Merge branch 'staging' into staging-next

Conflicts (tried to quickly resolve somehow, checked eval):
	pkgs/development/python-modules/apsw/default.nix
	pkgs/development/python-modules/mido/default.nix
	pkgs/development/python-modules/pytest-bdd/default.nix
	pkgs/development/python-modules/sparse/default.nix

doc/languages-frameworks/python.section.md

@@ -497,40 +497,6 @@ are used in [`buildPythonPackage`](#buildpythonpackage-function).
   with the `pipInstallHook`.
 - `unittestCheckHook` will run tests with `python -m unittest discover`. See [example usage](#using-unittestcheckhook).
 
-### Development mode {#development-mode}
-
-Development or editable mode is supported. To develop Python packages
-[`buildPythonPackage`](#buildpythonpackage-function) has additional logic inside `shellPhase` to run `pip
-install -e . --prefix $TMPDIR/`for the package.
-
-Warning: `shellPhase` is executed only if `setup.py` exists.
-
-Given a `default.nix`:
-
-```nix
-with import <nixpkgs> {};
-
-python3Packages.buildPythonPackage {
-  name = "myproject";
-  buildInputs = with python3Packages; [ pyramid ];
-
-  src = ./.;
-}
-```
-
-Running `nix-shell` with no arguments should give you the environment in which
-the package would be built with `nix-build`.
-
-Shortcut to setup environments with C headers/libraries and Python packages:
-
-```shell
-nix-shell -p python3Packages.pyramid zlib libjpeg git
-```
-
-::: {.note}
-There is a boolean value `lib.inNixShell` set to `true` if nix-shell is invoked.
-:::
-
 ## User Guide {#user-guide}
 
 ### Using Python {#using-python}
@@ -867,8 +833,7 @@ Above, we were mostly just focused on use cases and what to do to get started
 creating working Python environments in nix.
 
 Now that you know the basics to be up and running, it is time to take a step
-back and take a deeper look at how Python packages are packaged on Nix. Then,
+back and take a deeper look at how Python packages are packaged on Nix.
-we will look at how you can use development mode with your code.
 
 #### Python library packages in Nixpkgs {#python-library-packages-in-nixpkgs}
 
@@ -1481,45 +1446,6 @@ documentation source root.
 The hook is also available to packages outside the python ecosystem by
 referencing it using `sphinxHook` from top-level.
 
-### Develop local package {#develop-local-package}
-
-As a Python developer you're likely aware of [development mode](http://setuptools.readthedocs.io/en/latest/setuptools.html#development-mode)
-(`python setup.py develop`); instead of installing the package this command
-creates a special link to the project code. That way, you can run updated code
-without having to reinstall after each and every change you make. Development
-mode is also available. Let's see how you can use it.
-
-In the previous Nix expression the source was fetched from a url. We can also
-refer to a local source instead using `src = ./path/to/source/tree;`
-
-If we create a `shell.nix` file which calls [`buildPythonPackage`](#buildpythonpackage-function), and if `src`
-is a local source, and if the local source has a `setup.py`, then development
-mode is activated.
-
-In the following example, we create a simple environment that has a Python 3.11
-version of our package in it, as well as its dependencies and other packages we
-like to have in the environment, all specified with `dependencies`.
-
-```nix
-with import <nixpkgs> {};
-with python311Packages;
-
-buildPythonPackage rec {
-  name = "mypackage";
-  src = ./path/to/package/source;
-  dependencies = [
-    pytest
-    numpy
-  ];
-  propagatedBuildInputs = [
-    pkgs.libsndfile
-  ];
-}
-```
-
-It is important to note that due to how development mode is implemented on Nix
-it is not possible to have multiple packages simultaneously in development mode.
-
 ### Organising your packages {#organising-your-packages}
 
 So far we discussed how you can use Python on Nix, and how you can develop with

lib/fileset/default.nix

@@ -1,5 +1,5 @@
 /*
-  <!-- This anchor is here for backwards compatibity -->
+  <!-- This anchor is here for backwards compatibility -->
   []{#sec-fileset}
 
   The [`lib.fileset`](#sec-functions-library-fileset) library allows you to work with _file sets_.

maintainers/maintainer-list.nix

@@ -16836,6 +16836,13 @@
     githubId = 12279531;
     name = "Ricardo Guevara";
   };
+  rhelmot = {
+    name = "Audrey Dutcher";
+    github = "rhelmot";
+    githubId = 2498805;
+    email = "audrey@rhelmot.io";
+    matrix = "@rhelmot:matrix.org";
+  };
   rhendric = {
     name = "Ryan Hendrickson";
     github = "rhendric";

pkgs/applications/audio/fluidsynth/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    hash = "sha256-3qLmo9Ibl44v6Jj5Ix17ixwqfPt3ITTXUqBETF5pzE4=";
+    hash = "sha256-CzKfvQzhF4Mz2WZaJM/Nt6XjF6ThlX4jyQSaXfZukG8=";
   };
 
   outputs = [ "out" "dev" "man" ];

pkgs/applications/audio/miniplayer/default.nix

@@ -15,7 +15,11 @@ buildPythonApplication rec {
     hash = "sha256-iUUsVIDLQAiaMomfA2LvvJZ2ePhgADtC6GCwIpRC1MA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     colorthief
     ffmpeg-python
     mpd2
@@ -25,6 +29,8 @@ buildPythonApplication rec {
     ueberzug
   ];
 
+  doCheck = false; # no tests
+
   # pythonImportsCheck is disabled because this package doesn't expose any modules.
 
   meta = with lib; {

pkgs/applications/audio/mpg123/default.nix

@@ -15,17 +15,18 @@
 , jack
 , withConplay ? !stdenv.hostPlatform.isWindows
 , perl
+, writeScript
 }:
 
 assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.5";
+  version = "1.32.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-r5CM32zbZUS5e8cGp5n3mJTmlGivWIG/RUoOu5Fx7WM=";
+    hash = "sha256-zN0dCrwx1z2LQ1/GWMeQSdCpBbMGabakKgOtFp3GCeY=";
   };
 
   outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
@@ -69,6 +70,20 @@ stdenv.mkDerivation rec {
       --prefix PATH : $out/bin
   '';
 
+  passthru = {
+    updateScript = writeScript "update-mpg123" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl pcre common-updater-scripts
+
+      set -eu -o pipefail
+
+      # Expect the text in format of '<a href="download/mpg123-1.32.6.tar.bz2">'
+      new_version="$(curl -s https://mpg123.org/download.shtml |
+          pcregrep -o1 '<a href="download/mpg123-([0-9.]+).tar.bz2">')"
+      update-source-version ${pname} "$new_version"
+    '';
+  };
+
   meta = with lib; {
     description = "Fast console MPEG Audio Player and decoder library";
     homepage = "https://mpg123.org";

pkgs/applications/editors/neovim/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, gettext, msgpack-c, libtermkey, libiconv
+{ lib, stdenv, fetchFromGitHub, removeReferencesTo, cmake, gettext, msgpack-c, libtermkey, libiconv
 , libuv, lua, ncurses, pkg-config
 , unibilium, gperf
 , libvterm-neovim
@@ -121,6 +121,7 @@ in {
       cmake
       gettext
       pkg-config
+      removeReferencesTo
     ];
 
     # extra programs test via `make functionaltest`
@@ -141,8 +142,11 @@ in {
       sed -i src/nvim/po/CMakeLists.txt \
         -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
     '';
+    postInstall = ''
+      find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+    '';
     # check that the above patching actually works
-    disallowedReferences = [ stdenv.cc ] ++ lib.optional (lua != codegenLua) codegenLua;
+    disallowedRequisites = [ stdenv.cc ] ++ lib.optional (lua != codegenLua) codegenLua;
 
     cmakeFlags = [
       # Don't use downloaded dependencies. At the end of the configurePhase one

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0148";
+  version = "9.1.0200";
 
   outputs = [ "out" "xxd" ];
 
@@ -8,7 +8,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-lBs9PwNE3GoxtMka9oftYx3gegjCv6D3sEyAWK6RZzM=";
+    hash = "sha256-MAMd+k4GpFUwEZzQTWtzSpYY6AEez+FMiqexozYK3Y4=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/vim-gen-doc-hook.sh

@@ -23,7 +23,7 @@ vimPluginGenTags() {
         echo "$addonInfo" > $target/addon-info.json
     fi
 
-    echo "Finished executing vimPluginInstallPhase"
+    echo "Finished executing vimPluginGenTags"
 }
 
 preFixupHooks+=(vimPluginGenTags)

pkgs/applications/misc/electron-cash/default.nix

@@ -12,6 +12,10 @@ python3Packages.buildPythonApplication rec {
     sha256 = "sha256-xOyj5XerOwgfvI0qj7+7oshDvd18h5IeZvcJTis8nWo=";
   };
 
+  build-system = with python3Packages; [
+    cython
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     # requirements
     pyaes
@@ -36,7 +40,6 @@ python3Packages.buildPythonApplication rec {
     cryptography
 
     # requirements-hw
-    cython
     trezor
     keepkey
     btchip-python

pkgs/applications/misc/opencpn/default.nix

@@ -108,12 +108,13 @@ stdenv.mkDerivation (finalAttrs: {
     wxGTK32
   ] ++ lib.optionals stdenv.isLinux [
     alsa-utils
-    elfutils
     libselinux
     libsepol
     util-linux
     xorg.libXdmcp
     xorg.libXtst
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
+    elfutils
   ] ++ lib.optionals stdenv.isDarwin [
     lame
   ];

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -179,7 +179,7 @@ stdenv.mkDerivation rec {
       --prefix PATH : ${lib.makeBinPath [ coreutils glib.dev pciutils procps util-linux ]} \
       --prefix LD_LIBRARY_PATH ":" ${libs}
 
-    # Backwards compatiblity: we used to call it zoom-us
+    # Backwards compatibility: we used to call it zoom-us
     ln -s $out/bin/{zoom,zoom-us}
   '';
 

pkgs/applications/networking/sync/rsync/default.nix

@@ -54,6 +54,10 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_64) [
     # fix `multiversioning needs 'ifunc' which is not supported on this target` error
     "--disable-roll-simd"
+  ] ++ lib.optionals (!enableZstd) [
+    "--disable-zstd"
+  ] ++ lib.optionals (!enableXXHash) [
+    "--disable-xxhash"
   ];
 
   enableParallelBuilding = true;

pkgs/applications/science/biology/macs2/default.nix

@@ -21,7 +21,7 @@ python3.pkgs.buildPythonPackage rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    cython
+    cython_0
     numpy
     setuptools
     wheel

pkgs/applications/science/electronics/nvc/default.nix

@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     llvm
     zlib
     zstd
-  ] ++ lib.optionals stdenv.isLinux [
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
     elfutils
   ];
 

pkgs/applications/science/math/sage/python-modules/sage-setup.nix

@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , sage-src
-, cython_3
+, cython
 , jinja2
 , pkgconfig # the python module, not the pkg-config alias
 }:
@@ -11,7 +11,7 @@ buildPythonPackage rec {
   pname = "sage-setup";
   src = sage-src;
 
-  nativeBuildInputs = [ cython_3 ];
+  nativeBuildInputs = [ cython ];
   buildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ jinja2 ];
 

pkgs/applications/science/math/sage/sagelib.nix

@@ -48,7 +48,7 @@
 , cvxopt
 , cypari2
 , cysignals
-, cython_3
+, cython
 , fpylll
 , gmpy2
 , importlib-metadata
@@ -153,7 +153,7 @@ buildPythonPackage rec {
     cvxopt
     cypari2
     cysignals
-    cython_3
+    cython
     fpylll
     gmpy2
     importlib-metadata

pkgs/applications/version-management/commitizen/default.nix

@@ -55,7 +55,7 @@ python3.pkgs.buildPythonApplication rec {
     pytest-freezer
     pytest-mock
     pytest-regressions
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
   ];
 
   doCheck = true;

pkgs/applications/version-management/git-up/default.nix

@@ -30,7 +30,7 @@ pythonPackages.buildPythonApplication rec {
 
   nativeCheckInputs = [
     git
-    pythonPackages.pytestCheckHook
+    pythonPackages.pytest7CheckHook
   ];
 
