Update stacked: 9 packages (#577)

* Update mesa to 26.2.0

* Update cloudflared to 2026.7.3

* Update crane to 0.21.9

* Update uv to 0.12.2

* Update grafana to 13.1.2

* Update grype to 0.116.1

* Update pulumi to 3.256.0

* Update vim to 9.2.0914

* Update zola to 0.23.1

* grafana: 13 ships one binary — drop the removed grafana-server / grafana-cli

The 12.4.3 -> 13.1.2 bump in this bundle fails to build on BOTH arches:

    + install -m 755 bin/grafana-server /build/output/usr/bin/grafana-server
    install: cannot stat 'bin/grafana-server': No such file or directory

Upstream removed them. Verified by listing both tarballs:

    12.4.3  bin/grafana         462,138,731
            bin/grafana-server    2,557,169
            bin/grafana-cli       2,557,169
    13.1.2  bin/grafana         511,622,560     <- the only bin

The two 12.x extras are byte-identical in SIZE — the same forwarder shipped
twice — i.e. they were already shims for the `grafana server` / `grafana cli`
subcommands, long deprecated. Grafana 13 finished the job.

So this is not a packaging error, and not a bad sha: upstream changed which
binaries the artifact ships. A version check cannot see that; only a build can.

Dropped rather than re-created as local shims: nothing else in pkgs referenced
either name (grepped *.ncl/*.sh/*.toml — the only hits were grafana's own
build.sh and its outputs block, both fixed here).

## Tests

The package had NONE. Added two, because "upstream changed which binaries the
tarball ships" is exactly the class that hid here and the class that will
recur:

  - smoketest — `grafana --version`
  - subcommands_replace_the_dropped_bins — asserts `grafana server --help` and
    `grafana cli --help` both work, so "we dropped two bins" can never quietly
    become "we dropped the functionality"

Mutation-verified: pointing the second test at a nonexistent subcommand turns
the suite red (`standalone tests...Fail`), so it can fail for the reason it
exists.

Built and checked on both the fixed and mutated trees: 15/15 Pass.

---------

Co-authored-by: gominimal-pkgmgr-mgr[bot] <285843623+gominimal-pkgmgr-mgr[bot]@users.noreply.github.com>
Co-authored-by: bryan <bryan@minimal.dev>

Author: gominimal-pkgmgr-mgr[bot]

packages/cloudflared/build.ncl

@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "2026.7.2" in
+let version = "2026.7.3" in
 {
   name = "cloudflared",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/cloudflare/cloudflared/archive/refs/tags/%{version}.tar.gz",
-      sha256 = "7c437dcf6c2b2efb25b93eaca4724f9be582d48fa97e020a11a177b36d14d606",
+      sha256 = "8e452b1630064f5951e18a2537e66274e006eb2e83daa0d42a0adb3fab3ee788",
       extract = true,
       strip_prefix = "cloudflared-%{version}",
     } | Source,

packages/crane/build.ncl

@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "0.21.8" in
+let version = "0.21.9" in
 {
   name = "crane",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/google/go-containerregistry/archive/refs/tags/v%{version}.tar.gz",
-      sha256 = "29a1b525881f89bf07c50537e40ea3609e2fe5d6851b9f62cf7452ab1104445d",
+      sha256 = "6d8bce869afcc485b518cc0d59ea0ffe1090026db965806bc3be8793182528cc",
       extract = true,
       strip_prefix = "go-containerregistry-%{version}",
     } | Source,

packages/grafana/build.ncl

@@ -1,12 +1,12 @@
-let { Attrs, BuildSpec, Local, OutputBin, OutputData, Source, .. } = import "minimal.ncl" in
+let { standaloneTest, Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
 let { target, .. } = import "config.ncl" in
 let base = import "../base/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "12.4.3" in
+let version = "13.1.2" in
 
