edec7',
-    },
-    'tar': {
-        'version': '0.6.3.0',
-        'revision': 0,
-        'src_sha256': '50bb660feec8a524416d6934251b996eaa7e39d49ae107ad505ab700d43f6814',
-        'cabal_sha256': 'b853b4296cb23386feda17dc0d9065af6709d22d684ec734aab65403d59ed547',
-    },
-    'random': {
-        'version': '1.2.1.2',
-        'revision': 0,
-        'src_sha256': '790f4dc2d2327c453ff6aac7bf15399fd123d55e927935f68f84b5df42d9a4b4',
-        'cabal_sha256': '32397de181e20ccaacf806ec70de9308cf044f089a2be37c936f3f8967bde867',
-    },
     'zlib': {
-        'version': '0.7.1.0',
-        'revision': 0,
-        'src_sha256': '6edd38b6b81df8d274952aa85affa6968ae86b2231e1d429ce8bc9083e6a55bc',
-        'cabal_sha256': 'd6696f2b55ab4a50b8de57947abca308604eb7cf8287c40bf69cfa26133e24d3',
         'flags': ['-bundled-c-zlib', '+non-blocking-ffi', '-pkg-config'],
     },
-    'ed25519': {
-        'version': '0.0.5.0',
-        'revision': 9,
-        'cabal_sha256': 'f1550ddbe3b53f1087a035667364011460896cc2b1ff328b521c05ed5973bb78',
-    },
 }
 new_deps = []
 for dep in data.get('dependencies', []):

diff --git a/packages/vim/build.ncl b/packages/vim/build.ncl
@@ -6,14 +6,14 @@ let toolchain = import "../toolchain/build.ncl" in
 let acl = import "../acl/build.ncl" in
 let ncurses = import "../ncurses/build.ncl" in
 
-let version = "9.2.0804" in
+let version = "9.2.0818" in
 {
   name = "vim",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/vim-%{version}.tar.gz",
-      sha256 = "d10040a537b3cd85b671a35b69236c071418fcf04fd0e4cb93d1b4eb11f10541"
+      sha256 = "1efbc68d8001fe29236586252690a3b097307c7eeb3cab64f8a6d2433dae0484"
     } | Source,
     base,
     make,