   # 1. git fails to run as it cannot detect the email address, so we set it

pkgs/applications/virtualization/virt-manager/default.nix

@@ -76,7 +76,7 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   nativeCheckInputs = with python3.pkgs; [
-    pytestCheckHook
+    pytest7CheckHook
     cpio
     cdrtools
     xorriso

pkgs/by-name/cm/cmake/package.nix

@@ -47,11 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.28.3";
+  version = "3.29.1";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-crdXDlyFk95qxKtDO3PqsYxfsyiIBGDIbOMmCBQa1cE=";
+    hash = "sha256-f7Auj1e2Kzmqa0z3HoIBSLoaI3JIiElHNQIeMqsO78w=";
   };
 
   patches = [

pkgs/by-name/ez/eza/package.nix

@@ -10,7 +10,7 @@
 , darwin
 , libiconv
 , installShellFiles
-  # once eza upstream gets support for setting up a compatibilty symlink for exa, we should change
+  # once eza upstream gets support for setting up a compatibility symlink for exa, we should change
   # the handling here from postInstall to passing the required argument to the builder.
 , exaAlias ? true
 }:

pkgs/by-name/ja/jasper/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jasper";
-  version = "4.2.2";
+  version = "4.2.3";
 
   src = fetchFromGitHub {
     owner = "jasper-software";
     repo = "jasper";
     rev = "version-${finalAttrs.version}";
-    hash = "sha256-dcE9Cc+L/nLp/JCvYuGLRnkxL1i3dLIB9cSILWaZWn4=";
+    hash = "sha256-Hmmoe1lzUR1DBwgg30KGfsIDzSNe5shghaieEXX/am4=";
   };
 
   outputs = [ "out" "dev" "doc" "lib" "man" ];

pkgs/by-name/me/meson/0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch

@@ -0,0 +1,92 @@
+From 8304b645c655832c47ee9ca706d182c26d29eaff Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Tue, 9 Apr 2024 06:35:39 +0000
+Subject: [PATCH] Revert "rust: recursively pull proc-macro dependencies as
+ well"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit aee941559c4b88a062e88186819a820c69c200ae.
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ mesonbuild/build.py                                   |  2 ++
+ test cases/rust/18 proc-macro/lib.rs                  |  8 --------
+ test cases/rust/18 proc-macro/meson.build             | 11 -----------
+ test cases/rust/18 proc-macro/subdir/meson.build      |  1 -
+ .../rust/18 proc-macro/transitive-proc-macro.rs       |  7 -------
+ 5 files changed, 2 insertions(+), 27 deletions(-)
+ delete mode 100644 test cases/rust/18 proc-macro/lib.rs
+ delete mode 100644 test cases/rust/18 proc-macro/subdir/meson.build
+ delete mode 100644 test cases/rust/18 proc-macro/transitive-proc-macro.rs
+
+diff --git a/mesonbuild/build.py b/mesonbuild/build.py
+index 6f0d6a2dd..7be9b497b 100644
+--- a/mesonbuild/build.py
++++ b/mesonbuild/build.py
+@@ -1295,6 +1295,8 @@ def get_dependencies_recurse(self, result: OrderedSet[BuildTargetTypes], include
+         for t in self.link_targets:
+             if t in result:
+                 continue
++            if t.rust_crate_type == 'proc-macro':
++                continue
+             if include_internals or not t.is_internal():
+                 result.add(t)
+             if isinstance(t, StaticLibrary):
+diff --git a/test cases/rust/18 proc-macro/lib.rs b/test cases/rust/18 proc-macro/lib.rs
+deleted file mode 100644
+index 5242886cc..000000000
+--- a/test cases/rust/18 proc-macro/lib.rs	
++++ /dev/null
+@@ -1,8 +0,0 @@
+-extern crate proc_macro_examples;
+-use proc_macro_examples::make_answer;
+-
+-make_answer!();
+-
+-pub fn func() -> u32 {
+-    answer()
+-}
+diff --git a/test cases/rust/18 proc-macro/meson.build b/test cases/rust/18 proc-macro/meson.build
+index e8b28eda1..c5f0dfc82 100644
+--- a/test cases/rust/18 proc-macro/meson.build	
++++ b/test cases/rust/18 proc-macro/meson.build	
+@@ -31,14 +31,3 @@ main = executable(
+ )
+ 
+ test('main_test2', main)
+-
+-subdir('subdir')
+-
+-staticlib = static_library('staticlib', 'lib.rs',
+-  link_with: pm_in_subdir,
+-  rust_dependency_map : {'proc_macro_examples3' : 'proc_macro_examples'}
+-)
+-
+-executable('transitive-proc-macro', 'transitive-proc-macro.rs',
+-  link_with: staticlib,
+-)
+diff --git a/test cases/rust/18 proc-macro/subdir/meson.build b/test cases/rust/18 proc-macro/subdir/meson.build
+deleted file mode 100644
+index 04842c431..000000000
+--- a/test cases/rust/18 proc-macro/subdir/meson.build	
++++ /dev/null
+@@ -1 +0,0 @@
+-pm_in_subdir = rust.proc_macro('proc_macro_examples3', '../proc.rs')
+diff --git a/test cases/rust/18 proc-macro/transitive-proc-macro.rs b/test cases/rust/18 proc-macro/transitive-proc-macro.rs
+deleted file mode 100644
+index 4c804b3b6..000000000
+--- a/test cases/rust/18 proc-macro/transitive-proc-macro.rs	
++++ /dev/null
+@@ -1,7 +0,0 @@
+-extern crate staticlib;
+-use staticlib::func;
+-
+-
+-fn main() {
+-    assert_eq!(42, func());
+-}
+-- 
+2.44.0
+

pkgs/by-name/me/meson/package.nix

@@ -14,17 +14,17 @@
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation LDAP OpenGL;
+  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation LDAP OpenAL OpenGL;
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-7M/El2snWsQi+gaZWPHnEr9gpJW3trqG1RbnT43M49s=";
+    hash = "sha256-hRTmKO2E6SIdvAhO7OJtV8dcsGm39c51H+2ZGEkdcFY=";
   };
 
   patches = [
@@ -65,6 +65,10 @@ python3.pkgs.buildPythonApplication rec {
 
     # Nixpkgs cctools does not have bitcode support.
     ./006-disable-bitcode.patch
+
+    # Fix cross-compilation of proc-macro (and mesa)
+    # https://github.com/mesonbuild/meson/issues/12973
+    ./0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch
   ];
 
   buildInputs = lib.optionals (python3.pythonOlder "3.9") [
@@ -86,6 +90,7 @@ python3.pkgs.buildPythonApplication rec {
     Cocoa
     Foundation
     LDAP
+    OpenAL
     OpenGL
     openldap
   ];
@@ -96,6 +101,7 @@ python3.pkgs.buildPythonApplication rec {
       patchShebangs 'test cases'
       substituteInPlace \
         'test cases/native/8 external program shebang parsing/script.int.in' \
+        'test cases/common/273 customtarget exe for test/generate.py' \
           --replace /usr/bin/env ${coreutils}/bin/env
     ''
   ]

pkgs/by-name/pr/pretix/package.nix

@@ -97,7 +97,6 @@ python.pkgs.buildPythonApplication rec {
   build-system = with python.pkgs; [
     gettext
     nodejs
-    pythonRelaxDepsHook
     setuptools
     tomli
   ];

pkgs/by-name/xo/xonsh/unwrapped.nix

@@ -90,6 +90,8 @@ python3.pkgs.buildPythonApplication {
     export HOME=$TMPDIR
   '';
 
+  dontWrapPythonPrograms = true;
+
   passthru = {
     shellPath = "/bin/xonsh";
     python = python3; # To the wrapper

pkgs/data/misc/iana-etc/default.nix

@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20231227";
+  version = "20240318";
 
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-8Pa6LtAml8axjrUS32UbFIqTtM8v124U2Tt0J4sC0Is=";
+    sha256 = "sha256-t/VOTFDdAH+EdzofdMyUO9Yvl5qdMjdPl9ebYtBC388=";
   };
 
   installPhase = ''

pkgs/desktops/budgie/budgie-desktop-view/default.nix

@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
     gtk3
   ];
 
+  mesonFlags = [ (lib.mesonBool "werror" false) ];
+
   meta = {
     description = "The official Budgie desktop icons application/implementation";
     homepage = "https://github.com/BuddiesOfBudgie/budgie-desktop-view";

pkgs/development/compilers/gcc/common/meta.nix

@@ -1,6 +1,15 @@
 { lib, version, }:
 
-with lib; {
+let
+  inherit (lib)
+    licenses
+    maintainers
+    platforms
+    teams
+    versionOlder
+    ;
+in
+{
   homepage = "https://gcc.gnu.org/";
   license = licenses.gpl3Plus; # runtime support libraries are typically LGPLv3+
   description = "GNU Compiler Collection, version ${version}";

pkgs/development/compilers/gcc/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
+{ lib, stdenv, targetPackages, fetchurl, fetchpatch, fetchFromGitHub, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
 , langAda ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
@@ -48,19 +48,37 @@
 }:
 
 let
-  versions = import ./versions.nix;
+  inherit (lib)
-  version = versions.fromMajorMinor majorMinorVersion;
+    callPackageWith
+    filter
+    getBin
+    maintainers
+    makeLibraryPath
+    makeSearchPathOutput
+    mapAttrs
+    optional
+    optionalAttrs
+    optionals
+    optionalString
+    pipe
+    platforms
+    versionAtLeast
+    versions
+    ;
 
-  majorVersion = lib.versions.major version;
+  gccVersions = import ./versions.nix;
-  atLeast13 = lib.versionAtLeast version "13";
+  version = gccVersions.fromMajorMinor majorMinorVersion;
-  atLeast12 = lib.versionAtLeast version "12";
+
-  atLeast11 = lib.versionAtLeast version "11";
+  majorVersion = versions.major version;
-  atLeast10 = lib.versionAtLeast version "10";
+  atLeast13 = versionAtLeast version "13";
-  atLeast9  = lib.versionAtLeast version  "9";
+  atLeast12 = versionAtLeast version "12";
-  atLeast8  = lib.versionAtLeast version  "8";
+  atLeast11 = versionAtLeast version "11";
-  atLeast7  = lib.versionAtLeast version  "7";
+  atLeast10 = versionAtLeast version "10";
-  atLeast6  = lib.versionAtLeast version  "6";
+  atLeast9  = versionAtLeast version  "9";
-  atLeast49 = lib.versionAtLeast version  "4.9";
+  atLeast8  = versionAtLeast version  "8";
+  atLeast7  = versionAtLeast version  "7";
+  atLeast6  = versionAtLeast version  "6";
+  atLeast49 = versionAtLeast version  "4.9";
   is13 = majorVersion == "13";
   is12 = majorVersion == "12";
   is11 = majorVersion == "11";
@@ -69,37 +87,9 @@ let
   is8  = majorVersion == "8";
   is7  = majorVersion == "7";
   is6  = majorVersion == "6";
-  is49 = majorVersion == "4" && lib.versions.minor version == "9";
+  is49 = majorVersion == "4" && versions.minor version == "9";
-  is48 = majorVersion == "4" && lib.versions.minor version == "8";
+  is48 = majorVersion == "4" && versions.minor version == "8";
-in
 
-# We enable the isl cloog backend.
-assert !atLeast6 -> (cloog != null -> isl != null);
-
-assert langJava -> !atLeast7 && zip != null && unzip != null && zlib != null && boehmgc != null && perl != null;  # for `--enable-java-home'
-
-# Make sure we get GNU sed.
-assert stdenv.buildPlatform.isDarwin -> gnused != null;
-
-# The go frontend is written in c++
-assert langGo -> langCC;
-assert (atLeast6 && !is7 && !is8) -> (langAda -> gnat-bootstrap != null);
-
-# TODO: fixup D bootstapping, probably by using gdc11 (and maybe other changes).
-#   error: GDC is required to build d
-assert atLeast12 -> !langD;
-
-# threadsCross is just for MinGW
-assert threadsCross != {} -> stdenv.targetPlatform.isWindows;
-
-# profiledCompiler builds inject non-determinism in one of the compilation stages.
-# If turned on, we can't provide reproducible builds anymore
-assert reproducibleBuild -> profiledCompiler == false;
-
-with lib;
-with builtins;
-
-let inherit version;
     disableBootstrap = atLeast11 && !stdenv.hostPlatform.isDarwin && (atLeast12 -> !profiledCompiler);
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@@ -117,7 +107,7 @@ let inherit version;
       libX11 libXt libSM libICE libXtst libXrender libXrandr libXi
       xorgproto
     ];
-    callFile = lib.callPackageWith ({
+    callFile = callPackageWith ({
       # lets
       inherit
         majorVersion
@@ -182,7 +172,7 @@ let inherit version;
         zip
         zlib
       ;
-    } // lib.optionalAttrs (!atLeast7) {
+    } // optionalAttrs (!atLeast7) {
       inherit
         boehmgc
         flex
@@ -225,10 +215,33 @@ let inherit version;
 
 in
 
+# We enable the isl cloog backend.
+assert !atLeast6 -> (cloog != null -> isl != null);
+
+assert langJava -> !atLeast7 && zip != null && unzip != null && zlib != null && boehmgc != null && perl != null;  # for `--enable-java-home'
+
+# Make sure we get GNU sed.
+assert stdenv.buildPlatform.isDarwin -> gnused != null;
+
+# The go frontend is written in c++
+assert langGo -> langCC;
+assert (atLeast6 && !is7 && !is8) -> (langAda -> gnat-bootstrap != null);
+
+# TODO: fixup D bootstapping, probably by using gdc11 (and maybe other changes).
+#   error: GDC is required to build d
+assert atLeast12 -> !langD;
+
+# threadsCross is just for MinGW
+assert threadsCross != {} -> stdenv.targetPlatform.isWindows;
+
+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 # We need all these X libraries when building AWT with GTK.
 assert !atLeast7 -> (x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == []);
 
-lib.pipe ((callFile ./common/builder.nix {}) ({
+pipe ((callFile ./common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
@@ -249,14 +262,14 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
           then "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.xz"
           else "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
     ${if is10 || is11 || is13 then "hash" else "sha256"} =
-      versions.srcHashForVersion version;
+      gccVersions.srcHashForVersion version;
   };
 
   inherit patches;
 
   outputs =
     if atLeast7
-    then [ "out" "man" "info" ] ++ lib.optional (!langJit) "lib"
+    then [ "out" "man" "info" ] ++ optional (!langJit) "lib"
     else if atLeast49 && (langJava || langGo || (if atLeast6 then langJit else targetPlatform.isDarwin)) then ["out" "man" "info"]
     else [ "out" "lib" "man" "info" ];
 
@@ -265,9 +278,9 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
   libc_dev = stdenv.cc.libc_dev;
 
   hardeningDisable = [ "format" "pie" ]
-  ++ lib.optionals (is11 && langAda) [ "fortify3" ];
+  ++ optionals (is11 && langAda) [ "fortify3" ];
 
-  postPatch = lib.optionalString atLeast7 ''
+  postPatch = optionalString atLeast7 ''
     configureScripts=$(find . -name configure)
     for configureScript in $configureScripts; do
       patchShebangs $configureScript
@@ -275,8 +288,8 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
   ''
   # This should kill all the stdinc frameworks that gcc and friends like to
   # insert into default search paths.
-  + lib.optionalString (atLeast6 && hostPlatform.isDarwin) ''
+  + optionalString (atLeast6 && hostPlatform.isDarwin) ''
-    substituteInPlace gcc/config/darwin-c.c${lib.optionalString atLeast12 "c"} \
+    substituteInPlace gcc/config/darwin-c.c${optionalString atLeast12 "c"} \
       --replace 'if (stdinc)' 'if (0)'
 
     substituteInPlace libgcc/config/t-slibgcc-darwin \
@@ -286,7 +299,7 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
       --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
   ''
   + (
-    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
+    optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
       # On NixOS, use the right path to the dynamic linker instead of
       # `/lib/ld*.so'.
       (let
@@ -296,18 +309,18 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
         '' echo "fixing the {GLIBC,UCLIBC,MUSL}_DYNAMIC_LINKER macros..."
            for header in "gcc/config/"*-gnu.h "gcc/config/"*"/"*.h
            do
-             grep -q ${lib.optionalString (!atLeast6) "LIBC"}_DYNAMIC_LINKER "$header" || continue
+             grep -q ${optionalString (!atLeast6) "LIBC"}_DYNAMIC_LINKER "$header" || continue
              echo "  fixing $header..."
              sed -i "$header" \
                  -e 's|define[[:blank:]]*\([UCG]\+\)LIBC_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define \1LIBC_DYNAMIC_LINKER\2 "${libc.out}\3"|g' \
                  -e 's|define[[:blank:]]*MUSL_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define MUSL_DYNAMIC_LINKER\1 "${libc.out}\2"|g'
              done
-        '' + lib.optionalString (atLeast6 && targetPlatform.libc == "musl") ''
+        '' + optionalString (atLeast6 && targetPlatform.libc == "musl") ''
            sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
         )
     ))
-      + lib.optionalString (atLeast7 && targetPlatform.isAvr) (''
+      + optionalString (atLeast7 && targetPlatform.isAvr) (''
             makeFlagsArray+=(
                '-s' # workaround for hitting hydra log limit
                'LIMITS_H_TEST=false'
@@ -319,7 +332,7 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
 
   inherit (callFile ./common/dependencies.nix { }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
 