-let amd64_sha256 = "64707f35d54a5441ecbc63c0b3b633b7e73fe404fac118e88574f56d70b08a93" in
-let arm64_sha256 = "825e31eb0aafcf026d7f04dd540042eedef42cb81a3d2832c296b27dacf7e95d" in
+let amd64_sha256 = "2215a38a59b573f114128e05f3836cb8708ac9b04b9283021ad28fdb88d71290" in
+let arm64_sha256 = "660cc31dbd159d98a3804ac5104b0aca0e0d95ee4e88a164ff63ddd72f9fda2e" in
 
 {
   name = "grafana",
@@ -42,8 +42,6 @@ let arm64_sha256 = "825e31eb0aafcf026d7f04dd540042eedef42cb81a3d2832c296b27dacf7
 
   outputs = {
     grafana = { glob = "usr/bin/grafana" } | OutputBin,
-    grafana-server = { glob = "usr/bin/grafana-server" } | OutputBin,
-    grafana-cli = { glob = "usr/bin/grafana-cli" } | OutputBin,
     public = { glob = "usr/share/grafana/public/**" } | OutputData,
     conf = { glob = "usr/share/grafana/conf/**" } | OutputData,
   },
@@ -58,4 +56,27 @@ let arm64_sha256 = "825e31eb0aafcf026d7f04dd540042eedef42cb81a3d2832c296b27dacf7
         repo = "grafana",
       },
     } | Attrs,
+
+  tests = {
+    # The package had NO tests until the 12.4.3 -> 13.1.2 bump failed at
+    # `install: cannot stat 'bin/grafana-server'`. That failure was loud only
+    # because build.sh runs with `set -e`; the shape it belongs to — upstream
+    # changing which binaries a tarball ships — is otherwise invisible until a
+    # user runs the missing command.
+    smoketest = standaloneTest "/bin/grafana --version",
+
+    subcommands_replace_the_dropped_bins =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [
+          # `grafana-server` and `grafana-cli` are gone as of 13. Assert the
+          # subcommands that replaced them actually exist, so "we dropped two
+          # bins" can never quietly become "we dropped the functionality".
+          ["/bin/bash", "-c", "/bin/grafana server --help >/dev/null"],
+          ["/bin/bash", "-c", "/bin/grafana cli --help >/dev/null"],
+        ],
+      }
+        | Test,
+  },
 } | BuildSpec

packages/grafana/build.sh

@@ -4,9 +4,15 @@ set -ex
 mkdir -p $OUTPUT_DIR/usr/bin
 mkdir -p $OUTPUT_DIR/usr/share/grafana
 
+# Grafana 13 ships ONE binary. `grafana-server` and `grafana-cli` were removed
+# upstream — through 12.x they were two shims of 2,557,169 bytes each (identical
+# size, i.e. the same forwarder built twice) sitting next to the real ~500MB
+# `grafana`, long deprecated in favour of the `grafana server` / `grafana cli`
+# subcommands. Installing them unconditionally is what broke 12.4.3 -> 13.1.2:
+#   install: cannot stat 'bin/grafana-server': No such file or directory
+# Nothing else in pkgs referenced either name, so they are dropped rather than
+# re-created as local shims.
 install -m 755 bin/grafana $OUTPUT_DIR/usr/bin/grafana
-install -m 755 bin/grafana-server $OUTPUT_DIR/usr/bin/grafana-server
-install -m 755 bin/grafana-cli $OUTPUT_DIR/usr/bin/grafana-cli
 
 cp -r public $OUTPUT_DIR/usr/share/grafana/
 cp -r conf $OUTPUT_DIR/usr/share/grafana/

packages/grype/build.ncl

@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "0.116.0" in
+let version = "0.116.1" in
 {
   name = "grype",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/anchore/grype/v%{version}.tar.gz",
-      sha256 = "5e8aa8cf1ae21e46f1f5aa8349af1416153a9a3299cd80f5bb1ef38fd9d38252",
+      sha256 = "e64bd796bc93092ac9af1955193903d37f33ffbd4667a64a6b97c8f0dc61a2a7",
       extract = true,
       strip_prefix = "grype-%{version}",
     } | Source,