-  preConfigure = (callFile ./common/pre-configure.nix { }) + lib.optionalString atLeast10 ''
+  preConfigure = (callFile ./common/pre-configure.nix { }) + optionalString atLeast10 ''
     ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
   '';
 
@@ -338,9 +351,9 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
     assert atLeast12 -> (profiledCompiler -> !disableBootstrap);
     if atLeast11
     then let target =
-               lib.optionalString (profiledCompiler) "profiled" +
+               optionalString (profiledCompiler) "profiled" +
-               lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+               optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
-         in lib.optional (target != "") target
+         in optional (target != "") target
     else
       optional
         (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
@@ -394,24 +407,24 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
       EXTRA_LDFLAGS_FOR_TARGET
       ;
   } // optionalAttrs is7 {
-    NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument"
+    NIX_CFLAGS_COMPILE = optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument"
       # Downgrade register storage class specifier errors to warnings when building a cross compiler from a clang stdenv.
-      + lib.optionalString (stdenv.cc.isClang && targetPlatform != hostPlatform) " -Wno-register";
+      + optionalString (stdenv.cc.isClang && targetPlatform != hostPlatform) " -Wno-register";
   } // optionalAttrs (!is7 && !atLeast12 && stdenv.cc.isClang && targetPlatform != hostPlatform) {
     NIX_CFLAGS_COMPILE = "-Wno-register";
   } // optionalAttrs (!atLeast7) {
     inherit langJava;
   } // optionalAttrs atLeast6 {
-    NIX_LDFLAGS = lib.optionalString hostPlatform.isSunOS "-lm";
+    NIX_LDFLAGS = optionalString hostPlatform.isSunOS "-lm";
   });
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD langJava version;
     isGNU = true;
-    hardeningUnsupportedFlags = lib.optional is48 "stackprotector"
+    hardeningUnsupportedFlags = optional is48 "stackprotector"
-      ++ lib.optional (!atLeast11) "zerocallusedregs"
+      ++ optional (!atLeast11) "zerocallusedregs"
-      ++ lib.optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
+      ++ optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
-      ++ lib.optionals (langFortran) [ "fortify" "format" ];
+      ++ optionals (langFortran) [ "fortify" "format" ];
   };
 
   enableParallelBuilding = true;
@@ -426,19 +439,19 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
       platforms
       maintainers
     ;
-  } // lib.optionalAttrs (!atLeast11) {
+  } // optionalAttrs (!atLeast11) {
     badPlatforms =
       # avr-gcc8 is maintained for the `qmk` package
       if (is8 && targetPlatform.isAvr) then []
       else if !(is48 || is49) then [ "aarch64-darwin" ]
-      else lib.platforms.darwin;
+      else platforms.darwin;
-  } // lib.optionalAttrs is11 {
+  } // optionalAttrs is11 {
     badPlatforms = if targetPlatform != hostPlatform then [ "aarch64-darwin" ] else [ ];
   };
-} // lib.optionalAttrs (!atLeast10 && stdenv.targetPlatform.isDarwin) {
+} // optionalAttrs (!atLeast10 && stdenv.targetPlatform.isDarwin) {
   # GCC <10 requires default cctools `strip` instead of `llvm-strip` used by Darwin bintools.
   preBuild = ''
-    makeFlagsArray+=('STRIP=${lib.getBin darwin.cctools-port}/bin/${stdenv.cc.targetPrefix}strip')
+    makeFlagsArray+=('STRIP=${getBin darwin.cctools-port}/bin/${stdenv.cc.targetPrefix}strip')
   '';
 } // optionalAttrs (!atLeast8) {
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv

pkgs/development/compilers/gnat-bootstrap/default.nix

@@ -67,8 +67,9 @@ in {
     zlib
   ] ++ lib.optionals stdenv.buildPlatform.isLinux [
     autoPatchelfHook
-    elfutils
     glibc
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.buildPlatform elfutils) [
+    elfutils
   ];
 
   postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin) ''

pkgs/development/compilers/go/1.22.nix

@@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.22.1";
+  version = "1.22.2";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-ecm5HX8QlRWiX8Ps2q0SXWfmvbVPbU2YWA9GeZyuoyE=";
+    hash = "sha256-N06oKyiexzjpaCZ8rFnH1f8YD5SSJQJUeEsgROkN9ak=";
   };
 
   strictDeps = true;

pkgs/development/compilers/llvm/17/llvm/default.nix

@@ -8,7 +8,7 @@
 , python3
 , python3Packages
 , libffi
-, enableGoldPlugin ? true
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2

pkgs/development/compilers/llvm/18/llvm/default.nix

@@ -8,7 +8,7 @@
 , python3
 , python3Packages
 , libffi
-, enableGoldPlugin ? true
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2

pkgs/development/compilers/llvm/git/llvm/default.nix

@@ -8,7 +8,7 @@
 , python3
 , python3Packages
 , libffi
-, enableGoldPlugin ? true
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2

pkgs/development/compilers/nasm/default.nix

@@ -1,12 +1,17 @@
-{ lib, stdenv, fetchurl, perl }:
+{ lib
+, stdenv
+, fetchurl
+, perl
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "nasm";
-  version = "2.16.01";
+  version = "2.16.02";
 
   src = fetchurl {
     url = "https://www.nasm.us/pub/nasm/releasebuilds/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-x3dF9IAjde/u4uxcCta38DfqnIfJKxSaljf/CZ8WJVg=";
+    sha256 = "sha256-HhuULqiPIu2uiWWeFb4m+gJ+rgdH9RQTVA9S1OrEeQ0=";
   };
 
   nativeBuildInputs = [ perl ];
@@ -16,10 +21,20 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   checkPhase = ''
+    runHook preCheck
+
     make golden
     make test
+
+    runHook postCheck
   '';
 
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/netwide-assembler/nasm.git";
+    rev-prefix = "nasm-";
+    ignoredVersions = "rc.*";
+  };
+
   meta = with lib; {
     homepage = "https://www.nasm.us/";
     description = "An 80x86 and x86-64 assembler designed for portability and modularity";

pkgs/development/compilers/orc/default.nix

@@ -18,11 +18,11 @@
   inherit (lib) optional optionals;
 in stdenv.mkDerivation rec {
   pname = "orc";
-  version = "0.4.36";
+  version = "0.4.38";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/orc/${pname}-${version}.tar.xz";
-    sha256 = "sha256-g7B0y2cxfVi+8ejQzIYveuinekW7/wVqH5h8ZIiy9f0=";
+    sha256 = "sha256-pVqY1HclZ6o/rtj7hNVAw9t36roW0+LhCwRPvJIoZo0=";
   };
 
   postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''

pkgs/development/compilers/rust/1_77.nix

@@ -19,8 +19,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.76.0";
+  rustcVersion = "1.77.1";
-  rustcSha256 = "sha256-nlz/Azp/DSJmgYmCrZDk0+Tvj47hcVd2xuJQc6E2wCE=";
+  rustcSha256 = "7hBuTFafUtujtbKCsQWCD4a9j2s9CcBrjc6C+xuzpKE=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
@@ -34,24 +34,24 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.75.0";
+  bootstrapVersion = "1.76.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "107b8d8825deab338f338b15f047829da6225bb34644790847e96f0957c6678f";
+    i686-unknown-linux-gnu = "4c3eefc9341b8809235e6c4fbcbc19ab52a5cbe771292c400df068c12984fa3e";
-    x86_64-unknown-linux-gnu = "473978b6f8ff216389f9e89315211c6b683cf95a966196e7914b46e8cf0d74f6";
+    x86_64-unknown-linux-gnu = "9d589d2036b503cc45ecc94992d616fb3deec074deb36cacc2f5c212408f7399";
-    x86_64-unknown-linux-musl = "cc6ef41aa811ab34f946fe2b4338d1107daf08642125fd566386bf45563597de";
+    x86_64-unknown-linux-musl = "aa8568f4d262468aaf4f622bd421c5435b24454d8fbcdae48da1162962205384";
-    arm-unknown-linux-gnueabihf = "985454b6c385cb461cc8a39d2d7d55dcf6c50495033fe5d28edcc717729d8ae9";
+    arm-unknown-linux-gnueabihf = "7d1da067362fc64bcad198d90a61e024d5712aed76e17b28e1cd7e8ba263cc6f";
-    armv7-unknown-linux-gnueabihf = "bd876a75f72040d96be2fb882770b16b482ac0ab15d7e3ad24e6d25b7c74bcf7";
+    armv7-unknown-linux-gnueabihf = "c03346d56d4a860cd3a8d2d2a7ea75c510b68204e3ad97b3770076595261c913";
-    aarch64-unknown-linux-gnu = "30828cd904fcfb47f1ac43627c7033c903889ea4aca538f53dcafbb3744a9a73";
+    aarch64-unknown-linux-gnu = "2e8313421e8fb673efdf356cdfdd4bc16516f2610d4f6faa01327983104c05a0";
-    aarch64-unknown-linux-musl = "26b5989525b7cf623f3868a37549736e0efe1142a08f191a97e29758cc640ac4";
+    aarch64-unknown-linux-musl = "a1d1c8ccb8ea00cfa2b79d80411b8eb22b2bef5214f86536825361e98d7c617a";
-    x86_64-apple-darwin = "ad066e4dec7ae5948c4e7afe68e250c336a5ab3d655570bb119b3eba9cf22851";
+    x86_64-apple-darwin = "7bdbe085695df8e46389115e99eda7beed37a9494f6b961b45554c658e53b8e7";
-    aarch64-apple-darwin = "878ecf81e059507dd2ab256f59629a4fb00171035d2a2f5638cb582d999373b1";
+    aarch64-apple-darwin = "17496f15c3cb6ff73d5c36f5b54cc110f1ac31fa09521a7991c0d7ddd890dceb";
-    powerpc64le-unknown-linux-gnu = "2599cdfea5860b4efbceb7bca69845a96ac1c96aa50cf8261151e82280b397a0";
+    powerpc64le-unknown-linux-gnu = "44b3494675284d26b04747a824dc974e32fd8fd46fc0aa06a7c8ebe851332d2c";
-    riscv64gc-unknown-linux-gnu = "7f7b73d8924d7dd24dcb2ef0da257eb48d9aed658b00fe68e8f1ade0b1ce4511";
+    riscv64gc-unknown-linux-gnu = "4a9db321874fc441235b71eb8aa295fc50251305e461540b25b4eef89fb56255";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_76;
+  selectRustPackage = pkgs: pkgs.rust_1_77;
 
   rustcPatches = [ ];
 }

pkgs/development/compilers/rust/cargo-auditable.nix

@@ -1,4 +1,4 @@
-{ lib, buildPackages, fetchFromGitHub, makeRustPlatform, installShellFiles, stdenv }:
+{ lib, buildPackages, fetchFromGitHub, fetchpatch, makeRustPlatform, installShellFiles, stdenv }:
 
 let
   args = rec {
@@ -12,6 +12,14 @@ let
       sha256 = "sha256-ERIzx9Fveanq7/aWcB2sviTxIahvSu0sTwgpGf/aYE8=";
     };
 
+    patches = [
+      (fetchpatch {
+        name = "rust-1.77-tests.patch";
+        url = "https://github.com/rust-secure-code/cargo-auditable/commit/5317a27244fc428335c4e7a1d066ae0f65f0d496.patch";
+        hash = "sha256-UblGseiSC/2eE4rcnTgYzxAMrutHFSdxKTHqKj1mX5o=";
+      })
+    ];
+
     cargoHash = "sha256-4o3ctun/8VcBRuj+j0Yaawdkyn6Z6LPp+FTyhPxQWU8=";
 
     # Cargo.lock is outdated

pkgs/development/compilers/rust/rustc.nix

@@ -93,7 +93,7 @@ in stdenv.mkDerivation (finalAttrs: {
     # attempts to download the missing source tarball
     "--set=build.rustfmt=${rustfmt}/bin/rustfmt"
   ] ++ [
-    "--tools=rustc,rust-analyzer-proc-macro-srv"
+    "--tools=rustc,rustdoc,rust-analyzer-proc-macro-srv"
     "--enable-rpath"
     "--enable-vendor"
     "--build=${stdenv.buildPlatform.rust.rustcTargetSpec}"

pkgs/development/interpreters/lua-5/build-luarocks-package.nix

@@ -94,6 +94,7 @@ let
   ];
 
   inherit doCheck extraConfig rockspecFilename knownRockspec externalDeps nativeCheckInputs;
+  inherit dontWrapLuaPrograms;
 
   buildInputs = let
     # example externalDeps': [ { name = "CRYPTO"; dep = pkgs.openssl; } ]
@@ -177,9 +178,11 @@ let
     runHook postBuild
   '';
 
-  postFixup = lib.optionalString (!dontWrapLuaPrograms) ''
+  fixupPhase = ''
-    wrapLuaPrograms
+    runHook preFixup
-  '' + attrs.postFixup or "";
+    ${lib.optionalString (!self.dontWrapLuaPrograms) "wrapLuaPrograms"}
+    runHook postFixup
+    '';
 
   installPhase = ''
     runHook preInstall
@@ -196,6 +199,7 @@ let
     # maybe we could reestablish dependency checking via passing --rock-trees
 
     nix_debug "ROCKSPEC $rockspecFilename"
+    # deps-mode=all tells luarocks to use every configured rocks_trees
     luarocks $LUAROCKS_EXTRA_ARGS make --deps-mode=all --tree=$out ''${rockspecFilename}
 
     runHook postInstall

pkgs/development/interpreters/lua-5/hooks/setup-hook.sh

@@ -25,7 +25,8 @@ addToLuaSearchPathWithCustomDelimiter() {
   # export only if the folder contains lua files
   shopt -s globstar
 
-  for _file in ${absPattern/\?/\*\*}; do
+  local adjustedPattern="${absPattern/\?/\*\*\/\*}"
+  for _file in $adjustedPattern; do
     export "${varName}=${!varName:+${!varName};}${absPattern}"
     shopt -u globstar
     return;

pkgs/development/interpreters/lua-5/tests/default.nix

@@ -66,6 +66,21 @@ in
       touch $out
     '');
 
+  # checks that lua's setup-hook adds dependencies to LUA_PATH
+  # Prevents the following regressions
+  # $ env NIX_PATH=nixpkgs=. nix-shell --pure -Q -p luajitPackages.lua luajitPackages.http
+  # nix-shell$ luajit
+  # > require('http.request')
+  # stdin:1: module 'http.request' not found:
+  checkSetupHook = pkgs.runCommandLocal "test-${lua.name}-setup-hook" ({
+      nativeBuildInputs = [lua];
+      buildInputs = [ lua.pkgs.http ];
+      meta.platforms = lua.meta.platforms;
+    }) (''
+      ${lua}/bin/lua -e "require'http.request'"
+      touch $out
+    '');
+
   checkRelativeImports = pkgs.runCommandLocal "test-${lua.name}-relative-imports" ({
     }) (''
       source ${./assert.sh}

pkgs/development/interpreters/python/cpython/2.7/default.nix

@@ -318,6 +318,8 @@ in with passthru; stdenv.mkDerivation ({
     inherit passthru;
 
     postFixup = ''
+      # Include a sitecustomize.py file. Note it causes an error when it's in postInstall with 2.7.
+      cp ${../../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
     '' + lib.optionalString strip2to3 ''
       rm -R $out/bin/2to3 $out/lib/python*/lib2to3
     '' + lib.optionalString stripConfig ''

pkgs/development/interpreters/python/cpython/default.nix

@@ -537,7 +537,8 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
     # Strip tests
     rm -R $out/lib/python*/test $out/lib/python*/**/test{,s}
     '' + optionalString includeSiteCustomize ''
-
+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
     '' + optionalString stripBytecode ''
     # Determinism: deterministic bytecode
     # First we delete all old bytecode.

pkgs/development/interpreters/python/default.nix

@@ -20,10 +20,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "8";
+        patch = "9";
         suffix = "";
       };
-      hash = "sha256-ngYAjIkBkkOVvB2jA+rFZ6cprgErqhgqs5Jp9lA4O7M=";
+      hash = "sha256-mx6JZSP8UQaREmyGRAbZNgo9Hphqy9pZzaV7Wr2kW4c=";
     };
   };
 
@@ -79,10 +79,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "12";
-      patch = "2";
+      patch = "3";
       suffix = "";
     };
-    hash = "sha256-vigRLayBPSBTVFwUvxOhZAGiGHfxpp626l2ExKDz2HA=";
+    hash = "sha256-Vr/vH9/BIhzmcg5DpmHj60F4XdkUzplpjYx4lq9L2qE=";
     inherit (darwin) configd;
     inherit passthruFun;
   };

pkgs/development/interpreters/python/hooks/default.nix

@@ -191,10 +191,12 @@ in {
 
   setuptoolsBuildHook = callPackage ({ makePythonHook, setuptools, wheel }:
     makePythonHook {
-      name = "setuptools-setup-hook";
+      name = "setuptools-build-hook";
       propagatedBuildInputs = [ setuptools wheel ];
       substitutions = {
-        inherit pythonInterpreter pythonSitePackages setuppy;
+        inherit pythonInterpreter setuppy;
+        # python2.pkgs.setuptools does not support parallelism
+        setuptools_has_parallel = setuptools != null && lib.versionAtLeast setuptools.version "69";
       };
     } ./setuptools-build-hook.sh) {};
 

pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh

@@ -3,7 +3,7 @@ echo "Sourcing setuptools-build-hook"
 
 setuptoolsBuildPhase() {
     echo "Executing setuptoolsBuildPhase"
-    local args
+    local args setuptools_has_parallel=@setuptools_has_parallel@
     runHook preBuild
 
     cp -f @setuppy@ nix_run_setup
@@ -12,7 +12,9 @@ setuptoolsBuildPhase() {
         args+="$setupPyGlobalFlags"
     fi
     if [ -n "$enableParallelBuilding" ]; then
-        setupPyBuildFlags+=" --parallel $NIX_BUILD_CORES"
+        if [ -n "$setuptools_has_parallel" ]; then
+            setupPyBuildFlags+=" --parallel $NIX_BUILD_CORES"
+        fi
     fi
     if [ -n "$setupPyBuildFlags" ]; then
         args+=" build_ext $setupPyBuildFlags"
@@ -23,36 +25,7 @@ setuptoolsBuildPhase() {
     echo "Finished executing setuptoolsBuildPhase"
 }
 
-setuptoolsShellHook() {
-    echo "Executing setuptoolsShellHook"
-    runHook preShellHook
-
-    if test -e setup.py; then
-        tmp_path=$(mktemp -d)
-        export PATH="$tmp_path/bin:$PATH"
-        export PYTHONPATH="$tmp_path/@pythonSitePackages@:$PYTHONPATH"
-        mkdir -p "$tmp_path/@pythonSitePackages@"
-        eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path \
-          --no-build-isolation >&2"
-
-        # Process pth file installed in tmp path. This allows one to
-        # actually import the editable installation. Note site.addsitedir
-        # appends, not prepends, new paths. Hence, it is not possible to override
-        # an existing installation of the package.
-        # https://github.com/pypa/setuptools/issues/2612
-        export NIX_PYTHONPATH="$tmp_path/@pythonSitePackages@:${NIX_PYTHONPATH-}"
-    fi
-
-    runHook postShellHook
-    echo "Finished executing setuptoolsShellHook"
-}
-
 if [ -z "${dontUseSetuptoolsBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using setuptoolsBuildPhase"
     buildPhase=setuptoolsBuildPhase
 fi
-
-if [ -z "${dontUseSetuptoolsShellHook-}" ] && [ -z "${shellHook-}" ]; then
-    echo "Using setuptoolsShellHook"
-    shellHook=setuptoolsShellHook
-fi

pkgs/development/interpreters/python/pypy/default.nix

@@ -126,6 +126,9 @@ in with passthru; stdenv.mkDerivation rec {
     ln -s $out/${executable}-c/include $out/include/${libPrefix}
     ln -s $out/${executable}-c/lib-python/${if isPy3k then "3" else pythonVersion} $out/lib/${libPrefix}
 
+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${if isPy38OrNewer then sitePackages else "lib/${libPrefix}/${sitePackages}"}/sitecustomize.py
+
     runHook postInstall
   '';
 

pkgs/development/interpreters/python/pypy/prebuilt.nix

@@ -95,6 +95,9 @@ in with passthru; stdenv.mkDerivation {
     echo "Removing bytecode"
     find . -name "__pycache__" -type d -depth -delete
 
+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
+
     runHook postInstall
   '';
 

pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix

@@ -96,6 +96,9 @@ in with passthru; stdenv.mkDerivation {
     echo "Removing bytecode"
     find . -name "__pycache__" -type d -depth -delete
 
+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
+
     runHook postInstall
   '';
 

pkgs/development/interpreters/python/sitecustomize.py

@@ -0,0 +1,39 @@
+"""
+This is a Nix-specific module for discovering modules built with Nix.
+
+The module recursively adds paths that are on `NIX_PYTHONPATH` to `sys.path`. In
+order to process possible `.pth` files `site.addsitedir` is used.
+
+The paths listed in `PYTHONPATH` are added to `sys.path` afterwards, but they
+will be added before the entries we add here and thus take precedence.
+
+Note the `NIX_PYTHONPATH` environment variable is unset in order to prevent leakage.
+
+Similarly, this module listens to the environment variable `NIX_PYTHONEXECUTABLE`
+and sets `sys.executable` to its value.
+"""
+import site
+import sys
+import os
+import functools
+
+paths = os.environ.pop('NIX_PYTHONPATH', None)
+if paths:
+    functools.reduce(lambda k, p: site.addsitedir(p, k), paths.split(':'), site._init_pathinfo())
+
+# Check whether we are in a venv or virtualenv.
+# For Python 3 we check whether our `base_prefix` is different from our current `prefix`.
+# For Python 2 we check whether the non-standard `real_prefix` is set.
+# https://stackoverflow.com/questions/1871549/determine-if-python-is-running-inside-virtualenv
+in_venv = (sys.version_info.major == 3 and sys.prefix != sys.base_prefix) or (sys.version_info.major == 2 and hasattr(sys, "real_prefix"))
+
+if not in_venv:
+    executable = os.environ.pop('NIX_PYTHONEXECUTABLE', None)
+    prefix = os.environ.pop('NIX_PYTHONPREFIX', None)
+
+    if 'PYTHONEXECUTABLE' not in os.environ and executable is not None:
+        sys.executable = executable
+    if prefix is not None:
+        # Sysconfig does not like it when sys.prefix is set to None
+        sys.prefix = sys.exec_prefix = prefix
+        site.PREFIXES.insert(0, prefix)

pkgs/development/interpreters/python/tests.nix

@@ -38,22 +38,14 @@ let
         is_nixenv = "False";
         is_virtualenv = "False";
       };
-    } // lib.optionalAttrs (!python.isPyPy) {
+    } // lib.optionalAttrs (!python.isPyPy && !stdenv.isDarwin) {
-      # Use virtualenv with symlinks from a Nix env.
+      # Use virtualenv from a Nix env.
-      nixenv-virtualenv-links = rec {
+      # Fails on darwin with
-        env = runCommand "${python.name}-virtualenv-links" {} ''
+      #   virtualenv: error: argument dest: the destination . is not write-able at /nix/store
-          ${pythonVirtualEnv.interpreter} -m virtualenv --system-site-packages --symlinks --no-seed $out
+      nixenv-virtualenv = rec {
-        '';
+        env = runCommand "${python.name}-virtualenv" {} ''
-        interpreter = "${env}/bin/${python.executable}";
+          ${pythonVirtualEnv.interpreter} -m virtualenv venv
-        is_venv = "False";
+          mv venv $out
-        is_nixenv = "True";
-        is_virtualenv = "True";
-      };
-    } // lib.optionalAttrs (!python.isPyPy) {
-      # Use virtualenv with copies from a Nix env.
-      nixenv-virtualenv-copies = rec {
-        env = runCommand "${python.name}-virtualenv-copies" {} ''
-          ${pythonVirtualEnv.interpreter} -m virtualenv --system-site-packages --copies --no-seed $out
         '';
         interpreter = "${env}/bin/${python.executable}";
         is_venv = "False";
@@ -69,48 +61,27 @@ let
         is_nixenv = "True";
         is_virtualenv = "False";
       };
-    } // lib.optionalAttrs (python.pythonAtLeast "3.8" && (!python.isPyPy)) {
+    } // lib.optionalAttrs (python.isPy3k && (!python.isPyPy)) {
-      # Venv built using links to plain Python
+      # Venv built using plain Python
       # Python 2 does not support venv
       # TODO: PyPy executable name is incorrect, it should be pypy-c or pypy-3c instead of pypy and pypy3.
-      plain-venv-links = rec {
+      plain-venv = rec {
-        env = runCommand "${python.name}-venv-links" {} ''
+        env = runCommand "${python.name}-venv" {} ''
-          ${python.interpreter} -m venv --system-site-packages --symlinks --without-pip $out
+          ${python.interpreter} -m venv $out
-        '';
-        interpreter = "${env}/bin/${python.executable}";
-        is_venv = "True";
-        is_nixenv = "False";
-        is_virtualenv = "False";
-      };
-    } // lib.optionalAttrs (python.pythonAtLeast "3.8" && (!python.isPyPy)) {
-      # Venv built using copies from plain Python
-      # Python 2 does not support venv
-      # TODO: PyPy executable name is incorrect, it should be pypy-c or pypy-3c instead of pypy and pypy3.
-      plain-venv-copies = rec {
-        env = runCommand "${python.name}-venv-copies" {} ''
-          ${python.interpreter} -m venv --system-site-packages --copies --without-pip $out
         '';
         interpreter = "${env}/bin/${python.executable}";
         is_venv = "True";
         is_nixenv = "False";
         is_virtualenv = "False";
       };
+
     } // lib.optionalAttrs (python.pythonAtLeast "3.8") {
       # Venv built using Python Nix environment (python.buildEnv)
-      nixenv-venv-links = rec {
+      # TODO: Cannot create venv from a  nix env
-        env = runCommand "${python.name}-venv-links" {} ''
+      # Error: Command '['/nix/store/ddc8nqx73pda86ibvhzdmvdsqmwnbjf7-python3-3.7.6-venv/bin/python3.7', '-Im', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.
-          ${pythonEnv.interpreter} -m venv --system-site-packages --symlinks --without-pip $out
+      nixenv-venv = rec {
-        '';
+        env = runCommand "${python.name}-venv" {} ''
-        interpreter = "${env}/bin/${pythonEnv.executable}";
+          ${pythonEnv.interpreter} -m venv $out
-        is_venv = "True";
-        is_nixenv = "True";
-        is_virtualenv = "False";
-      };
-    } // lib.optionalAttrs (python.pythonAtLeast "3.8") {
-      # Venv built using Python Nix environment (python.buildEnv)
-      nixenv-venv-copies = rec {
-        env = runCommand "${python.name}-venv-copies" {} ''
-          ${pythonEnv.interpreter} -m venv --system-site-packages --copies --without-pip $out
         '';
         interpreter = "${env}/bin/${pythonEnv.executable}";
         is_venv = "True";
@@ -122,33 +93,11 @@ let
     testfun = name: attrs: runCommand "${python.name}-tests-${name}" ({
       inherit (python) pythonVersion;
     } // attrs) ''
-      mkdir $out
-
-      # set up the test files
       cp -r ${./tests/test_environments} tests
       chmod -R +w tests
       substituteAllInPlace tests/test_python.py
-
+      ${attrs.interpreter} -m unittest discover --verbose tests #/test_python.py
-      # run the tests by invoking the interpreter via full path
+      mkdir $out
-      echo "absolute path: ${attrs.interpreter}"
-      ${attrs.interpreter} -m unittest discover --verbose tests 2>&1 | tee "$out/full.txt"
-
-      # run the tests by invoking the interpreter via $PATH
-      export PATH="$(dirname ${attrs.interpreter}):$PATH"
-      echo "PATH: $(basename ${attrs.interpreter})"
-      "$(basename ${attrs.interpreter})" -m unittest discover --verbose tests 2>&1 | tee "$out/path.txt"
-
-      # make sure we get the right path when invoking through a result link
-      ln -s "${attrs.env}" result
-      relative="result/bin/$(basename ${attrs.interpreter})"
-      expected="$PWD/$relative"
-      actual="$(./$relative -c "import sys; print(sys.executable)" | tee "$out/result.txt")"
-      if [ "$actual" != "$expected" ]; then
-        echo "expected $expected, got $actual"
-        exit 1
-      fi
-
-      # if we got this far, the tests passed
       touch $out/success
     '';
 

pkgs/development/interpreters/python/tests/test_environments/test_python.py

@@ -38,7 +38,7 @@ class TestCasePython(unittest.TestCase):
 