packages/mesa/build.ncl

@@ -22,17 +22,17 @@ let expat = import "../expat/build.ncl" in
 let zlib = import "../zlib/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "26.1.6" in
+let version = "26.2.0" in
 {
   name = "mesa",
   build_deps = [
     { file = "build.sh" } | Local,
     {
-      # https://archive.mesa3d.org/mesa-26.1.6.tar.xz
+      # https://archive.mesa3d.org/mesa-26.2.0.tar.xz
       # (mesa is developed at gitlab.freedesktop.org/mesa/mesa; archive.mesa3d.org
       #  serves the release tarballs. The gs:// URL is a staged mirror of that.)
       url = "gs://minimal-staging-archives/mesa-%{version}.tar.xz",
-      sha256 = "5296b88a0f1e012e2cb9ada150a2bbadf728ca81e5a4fb2ab43c83a4d2158606",
+      sha256 = "efd4bb08cdb7c365a812cd4e6c9202ab55b2f22cdcd13c7d6c4f9647b799a4ef",
       extract = true,
       strip_prefix = "mesa-%{version}",
     } | Source,

packages/pulumi/build.ncl

@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "3.255.0" in
+let version = "3.256.0" in
 {
   name = "pulumi",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/pulumi/pulumi/v%{version}.tar.gz",
-      sha256 = "c0ed8c10910d73d484547ab5146b12de3f607d84b63414f7d51bed1017497a8b",
+      sha256 = "43887337b91f4d61cb81d917947193337d4718dfe3ad21497857b431b279d886",
       extract = true,
       strip_prefix = "pulumi-%{version}",
     } | Source,

packages/uv/build.ncl

@@ -6,14 +6,14 @@ let make = import "../make/build.ncl" in
 let rust = import "../rust/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 
-let version = "0.12.1" in
+let version = "0.12.2" in
 {
   name = "uv",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/uv-%{version}.tar.gz",
-      sha256 = "4e87a6c0e5feddb55e080ba2e8b7ecc1379361471d724071b0c0e0ba5df72981"
+      sha256 = "62e876d5ed5494f42bf72bc850022d6fb2137d0849503461176dd3fa27edbb81"
     } | Source,
     base,
     make,

packages/vim/build.ncl

@@ -6,14 +6,14 @@ let toolchain = import "../toolchain/build.ncl" in
 let acl = import "../acl/build.ncl" in
 let ncurses = import "../ncurses/build.ncl" in
 
-let version = "9.2.0901" in
+let version = "9.2.0914" in
 {
   name = "vim",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/vim-%{version}.tar.gz",
-      sha256 = "97389396da7de9bbcf6f4fa14dda5671557bbda8213324fd4040277057010b54"
+      sha256 = "94f44ff0d08ceb717140906b70cbe613f3f3016e20e79cac43034d11322c6280"
     } | Source,
     base,
     make,

packages/zola/build.ncl

@@ -7,14 +7,14 @@ let toolchain = import "../toolchain/build.ncl" in
 let make = import "../make/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 let gcc = import "../gcc/build.ncl" in
-let version = "0.22.1" in
+let version = "0.23.1" in
 {
   name = "zola",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/getzola/zola/v%{version}.tar.gz",
-      sha256 = "0f59479e05bce79e8d5860dc7e807ea818986094469ed8bf0bb46588ade95982",
+      sha256 = "331240b037bbef0a15e6c1db5a2eb572097f12a362deb075a331dbb849928f83",
       extract = true,
       strip_prefix = "zola-%{version}",
     } | Source,
@@ -37,7 +37,7 @@ let version = "0.22.1" in
     {
       upstream_version = version,
       source_provenance = { category = 'GithubRepo, owner = "getzola", repo = "zola" },
-      # zola relicensed to EUPL-1.2 at v0.22 (commit 3c9131d); v0.22.1 declares
+      # zola relicensed to EUPL-1.2 at v0.22 (commit 3c9131d); v0.23.1 declares
       # `license = "EUPL-1.2"` in Cargo.toml and ships only the EUPL LICENSE file.
       license_spdx = "EUPL-1.2",
     } | Attrs,