     @unittest.skipIf(IS_PYPY or sys.version_info.major==2, "Python 2 does not have base_prefix")
     def test_base_prefix(self):
-        if IS_VENV or IS_VIRTUALENV:
+        if IS_VENV or IS_NIXENV or IS_VIRTUALENV:
             self.assertNotEqual(sys.prefix, sys.base_prefix)
         else:
             self.assertEqual(sys.prefix, sys.base_prefix)

pkgs/development/interpreters/python/wrapper.nix

@@ -35,8 +35,6 @@ let
       fi
       mkdir -p "$out/bin"
 
-      rm -f $out/bin/.*-wrapped
-
       for path in ${lib.concatStringsSep " " paths}; do
         if [ -d "$path/bin" ]; then
           cd "$path/bin"
@@ -44,13 +42,7 @@ let
             if [ -f "$prg" ]; then
               rm -f "$out/bin/$prg"
               if [ -x "$prg" ]; then
-                if [ -f ".$prg-wrapped" ]; then
+                makeWrapper "$path/bin/$prg" "$out/bin/$prg" --set NIX_PYTHONPREFIX "$out" --set NIX_PYTHONEXECUTABLE ${pythonExecutable} --set NIX_PYTHONPATH ${pythonPath} ${lib.optionalString (!permitUserSite) ''--set PYTHONNOUSERSITE "true"''} ${lib.concatStringsSep " " makeWrapperArgs}
-                  echo "#!${pythonExecutable}" > "$out/bin/$prg"
-                  sed -e '1d' -e '3d' ".$prg-wrapped" >> "$out/bin/$prg"
-                  chmod +x "$out/bin/$prg"
-                else
-                  makeWrapper "$path/bin/$prg" "$out/bin/$prg" --inherit-argv0 --resolve-argv0 ${lib.optionalString (!permitUserSite) ''--set PYTHONNOUSERSITE "true"''} ${lib.concatStringsSep " " makeWrapperArgs}
-                fi
               fi
             fi
           done

pkgs/development/interpreters/ruby/default.nix

@@ -74,7 +74,7 @@ let
 
         strictDeps = true;
 
-        nativeBuildInputs = [ autoreconfHook bison ]
+        nativeBuildInputs = [ autoreconfHook bison removeReferencesTo ]
           ++ (op docSupport groff)
           ++ (ops (dtraceSupport && stdenv.isLinux) [ systemtap libsystemtap ])
           ++ ops yjitSupport [ rustPlatform.cargoSetupHook cargo rustc ]
@@ -190,10 +190,10 @@ let
           ${
             lib.optionalString (!jitSupport) ''
               # Get rid of the CC runtime dependency
-              ${removeReferencesTo}/bin/remove-references-to \
+              remove-references-to \
                 -t ${stdenv.cc} \
                 $out/lib/libruby*
-              ${removeReferencesTo}/bin/remove-references-to \
+              remove-references-to \
                 -t ${stdenv.cc} \
                 $rbConfig
               sed -i '/CC_VERSION_MESSAGE/d' $rbConfig
@@ -237,7 +237,7 @@ let
           cp ${./rbconfig.rb} $devdoc/lib/ruby/site_ruby/rbconfig.rb
         '' + opString useBaseRuby ''
           # Prevent the baseruby from being included in the closure.
-          ${removeReferencesTo}/bin/remove-references-to \
+          remove-references-to \
             -t ${baseRuby} \
             $rbConfig $out/lib/libruby*
         '';
@@ -257,7 +257,7 @@ let
         '';
         doInstallCheck = true;
 
-        disallowedRequisites = op (!jitSupport) stdenv.cc.cc
+        disallowedRequisites = op (!jitSupport) stdenv.cc
           ++ op useBaseRuby baseRuby;
 
         meta = with lib; {

pkgs/development/interpreters/ruby/rubygems/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.5.6";
+  version = "3.5.7";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-8/zAMnzuC3677i7wFKQroFtAMtfhg0280xZd3nAMmcI=";
+    hash = "sha256-w9BKIE0vcmX+mmtDqF1tInhplHdBok1W5R1xNtRinjk=";
   };
 
   patches = [

pkgs/development/libraries/SDL2/default.nix

@@ -58,13 +58,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2";
-  version = "2.30.1";
+  version = "2.30.2";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-nwmmyJK1/5Mu7l1YCk4PsasJIrx3jdiM5f/Cu3n0paA=";
+    hash = "sha256-yYYtsF6+IKynXpfay0rUmCQPdL8vp6dlmon8N7UG89A=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];

pkgs/development/libraries/abseil-cpp/202401.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abseil-cpp";
-  version = "20240116.1";
+  version = "20240116.2";
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-cpp";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-D4E11bICKr3Z5RRah7QkfXVsXtuUg32FMmKpiOGjZDM=";
+    hash = "sha256-eA2/dZpNOlex1O5PNa3XSZhpMB3AmaIoHzVDI9TD/cg=";
   };
 
   cmakeFlags = [

pkgs/development/libraries/audio/libopenmpt/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.7.4";
+  version = "0.7.6";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-FgD5M16uOQQImmKG9SWBKWHFTONqBd/m7qpXbdkyjz8=";
+    hash = "sha256-Fi1yowa7LhFMJPolJn0NCgrBbzn9laXA38daZm7l5PU=";
   };
 
   enableParallelBuilding = true;

pkgs/development/libraries/avahi/CVE-2023-38469.patch

@@ -1,102 +0,0 @@
-From a337a1ba7d15853fb56deef1f464529af6e3a1cf Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Mon, 23 Oct 2023 20:29:31 +0000
-Subject: [PATCH 1/2] core: reject overly long TXT resource records
-
-Closes https://github.com/lathiat/avahi/issues/455
-
-CVE-2023-38469
----
- avahi-core/rr.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/avahi-core/rr.c b/avahi-core/rr.c
-index 2bb89244..9c04ebbd 100644
---- a/avahi-core/rr.c
-+++ b/avahi-core/rr.c
-@@ -32,6 +32,7 @@
- #include <avahi-common/malloc.h>
- #include <avahi-common/defs.h>
- 
-+#include "dns.h"
- #include "rr.h"
- #include "log.h"
- #include "util.h"
-@@ -689,11 +690,17 @@ int avahi_record_is_valid(AvahiRecord *r) {
-         case AVAHI_DNS_TYPE_TXT: {
- 
-             AvahiStringList *strlst;
-+            size_t used = 0;
- 
--            for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next)
-+            for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next) {
-                 if (strlst->size > 255 || strlst->size <= 0)
-                     return 0;
- 
-+                used += 1+strlst->size;
-+                if (used > AVAHI_DNS_RDATA_MAX)
-+                    return 0;
-+            }
-+
-             return 1;
-         }
-     }
-
-From c6cab87df290448a63323c8ca759baa516166237 Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Wed, 25 Oct 2023 18:15:42 +0000
-Subject: [PATCH 2/2] tests: pass overly long TXT resource records
-
-to make sure they don't crash avahi any more.
-
-It reproduces https://github.com/lathiat/avahi/issues/455
----
- avahi-client/client-test.c       | 14 ++++++++++++++
- 2 files changed, 20 insertions(+)
-
-diff --git a/avahi-client/client-test.c b/avahi-client/client-test.c
-index ba979988..da0e43ad 100644
---- a/avahi-client/client-test.c
-+++ b/avahi-client/client-test.c
-@@ -22,6 +22,7 @@
- #endif
- 
- #include <stdio.h>
-+#include <string.h>
- #include <assert.h>
- 
- #include <avahi-client/client.h>
-@@ -33,6 +34,8 @@
- #include <avahi-common/malloc.h>
- #include <avahi-common/timeval.h>
- 
-+#include <avahi-core/dns.h>
-+
- static const AvahiPoll *poll_api = NULL;
- static AvahiSimplePoll *simple_poll = NULL;
- 
-@@ -222,6 +225,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) {
-     uint32_t cookie;
-     struct timeval tv;
-     AvahiAddress a;
-+    uint8_t rdata[AVAHI_DNS_RDATA_MAX+1];
-+    AvahiStringList *txt = NULL;
-+    int r;
- 
-     simple_poll = avahi_simple_poll_new();
-     poll_api = avahi_simple_poll_get(simple_poll);
-@@ -261,6 +267,14 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) {
-     error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0);
-     assert(error != AVAHI_OK);
- 
-+    memset(rdata, 1, sizeof(rdata));
-+    r = avahi_string_list_parse(rdata, sizeof(rdata), &txt);
-+    assert(r >= 0);
-+    assert(avahi_string_list_serialize(txt, NULL, 0) == sizeof(rdata));
-+    error = avahi_entry_group_add_service_strlst(group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", "_qotd._tcp", NULL, NULL, 123, txt);
-+    assert(error == AVAHI_ERR_INVALID_RECORD);
-+    avahi_string_list_free(txt);
-+
-     avahi_entry_group_commit (group);
- 
-     domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u");

pkgs/development/libraries/avahi/CVE-2023-38471-2.patch

@@ -1,47 +0,0 @@
-From 04ac71fd56a16365360f14bd4691219913e22f21 Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Tue, 24 Oct 2023 21:57:32 +0000
-Subject: [PATCH 1/2] smoke-test: call SetHostName with unusual names
-
-It's prompted by https://github.com/lathiat/avahi/issues/453
----
- avahi-core/server.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/avahi-core/server.c b/avahi-core/server.c
-index f6a21bb7..84df6b5d 100644
---- a/avahi-core/server.c
-+++ b/avahi-core/server.c
-@@ -1309,10 +1309,13 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     else
-         hn = avahi_normalize_name_strdup(host_name);
- 
-+    if (!hn)
-+        return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY);
-+
-     h = hn;
-     if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) {
-         avahi_free(h);
--        return AVAHI_ERR_INVALID_HOST_NAME;
-+        return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME);
-     }
- 
-     avahi_free(h);
-@@ -1320,7 +1323,7 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     h = label_escaped;
-     len = sizeof(label_escaped);
-     if (!avahi_escape_label(label, strlen(label), &h, &len))
--        return AVAHI_ERR_INVALID_HOST_NAME;
-+        return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME);
- 
-     if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION)
-         return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE);
-@@ -1330,7 +1333,7 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     avahi_free(s->host_name);
-     s->host_name = avahi_strdup(label_escaped);
-     if (!s->host_name)
--        return AVAHI_ERR_NO_MEMORY;
-+        return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY);
- 
-     update_fqdn(s);
- 

pkgs/development/libraries/avahi/default.nix

@@ -57,6 +57,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c.patch";
       sha256 = "sha256-Fanh9bvz+uknr5pAmltqijuUAZIG39JR2Lyq5zGKJ58=";
     })
+    # https://github.com/avahi/avahi/pull/480 merged Sept 19
+    (fetchpatch {
+      name = "bail-out-unless-escaped-labels-fit.patch";
+      url = "https://github.com/avahi/avahi/commit/20dec84b2480821704258bc908e7b2bd2e883b24.patch";
+      sha256 = "sha256-p/dOuQ/GInIcUwuFhQR3mGc5YBL5J8ho+1gvzcqEN0c=";
+    })
     # CVE-2023-38473
     # https://github.com/lathiat/avahi/pull/486 merged Oct 18
     (fetchpatch {
@@ -79,12 +85,39 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-4dG+5ZHDa+A4/CszYS8uXWlpmA89m7/jhbZ7rheMs7U=";
     })
     # https://github.com/lathiat/avahi/pull/499 merged Oct 25
-    # (but with the changes to '.github/workflows/smoke-tests.sh removed)
+    (fetchpatch {
-    ./CVE-2023-38471-2.patch
+      name = "CVE-2023-38471-2.patch";
+      url = "https://github.com/avahi/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460.patch";
+      sha256 = "sha256-uDtMPWuz1lsu7n0Co/Gpyh369miQ6GWGyC0UPQB/yI8=";
+    })
     # CVE-2023-38469
     # https://github.com/lathiat/avahi/pull/500 merged Oct 25
-    # (but with the changes to '.github/workflows/smoke-tests.sh removed)
+    (fetchpatch {
-    ./CVE-2023-38469.patch
+      name = "CVE-2023-38469.patch";
+      url = "https://github.com/avahi/avahi/commit/61b9874ff91dd20a12483db07df29fe7f35db77f.patch";
+      sha256 = "sha256-qR7scfQqhRGxg2n4HQsxVxCLkXbwZi+PlYxrOSEPsL0=";
+      excludes = [ ".github/workflows/smoke-tests.sh" ];
+    })
+    # https://github.com/avahi/avahi/pull/515 merged Nov 3
+    (fetchpatch {
+      name = "fix-compare-rrs-with-zero-length-rdata.patch";
+      url = "https://github.com/avahi/avahi/commit/177d75e8c43be45a8383d794ce4084dd5d600a9e.patch";
+      sha256 = "sha256-uwIyruAWgiWt0yakRrvMdYjjhEhUk5cIGKt6twyXbHw=";
+    })
+    # https://github.com/avahi/avahi/pull/519 merged Nov 8
+    (fetchpatch {
+      name = "reject-non-utf-8-service-names.patch";
+      url = "https://github.com/avahi/avahi/commit/2b6d3e99579e3b6e9619708fad8ad8e07ada8218.patch";
+      sha256 = "sha256-lwSA3eEQgH0g51r0i9/HJMJPRXrhQnTIEDxcYqUuLdI=";
+      excludes = [ "fuzz/fuzz-domain.c" ];
+    })
+    # https://github.com/avahi/avahi/pull/523 merged Nov 12
+    (fetchpatch {
+      name = "core-no-longer-supply-bogus-services-to-callbacks.patch";
+      url = "https://github.com/avahi/avahi/commit/93b14365c1c1e04efd1a890e8caa01a2a514bfd8.patch";
+      sha256 = "sha256-VBm8vsBZkTbbWAK8FI71SL89lZuYd1yFNoB5o+FvlEU=";
+      excludes = [ ".github/workflows/smoke-tests.sh" "fuzz/fuzz-packet.c" ];
+    })
   ];
 
   depsBuildBuild = [

pkgs/development/libraries/aws-c-auth/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.10";
+  version = "0.7.16";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    hash = "sha256-yJ0sgw0y9tIiIHgTPVnfYd8zAGjO83qfeeEzstGH9CE=";
+    hash = "sha256-76sBv4oChDrkv80HPktkULFNC37kfTNxjlwNg/FJiyA=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/aws-c-common/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
-  version = "0.9.10";
+  version = "0.9.14";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xqNqyVtibR8oSMvl5RTU166FIxcbvGjZJOjJ9j6fU78=";
+    hash = "sha256-aeuIXqnO8divpguDpiPlYJHABYIqegpaDNGwqJ5TKZw=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/aws-c-event-stream/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-event-stream";
-  version = "0.3.2";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uKprdBJn9yHDm2HCBOiuanizCtLi/VKrvUUScNv6OPY=";
+    hash = "sha256-wj3PZshUay3HJy+v7cidDL4mDAqSDiX+MmQtJDK4rTI=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/aws-c-http/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-http";
-  version = "0.7.14";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${version}";
-    sha256 = "sha256-HrNdePWNw/5tDBeybnUjK3LgftnGQ4CBXPG0URaxIeU=";
+    hash = "sha256-S5ETVkdGTndt2GJBNL4DU5SycHAufsmN06xBDRMFVKo=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/aws-c-io/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
-  version = "0.13.36";
+  version = "0.14.6";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TwPcsTMBOE1uIInH6/eQdUMV6uD7d60773THzc1/G9Y=";
+    hash = "sha256-fekeGghqMKbUqKWIfpZg3a6dCpgxywhmXPoGz9y4Aos=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/aws-c-mqtt/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-mqtt";
-  version = "0.9.10";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-mqtt";
     rev = "v${version}";
-    sha256 = "sha256-hxisqBUARJLtmZniXaZ2th0hqWiKn4XQIy6I0Oz/kUs=";
+    hash = "sha256-MWcXTMwKtFnrNp+OnHxkiYCUXc3IUhM6iTQa+F9JwsQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/aws-c-s3/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.4.0";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-tb9h78Gd4N11DPB2ETq241lvDQqHIy2HYBsJrBlLpxA=";
+    hash = "sha256-8eKQsP7AftNDccsZHPC9PcwpbpgZSvsioUuSsiggQDs=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/aws-c-sdkutils/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-sdkutils";
-  version = "0.1.12";
+  version = "0.1.15";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-sdkutils";
     rev = "v${version}";
-    sha256 = "sha256-4YuOC90FBcuNYGBsqw3wKYNGkg3MssezvR8bu6BNGeM=";
+    hash = "sha256-RTRDbdv+QmRG0Sk/R9qhl45WYEVyl+M0EceLFsoONTI=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/aws-crt-cpp/default.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-crt-cpp";
-  version = "0.24.7";
+  version = "0.26.4";
 
   outputs = [ "out" "dev" ];
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${version}";
-    sha256 = "sha256-AYO0ckqEx2jG7HduvaxASQMOsxuHGkRkyVsUP5WOs98=";
+    sha256 = "sha256-H5ms6fhhlkARn9g8S5Ma8bnisZv8mfNizP0QpzsF1tA=";
   };
 
   patches = [

pkgs/development/libraries/aws-sdk-cpp/default.nix

@@ -27,13 +27,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = "1.11.207";
+  version = "1.11.296";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "sha256-IsPDQJo+TZ2noLefroiWl/Jx8fXmrmY73WHNRO41sik=";
+    hash = "sha256-yg+OkeUaqwUQGQ5ThIVQUpF2rHm4FuFbcl5gE5WHHOQ=";
   };
 
   postPatch = ''

pkgs/development/libraries/enchant/2.x.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.6.7";
+  version = "2.6.8";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-ocLltZrMoAC7+ySBCvShFlcz1AfyFUeGWI4HbIzVe/w=";
+    hash = "sha256-9WWSMGLHfz1YhG8FWNIebQfKSkiMWIEt/e+zUgL6x64=";
   };
 
   strictDeps = true;

pkgs/development/libraries/ffmpeg/default.nix

@@ -6,13 +6,10 @@ let
     callPackage ./generic.nix (
       {
         inherit (darwin.apple_sdk.frameworks)
-          Cocoa
+          AppKit
-          CoreServices
+          AudioToolbox
-          CoreAudio
-          CoreMedia
           AVFoundation
-          MediaToolbox
+          CoreImage
-          VideoDecodeAcceleration
           VideoToolbox
           ;
       }

pkgs/development/libraries/ffmpeg/generic.nix

@@ -35,20 +35,26 @@
   # Feature flags
 , withAlsa ? withHeadlessDeps && stdenv.isLinux # Alsa in/output supporT
 , withAom ? withFullDeps # AV1 reference encoder
+, withAppKit ? withHeadlessDeps && stdenv.isDarwin # Apple AppKit framework
 , withAribcaption ? withFullDeps && lib.versionAtLeast version "6.1" # ARIB STD-B24 Caption Decoder/Renderer
 , withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
+, withAudioToolbox ? withHeadlessDeps && stdenv.isDarwin # Apple AudioToolbox
+, withAvFoundation ? withHeadlessDeps && stdenv.isDarwin # Apple AVFoundation framework
 , withBluray ? withFullDeps # BluRay reading
 , withBs2b ? withFullDeps # bs2b DSP library
 , withBzlib ? withHeadlessDeps
 , withCaca ? withFullDeps # Textual display (ASCII art)
 , withCelt ? withFullDeps # CELT decoder
 , withChromaprint ? withFullDeps # Audio fingerprinting
-, withCuda ? withFullDeps && (with stdenv; (!isDarwin && !hostPlatform.isAarch && !hostPlatform.isRiscV))
+, withCoreImage ? withHeadlessDeps && stdenv.isDarwin # Apple CoreImage framework
+, withCuda ? withFullDeps && withNvcodec
 , withCudaLLVM ? withFullDeps
+, withCuvid ? withHeadlessDeps && withNvcodec
 , withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
 , withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
 , withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # libdrm support
 , withFdkAac ? withFullDeps && (!withGPL || withUnfree) # Fraunhofer FDK AAC de/encoder
+, withNvcodec ? withHeadlessDeps && (with stdenv; !isDarwin && !isAarch32 && !hostPlatform.isRiscV && hostPlatform == buildPlatform) # dynamically linked Nvidia code
 , withFlite ? withFullDeps # Voice Synthesis
 , withFontconfig ? withHeadlessDeps # Needed for drawtext filter
 , withFreetype ? withHeadlessDeps # Needed for drawtext filter
@@ -66,14 +72,14 @@
 , withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
 , withMp3lame ? withHeadlessDeps # LAME MP3 encoder
 , withMysofa ? withFullDeps # HRTF support via SOFAlizer
-, withNvdec ? withHeadlessDeps && (with stdenv; !isDarwin && hostPlatform == buildPlatform && !isAarch32 && !hostPlatform.isRiscV)
+, withNvdec ? withHeadlessDeps && withNvcodec
-, withNvenc ? withHeadlessDeps && (with stdenv; !isDarwin && hostPlatform == buildPlatform && !isAarch32 && !hostPlatform.isRiscV)
+, withNvenc ? withHeadlessDeps && withNvcodec
 , withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
 , withOpenal ? withFullDeps # OpenAL 1.1 capture support
 , withOpencl ? withFullDeps
 , withOpencoreAmrnb ? withFullDeps && withVersion3 # AMR-NB de/encoder
 , withOpencoreAmrwb ? withFullDeps && withVersion3 # AMR-WB decoder
-, withOpengl ? false # OpenGL rendering
+, withOpengl ? withFullDeps && !stdenv.isDarwin # OpenGL rendering
 , withOpenh264 ? withFullDeps # H.264/AVC encoder
 , withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
 , withOpenmpt ? withFullDeps # Tracked music files decoder
@@ -83,7 +89,7 @@
 , withQrencode ? withFullDeps && lib.versionAtLeast version "7" # QR encode generation
 , withQuirc ? withFullDeps && lib.versionAtLeast version "7" # QR decoding
 , withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
-, withRtmp ? false # RTMP[E] support
+, withRtmp ? withFullDeps # RTMP[E] support
 , withSamba ? withFullDeps && !stdenv.isDarwin && withGPLv3 # Samba protocol
 , withSdl2 ? withSmallDeps
 , withShaderc ? withFullDeps && !stdenv.isDarwin && lib.versionAtLeast version "5.0"
@@ -93,12 +99,13 @@
 , withSsh ? withHeadlessDeps # SFTP protocol
 , withSvg ? withFullDeps # SVG protocol
 , withSvtav1 ? withHeadlessDeps && !stdenv.isAarch64 && !stdenv.hostPlatform.isMinGW # AV1 encoder/decoder (focused on speed and correctness)
-, withTensorflow ? false # Tensorflow dnn backend support
+, withTensorflow ? false # Tensorflow dnn backend support (Increases closure size by ~390 MiB)
 , withTheora ? withHeadlessDeps # Theora encoder
 , withV4l2 ? withHeadlessDeps && stdenv.isLinux  # Video 4 Linux support
 , withV4l2M2m ? withV4l2
 , withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
 , withVdpau ? withSmallDeps && !stdenv.hostPlatform.isMinGW # Vdpau hardware acceleration
+, withVideoToolbox ? withHeadlessDeps && stdenv.isDarwin # Apple VideoToolbox
 , withVidStab ? withFullDeps && withGPL # Video stabilization
 , withVmaf ? withFullDeps && !stdenv.isAarch64 && lib.versionAtLeast version "5" # Netflix's VMAF (Video Multi-Method Assessment Fusion)
 , withVoAmrwbenc ? withFullDeps && withVersion3 # AMR-WB encoder
@@ -295,13 +302,10 @@
 /*
  *  Darwin frameworks
  */
+, AppKit
+, AudioToolbox
 , AVFoundation
-, Cocoa
+, CoreImage
-, CoreAudio
-, CoreMedia
-, CoreServices
-, MediaToolbox
-, VideoDecodeAcceleration
 , VideoToolbox
 /*
  *  Testing
@@ -362,6 +366,11 @@ assert buildAvformat -> buildAvcodec && buildAvutil; # configure flag since 0.6
 assert buildPostproc -> buildAvutil;
 assert buildSwscale -> buildAvutil;
 
+/*
+ *  External Library dependencies
+ */
+assert (withCuda || withCuvid || withNvdec  || withNvenc) -> withNvcodec;
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "ffmpeg" + (optionalString (ffmpegVariant != "small") "-${ffmpegVariant}");
   inherit version;
@@ -507,22 +516,28 @@ stdenv.mkDerivation (finalAttrs: {
      */
     (enableFeature withAlsa "alsa")
     (enableFeature withAom "libaom")
+    (enableFeature withAppKit "appkit")
   ] ++ optionals (versionAtLeast version "6.1") [
     (enableFeature withAribcaption "libaribcaption")
   ] ++ [
     (enableFeature withAss "libass")
+    (enableFeature withAudioToolbox "audiotoolbox")
+    (enableFeature withAvFoundation "avfoundation")
     (enableFeature withBluray "libbluray")
     (enableFeature withBs2b "libbs2b")
     (enableFeature withBzlib "bzlib")
     (enableFeature withCaca "libcaca")
     (enableFeature withCelt "libcelt")
     (enableFeature withChromaprint "chromaprint")
+    (enableFeature withCoreImage "coreimage")
     (enableFeature withCuda "cuda")
     (enableFeature withCudaLLVM "cuda-llvm")
+    (enableFeature withCuvid "cuvid")
     (enableFeature withDav1d "libdav1d")
     (enableFeature withDc1394 "libdc1394")
     (enableFeature withDrm "libdrm")
     (enableFeature withFdkAac "libfdk-aac")
+    (enableFeature withNvcodec "ffnvcodec")
     (enableFeature withFlite "libflite")
     (enableFeature withFontconfig "fontconfig")
     (enableFeature withFontconfig "libfontconfig")
@@ -543,7 +558,6 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withModplug "libmodplug")
     (enableFeature withMp3lame "libmp3lame")
     (enableFeature withMysofa "libmysofa")
-    (enableFeature withNvdec "cuvid")
     (enableFeature withNvdec "nvdec")
     (enableFeature withNvenc "nvenc")
     (enableFeature withOpenal "openal")
@@ -585,6 +599,7 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ optionals (versionAtLeast version "6.0")  [
     (enableFeature withVpl "libvpl")
   ] ++ [
+    (enableFeature withVideoToolbox "videotoolbox")
     (enableFeature withVidStab "libvidstab") # Actual min. version 2.0
     (enableFeature withVmaf "libvmaf")
     (enableFeature withVoAmrwbenc "libvo-amrwbenc")
@@ -643,18 +658,23 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = []
   ++ optionals withAlsa [ alsa-lib ]
   ++ optionals withAom [ libaom ]
+  ++ optionals withAppKit [ AppKit ]
   ++ optionals withAribcaption [ libaribcaption ]
   ++ optionals withAss [ libass ]
+  ++ optionals withAudioToolbox [ AudioToolbox ]
+  ++ optionals withAvFoundation [ AVFoundation ]
   ++ optionals withBluray [ libbluray ]
   ++ optionals withBs2b [ libbs2b ]
   ++ optionals withBzlib [ bzip2 ]
   ++ optionals withCaca [ libcaca ]
   ++ optionals withCelt [ celt ]
   ++ optionals withChromaprint [ chromaprint ]
+  ++ optionals withCoreImage [ CoreImage ]
   ++ optionals withDav1d [ dav1d ]
   ++ optionals withDc1394 [ libdc1394 libraw1394 ]
   ++ optionals withDrm [ libdrm ]
   ++ optionals withFdkAac [ fdk_aac ]
+  ++ optionals withNvcodec [ (if (lib.versionAtLeast version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withFlite [ flite ]
   ++ optionals withFontconfig [ fontconfig ]
   ++ optionals withFreetype [ freetype ]
@@ -672,7 +692,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withModplug [ libmodplug ]
   ++ optionals withMp3lame [ lame ]
   ++ optionals withMysofa [ libmysofa ]
-  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withOgg [ libogg ]
   ++ optionals withOpenal [ openal ]
   ++ optionals withOpencl [ ocl-icd opencl-headers ]
@@ -702,6 +721,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withV4l2 [ libv4l ]
   ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
   ++ optionals withVdpau [ libvdpau ]
+  ++ optionals withVideoToolbox [ VideoToolbox ]
   ++ optionals withVidStab [ vid-stab ]
   ++ optionals withVmaf [ libvmaf ]
   ++ optionals withVoAmrwbenc [ vo-amrwbenc ]
@@ -722,17 +742,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withZimg [ zimg ]
   ++ optionals withZlib [ zlib ]
   ++ optionals withZmq [ zeromq4 ]
-  ++ optionals stdenv.isDarwin [
+  ;
-    # TODO fine-grained flags
-    AVFoundation
-    Cocoa
-    CoreAudio
-    CoreMedia
-    CoreServices
-    MediaToolbox
-    VideoDecodeAcceleration
-    VideoToolbox
-  ];
 
   buildFlags = [ "all" ]
     ++ optional buildQtFaststart "tools/qt-faststart"; # Build qt-faststart executable
@@ -800,7 +810,16 @@ stdenv.mkDerivation (finalAttrs: {
       ++ optional withGPLv3 gpl3Plus
       ++ optional withUnfree unfreeRedistributable
       ++ optional (withGPL && withUnfree) unfree;
-    pkgConfigModules = [ "libavutil" ];
+    pkgConfigModules = [ ]
+      ++ optional buildAvcodec "libavcodec"
+      ++ optional buildAvdevice "libavdevice"
+      ++ optional buildAvfilter "libavfilter"
+      ++ optional buildAvformat "libavformat"
+      ++ optional buildAvresample "libavresample"
+      ++ optional buildAvutil "libavutil"
+      ++ optional buildPostproc "libpostproc"
+      ++ optional buildSwresample "libswresample"
+      ++ optional buildSwscale "libswscale";
     platforms = platforms.all;
     # See https://github.com/NixOS/nixpkgs/pull/295344#issuecomment-1992263658
     broken = stdenv.hostPlatform.isMinGW && stdenv.hostPlatform.is64bit;

pkgs/development/libraries/gstreamer/core/default.nix

@@ -67,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optionals stdenv.isLinux [
     libcap
     libunwind
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
     elfutils
   ] ++ lib.optionals stdenv.isDarwin [
     Cocoa

pkgs/development/libraries/harfbuzz/default.nix

@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "8.3.0";
+  version = "8.4.0";
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${finalAttrs.version}/harfbuzz-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EJUB6uuL3j6tsl+rQWTpk/us4pw9d1vKocHlji8V+Ec=";
+    hash = "sha256-r06nPiWrdIyMBjt4wviOSIM9ubKsNp4pvRFXAueJdV4=";
   };
 
   postPatch = ''

pkgs/development/libraries/libaom/default.nix

@@ -8,11 +8,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.8.1";
+  version = "3.8.2";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    hash = "sha256-qng9fEbm71HqPnPzfgqswSium9egIgpB6ZLesOQVg6c=";
+    hash = "sha256-x152jIe7QxeprFEFJnXBfou8yHuW0oHImLIVkSxByWw=";
     stripRoot = false;
   };
 

pkgs/development/libraries/libarchive/default.nix

@@ -44,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/libarchive/libarchive/commit/3bd918d92f8c34ba12de9c6604d96f9e262a59fc.patch";
       hash = "sha256-RM3xFM6S2DkM5DJ0kAba8eLzEXuY5/7AaU06maHJ6rM=";
     })
+    (fetchpatch {
+      name = "fix-suspicious-commit-from-known-bad-actor.patch";
+      url = "https://github.com/libarchive/libarchive/commit/6110e9c82d8ba830c3440f36b990483ceaaea52c.patch";
+      hash = "sha256-/j6rJ0xWhtXU0YCu1LOokxxNppy5Of6Q0XyO4U6la7M=";
+    })
   ];
 
   outputs = [ "out" "lib" "dev" ];

pkgs/development/libraries/libdeflate/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeflate";
-  version = "1.19";
+  version = "1.20";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-HgZ2an1PCPhiLsd3ZA7tgZ1wVTOdHzDr8FHrqJhEbQw=";
+    sha256 = "sha256-kHLdu/Pb94+arj98Jjp57FpvWbAXW49s9cxCA1cf898=";
   };
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "-DLIBDEFLATE_BUILD_SHARED_LIB=OFF" ];

pkgs/development/libraries/libical/default.nix

@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.17";
+  version = "3.0.18";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "sha256-GqPCjI40kkqNv9zTnLdJgZVBxS4eZRHl+k/BN9vGnDo=";
+    sha256 = "sha256-32FNnCybXO67Vtg1LM6miJUaK+r0mlfjxgLQg1LD8Es=";
   };
 
   strictDeps = true;

pkgs/development/libraries/libiconv/default.nix

@@ -37,12 +37,12 @@ stdenv.mkDerivation rec {
     + lib.optionalString enableDarwinABICompat ''
       for iconv_h_in in iconv.h.in iconv.h.build.in; do
         substituteInPlace "include/$iconv_h_in" \
-          --replace "#define iconv libiconv" "" \
+          --replace-fail "#define iconv libiconv" "" \
-          --replace "#define iconv_close libiconv_close" "" \
+          --replace-fail "#define iconv_close libiconv_close" "" \
-          --replace "#define iconv_open libiconv_open" "" \
+          --replace-fail "#define iconv_open libiconv_open" "" \
-          --replace "#define iconv_open_into libiconv_open_into" "" \
+          --replace-fail "#define iconv_open_into libiconv_open_into" "" \
-          --replace "#define iconvctl libiconvctl" "" \
+          --replace-fail "#define iconvctl libiconvctl" "" \
-          --replace "#define iconvlist libiconvlist" ""
+          --replace-fail "#define iconvlist libiconvlist" ""
       done
     '';
 

pkgs/development/libraries/libimobiledevice-glue/default.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libimobiledevice-glue";
-  version = "1.0.0";
+  version = "1.2.0";
 
   outputs = [ "out" "dev" ];
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     owner = "libimobiledevice";
     repo = pname;
     rev = version;
-    hash = "sha256-9TjIYz6w61JaJgOJtWteIDk9bO3NnXp/2ZJwdirFcYM=";
+    hash = "sha256-Rfs1i1Tt8uf3WfR+cDlF4L75nFHg9VypjMhHt0TgkyQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libjxl/default.nix

@@ -8,15 +8,22 @@
 , libjpeg
 , libpng
 , libwebp
+, gdk-pixbuf
 , openexr_3
 , pkg-config
+, makeWrapper
 , zlib
 , asciidoc
 , graphviz
 , doxygen
 , python3
+, lcms2
 }:
 
+let
+  loadersPath = "${gdk-pixbuf.binaryDir}/jxl-loaders.cache";
+in
+
 stdenv.mkDerivation rec {
   pname = "libjxl";
   version = "0.9.1";
@@ -37,6 +44,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
+    gdk-pixbuf
+    makeWrapper
     asciidoc
     doxygen
     python3
@@ -63,12 +72,14 @@ stdenv.mkDerivation rec {
   # conclusively in its README or otherwise; they can best be determined
   # by checking the CMake output for "Could NOT find".
   buildInputs = [
+    lcms2
     giflib
     gperftools # provides `libtcmalloc`
     gtest
     libjpeg
     libpng
     libwebp
+    gdk-pixbuf
     openexr_3
     zlib
   ];
@@ -96,17 +107,30 @@ stdenv.mkDerivation rec {
     # Viewer tools for evaluation.
     # "-DJPEGXL_ENABLE_VIEWERS=ON"
 
-    # TODO: Update this package to enable this (overridably via an option):
     # Enable plugins, such as:
     # * the `gdk-pixbuf` one, which allows applications like `eog` to load jpeg-xl files
     # * the `gimp` one, which allows GIMP to load jpeg-xl files
-    # "-DJPEGXL_ENABLE_PLUGINS=ON"
+    "-DJPEGXL_ENABLE_PLUGINS=ON"
   ] ++ lib.optionals stdenv.hostPlatform.isStatic [
     "-DJPEGXL_STATIC=ON"
   ] ++ lib.optionals stdenv.hostPlatform.isAarch32 [
     "-DJPEGXL_FORCE_NEON=ON"
   ];
 
+  postPatch = ''
+    substituteInPlace plugins/gdk-pixbuf/jxl.thumbnailer \
+      --replace '/usr/bin/gdk-pixbuf-thumbnailer' "$out/libexec/gdk-pixbuf-thumbnailer-jxl"
+  '';
+
+  postInstall = ''
+    GDK_PIXBUF_MODULEDIR="$out/${gdk-pixbuf.moduleDir}" \
+    GDK_PIXBUF_MODULE_FILE="$out/${loadersPath}" \
+      gdk-pixbuf-query-loaders --update-cache
+    mkdir -p "$out/bin"
+    makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-jxl" \
+      --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
+  '';
+
   CXXFLAGS = lib.optionalString stdenv.hostPlatform.isAarch32 "-mfp16-format=ieee";
 
   # FIXME x86_64-darwin:

pkgs/development/libraries/liblc3/default.nix

@@ -7,7 +7,7 @@
 
 let
   name = "liblc3";
-  version = "1.0.4";
+  version = "1.1.0";
 in
 stdenv.mkDerivation {
   pname = name;
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     owner = "google";
     repo = "liblc3";
     rev = "v${version}";
-    sha256 = "sha256-nQJgF/cWoCx5TkX4xOaLB9SzvhVXPY29bLh7UwPMWEE=";
+    sha256 = "sha256-pKd9wOrDjKhWX8vTsg6qkE71FQlsC7VM/uq0ss1vsAQ=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libplist/default.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libplist";
-  version = "2.3.0";
+  version = "2.4.0";
 
   outputs = [ "bin" "dev" "out" ] ++ lib.optional enablePython "py";
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     owner = "libimobiledevice";
     repo = pname;
     rev = version;
-    hash = "sha256-fZfDSWVRg73dN+WF6LbgRSj8vtyeKeyjC8pWXFxUmBg=";
+    hash = "sha256-bH40HSp76w56tlxO5M1INAW4wRR7O27AY4H/CyEcp+Y=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libproxy/default.nix

@@ -1,83 +1,122 @@
 { lib
-, stdenv
+, _experimental-update-script-combinators
+, curl
+, darwin
+, duktape
 , fetchFromGitHub
 , fetchpatch
-, pkg-config
+, gi-docgen
-, cmake
+, gitUpdater
-, zlib
-, dbus
-, networkmanager
-, enableJavaScript ? stdenv.isDarwin || lib.meta.availableOn stdenv.hostPlatform duktape
-, duktape
-, pcre
-, gsettings-desktop-schemas
 , glib
-, makeWrapper
+, gobject-introspection
-, python3
+, gsettings-desktop-schemas
-, SystemConfiguration
+, makeHardcodeGsettingsPatch
-, CoreFoundation
+, meson
-, JavaScriptCore
+, ninja
+, pkg-config
+, stdenv
+, substituteAll
+, vala
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libproxy";
-  version = "0.4.18";
+  version = "0.5.3";
+
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchFromGitHub {
     owner = "libproxy";
     repo = "libproxy";
-    rev = version;
+    rev = finalAttrs.version;
-    hash = "sha256-pqj1LwRdOK2CUu3hYIsogQIXxWzShDuKEbDTbtWkgnQ=";
+    hash = "sha256-qdYB6HJkgboS8kkTvTqLy6Z3JYY5SOJsRl6nZM0iuvw=";
   };
 
-  patches = lib.optionals stdenv.isDarwin [
+  patches = [
-    # https://github.com/libproxy/libproxy/pull/189
+    # Minor refactoring. Allows the following patches to apply without rebasing.
     (fetchpatch {
-      url = "https://github.com/libproxy/libproxy/commit/4331b9db427ce2c25ff5eeb597bec4bc35ed1a0b.patch";
+      url = "https://github.com/libproxy/libproxy/commit/397f4dc72607cc1bb3b584ffd3de49f8ba80491a.patch";
-      sha256 = "sha256-uTh3rYVvEke1iWVHsT3Zj2H1F+gyLrffcmyt0JEKaCA=";
+      hash = "sha256-iUMBMpcVOLG+NxEj8Nd7JtKZFmoGXn0t6A2r2ayiteg=";
+      includes = [
+        "src/backend/plugins/config-gnome/config-gnome.c"
+      ];
+    })
+
+    # Disable schema presence detection, it would fail because it cannot be autopatched,
+    # and it will be hardcoded by the next patch anyway.
+    ./skip-gsettings-detection.patch
+
+    # Hardcode path to Settings schemas for GNOME & related desktops.
+    # Otherwise every app using libproxy would need to be wrapped individually.
+    (substituteAll {
+      src = ./hardcode-gsettings.patch;
+      gds = glib.getSchemaPath gsettings-desktop-schemas;
     })
   ];
 
-  outputs = [ "out" "dev" "py3" ];
-
   nativeBuildInputs = [
+    gi-docgen
+    gobject-introspection
+    meson
+    ninja
     pkg-config
-    cmake
+    vala
-    makeWrapper
   ];
 
   buildInputs = [
-    pcre
+    curl
-    python3
+    duktape
-    zlib
+  ] ++ (if stdenv.hostPlatform.isDarwin then (with darwin.apple_sdk.frameworks; [
-  ] ++ lib.optionals enableJavaScript [
-    (if stdenv.hostPlatform.isDarwin then JavaScriptCore else duktape)
-  ] ++ (if stdenv.hostPlatform.isDarwin then [
-    SystemConfiguration
     CoreFoundation
-  ] else [
+    SystemConfiguration
+  ]) else [
     glib
-    dbus
+    gsettings-desktop-schemas
-    networkmanager
   ]);
 
-  cmakeFlags = [
+  doCheck = true;
-    "-DWITH_PYTHON2=OFF"
-    "-DPYTHON3_SITEPKG_DIR=${placeholder "py3"}/${python3.sitePackages}"
-  ] ++ lib.optional (enableJavaScript && !stdenv.hostPlatform.isDarwin) "-DWITH_MOZJS=ON";
 
-  postFixup = lib.optionalString stdenv.isLinux ''
+  postPatch = ''
-    # config_gnome3 uses the helper to find GNOME proxy settings
+    # Fix running script that will try to install git hooks.
-    wrapProgram $out/libexec/pxgsettings --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}"
+    # Though it will not do anything since we do not keep .git/ directory.
+    # https://github.com/libproxy/libproxy/issues/262
+    chmod +x data/install-git-hook.sh
+    patchShebangs data/install-git-hook.sh
   '';
 
-  doCheck = false; # fails 1 out of 10 tests
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
+  passthru = {
+    hardcodeGsettingsPatch = makeHardcodeGsettingsPatch {
+      schemaIdToVariableMapping = {
+        "org.gnome.system.proxy" = "gds";
+        "org.gnome.system.proxy.http" = "gds";
+        "org.gnome.system.proxy.https" = "gds";
+        "org.gnome.system.proxy.ftp" = "gds";
+        "org.gnome.system.proxy.socks" = "gds";
+      };
+      inherit (finalAttrs) src;
+    };
+
+    updateScript =
+      let
+        updateSource = gitUpdater { };
+        updatePatch = _experimental-update-script-combinators.copyAttrOutputToFile "libproxy.hardcodeGsettingsPatch" ./hardcode-gsettings.patch;
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updatePatch
+      ];
+  };
 
   meta = with lib; {
-    platforms = platforms.linux ++ platforms.darwin;
-    license = licenses.lgpl21;
-    homepage = "https://libproxy.github.io/libproxy/";
     description = "A library that provides automatic proxy configuration management";
+    homepage = "https://libproxy.github.io/libproxy/";
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux ++ platforms.darwin;
     mainProgram = "proxy";
   };
-}
+})

pkgs/development/libraries/libproxy/hardcode-gsettings.patch

@@ -0,0 +1,140 @@
+diff --git a/src/backend/plugins/config-gnome/config-gnome.c b/src/backend/plugins/config-gnome/config-gnome.c
+index 820827b..338e269 100644
+--- a/src/backend/plugins/config-gnome/config-gnome.c
++++ b/src/backend/plugins/config-gnome/config-gnome.c
+@@ -85,11 +85,60 @@ px_config_gnome_init (PxConfigGnome *self)
+   if (!self->available)
+     return;
+ 
+-  self->proxy_settings = g_settings_new ("org.gnome.system.proxy");
+-  self->http_proxy_settings = g_settings_new ("org.gnome.system.proxy.http");
+-  self->https_proxy_settings = g_settings_new ("org.gnome.system.proxy.https");
+-  self->ftp_proxy_settings = g_settings_new ("org.gnome.system.proxy.ftp");
+-  self->socks_proxy_settings = g_settings_new ("org.gnome.system.proxy.socks");
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy", FALSE);
++    self->proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.http",
++                                             FALSE);
++    self->http_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.https",
++                                             FALSE);
++    self->https_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.ftp",
++                                             FALSE);
++    self->ftp_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.socks",
++                                             FALSE);
++    self->socks_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
+ }
+ 
+ static void
+diff --git a/tests/config-gnome-test.c b/tests/config-gnome-test.c
+index f80914a..118d429 100644
+--- a/tests/config-gnome-test.c
++++ b/tests/config-gnome-test.c
+@@ -60,11 +60,60 @@ static void
+ fixture_setup (Fixture       *self,
+                gconstpointer  data)
+ {
+-  self->proxy_settings = g_settings_new ("org.gnome.system.proxy");
+-  self->http_proxy_settings = g_settings_new ("org.gnome.system.proxy.http");
+-  self->https_proxy_settings = g_settings_new ("org.gnome.system.proxy.https");
+-  self->ftp_proxy_settings = g_settings_new ("org.gnome.system.proxy.ftp");
+-  self->socks_proxy_settings = g_settings_new ("org.gnome.system.proxy.socks");
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy", FALSE);
++    self->proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.http",
++                                             FALSE);
++    self->http_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.https",
++                                             FALSE);
++    self->https_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.ftp",
++                                             FALSE);
++    self->ftp_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
++  {
++    g_autoptr(GSettingsSchemaSource) schema_source;
++    g_autoptr(GSettingsSchema) schema;
++    schema_source = g_settings_schema_source_new_from_directory("@gds@",
++                                                                g_settings_schema_source_get_default(),
++                                                                TRUE, NULL);
++    schema = g_settings_schema_source_lookup(schema_source,
++                                             "org.gnome.system.proxy.socks",
++                                             FALSE);
++    self->socks_proxy_settings = g_settings_new_full(schema, NULL, NULL);
++  }
+ }
+ 
+ static void

pkgs/development/libraries/libproxy/skip-gsettings-detection.patch

@@ -0,0 +1,29 @@
+diff --git a/src/backend/plugins/config-gnome/config-gnome.c b/src/backend/plugins/config-gnome/config-gnome.c
+index 52e812e..a1edcab 100644
+--- a/src/backend/plugins/config-gnome/config-gnome.c
++++ b/src/backend/plugins/config-gnome/config-gnome.c
+@@ -57,7 +57,6 @@ enum {
+ static void
+ px_config_gnome_init (PxConfigGnome *self)
+ {
+-  GSettingsSchemaSource *source;
+   g_autoptr (GSettingsSchema) proxy_schema = NULL;
+   const char *desktops;
+ 
+@@ -71,15 +70,7 @@ px_config_gnome_init (PxConfigGnome *self)
+   if (strstr (desktops, "GNOME") == NULL)
+     return;
+ 
+-  source = g_settings_schema_source_get_default ();
+-  if (!source) {
+-    g_warning ("GNOME desktop detected but no schemes installed, aborting.");
+-    return;
+-  }
+-
+-  proxy_schema = g_settings_schema_source_lookup (source, "org.gnome.system.proxy", TRUE);
+-
+-  self->available = proxy_schema != NULL;
++  self->available = TRUE;
+   if (!self->available)
+     return;
+ 

pkgs/development/libraries/librsvg/default.nix

@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.57.92";
+  version = "2.58.0";
 
   outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
     "devdoc"
@@ -50,13 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Kiwwvqvzz91ApKbb7T+zPmd8ruXY8wR4gkm3Mee+OFI=";
+    hash = "sha256-18REqSZAa1l5C+DerhluGO0mBZ2lc/oaqeycp2WKVZw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-yJf3V2dPwI+RcDH6Lh/AhUgaisdbTnzdAFt+SeNw9NY=";
+    hash = "sha256-ta+3KkDtqTLGoKknUn89c+3XHzvcZyPFPFpgLH5f5uw=";
     # TODO: move this to fetchCargoTarball
     dontConfigure = true;
   };

pkgs/development/libraries/libsamplerate/default.nix

@@ -5,11 +5,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "libsamplerate";
-  version = "0.1.9";
+  version = "0.2.2";
 
   src = fetchurl {
-    url = "http://www.mega-nerd.com/SRC/${pname}-${version}.tar.gz";
+    url = "https://github.com/libsndfile/libsamplerate/releases/download/${version}/libsamplerate-${version}.tar.xz";
-    sha256 = "1ha46i0nbibq0pl0pjwcqiyny4hj8lp1bnl4dpxm64zjw9lb2zha";
+    hash = "sha256-MljaKAUR0ktJ1rCGFbvoJNDKzJhCsOTK8RxSzysEOJM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -18,20 +18,17 @@ in stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-fftw" ];
 
-  outputs = [ "bin" "dev" "out" ];
+  outputs = [ "dev" "out" ];
 
   postConfigure = optionalString stdenv.isDarwin ''
     # need headers from the Carbon.framework in /System/Library/Frameworks to
     # compile this on darwin -- not sure how to handle
     NIX_CFLAGS_COMPILE+=" -I${Carbon}/Library/Frameworks/Carbon.framework/Headers"
-
-    substituteInPlace examples/Makefile --replace "-fpascal-strings" ""
   '';
 
   meta = with lib; {
     description = "Sample Rate Converter for audio";
-    mainProgram = "sndfile-resample";
+    homepage    = "https://libsndfile.github.io/libsamplerate/";
-    homepage    = "http://www.mega-nerd.com/SRC/index.html";
     license     = licenses.bsd2;
     maintainers = with maintainers; [ lovek323 ];
     platforms   = platforms.all;

pkgs/development/libraries/mesa/backport-radeon-crash-fix.patch

@@ -1,13 +0,0 @@
-diff --git a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
-index 2e1d9c488e2..7979cad75fa 100644
---- a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
-+++ b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
-@@ -729,7 +729,7 @@ bool radeon_bo_can_reclaim_slab(void *priv, struct pb_slab_entry *entry)
- {
-    struct radeon_bo *bo = container_of(entry, struct radeon_bo, u.slab.entry);
- 
--   return radeon_bo_can_reclaim(NULL, &bo->base);
-+   return radeon_bo_can_reclaim(priv, &bo->base);
- }
- 
- static void radeon_bo_slab_destroy(void *winsys, struct pb_buffer_lean *_buf)

pkgs/development/libraries/mesa/default.nix

@@ -81,8 +81,8 @@
 # nix build .#mesa .#pkgsi686Linux.mesa .#pkgsCross.aarch64-multiplatform.mesa .#pkgsMusl.mesa
 
 let
-  version = "24.0.3";
+  version = "24.0.4";
-  hash = "sha256-d67JoqN7fTWW6hZAs8xT0LXZs7Uqvtid4H43F+kb/b4=";
+  hash = "sha256-kP69MKCYy82X/2Lsw9z1yT129/oxTelEz86BlRunRfA=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
@@ -141,11 +141,6 @@ self = stdenv.mkDerivation {
 
   patches = [
     ./opencl.patch
-
-    # Backport crash fix for Radeon (legacy) kernel driver
-    # see https://gitlab.freedesktop.org/mesa/mesa/-/issues/10613
-    # FIXME: remove when merged upstream
-    ./backport-radeon-crash-fix.patch
   ];
 
   postPatch = ''
@@ -254,7 +249,8 @@ self = stdenv.mkDerivation {
   ] ++ [
     python3Packages.python # for shebang
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ elfutils libomxil-bellagio libva-minimal udev lm_sensors ]
+    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
+    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [ elfutils ]
     ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator ]
     ++ lib.optional withValgrind valgrind-light
     ++ lib.optional haveZink vulkan-loader

pkgs/development/libraries/mtdev/default.nix

@@ -1,16 +1,26 @@
-{ lib, stdenv, fetchurl, evdev-proto }:
+{ lib
+, stdenv
+, fetchurl
+, evdev-proto
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "mtdev";
-  version = "1.1.6";
+  version = "1.1.7";
 
   src = fetchurl {
     url = "https://bitmath.org/code/mtdev/${pname}-${version}.tar.bz2";
-    sha256 = "1q700h9dqcm3zl6c3gj0qxxjcx6ibw2c51wjijydhwdcm26v5mqm";
+    hash = "sha256-oQetrSEB/srFSsf58OCg3RVdlUGT2lXCNAyX8v8dgU4=";
   };
 
   buildInputs = lib.optional stdenv.hostPlatform.isFreeBSD evdev-proto;
 
+  passthru.updateScript = gitUpdater {
+    url = "https://bitmath.org/git/mtdev.git";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     homepage = "https://bitmath.org/code/mtdev/";
     description = "Multitouch Protocol Translation Library";

pkgs/development/libraries/nghttp2/default.nix

@@ -32,11 +32,11 @@ assert enableJemalloc -> enableApp;
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.60.0";
+  version = "1.61.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-W4wmgdQstLMcs+DaDggb+jAl1cNZKN6PYHAVUgFbAM4=";
+    sha256 = "sha256-Toz37DLUxaQwlmJC1yA10lXNlHCodm1h7tegGQ3VRP0=";
   };
 
   outputs = [ "out" "dev" "lib" "doc" "man" ];

pkgs/development/libraries/npth/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook }:
+{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, pkgsCross }:
 
 stdenv.mkDerivation rec {
   pname = "npth";
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests = {
+    musl = pkgsCross.musl64.npth;
+  };
+
   meta = with lib; {
     description = "The New GNU Portable Threads Library";
     mainProgram = "npth-config";

pkgs/development/libraries/openexr/3.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.2.2";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-7KBjZpImSaW4GiK0ZCpMcjBPQ9aMmN5LW+/m6lkGK68=";
+    hash = "sha256-mVUxxYe6teiJ18PQ9703/kjBpJ9+a7vcDme+NwtQQQM=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];

pkgs/development/libraries/pcre2/default.nix

@@ -13,6 +13,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-4qU5hP8LB9/bWuRIa7ubIcyo598kNAlsyb8bcow1C8s=";
   };
 
+  postPatch = ''
+    # Fix jit autodetection:
+    #   https://github.com/PCRE2Project/pcre2/pull/396
+    # Applying manually to avoid fetchpatch and autoreconfHook.
+    # TODO: remove once 10.44 is released
+    substituteInPlace configure --replace-fail \
+      '#include "src/sljit/sljitConfigInternal.h"' \
+      '#include "src/sljit/sljitConfigCPU.h"'
+  '';
+
   configureFlags = [
     "--enable-pcre2-16"
     "--enable-pcre2-32"